Trojaner-Board - PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 1

Seite 1 von 2

100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 1 (https://www.trojaner-board.de/167530-pc-win7-64-booten-dauert-lang-programme-starten-auffaellig-langsam-teil-1-a.html)

PC_Knecht

03.06.2015 09:58

PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 1

Hallo liebe Experten,

seit etwa 2 Wochen bootet mein PC sehr langsam. Auch Programme (Firefox, Thunderbird, Softmaker FreeOffice etc.) brauchen gefühlt dreimal so lang, bis sie geladen sind. Selbst der Windows-Explorer braucht eine Gedenkminute. Treiber habe ich soweit wie möglich aktualisiert. Die Windows-Updates sind auch aktuell.

Ich habe Avast-AV installiert, dazu habe ich MalwareBytes und Emisoft mehrmals ausgeführt. Leider ohne Erfolg :( Ich bin nun mit meinem Latein am Ende

Ich habe mich so gut es geht an die 8 goldenen Regeln des Forums gehalten (Defogger, FRST etc.) und poste nun alle erforderlichen log-Dateien.

Vorab schon mal vielen Dank für Eure Unterstützung.

P.S.: Leider ist die Gmer Log sehr groß. Ich muß sie in drei Teile aufteilen. Es wird also vier Posts von mir geben.

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:04 on 02/06/2015 (Eltern)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...

-=E.O.F=-

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 29-05-2015
Ran by Eltern (administrator) on ELTERN-PC on 02-06-2015 17:10:07
Running from C:\Users\Eltern\Desktop
Loaded Profiles: Eltern (Available Profiles: Eltern)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(Avast Software s.r.o.) C:\Program Files (x86)\AVAST Software\Avast\AvastSvc.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Avast Software s.r.o.) C:\Program Files (x86)\AVAST Software\Avast\avastui.exe
(Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Avast Software s.r.o.) C:\Program Files (x86)\AVAST Software\Avast\setup\instup.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files (x86)\AVAST Software\Avast\AvastUI.exe [5515496 2015-05-12] (Avast Software s.r.o.)
HKLM-x32\...\Run: [emsisoft anti-malware] => c:\program files (x86)\emsisoft anti-malware\a2guard.exe [4923832 2015-05-26] (Emsisoft Ltd)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Bubbles.scr [899584 2010-11-20] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2013-10-17] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files (x86)\AVAST Software\Avast\ashShA64.dll [2015-05-04] (Avast Software s.r.o.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files (x86)\AVAST Software\Avast\aswWebRepIE64.dll [2015-05-04] (Avast Software s.r.o.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll [2009-02-06] (Zeon Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files (x86)\AVAST Software\Avast\aswWebRepIE.dll [2015-05-04] (Avast Software s.r.o.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-03-11] (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-03-11] (Citrix Systems, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Eltern\AppData\Roaming\Mozilla\Firefox\Profiles\myv9y403.default-1432651667587
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-13] ()
FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-13] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Extension: Adblock Plus - C:\Users\Eltern\AppData\Roaming\Mozilla\Firefox\Profiles\myv9y403.default-1432651667587\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-05-26]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files (x86)\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files (x86)\AVAST Software\Avast\WebRep\FF [2015-04-26]

Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files (x86)\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-26]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [5155576 2015-05-26] (Emsisoft Ltd)
R2 avast! Antivirus; C:\Program Files (x86)\AVAST Software\Avast\AvastSvc.exe [343336 2015-05-04] (Avast Software s.r.o.)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112 2013-09-25] (Brother Industries, Ltd.) [File not signed]
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S4 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [145256 2011-08-02] (Nuance Communications, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-05-04] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-05-04] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-05-04] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-05-04] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-05-04] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-05-04] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-05-04] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-05-04] ()
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2011-07-29] () [File not signed]
S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [14216 2011-07-29] () [File not signed]
R1 epp64; C:\Windows\System32\DRIVERS\epp64.sys [135800 2015-03-24] (Emsisoft GmbH)
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2011-07-29] () [File not signed]
S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [8456 2011-07-29] () [File not signed]
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
U5 UnlockerDriver5; C:\Program Files (x86)\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
S3 HWiNFO32; \??\C:\Users\Eltern\AppData\Local\Temp\HWiNFO64A.SYS [X]
S3 SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP6\WNt500x64\Sandra.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-02 17:10 - 2015-06-02 17:10 - 00009672 _____ () C:\Users\Eltern\Desktop\FRST.txt
2015-06-02 17:09 - 2015-06-02 17:10 - 00000000 ____D () C:\FRST
2015-06-02 17:07 - 2015-06-02 17:07 - 02108928 _____ (Farbar) C:\Users\Eltern\Desktop\FRST64.exe
2015-06-02 17:04 - 2015-06-02 17:04 - 00000474 _____ () C:\Users\Eltern\Desktop\defogger_disable.log
2015-06-02 17:04 - 2015-06-02 17:04 - 00000000 _____ () C:\Users\Eltern\defogger_reenable
2015-06-02 17:02 - 2015-06-02 17:02 - 00050477 _____ () C:\Users\Eltern\Desktop\Defogger.exe
2015-06-02 14:26 - 2015-06-02 14:26 - 00000000 ____D () C:\Users\Eltern\AppData\Local\GWX
2015-06-01 19:21 - 2015-06-01 19:21 - 00000000 ____D () C:\Program Files (x86)\Realtek
2015-06-01 19:21 - 2009-08-18 11:44 - 00236544 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys
2015-06-01 19:21 - 2009-08-18 11:44 - 00067584 _____ () C:\Windows\system32\RtNicProp64.dll
2015-06-01 19:21 - 2009-07-22 18:24 - 00097792 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll
2015-06-01 16:49 - 2015-06-01 16:49 - 00000000 ____D () C:\Users\Eltern\Documents\hw64_462-1
2015-05-27 12:08 - 2015-05-28 17:09 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-05-27 11:25 - 2015-05-27 11:25 - 00001051 _____ () C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
2015-05-27 11:25 - 2015-05-27 11:25 - 00001051 _____ () C:\ProgramData\Desktop\Revo Uninstaller Pro.lnk
2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D () C:\Users\Eltern\AppData\Local\VS Revo Group
2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D () C:\ProgramData\VS Revo Group
2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D () C:\Program Files\VS Revo Group
2015-05-27 11:25 - 2009-12-30 10:21 - 00031800 _____ (VS Revo Group) C:\Windows\system32\Drivers\revoflt.sys
2015-05-27 11:17 - 2015-05-27 11:18 - 10801480 _____ (VS Revo Group ) C:\Users\Eltern\Downloads\RevoUninProSetup-312.exe
2015-05-26 16:47 - 2015-05-26 16:47 - 00000000 ____D () C:\Users\Eltern\Desktop\Alte Firefox-Daten
2015-05-26 16:44 - 2015-05-26 16:44 - 00494857 _____ () C:\Users\Eltern\Desktop\bookmarks.html
2015-05-26 08:44 - 2015-05-26 08:44 - 00000000 ____D () C:\Program Files\avast software
2015-05-20 17:31 - 2015-01-31 05:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-05-20 17:31 - 2015-01-31 05:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-05-20 17:31 - 2015-01-31 01:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-05-20 17:30 - 2014-12-11 19:47 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-05-19 20:02 - 2014-09-05 03:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-05-19 20:01 - 2014-09-05 04:11 - 06584320 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-05-17 19:29 - 2015-05-17 19:29 - 00000000 ____D () C:\ProgramData\Emsisoft
2015-05-17 19:11 - 2015-06-02 16:26 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2015-05-17 19:11 - 2015-05-17 19:11 - 00001105 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2015-05-17 19:11 - 2015-05-17 19:11 - 00001105 _____ () C:\ProgramData\Desktop\Emsisoft Anti-Malware.lnk
2015-05-17 19:11 - 2015-05-17 19:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2015-05-17 19:11 - 2015-03-24 00:17 - 00135800 _____ (Emsisoft GmbH) C:\Windows\system32\Drivers\epp64.sys
2015-05-17 19:01 - 2015-05-17 19:10 - 161426392 _____ (Emsisoft Ltd. ) C:\Users\Eltern\Downloads\emsisoftantimalwaresetup.exe
2015-05-17 17:22 - 2015-05-17 17:22 - 21545848 _____ (Malwarebytes Corporation ) C:\Users\Eltern\Downloads\Anti-Malware.exe
2015-05-17 16:30 - 2015-05-17 16:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-17 15:56 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2015-05-17 15:56 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2015-05-17 15:56 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2015-05-17 15:56 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2015-05-17 15:56 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2015-05-17 15:56 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2015-05-17 15:56 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2015-05-17 15:56 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2015-05-17 15:56 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2015-05-17 15:56 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2015-05-17 15:56 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2015-05-17 15:56 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2015-05-17 15:56 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2015-05-17 15:56 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2015-05-17 15:56 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2015-05-17 15:55 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2015-05-17 15:55 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2015-05-17 15:55 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2015-05-17 15:54 - 2015-03-14 05:21 - 01632768 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-05-17 15:54 - 2015-03-14 05:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-05-17 15:54 - 2015-03-14 05:04 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-05-17 15:54 - 2015-03-14 05:04 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-05-17 13:56 - 2015-05-17 10:57 - 00008969 _____ () C:\Users\Eltern\Documents\Arbeitszeitreduzierung.tmd
2015-05-14 19:49 - 2015-05-14 19:49 - 02209792 _____ () C:\Users\Eltern\Downloads\adwcleaner_4.204.exe
2015-05-13 08:28 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 08:28 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 08:19 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 08:19 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-13 08:19 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 08:19 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-13 08:19 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 08:19 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 08:19 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 08:19 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 08:19 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 08:19 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 08:19 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 08:19 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 08:19 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 08:19 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 08:19 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 08:19 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 08:19 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 08:19 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 08:19 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 08:19 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 08:19 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 08:19 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 08:19 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-13 08:19 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-13 08:19 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 08:19 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 08:19 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-13 08:19 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-13 08:19 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-13 08:19 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-13 08:19 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 08:19 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 08:19 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-13 08:19 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 08:19 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-13 08:19 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-13 08:19 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-13 08:19 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-13 08:19 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-13 08:19 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-13 08:19 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-13 08:19 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 08:19 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 08:19 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-13 08:19 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 08:19 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 08:19 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-13 08:19 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 08:19 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-13 08:19 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-13 08:19 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-13 08:19 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-13 08:19 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 08:19 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-13 08:19 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-13 08:19 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-13 08:19 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-13 08:19 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 08:19 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 08:19 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-13 08:19 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-13 08:19 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-13 08:19 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 08:19 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-13 08:18 - 2015-04-27 21:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-13 08:18 - 2015-04-27 21:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 08:18 - 2015-04-27 21:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 08:18 - 2015-04-27 21:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-05-13 08:18 - 2015-04-27 21:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-13 08:18 - 2015-04-27 21:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 08:18 - 2015-04-27 21:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 08:18 - 2015-04-27 21:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-05-13 08:18 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-05-13 08:18 - 2015-04-27 21:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-05-13 08:18 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-05-13 08:18 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-13 08:18 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-05-13 08:18 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-05-13 08:18 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-05-13 08:18 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-05-13 08:18 - 2015-04-27 21:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-05-13 08:18 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-13 08:18 - 2015-04-27 21:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-05-13 08:18 - 2015-04-27 21:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-05-13 08:18 - 2015-04-27 21:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-13 08:18 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-13 08:18 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-05-13 08:18 - 2015-04-27 21:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-05-13 08:18 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-13 08:18 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-13 08:18 - 2015-04-27 19:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-05-13 08:18 - 2015-04-27 19:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-05-13 08:18 - 2015-04-27 19:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-05-13 08:18 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 08:17 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 08:17 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 08:17 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-13 08:17 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 08:17 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 08:17 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 08:17 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-13 08:17 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-13 08:17 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-13 08:17 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-13 08:17 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-13 08:17 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-05-13 08:17 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-05-13 08:17 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-13 08:17 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-13 08:17 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 08:17 - 2015-01-29 05:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-13 08:17 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-10 16:11 - 2015-05-10 16:11 - 00001093 _____ () C:\Users\Public\Desktop\PDF24 Creator.lnk
2015-05-10 16:11 - 2015-05-10 16:11 - 00001093 _____ () C:\ProgramData\Desktop\PDF24 Creator.lnk
2015-05-10 16:11 - 2015-05-10 16:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
2015-05-10 16:11 - 2015-05-10 16:11 - 00000000 ____D () C:\Program Files (x86)\PDF24
2015-05-10 16:08 - 2015-05-10 16:08 - 16342352 _____ (Geek Software GmbH ) C:\Program Files (x86)\pdf24-creator-6.9.2.exe
2015-05-10 15:30 - 2015-05-10 15:31 - 27837984 _____ (pdfforge ) C:\Users\Eltern\Downloads\PDFCreator-2_1_1-setup.exe
2015-05-10 15:06 - 2015-05-10 15:06 - 00000000 ____D () C:\Users\Eltern\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker
2015-05-10 14:47 - 2015-05-10 15:06 - 00000000 ____D () C:\Program Files (x86)\Unlocker
2015-05-10 13:14 - 2015-05-10 13:14 - 00001138 _____ () C:\Users\Eltern\Desktop\PK.vbs
2015-05-10 10:50 - 2015-05-10 10:50 - 00002562 _____ () C:\Windows\diagwrn.xml
2015-05-10 10:50 - 2015-05-10 10:50 - 00001908 _____ () C:\Windows\diagerr.xml
2015-05-09 14:08 - 2015-05-10 15:27 - 00000000 ____D () C:\Windows\pss
2015-05-04 18:51 - 2015-05-04 18:51 - 00001293 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inhaltsmanager-Assistent für PlayStation(R).lnk
2015-05-04 18:51 - 2015-05-04 18:51 - 00000000 ____D () C:\Program Files (x86)\Sony
2015-05-04 18:48 - 2015-05-04 18:49 - 10457912 _____ (Sony Computer Entertainment Inc. ) C:\Program Files (x86)\CMASetup.exe
2015-05-04 13:46 - 2015-05-04 13:46 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-05-04 13:45 - 2015-05-04 13:45 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-02 17:04 - 2013-10-14 21:31 - 00000000 ____D () C:\Users\Eltern
2015-06-02 16:29 - 2013-10-14 23:52 - 00000000 ____D () C:\Users\Eltern\AppData\Roaming\vlc
2015-06-02 15:14 - 2009-07-14 19:58 - 00699416 _____ () C:\Windows\system32\perfh007.dat
2015-06-02 15:14 - 2009-07-14 19:58 - 00149556 _____ () C:\Windows\system32\perfc007.dat
2015-06-02 15:14 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-06-02 14:35 - 2009-07-14 06:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-02 14:35 - 2009-07-14 06:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-02 14:30 - 2013-10-14 21:23 - 01782201 _____ () C:\Windows\WindowsUpdate.log
2015-06-02 14:25 - 2015-04-19 19:41 - 00004837 _____ () C:\Windows\setupact.log
2015-06-02 14:25 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-06-02 10:20 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2015-06-01 19:21 - 2014-06-25 19:42 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-05-30 19:17 - 2014-06-25 19:46 - 00007887 _____ () C:\Windows\BRRBCOM.INI
2015-05-30 18:44 - 2013-10-15 14:51 - 00000000 ____D () C:\Windows\rescache
2015-05-30 12:13 - 2015-04-26 16:08 - 00004194 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-05-28 18:10 - 2013-10-14 23:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-28 11:06 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-05-27 12:03 - 2013-10-17 00:31 - 01593956 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-05-20 18:32 - 2015-04-04 12:12 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-05-20 18:32 - 2015-04-04 12:12 - 00000000 ___SD () C:\Windows\system32\GWX
2015-05-17 17:54 - 2015-04-26 14:00 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-05-17 17:27 - 2015-04-26 14:00 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-17 16:04 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-05-17 16:01 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-05-16 09:18 - 2013-10-17 21:16 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-14 21:21 - 2015-04-26 13:57 - 00007504 _____ () C:\Windows\PFRO.log
2015-05-14 20:46 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources
2015-05-14 19:54 - 2015-04-26 13:54 - 00000000 ____D () C:\AdwCleaner
2015-05-13 14:17 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-05-13 10:45 - 2009-07-14 06:45 - 00287472 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-13 10:42 - 2013-11-15 19:52 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-13 10:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-13 08:35 - 2013-10-18 20:38 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-13 08:32 - 2013-10-18 20:38 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-13 07:57 - 2015-02-04 19:56 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-13 07:57 - 2015-02-04 19:56 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-10 10:50 - 2015-04-19 19:41 - 00000000 _____ () C:\Windows\setuperr.log
2015-05-04 18:52 - 2014-08-04 15:18 - 00000000 ____D () C:\Users\Eltern\AppData\Roaming\Sony Corporation
2015-05-04 13:46 - 2015-04-26 16:08 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-05-04 13:46 - 2015-04-26 16:08 - 00272248 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-05-04 13:46 - 2015-04-26 16:08 - 00137288 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys
2015-05-04 13:46 - 2015-04-26 16:08 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys
2015-05-04 13:46 - 2015-04-26 16:08 - 00089944 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-05-04 13:46 - 2015-04-26 16:08 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-05-04 13:46 - 2015-04-26 16:08 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-05-04 13:45 - 2015-04-26 16:08 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys

==================== Files in the root of some directories =======

2013-11-15 19:51 - 2013-10-15 01:28 - 3294168 _____ (Piriform Ltd) C:\Program Files\ccsetup406_slim.exe
2014-08-04 15:16 - 2014-08-04 15:16 - 10410712 _____ (Sony Computer Entertainment Inc. ) C:\Program Files\CMASetup.exe
2013-11-15 19:51 - 2012-10-11 22:21 - 11766024 _____ (EASEUS ) C:\Program Files\epm911.exe
2014-02-15 19:34 - 2014-02-15 19:34 - 0921000 _____ (Oracle Corporation) C:\Program Files\jxpiinstall.exe
2014-02-17 18:56 - 2014-02-17 18:56 - 0675988 _____ () C:\Program Files\Minecraft.exe
2014-02-17 20:22 - 2014-02-17 20:22 - 0774144 _____ () C:\Program Files\NBTExplorer-2.7.0.msi
2013-11-15 19:51 - 2013-10-15 16:49 - 0537818 _____ (IDG Magazine Media GmbH ) C:\Program Files\pcwFixMyRights.exe
2014-12-26 17:14 - 2014-12-26 17:14 - 0095662 _____ () C:\Program Files (x86)\7-zip.chm
2014-12-26 17:48 - 2014-12-26 17:48 - 0080384 _____ (Igor Pavlov) C:\Program Files (x86)\7-zip.dll
2014-12-26 17:48 - 2014-12-26 17:48 - 0050176 _____ (Igor Pavlov) C:\Program Files (x86)\7-zip32.dll
2014-12-26 18:00 - 2014-12-26 18:00 - 1508352 _____ (Igor Pavlov) C:\Program Files (x86)\7z.dll
2014-12-26 17:48 - 2014-12-26 17:48 - 0424960 _____ (Igor Pavlov) C:\Program Files (x86)\7z.exe
2014-12-26 18:06 - 2014-12-26 18:06 - 0181760 _____ (Igor Pavlov) C:\Program Files (x86)\7z.sfx
2014-12-26 18:06 - 2014-12-26 18:06 - 0166400 _____ (Igor Pavlov) C:\Program Files (x86)\7zCon.sfx
2014-12-26 17:50 - 2014-12-26 17:50 - 0803328 _____ (Igor Pavlov) C:\Program Files (x86)\7zFM.exe
2014-12-26 17:50 - 2014-12-26 17:50 - 0545792 _____ (Igor Pavlov) C:\Program Files (x86)\7zG.exe
2014-08-22 08:08 - 2014-08-22 08:11 - 149527616 _____ () C:\Program Files (x86)\avira_free_antivirus_de_14.0.6.570.exe
2014-05-29 15:25 - 2014-05-29 15:25 - 8697544 _____ (Georgy Berdyshev) C:\Program Files (x86)\CDex-win32-1.70-b4-2009.exe
2014-11-07 13:28 - 2014-11-07 13:28 - 12436848 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\CitrixOnlinePluginWeb.exe
2015-05-04 18:48 - 2015-05-04 18:49 - 10457912 _____ (Sony Computer Entertainment Inc. ) C:\Program Files (x86)\CMASetup.exe
2011-04-04 17:54 - 2011-04-04 17:54 - 0000366 _____ () C:\Program Files (x86)\descript.ion
2015-04-20 17:59 - 2015-04-20 18:03 - 190719264 _____ (Microsoft Corporation) C:\Program Files (x86)\DraftSight64.exe
2015-01-04 23:03 - 2015-01-04 23:03 - 3105553 _____ () C:\Program Files (x86)\forge-1.7.10-10.13.2.1230-installer-win.exe
2015-01-03 12:26 - 2015-01-03 12:29 - 91670064 _____ (The GIMP Team ) C:\Program Files (x86)\gimp-2.8.14-setup.exe
2014-12-26 18:06 - 2014-12-26 18:06 - 0040769 _____ () C:\Program Files (x86)\History.txt
2014-06-12 22:02 - 2014-06-12 22:02 - 0001927 _____ () C:\Program Files (x86)\License.txt
2015-04-26 13:19 - 2015-04-26 13:19 - 21546080 _____ (Malwarebytes Corporation ) C:\Program Files (x86)\mbam-setup-2.1.6.1022.exe
2015-05-10 16:08 - 2015-05-10 16:08 - 16342352 _____ (Geek Software GmbH ) C:\Program Files (x86)\pdf24-creator-6.9.2.exe
2014-12-26 17:24 - 2014-12-26 17:24 - 0001683 _____ () C:\Program Files (x86)\readme.txt
2015-01-07 21:39 - 2015-01-07 21:39 - 0001551 _____ () C:\Users\Eltern\AppData\Local\recently-used.xbel

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-05-24 11:44

==================== End of log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-05-2015
Ran by Eltern at 2015-06-02 17:11:16
Running from C:\Users\Eltern\Desktop
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2127788250-3807647062-608468377-500 - Administrator - Disabled)
Eltern (S-1-5-21-2127788250-3807647062-608468377-1000 - Administrator - Enabled) => C:\Users\Eltern
Gast (S-1-5-21-2127788250-3807647062-608468377-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2127788250-3807647062-608468377-1002 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.36 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0936-000001000000}) (Version: 9.36.00.0 - Igor Pavlov)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
Amazon Music (HKU\S-1-5-21-2127788250-3807647062-608468377-1000\...\Amazon Amazon Music) (Version: 3.7.1.698 - Amazon Services LLC)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.2.2218 - AVAST Software)
Brother MFL-Pro Suite MFC-J245 (HKLM-x32\...\{B742757A-7658-4E09-A51A-085CF0F7F4D3}) (Version: 1.0.0.0 - Brother Industries, Ltd.)
CDex - Open Source Digital Audio CD Extractor (HKLM-x32\...\CDex) (Version: 1.70.4.2009 - Georgy Berdyshev)
Citrix Online Plug-in - Web (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 12.0.0.6410 - Citrix Systems, Inc.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DriveImage XML (Private Edition) (HKLM-x32\...\{F7E1CA14-B39D-452A-960B-39423DDDD933}) (Version: 2.44.000 - Runtime Software)
EASEUS Partition Master 9.1.1 Home Edition (HKLM-x32\...\EASEUS Partition Master Home Edition_is1) (Version: - EASEUS)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 16.0.20150211 - Landesfinanzdirektion Thüringen)
Emsisoft Anti-Malware (HKLM-x32\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 10.0 - Emsisoft Ltd.)
Free YouTube to MP3 Converter version 3.12.54.128 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.54.128 - DVDVideoSoft Ltd.)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Inhaltsmanager-Assistent für PlayStation(R) (HKLM-x32\...\{961D5D7E-3DEC-4E3B-9065-EA8074923B18}) (Version: 3.31.7643.1 - Sony Computer Entertainment Inc.)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 37.0.2 - Mozilla)
Mozilla Thunderbird 31.7.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.7.0 (x86 de)) (Version: 31.7.0 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
NBTExplorer (HKLM-x32\...\{273D5BF1-EC9C-4549-880D-D8C293296A36}) (Version: 2.7.0.0 - Justin Aquadro)
Nuance PaperPort 12 (HKLM-x32\...\{869FCC6C-5669-4B0B-827E-2BBAACD88A87}) (Version: 12.1.0006 - Nuance Communications, Inc.)
Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc)
PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 14.00.0000 - Nuance Communications, Inc.)
PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
Pusteblume Sachunterricht 3 (HKLM-x32\...\Pusteblume Sachunterricht 3) (Version: - Bildungshaus Schulbuchverlage Westermann Schroedel Diesterweg Schöningh Winklers GmbH)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0008 - Realtek)
Revo Uninstaller Pro 3.1.2 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.1.2 - VS Revo Group, Ltd.)
Scansoft PDF Professional (x32 Version: - ) Hidden
SoftMaker FreeOffice (HKLM-x32\...\{8EBB8452-274B-465D-8324-00B0832FBB02}) (Version: 1.0.3395 - SoftMaker Software GmbH)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Restore Points =========================

01-06-2015 16:00:03 Revo Uninstaller Pro's restore point - SiSoftware Sandra Lite 2013.SP6
01-06-2015 16:01:03 SiSoftware Sandra Lite
01-06-2015 19:17:21 vor LAN-Treiber
01-06-2015 19:21:02 Installiert Realtek Ethernet Controller Driver
02-06-2015 10:12:14 Windows Update
02-06-2015 10:16:34 Wiederherstellungsvorgang

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0051A1AD-0606-4209-BFFE-5DC7ED6C9B20} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-07] (Microsoft Corporation)
Task: {1B1ED7BC-0022-40DF-881B-1F1DD17605C9} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {1F16F3F8-0026-445B-AC17-E40EDFB35128} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {31E02CA9-C51E-4460-BA97-B7E21A651C34} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {50535350-84E1-4323-9DDE-0CD437D0DE7A} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {645F6365-4A2D-4183-BB76-C828836618FD} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: {C16F411F-5A38-4010-8311-B2469B0D6545} - System32\Tasks\avast! Emergency Update => C:\Program Files (x86)\AVAST Software\Avast\AvastEmUpdate.exe [2015-05-04] (Avast Software s.r.o.)

==================== Loaded Modules (Whitelisted) ==============

2015-05-04 13:45 - 2015-05-04 13:45 - 00104400 _____ () C:\Program Files (x86)\AVAST Software\Avast\log.dll
2015-05-04 13:45 - 2015-05-04 13:45 - 00081728 _____ () C:\Program Files (x86)\AVAST Software\Avast\JsonRpcServer.dll
2015-06-02 10:01 - 2015-06-02 10:01 - 02951680 _____ () C:\Program Files (x86)\AVAST Software\Avast\defs\15060200\algo.dll
2015-04-26 16:08 - 2015-04-26 16:08 - 40540672 _____ () C:\Program Files (x86)\AVAST Software\Avast\libcef.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Eltern\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: PDFProFiltSrvPP => 2
MSCONFIG\Services: wscsvc => 2
MSCONFIG\Services: WSearch => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Inhaltsmanager-Assistent für PlayStation(R).lnk => C:\Windows\pss\Inhaltsmanager-Assistent für PlayStation(R).lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Amazon Music => "C:\Users\Eltern\AppData\Local\Amazon Music\Amazon Music Helper.exe"
MSCONFIG\startupreg: BrHelp => C:\Program Files (x86)\Brother\Brother Help\BrotherHelp.exe /AUTORUN
MSCONFIG\startupreg: BrStsMon00 => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN
MSCONFIG\startupreg: ConnectionCenter => "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup
MSCONFIG\startupreg: ControlCenter4 => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe /autorun
MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe
MSCONFIG\startupreg: IndexSearch => "C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe"
MSCONFIG\startupreg: ISUSPM => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
MSCONFIG\startupreg: PaperPort PTD => "C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe"
MSCONFIG\startupreg: PDF5 Registry Controller => C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe
MSCONFIG\startupreg: PDFHook => C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe
MSCONFIG\startupreg: PDFPrint => C:\Program Files (x86)\PDF24\pdf24.exe
MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{1B5878FA-F799-4C68-A2DA-8E7A57B40EFB}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{AF0730C6-8801-41FD-9979-03A14518E175}] => (Allow) LPort=2869
FirewallRules: [{639EFFE0-6DC2-43C2-A676-855C8FEF6F89}] => (Allow) LPort=1900
FirewallRules: [TCP Query User{7A9608B7-A0ED-423F-BE89-7991B131A01B}C:\program files\videolan\vlc\vlc.exe] => (Block) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [UDP Query User{BA917422-0A70-45A0-88FF-CEA25E4D4AA8}C:\program files\videolan\vlc\vlc.exe] => (Block) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [TCP Query User{074F9C1C-051B-4319-BF7A-A98FD2FDF065}C:\program files (x86)\java\jre1.8.0_31\bin\java.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\java.exe
FirewallRules: [UDP Query User{55D30EF6-0A63-403F-900B-656D36616F2B}C:\program files (x86)\java\jre1.8.0_31\bin\java.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\java.exe
FirewallRules: [TCP Query User{362F5215-85FC-421B-B914-ABE6EA456261}C:\program files\firefox.exe] => (Block) C:\program files\firefox.exe
FirewallRules: [UDP Query User{BE7C41C2-E1AB-4E12-9414-4D0DA7F81B6F}C:\program files\firefox.exe] => (Block) C:\program files\firefox.exe
FirewallRules: [{1023DE4E-B766-48DA-AAA2-EF53ED9DE278}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4F66FC22-FD46-46BE-87E1-A8C2AD47AF02}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Faulty Device Manager Devices =============

Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

==================== Event log errors: =========================

Application errors:
==================
Error: (06/02/2015 10:23:14 AM) (Source: System Restore) (EventID: 8210) (User: )
Description: Unbekannter Fehler bei der Systemwiederherstellung: (vor LAN-Treiber). Zusätzliche Informationen: 0x80070003.

Error: (06/01/2015 04:00:02 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.

Vorgang:
Generatordaten werden gesammelt

Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {1ebb083b-1f10-42be-8023-f86a86c66225}

Error: (06/01/2015 03:34:12 PM) (Source: ESENT) (EventID: 439) (User: )
Description: Windows (2388) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032.

Error: (06/01/2015 03:34:12 PM) (Source: ESENT) (EventID: 490) (User: )
Description: Windows (2388) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.

Error: (05/30/2015 00:14:26 PM) (Source: ESENT) (EventID: 439) (User: )
Description: Windows (1376) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032.

Error: (05/30/2015 00:14:26 PM) (Source: ESENT) (EventID: 490) (User: )
Description: Windows (1376) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.

Error: (05/30/2015 09:14:05 AM) (Source: ESENT) (EventID: 439) (User: )
Description: Windows (3048) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032.

Error: (05/30/2015 09:14:05 AM) (Source: ESENT) (EventID: 490) (User: )
Description: Windows (3048) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.

Error: (05/28/2015 06:12:41 PM) (Source: ESENT) (EventID: 439) (User: )
Description: Windows (1936) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032.

Error: (05/28/2015 06:12:41 PM) (Source: ESENT) (EventID: 490) (User: )
Description: Windows (1936) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.

System errors:
=============
Error: (06/02/2015 02:27:16 PM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: WMPNetworkSvc0x80004005

Error: (05/30/2015 09:55:12 AM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst Diagnostics Tracking Service konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.

Error: (05/30/2015 09:17:25 AM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst Windows Update konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.

Error: (05/29/2015 07:47:00 AM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst Diagnostics Tracking Service konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.

Error: (05/27/2015 05:30:02 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (05/27/2015 05:30:02 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1073473535.

Error: (05/24/2015 05:12:29 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (05/22/2015 05:56:33 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "MBAMService" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (05/22/2015 05:56:33 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst MBAMService erreicht.

Error: (05/20/2015 05:14:04 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.

Microsoft Office:
=========================
Error: (06/02/2015 10:23:14 AM) (Source: System Restore) (EventID: 8210) (User: )
Description: vor LAN-Treiber0x80070003

Error: (06/01/2015 04:00:02 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert

Vorgang:
Generatordaten werden gesammelt

Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {1ebb083b-1f10-42be-8023-f86a86c66225}

Error: (06/01/2015 03:34:12 PM) (Source: ESENT) (EventID: 439) (User: )
Description: Windows2388Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032

Error: (06/01/2015 03:34:12 PM) (Source: ESENT) (EventID: 490) (User: )
Description: Windows2388Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

Error: (05/30/2015 00:14:26 PM) (Source: ESENT) (EventID: 439) (User: )
Description: Windows1376Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032

Error: (05/30/2015 00:14:26 PM) (Source: ESENT) (EventID: 490) (User: )
Description: Windows1376Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

Error: (05/30/2015 09:14:05 AM) (Source: ESENT) (EventID: 439) (User: )
Description: Windows3048Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032

Error: (05/30/2015 09:14:05 AM) (Source: ESENT) (EventID: 490) (User: )
Description: Windows3048Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

Error: (05/28/2015 06:12:41 PM) (Source: ESENT) (EventID: 439) (User: )
Description: Windows1936Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032

Error: (05/28/2015 06:12:41 PM) (Source: ESENT) (EventID: 490) (User: )
Description: Windows1936Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

==================== Memory info ===========================

Processor: Pentium(R) Dual-Core CPU E5200 @ 2.50GHz
Percentage of memory in use: 47%
Total physical RAM: 3062.18 MB
Available physical RAM: 1609.4 MB
Total Pagefile: 6122.57 MB
Available Pagefile: 4143.49 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (Eigene Dateien) (Fixed) (Total:58.64 GB) (Free:17.77 GB) NTFS
Drive d: () (Fixed) (Total:43.95 GB) (Free:25.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (Eigene Bilder Filme) (Fixed) (Total:39.21 GB) (Free:21.25 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: 102C102B)
Partition 1: (Active) - (Size=43.9 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=39.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=58.6 GB) - (Type=OF Extended)

==================== End of log ============================

Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 26.04.2015
Suchlauf-Zeit: 14:02:35
Logdatei: MWBT_Scan_1.txt
Administrator: Ja

Version: 2.01.6.1022
Malware Datenbank: v2015.04.26.01
Rootkit Datenbank: v2015.04.21.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Eltern

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 335586
Verstrichene Zeit: 16 Min, 55 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 0
(Keine schädliche Elemente gefunden)

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 0
(Keine schädliche Elemente gefunden)

Dateien: 1
PUP.Optional.Softonic.A, C:\Program Files\SoftonicDownloader_fuer_minecraft.exe, In Quarantäne, [fc2da4cd751570c67f3c89c853aee41c],

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)

(end)

Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 14.05.2015
Suchlauf-Zeit: 19:59:57
Logdatei: MWBT_Scan_2.txt
Administrator: Ja

Version: 2.01.6.1022
Malware Datenbank: v2015.05.14.04
Rootkit Datenbank: v2015.04.21.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Eltern

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 343786
Verstrichene Zeit: 25 Min, 8 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 0
(Keine schädliche Elemente gefunden)

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 0
(Keine schädliche Elemente gefunden)

Dateien: 3
PUP.Optional.Babylon.A, C:\Program Files (x86)\Unlocker1.9.2.exe, In Quarantäne, [315b6231b5d5f145c1eafd3c9a67ff01],
PUP.Optional.Babylon.A, C:\Users\Eltern\AppData\Local\Temp\DeltaTB.exe, In Quarantäne, [97f5662df09a78be6f3c54e5a45d59a7],
PUP.Optional.Babylon.A, C:\Users\Eltern\AppData\Local\Temp\7F61D543-BAB0-7891-A3F4-F6F5DDBEF7A0\Latest\BExternal.dll, In Quarantäne, [a7e5444f8ffb2016182100255aa6916f],

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)

(end)

Emsisoft Anti-Malware - Version 10.0
Scan-Protokoll

Datum Scan Methode Gescannt Erkannt Dauer Typ
01.06.2015 11:39:35 Malware 69836 0 0:04:35 Manueller Scan
17.05.2015 19:24:14 Malware 69224 0 0:05:00 Manueller Scan

Emsisoft Anti-Malware - Version 10.0
Scan-Protokoll

Datum Scan Methode Gescannt Erkannt Dauer Typ
01.06.2015 11:39:35 Malware 69836 0 0:04:35 Manueller Scan
17.05.2015 19:24:14 Malware 69224 0 0:05:00 Manueller Scan

C:\Users\Eltern\Downloads\FreeYouTubeToMP354Converter.exe Variante von Win32/OpenCandy.C potenziell unsichere Anwendung
C:\Users\Eltern\Downloads\PDFCreator-1_7_1_setup.exe Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung
C:\Users\Eltern\Downloads\PDFCreator-2_1_1-setup.exe Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung
D:\Documents and Settings\Eltern\Downloads\FreeYouTubeToMP354Converter.exe Variante von Win32/OpenCandy.C potenziell unsichere Anwendung
D:\Documents and Settings\Eltern\Downloads\PDFCreator-1_7_1_setup.exe Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung
D:\Documents and Settings\Eltern\Downloads\PDFCreator-2_1_1-setup.exe Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung
D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SaveByclick\dfnfldhlfgmlpgfacmffbnonedjmpjag.crx Win32/Adware.MultiPlug.H Anwendung
D:\RECYCLER\S-1-5-21-1606980848-1390067357-839522115-1003\Dc14.exe Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP171\A0038320.msi Variante von Win32/Systweak.L evtl. unerwünschte Anwendung
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP172\A0038322.msi Variante von Win32/Systweak.L evtl. unerwünschte Anwendung
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP175\A0039051.exe Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040097.dll Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040098.exe Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040099.exe Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP213\A0046627.exe Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung
D:\Unser Kram\Erik\FreeYouTubeToMP3Converter3.12.44.908.exe Variante von Win32/OpenCandy.C potenziell unsichere Anwendung

PC_Knecht

03.06.2015 10:00

PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 2

Hier nun mein zweiter Post mit dem 1. Teil von Gmer.txt

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-06-02 17:31:45
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 ST3160813AS rev.CC2J 149,05GB
Running: Gmer-19357.exe; Driver: C:\Users\Eltern\AppData\Local\Temp\uxdiypow.sys

---- User code sections - GMER 2.1 ----

.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000100040460
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000100040450
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000100040370
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000100040470
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000001000403e0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000100040320
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000001000403b0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000100040390
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000001000402e0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000001000402d0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000100040310
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000001000403c0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000001000403f0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000100040230
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000100040480
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000001000403a0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000001000402f0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000100040350
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000100040290
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000001000402b0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000001000403d0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000100040330
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000100040410
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000100040240
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000001000401e0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000100040250
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000100040490
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000001000404a0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000100040300
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000100040360
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000001000402a0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000001000402c0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000100040380
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000100040340
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000100040440
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000100040260
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000100040270
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000100040400
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000001000401f0
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000100040210
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000100040200
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000100040420
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000100040430
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000100040220
.text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000100040280
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 000000014a650460
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 000000014a650450
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 000000014a650370
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 000000014a650470
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 000000014a6503e0
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 000000014a650320
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 000000014a6503b0
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 000000014a650390
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 000000014a6502e0
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 000000014a6502d0
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 000000014a650310
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 000000014a6503c0
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 000000014a6503f0
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 000000014a650230
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 000000014a650480
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 000000014a6503a0
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 000000014a6502f0
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 000000014a650350
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 000000014a650290
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 000000014a6502b0
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 000000014a6503d0
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 000000014a650330
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 000000014a650410
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 000000014a650240
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 000000014a6501e0
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 000000014a650250
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 000000014a650490
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 000000014a6504a0
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 000000014a650300
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 000000014a650360
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 000000014a6502a0
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 000000014a6502c0
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 000000014a650380
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 000000014a650340
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 000000014a650440
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 000000014a650260
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 000000014a650270
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 000000014a650400
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 000000014a6501f0
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 000000014a650210
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 000000014a650200
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 000000014a650420
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 000000014a650430
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 000000014a650220
.text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 000000014a650280
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000100070460
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000100070450
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000100070370
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000100070470
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000001000703e0
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000100070320
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000001000703b0
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000100070390
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000001000702e0
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000001000702d0
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000100070310
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000001000703c0
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000001000703f0
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000100070230
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000100070480
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000001000703a0
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000001000702f0
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000100070350
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000100070290
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000001000702b0
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000001000703d0
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000100070330
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000100070410
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000100070240
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000001000701e0
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000100070250
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000100070490
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000001000704a0
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000100070300
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000100070360
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000001000702a0
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000001000702c0
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000100070380
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000100070340
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000100070440
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000100070260
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000100070270
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000100070400
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000001000701f0
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000100070210
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000100070200
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000100070420
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000100070430
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000100070220
.text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000100070280
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000100070460
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000100070450
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000100070370
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000100070470
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000001000703e0
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000100070320
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000001000703b0
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000100070390
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000001000702e0
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000001000702d0
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000100070310
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000001000703c0
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000001000703f0
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000100070230
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000100070480
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000001000703a0
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000001000702f0
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000100070350
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000100070290
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000001000702b0
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000001000703d0
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000100070330
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000100070410
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000100070240
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000001000701e0
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000100070250
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000100070490
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000001000704a0
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000100070300
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000100070360
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000001000702a0
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000001000702c0
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000100070380
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000100070340
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000100070440
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000100070260
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000100070270
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000100070400
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000001000701f0
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000100070210
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000100070200
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000100070420
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000100070430
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000100070220
.text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000100070280
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350

PC_Knecht

03.06.2015 10:02

PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 3

Hier der zweite Teil von Gmer.txt

.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\SysWOW64\ntdll.dll!RtlFreeActivationContextStack + 271 00000000773e69e7 7 bytes JMP 000000010914883c
.text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\kernel32.dll!FreeLibrary + 8 00000000750c3480 7 bytes JMP 000000010914866c
.text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\kernel32.dll!GetFileInformationByHandle + 19 00000000750c5379 7 bytes JMP 00000001090f81b4
.text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 18 0000000076aa1402 1 byte [76]
.text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 18 0000000076aa141a 1 byte [76]
.text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 18 0000000076aa1432 1 byte [76]
.text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 43 0000000076aa144b 1 byte [76]
.text ... * 9
.text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 18 0000000076aa14de 1 byte [76]
.text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 18 0000000076aa14f6 1 byte [76]
.text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 18 0000000076aa150e 1 byte [76]
.text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 18 0000000076aa1526 1 byte [76]
.text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 18 0000000076aa153e 1 byte [76]
.text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 18 0000000076aa1556 1 byte [76]
.text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 18 0000000076aa156e 1 byte [76]
.text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 18 0000000076aa1586 1 byte [76]
.text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 18 0000000076aa159e 1 byte [76]
.text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 18 0000000076aa15b6 1 byte [76]
.text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 18 0000000076aa15ce 1 byte [76]
.text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 21 0000000076aa16b3 1 byte [76]
.text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 32 0000000076aa16be 1 byte [76]
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00000000771fde20 6 bytes {JMP QWORD [RIP+0x8f82210]}
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000771fdee0 6 bytes {JMP QWORD [RIP+0x8f62150]}
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00000000771fe100 6 bytes {JMP QWORD [RIP+0x8f41f30]}
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000771fe1b0 6 bytes {JMP QWORD [RIP+0x8f01e80]}
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00000000771fe740 6 bytes {JMP QWORD [RIP+0x8f218f0]}
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076fadbc0 6 bytes {JMP QWORD [RIP+0x91f2470]}
.text C:\Windows\system32\Dwm.exe[1224] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd27a6f5 3 bytes [15, 59, 05]
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00000000771fde20 6 bytes JMP 101
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000771fdee0 6 bytes JMP 52001600
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00000000771fe100 6 bytes JMP 410041
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000771fe1b0 6 bytes JMP 8f015c0
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00000000771fe740 6 bytes {JMP QWORD [RIP+0x8f218f0]}
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076fadbc0 6 bytes {JMP QWORD [RIP+0x91f2470]}
.text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd27a6f5 3 bytes [15, 59, 09]
.text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\msi.dll!MsiSetInternalUI 000007fef9c65c70 6 bytes JMP 6c0061
.text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\msi.dll!MsiInstallProductA 000007fef9ce2ad4 2 bytes [FF, 25]
.text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\msi.dll!MsiInstallProductA + 3 000007fef9ce2ad7 3 bytes [D5, 2B, 00]
.text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\msi.dll!MsiInstallProductW 000007fef9cf167c 6 bytes JMP 0
.text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW 000007feff0d3030 6 bytes {JMP QWORD [RIP+0x47d000]}
.text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\WS2_32.dll!connect + 1 000007feff0d45c1 5 bytes {JMP QWORD [RIP+0x41ba70]}
.text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\WS2_32.dll!listen 000007feff0d8290 6 bytes {JMP QWORD [RIP+0x457da0]}
.text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\WS2_32.dll!WSAConnect 000007feff0fe0f0 6 bytes JMP c1e9acd0
.text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\RASAPI32.dll!RasDialW + 1 000007fef43896f5 5 bytes JMP 4d004d
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000100070460
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000100070450
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000100070370
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000100070470
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000001000703e0
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000100070320
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000001000703b0
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000100070390
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000001000702e0
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000001000702d0
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000100070310
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000001000703c0
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000001000703f0
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000100070230
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000100070480
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000001000703a0
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000001000702f0
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000100070350
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000100070290
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000001000702b0
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000001000703d0
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000100070330
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000100070410
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000100070240
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000001000701e0
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000100070250
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000100070490
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000001000704a0
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000100070300
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000100070360
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000001000702a0
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000001000702c0
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000100070380
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000100070340
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000100070440
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000100070260
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000100070270
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000100070400
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000001000701f0
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000100070210
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000100070200
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000100070420
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000100070430
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000100070220
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000100070280
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000100070460
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000100070450
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000100070370
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000100070470
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000001000703e0
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000100070320
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000001000703b0
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000100070390
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000001000702e0
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000001000702d0
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000100070310
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000001000703c0
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000001000703f0
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000100070230
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000100070480
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000001000703a0
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000001000702f0
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000100070350
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000100070290
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000001000702b0
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000001000703d0
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000100070330
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000100070410
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000100070240
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000001000701e0
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000100070250
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000100070490
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000001000704a0
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000100070300
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000100070360
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000001000702a0
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000001000702c0
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000100070380
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000100070340
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000100070440
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000100070260
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000100070270
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000100070400
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000001000701f0
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000100070210
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000100070200
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000100070420
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000100070430
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000100070220
.text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000100070280
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00000000771fde20 6 bytes {JMP QWORD [RIP+0x8f82210]}
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000771fdee0 6 bytes {JMP QWORD [RIP+0x8f62150]}
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00000000771fe100 6 bytes {JMP QWORD [RIP+0x8f41f30]}
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000771fe1b0 6 bytes {JMP QWORD [RIP+0x8f01e80]}
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00000000771fe740 6 bytes {JMP QWORD [RIP+0x8f218f0]}
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076fadbc0 6 bytes {JMP QWORD [RIP+0x91f2470]}
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd27a6f5 3 bytes CALL 3000025
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 000007fefec55538 6 bytes {JMP QWORD [RIP+0xfaaf8]}
.text C:\Windows\system32\taskhost.exe[1748] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 000007fefec6ba4c 6 bytes {JMP QWORD [RIP+0xc45e4]}
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread

PC_Knecht

03.06.2015 10:04

PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 4

Hier nun der letzte Abschnitt aus meiner Gmer.txt

Vielen Dank nochmals für Euren Einsatz!!

00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00000000771fde20 6 bytes {JMP QWORD [RIP+0x8f82210]}
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000771fdee0 6 bytes {JMP QWORD [RIP+0x8f62150]}
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00000000771fe100 6 bytes {JMP QWORD [RIP+0x8f41f30]}
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000771fe1b0 6 bytes {JMP QWORD [RIP+0x8f01e80]}
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00000000771fe740 6 bytes {JMP QWORD [RIP+0x8f218f0]}
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076fadbc0 6 bytes {JMP QWORD [RIP+0x91f2470]}
.text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd27a6f5 3 bytes [15, 59, 05]
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 00000000773afc6c 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 00000000773afc70 2 bytes [01, 6F]
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile 00000000773afc84 3 bytes JMP 6ef9000a
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4 00000000773afc88 2 bytes JMP 6ef9000a
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 00000000773afdb0 3 bytes JMP 6efc000a
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 00000000773afdb4 2 bytes JMP 6efc000a
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 00000000773b0100 3 bytes JMP 6eff000a
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 00000000773b0104 2 bytes JMP 6eff000a
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 00000000773b0210 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 00000000773b0214 2 bytes [7A, 71]
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 00000000773b0a90 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 00000000773b0a94 2 bytes [04, 6F]
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000773b196c 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 00000000773b1970 2 bytes [F5, 6E]
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 00000000750c8781 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 00000000750d3bab 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 00000000750d3baf 2 bytes [F2, 6E]
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000074ec7154 6 bytes {JMP QWORD [RIP+0x717d001e]}
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000074ee342c 6 bytes {JMP QWORD [RIP+0x7180001e]}
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\syswow64\WS2_32.dll!WSALookupServiceBeginW 0000000074e1575a 6 bytes JMP 719c000a
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\syswow64\WS2_32.dll!connect 0000000074e16bdd 6 bytes JMP 71a5000a
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\syswow64\WS2_32.dll!listen 0000000074e1b001 6 bytes {JMP QWORD [RIP+0x719e001e]}
.text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\syswow64\WS2_32.dll!WSAConnect 0000000074e1cc3f 6 bytes {JMP QWORD [RIP+0x71a1001e]}
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00000000771fde20 6 bytes {JMP QWORD [RIP+0x8f82210]}
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000771fdee0 6 bytes {JMP QWORD [RIP+0x8f62150]}
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00000000771fe100 6 bytes {JMP QWORD [RIP+0x8f41f30]}
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000771fe1b0 6 bytes {JMP QWORD [RIP+0x8f01e80]}
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00000000771fe740 6 bytes {JMP QWORD [RIP+0x8f218f0]}
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076fadbc0 6 bytes {JMP QWORD [RIP+0x91f2470]}
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd27a6f5 3 bytes [15, 59, 05]
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW 000007feff0d3030 6 bytes {JMP QWORD [RIP+0x1ed000]}
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\system32\WS2_32.dll!connect + 1 000007feff0d45c1 5 bytes {JMP QWORD [RIP+0x18ba70]}
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\system32\WS2_32.dll!listen 000007feff0d8290 6 bytes {JMP QWORD [RIP+0x1c7da0]}
.text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\system32\WS2_32.dll!WSAConnect 000007feff0fe0f0 6 bytes {JMP QWORD [RIP+0x181f40]}
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220
.text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 00000000773afc6c 3 bytes JMP 718a000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 00000000773afc70 2 bytes JMP 718a000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile 00000000773afc84 3 bytes JMP 7181000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4 00000000773afc88 2 bytes JMP 7181000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 00000000773afdb0 3 bytes JMP 7184000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 00000000773afdb4 2 bytes JMP 7184000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 00000000773b0100 3 bytes JMP 7187000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 00000000773b0104 2 bytes JMP 7187000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 00000000773b0210 3 bytes JMP 7190000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 00000000773b0214 2 bytes JMP 7190000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 00000000773b0a90 3 bytes JMP 718d000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 00000000773b0a94 2 bytes JMP 718d000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000773b196c 3 bytes JMP 717e000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 00000000773b1970 2 bytes JMP 717e000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 00000000750d3bab 3 bytes JMP 717b000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 00000000750d3baf 2 bytes JMP 717b000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076bc2c9e 4 bytes CALL 71af0000
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076429679 6 bytes JMP 719f000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\USER32.dll!PostMessageW 00000000764312a5 6 bytes JMP 7199000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076433baa 6 bytes JMP 719c000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\USER32.dll!SendMessageA 000000007643612e 6 bytes JMP 71a2000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\USER32.dll!SendInput 000000007644ff4a 3 bytes JMP 71a5000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\USER32.dll!SendInput + 4 000000007644ff4e 2 bytes JMP 71a5000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\USER32.dll!mouse_event 000000007648027b 6 bytes JMP 71ab000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\USER32.dll!keybd_event 00000000764802bf 6 bytes JMP 71a8000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000074ec7154 6 bytes JMP 7193000a
.text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000074ee342c 6 bytes JMP 7196000a

---- EOF - GMER 2.1 ----

schrauber

03.06.2015 18:02

hi,

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

Downloade dir bitte

Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

PC_Knecht

05.06.2015 08:37

Hallo Schrauber,

hier die txt zu mbar

Code:

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.09.1.1004
 

(c) Malwarebytes Corporation 2011-2012
 

OS version: 6.1.7601 Windows 7 Service Pack 1 x64
 

Account is Administrative
 

Internet Explorer version: 11.0.9600.17801
 

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, E:\ DRIVE_FIXED

CPU speed: 2.500000 GHz

Memory total: 3210928128, free: 1537445888
 

Downloaded database version: v2015.06.05.01

Downloaded database version: v2015.06.02.01

Downloaded database version: v2015.05.13.01

Initializing...

======================

------------ Kernel report ------------

     06/05/2015 08:37:04

------------ Loaded modules -----------

\SystemRoot\system32\ntoskrnl.exe

\SystemRoot\system32\hal.dll

\SystemRoot\system32\kdcom.dll

\SystemRoot\system32\mcupdate_GenuineIntel.dll

\SystemRoot\system32\PSHED.dll

\SystemRoot\system32\CLFS.SYS

\SystemRoot\system32\CI.dll

\SystemRoot\system32\drivers\Wdf01000.sys

\SystemRoot\system32\drivers\WDFLDR.SYS

\SystemRoot\system32\drivers\ACPI.sys

\SystemRoot\system32\drivers\WMILIB.SYS

\SystemRoot\system32\drivers\msisadrv.sys

\SystemRoot\system32\drivers\pci.sys

\SystemRoot\system32\drivers\vdrvroot.sys

\SystemRoot\System32\drivers\partmgr.sys

\SystemRoot\system32\drivers\volmgr.sys

\SystemRoot\System32\drivers\volmgrx.sys

\SystemRoot\system32\drivers\intelide.sys

\SystemRoot\system32\drivers\PCIIDEX.SYS

\SystemRoot\System32\drivers\mountmgr.sys

\SystemRoot\system32\drivers\atapi.sys

\SystemRoot\system32\drivers\ataport.SYS

\SystemRoot\system32\drivers\amdxata.sys

\SystemRoot\system32\drivers\fltmgr.sys

\SystemRoot\system32\drivers\fileinfo.sys

\SystemRoot\System32\Drivers\Ntfs.sys

\SystemRoot\System32\Drivers\msrpc.sys

\SystemRoot\System32\Drivers\ksecdd.sys

\SystemRoot\System32\Drivers\cng.sys

\SystemRoot\System32\drivers\pcw.sys

\SystemRoot\System32\Drivers\Fs_Rec.sys

\SystemRoot\system32\drivers\ndis.sys

\SystemRoot\system32\drivers\NETIO.SYS

\SystemRoot\System32\Drivers\ksecpkg.sys

\SystemRoot\System32\drivers\tcpip.sys

\SystemRoot\System32\drivers\fwpkclnt.sys

\SystemRoot\system32\drivers\volsnap.sys

\SystemRoot\System32\Drivers\spldr.sys

\SystemRoot\System32\drivers\rdyboost.sys

\SystemRoot\System32\Drivers\mup.sys

\SystemRoot\System32\drivers\hwpolicy.sys

\SystemRoot\System32\DRIVERS\fvevol.sys

\SystemRoot\system32\DRIVERS\disk.sys

\SystemRoot\system32\DRIVERS\CLASSPNP.SYS

\SystemRoot\System32\Drivers\aswVmm.sys

\SystemRoot\System32\Drivers\aswRvrt.sys

\SystemRoot\system32\DRIVERS\cdrom.sys

\SystemRoot\system32\drivers\aswSnx.sys

\SystemRoot\system32\DRIVERS\epp64.sys

\SystemRoot\system32\drivers\aswSP.sys

\SystemRoot\System32\Drivers\Null.SYS

\SystemRoot\System32\Drivers\Beep.SYS

\SystemRoot\System32\drivers\vga.sys

\SystemRoot\System32\drivers\VIDEOPRT.SYS

\SystemRoot\System32\drivers\watchdog.sys

\SystemRoot\System32\DRIVERS\RDPCDD.sys

\SystemRoot\system32\drivers\rdpencdd.sys

\SystemRoot\system32\drivers\rdprefmp.sys

\SystemRoot\System32\Drivers\Msfs.SYS

\SystemRoot\System32\Drivers\Npfs.SYS

\SystemRoot\system32\DRIVERS\tdx.sys

\SystemRoot\system32\DRIVERS\TDI.SYS

\SystemRoot\system32\drivers\afd.sys

\SystemRoot\system32\drivers\aswRdr2.sys

\SystemRoot\System32\DRIVERS\netbt.sys

\SystemRoot\system32\DRIVERS\wfplwf.sys

\SystemRoot\system32\DRIVERS\pacer.sys

\SystemRoot\system32\DRIVERS\netbios.sys

\SystemRoot\system32\DRIVERS\serial.sys

\SystemRoot\system32\DRIVERS\wanarp.sys

\SystemRoot\system32\drivers\termdd.sys

\SystemRoot\system32\DRIVERS\rdbss.sys

\SystemRoot\system32\drivers\nsiproxy.sys

\SystemRoot\system32\drivers\mssmbios.sys

\SystemRoot\System32\drivers\discache.sys

\SystemRoot\System32\Drivers\dfsc.sys

\SystemRoot\system32\DRIVERS\ctxusbm.sys

\SystemRoot\system32\DRIVERS\blbdrive.sys

\SystemRoot\system32\DRIVERS\tunnel.sys

\SystemRoot\system32\DRIVERS\intelppm.sys

\SystemRoot\system32\DRIVERS\igdkmd64.sys

\SystemRoot\System32\drivers\dxgkrnl.sys

\SystemRoot\System32\drivers\dxgmms1.sys

\SystemRoot\system32\drivers\HDAudBus.sys

\SystemRoot\system32\DRIVERS\Rt64win7.sys

\SystemRoot\system32\DRIVERS\usbuhci.sys

\SystemRoot\system32\DRIVERS\USBPORT.SYS

\SystemRoot\system32\DRIVERS\usbehci.sys

\SystemRoot\system32\DRIVERS\fdc.sys

\SystemRoot\system32\DRIVERS\parport.sys

\SystemRoot\system32\DRIVERS\ASACPI.sys

\SystemRoot\system32\drivers\i8042prt.sys

\SystemRoot\system32\drivers\kbdclass.sys

\SystemRoot\system32\drivers\mouclass.sys

\SystemRoot\system32\DRIVERS\serenum.sys

\SystemRoot\system32\drivers\CompositeBus.sys

\SystemRoot\system32\DRIVERS\AgileVpn.sys

\SystemRoot\system32\DRIVERS\rasl2tp.sys

\SystemRoot\system32\DRIVERS\ndistapi.sys

\SystemRoot\system32\DRIVERS\ndiswan.sys

\SystemRoot\system32\DRIVERS\raspppoe.sys

\SystemRoot\system32\DRIVERS\raspptp.sys

\SystemRoot\system32\DRIVERS\rassstp.sys

\SystemRoot\system32\drivers\swenum.sys

\SystemRoot\system32\drivers\ks.sys

\SystemRoot\system32\drivers\umbus.sys

\SystemRoot\system32\DRIVERS\usbhub.sys

\SystemRoot\system32\DRIVERS\flpydisk.sys

\SystemRoot\System32\Drivers\NDProxy.SYS

\SystemRoot\system32\drivers\HdAudio.sys

\SystemRoot\system32\drivers\portcls.sys

\SystemRoot\system32\drivers\drmk.sys

\SystemRoot\system32\drivers\ksthunk.sys

\SystemRoot\System32\Drivers\crashdmp.sys

\SystemRoot\System32\Drivers\dump_dumpata.sys

\SystemRoot\System32\Drivers\dump_atapi.sys

\SystemRoot\System32\Drivers\dump_dumpfve.sys

\SystemRoot\system32\DRIVERS\usbccgp.sys

\SystemRoot\system32\DRIVERS\USBD.SYS

\SystemRoot\system32\DRIVERS\usbprint.sys

\SystemRoot\system32\DRIVERS\usbscan.sys

\SystemRoot\system32\DRIVERS\BrUsbSIb.sys

\SystemRoot\system32\DRIVERS\BrSerIb.sys

\SystemRoot\System32\win32k.sys

\SystemRoot\System32\drivers\Dxapi.sys

\SystemRoot\system32\DRIVERS\monitor.sys

\SystemRoot\System32\TSDDD.dll

\SystemRoot\system32\drivers\hidusb.sys

\SystemRoot\system32\drivers\HIDCLASS.SYS

\SystemRoot\system32\drivers\HIDPARSE.SYS

\SystemRoot\System32\cdd.dll

\SystemRoot\system32\DRIVERS\mouhid.sys

\SystemRoot\system32\drivers\luafv.sys

\SystemRoot\system32\drivers\aswMonFlt.sys

\??\C:\Windows\system32\drivers\mbam.sys

\SystemRoot\system32\drivers\aswStm.sys

\SystemRoot\system32\DRIVERS\lltdio.sys

\SystemRoot\system32\DRIVERS\rspndr.sys

\SystemRoot\system32\drivers\HTTP.sys

\SystemRoot\system32\DRIVERS\bowser.sys

\SystemRoot\System32\drivers\mpsdrv.sys

\SystemRoot\system32\DRIVERS\mrxsmb.sys

\SystemRoot\system32\DRIVERS\mrxsmb10.sys

\SystemRoot\system32\DRIVERS\mrxsmb20.sys

\SystemRoot\system32\drivers\aswHwid.sys

\SystemRoot\system32\drivers\peauth.sys

\SystemRoot\System32\Drivers\secdrv.SYS

\SystemRoot\System32\DRIVERS\srvnet.sys

\SystemRoot\System32\drivers\tcpipreg.sys

\SystemRoot\System32\DRIVERS\srv2.sys

\SystemRoot\System32\DRIVERS\srv.sys

\SystemRoot\system32\DRIVERS\asyncmac.sys

\??\C:\Windows\system32\drivers\mbamchameleon.sys

\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys

\Windows\System32\ntdll.dll

\Windows\System32\smss.exe

\Windows\System32\apisetschema.dll

\Windows\System32\autochk.exe

\Windows\System32\imagehlp.dll

\Windows\System32\wininet.dll

\Windows\System32\imm32.dll

\Windows\System32\shell32.dll

\Windows\System32\clbcatq.dll

\Windows\System32\Wldap32.dll

\Windows\System32\comdlg32.dll

\Windows\System32\nsi.dll

\Windows\System32\lpk.dll

\Windows\System32\rpcrt4.dll

\Windows\System32\usp10.dll

\Windows\System32\msctf.dll

\Windows\System32\advapi32.dll

\Windows\System32\difxapi.dll

\Windows\System32\sechost.dll

\Windows\System32\kernel32.dll

\Windows\System32\oleaut32.dll

\Windows\System32\shlwapi.dll

\Windows\System32\urlmon.dll

\Windows\System32\setupapi.dll

\Windows\System32\ws2_32.dll

\Windows\System32\user32.dll

\Windows\System32\normaliz.dll

\Windows\System32\gdi32.dll

\Windows\System32\ole32.dll

\Windows\System32\msvcrt.dll

\Windows\System32\iertutil.dll

\Windows\System32\psapi.dll

\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll

\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll

\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll

\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll

\Windows\System32\userenv.dll

\Windows\System32\wintrust.dll

\Windows\System32\cfgmgr32.dll

\Windows\System32\comctl32.dll

\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

\Windows\System32\devobj.dll

\Windows\System32\crypt32.dll

\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll

\Windows\System32\KernelBase.dll

\Windows\System32\msasn1.dll

\Windows\System32\profapi.dll

----------- End -----------

Done!
 

Scan started

Database versions:

  main:    v2015.06.05.01

  rootkit: v2015.06.02.01
 

<<<2>>>

Physical Sector Size: 512

Drive: 0, DevicePointer: 0xfffffa80033ed140, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa80033ee040, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa80033ed140, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa80032c8520, DeviceName: Unknown, DriverName: \Driver\ACPI\

DevicePointer: 0xfffffa800316d060, DeviceName: \Device\Ide\IdeDeviceP2T0L0-2\, DriverName: \Driver\atapi\

------------ End ----------

Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

Upper DeviceData: 0x0, 0x0, 0x0

Lower DeviceData: 0x0, 0x0, 0x0

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...

Done!

Drive 0

This is a System drive

Scanning MBR on drive 0...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: 102C102B
 

Partition information:
 

    Partition 0 type is Primary (0x7)

    Partition is ACTIVE.

    Partition starts at LBA: 63  Numsec = 92164842

    Partition file system is NTFS

    Partition is bootable
 

    Partition 1 type is Primary (0x7)

    Partition is NOT ACTIVE.

    Partition starts at LBA: 230339969  Numsec = 82236736
 

    Partition 2 type is Extended with LBA (0xf)

    Partition is NOT ACTIVE.

    Partition starts at LBA: 92164905  Numsec = 122977575
 

    Partition 3 type is Empty (0x0)

    Partition is NOT ACTIVE.

    Partition starts at LBA: 0  Numsec = 0
 

Disk Size: 160041885696 bytes

Sector size: 512 bytes
 

Done!

File "C:\ProgramData\AVAST Software\Avast\log\AvastSvc.log" is compressed (flags = 1)

File "C:\ProgramData\AVAST Software\Avast\log\AvastUI.log" is compressed (flags = 1)

File "C:\ProgramData\AVAST Software\Avast\log\CommChannel.Protocol.log" is compressed (flags = 1)

File "C:\ProgramData\AVAST Software\Avast\log\Grimefighter.log" is compressed (flags = 1)

File "C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-D45F552B0A7EA2BE16DE83DACAABBE99F1AAAF0B.bin.VE1" is compressed (flags = 1)

File "C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-D45F552B0A7EA2BE16DE83DACAABBE99F1AAAF0B.bin.VF" is compressed (flags = 1)

Scan finished

=======================================
 
 

Removal queue found; removal started

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-63-i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...

Removal finished

und hier der Report zu TDSSKiller

Code:

09:28:08.0529 0x0bf0  TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04

09:28:10.0698 0x0bf0  ============================================================

09:28:10.0698 0x0bf0  Current date / time: 2015/06/05 09:28:10.0698

09:28:10.0698 0x0bf0  SystemInfo:

09:28:10.0698 0x0bf0  

09:28:10.0698 0x0bf0  OS Version: 6.1.7601 ServicePack: 1.0

09:28:10.0698 0x0bf0  Product type: Workstation

09:28:10.0698 0x0bf0  ComputerName: ELTERN-PC

09:28:10.0698 0x0bf0  UserName: Eltern

09:28:10.0698 0x0bf0  Windows directory: C:\Windows

09:28:10.0698 0x0bf0  System windows directory: C:\Windows

09:28:10.0698 0x0bf0  Running under WOW64

09:28:10.0698 0x0bf0  Processor architecture: Intel x64

09:28:10.0698 0x0bf0  Number of processors: 2

09:28:10.0698 0x0bf0  Page size: 0x1000

09:28:10.0698 0x0bf0  Boot type: Normal boot

09:28:10.0698 0x0bf0  ============================================================

09:28:12.0694 0x0bf0  KLMD registered as C:\Windows\system32\drivers\68402580.sys

09:28:12.0944 0x0bf0  System UUID: {DC0E9369-626B-8836-9C44-FBEA2EEB311E}

09:28:13.0443 0x0bf0  Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 ( 149.05 Gb ), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

09:28:13.0443 0x0bf0  ============================================================

09:28:13.0443 0x0bf0  \Device\Harddisk0\DR0:

09:28:13.0443 0x0bf0  MBR partitions:

09:28:13.0443 0x0bf0  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x57E52EA

09:28:13.0443 0x0bf0  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0xDBAB581, BlocksNum 0x4E6D540

09:28:13.0459 0x0bf0  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x57E5368, BlocksNum 0x7547CE8

09:28:13.0459 0x0bf0  ============================================================

09:28:13.0490 0x0bf0  E: <-> \Device\Harddisk0\DR0\Partition2

09:28:13.0521 0x0bf0  D: <-> \Device\Harddisk0\DR0\Partition1

09:28:13.0537 0x0bf0  C: <-> \Device\Harddisk0\DR0\Partition3

09:28:13.0537 0x0bf0  ============================================================

09:28:13.0537 0x0bf0  Initialize success

09:28:13.0537 0x0bf0  ============================================================

09:28:40.0854 0x0c38  ============================================================

09:28:40.0854 0x0c38  Scan started

09:28:40.0854 0x0c38  Mode: Manual; SigCheck; TDLFS; 

09:28:40.0854 0x0c38  ============================================================

09:28:40.0854 0x0c38  KSN ping started

09:28:43.0365 0x0c38  KSN ping finished: true

09:28:44.0286 0x0c38  ================ Scan system memory ========================

09:28:44.0286 0x0c38  System memory - ok

09:28:44.0286 0x0c38  ================ Scan services =============================

09:28:44.0442 0x0c38  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys

09:28:44.0729 0x0c38  1394ohci - ok

09:28:45.0093 0x0c38  [ BBFD6BC7E79989B69F0998D0FEF4E6B8, 2283EC51F26AE34C79679741A220F0FF45703EB5F83823DF64F7AEA24A1966BA ] a2AntiMalware   C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe

09:28:45.0259 0x0c38  a2AntiMalware - ok

09:28:45.0310 0x0c38  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\Windows\system32\drivers\ACPI.sys

09:28:45.0347 0x0c38  ACPI - ok

09:28:45.0378 0x0c38  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys

09:28:45.0437 0x0c38  AcpiPmi - ok

09:28:45.0512 0x0c38  [ FC5B75CA6A1DA31EDD4F8D53F5540B98, CDC445F2790ADFC4C5568C40D4DA8BB95CD71991665B38AEC3D84571C99C3520 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

09:28:45.0556 0x0c38  AdobeARMservice - ok

09:28:45.0611 0x0c38  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys

09:28:45.0653 0x0c38  adp94xx - ok

09:28:45.0693 0x0c38  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys

09:28:45.0732 0x0c38  adpahci - ok

09:28:45.0785 0x0c38  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys

09:28:45.0822 0x0c38  adpu320 - ok

09:28:45.0858 0x0c38  [ 83BFCCAC53795E8A5055A93672D0C46C, B2B03473D950A5BA9DE59D81E7B14C1FAFF17B2A4D8A5808588F5CC21D63B291 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll

09:28:45.0903 0x0c38  AeLookupSvc - ok

09:28:45.0969 0x0c38  [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD             C:\Windows\system32\drivers\afd.sys

09:28:46.0055 0x0c38  AFD - ok

09:28:46.0124 0x0c38  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\Windows\system32\drivers\agp440.sys

09:28:46.0172 0x0c38  agp440 - ok

09:28:46.0214 0x0c38  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG             C:\Windows\System32\alg.exe

09:28:46.0267 0x0c38  ALG - ok

09:28:46.0310 0x0c38  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\Windows\system32\drivers\aliide.sys

09:28:46.0340 0x0c38  aliide - ok

09:28:46.0357 0x0c38  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\Windows\system32\drivers\amdide.sys

09:28:46.0386 0x0c38  amdide - ok

09:28:46.0421 0x0c38  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys

09:28:46.0464 0x0c38  AmdK8 - ok

09:28:46.0476 0x0c38  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys

09:28:46.0521 0x0c38  AmdPPM - ok

09:28:46.0555 0x0c38  [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata         C:\Windows\system32\drivers\amdsata.sys

09:28:46.0588 0x0c38  amdsata - ok

09:28:46.0610 0x0c38  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys

09:28:46.0643 0x0c38  amdsbs - ok

09:28:46.0656 0x0c38  [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata         C:\Windows\system32\drivers\amdxata.sys

09:28:46.0685 0x0c38  amdxata - ok

09:28:46.0737 0x0c38  [ 90C53BD47979FB8814F465A08B885102, 5EDFC1909FC1FF9133A534DFCC5408CF3A777AC41FB21FAD375436E3D86C02EC ] AppID           C:\Windows\system32\drivers\appid.sys

09:28:46.0786 0x0c38  AppID - ok

09:28:46.0799 0x0c38  [ 72D4757510FDA69D729169C00AFC211E, FB9686D0D94EE7C19A3994C29E8331A6EC3020B2980B2CC75F72F3AB25512C15 ] AppIDSvc        C:\Windows\System32\appidsvc.dll

09:28:46.0859 0x0c38  AppIDSvc - ok

09:28:46.0900 0x0c38  [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo         C:\Windows\System32\appinfo.dll

09:28:46.0952 0x0c38  Appinfo - ok

09:28:46.0989 0x0c38  [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc             C:\Windows\system32\DRIVERS\arc.sys

09:28:47.0020 0x0c38  arc - ok

09:28:47.0037 0x0c38  [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys

09:28:47.0068 0x0c38  arcsas - ok

09:28:47.0165 0x0c38  [ F15AB80B867D3332D5DDFB0A05B9CE04, 5A16577106246AB5DCC04FE0A0B00B7C5702557B75F958721E4C00383AB99809 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

09:28:47.0227 0x0c38  aspnet_state - ok

09:28:47.0272 0x0c38  [ B5B4C90E9F52DA8586F1E5461AD90A5D, D1EAA34E6AEB014E942D22F8CB5FB19BF1E2EADE5B5357274C001F44FDC25F05 ] aswHwid         C:\Windows\system32\drivers\aswHwid.sys

09:28:47.0339 0x0c38  aswHwid - ok

09:28:47.0370 0x0c38  [ 300CB8E510855189CAD0B72FFB5590CB, EB50DC553FA8FD9DE3F60AAFED20702EAFBB1498EBD3220A39CC52A12F694246 ] aswMonFlt       C:\Windows\system32\drivers\aswMonFlt.sys

09:28:47.0451 0x0c38  aswMonFlt - ok

09:28:47.0476 0x0c38  [ 6D37D8DB30D086739507C5F6E542656A, 746D9E32E729138EA19062F4E6B6C98B6833504020A296E3E2A9CD92E0FED0B9 ] aswRdr          C:\Windows\system32\drivers\aswRdr2.sys

09:28:47.0507 0x0c38  aswRdr - ok

09:28:47.0542 0x0c38  [ 07E32DFCA422A2920482D762D01957EC, A6502D26266D708E55EB2883897673AD3087C41D9EA0B41CD6BF6BD923EBDCB8 ] aswRvrt         C:\Windows\system32\drivers\aswRvrt.sys

09:28:47.0672 0x0c38  aswRvrt - ok

09:28:47.0769 0x0c38  [ 3B4AC2DBFC86F7247C1FF1FAF2860530, A54A693D01C02AAE2B78BFE9B3900B5A6DD0C2C37C8FA58B14B5F57107032FF5 ] aswSnx          C:\Windows\system32\drivers\aswSnx.sys

09:28:47.0891 0x0c38  aswSnx - ok

09:28:47.0973 0x0c38  [ B1368BE5F6BA529E0886F4DA2361BD2D, B95F430B4E4EFE9D257870722AA8F0507FB96FBE3AAB12068C662CCB6A180FE2 ] aswSP           C:\Windows\system32\drivers\aswSP.sys

09:28:48.0060 0x0c38  aswSP - ok

09:28:48.0102 0x0c38  [ 6E53278ECCFFBC2ACC2A5006745ED4BB, 392170073A8933DB43CD1D64AD087F972F1971BF83BCAFE5B8FA1273C02026CE ] aswStm          C:\Windows\system32\drivers\aswStm.sys

09:28:48.0140 0x0c38  aswStm - ok

09:28:48.0186 0x0c38  [ 91782404718C6352C26B3242BAC3F0F1, 84B1CDD1EBC83FAEBDCC8F67B13CA405C6CF0C518FC016603889EBE48FC91AB9 ] aswVmm          C:\Windows\system32\drivers\aswVmm.sys

09:28:48.0247 0x0c38  aswVmm - ok

09:28:48.0292 0x0c38  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys

09:28:48.0395 0x0c38  AsyncMac - ok

09:28:48.0434 0x0c38  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi           C:\Windows\system32\drivers\atapi.sys

09:28:48.0471 0x0c38  atapi - ok

09:28:48.0522 0x0c38  [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll

09:28:48.0600 0x0c38  AudioEndpointBuilder - ok

09:28:48.0673 0x0c38  [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioSrv        C:\Windows\System32\Audiosrv.dll

09:28:48.0747 0x0c38  AudioSrv - ok

09:28:49.0002 0x0c38  [ 54236E79A44F909612391C8A2D70D512, B0DF5BCC4F90AF087D0306F8D81F90B2CAE0176813E3AA6A7D5460F7878677CD ] avast! Antivirus C:\Program Files (x86)\AVAST Software\Avast\AvastSvc.exe

09:28:49.0048 0x0c38  avast! Antivirus - ok

09:28:49.0098 0x0c38  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\Windows\System32\AxInstSV.dll

09:28:49.0173 0x0c38  AxInstSV - ok

09:28:49.0261 0x0c38  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbda.sys

09:28:49.0353 0x0c38  b06bdrv - ok

09:28:49.0450 0x0c38  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys

09:28:49.0518 0x0c38  b57nd60a - ok

09:28:49.0587 0x0c38  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\Windows\System32\bdesvc.dll

09:28:49.0702 0x0c38  BDESVC - ok

09:28:49.0746 0x0c38  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\Windows\system32\drivers\Beep.sys

09:28:49.0826 0x0c38  Beep - ok

09:28:49.0918 0x0c38  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE             C:\Windows\System32\bfe.dll

09:28:50.0035 0x0c38  BFE - ok

09:28:50.0080 0x0c38  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\Windows\System32\qmgr.dll

09:28:50.0181 0x0c38  BITS - ok

09:28:50.0208 0x0c38  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys

09:28:50.0256 0x0c38  blbdrive - ok

09:28:50.0296 0x0c38  [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys

09:28:50.0342 0x0c38  bowser - ok

09:28:50.0375 0x0c38  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys

09:28:50.0427 0x0c38  BrFiltLo - ok

09:28:50.0443 0x0c38  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys

09:28:50.0485 0x0c38  BrFiltUp - ok

09:28:50.0514 0x0c38  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser         C:\Windows\System32\browser.dll

09:28:50.0566 0x0c38  Browser - ok

09:28:50.0610 0x0c38  [ 63A00CDBEB300522C49EC7CA77324060, 99CB6D37C7D898982A192AAA8DE5CE255E6FA482E19FE9032BAA7069E652F6F5 ] BrSerIb         C:\Windows\system32\DRIVERS\BrSerIb.sys

09:28:50.0639 0x0c38  BrSerIb - ok

09:28:50.0673 0x0c38  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid         C:\Windows\System32\Drivers\Brserid.sys

09:28:50.0734 0x0c38  Brserid - ok

09:28:50.0750 0x0c38  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys

09:28:50.0797 0x0c38  BrSerWdm - ok

09:28:50.0843 0x0c38  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys

09:28:50.0887 0x0c38  BrUsbMdm - ok

09:28:50.0893 0x0c38  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys

09:28:50.0934 0x0c38  BrUsbSer - ok

09:28:50.0959 0x0c38  [ BBCFD6C6EF66449F55AF1BFDB08C9B12, D6D5D408FCFFF9ED69D095948E786C08EEECD5F55905A3D8FE2BB08944C5E1F2 ] BrUsbSIb        C:\Windows\system32\DRIVERS\BrUsbSIb.sys

09:28:50.0986 0x0c38  BrUsbSIb - ok

09:28:51.0091 0x0c38  [ 0471D5669F18C50E552B2BC0CB15E7B3, 472F471FF9E5A1FDD5610BAC2F5E727AB284B7B5A71C4E515D549667F0B5EB86 ] BrYNSvc         C:\Program Files (x86)\Browny02\BrYNSvc.exe

09:28:51.0156 0x0c38  BrYNSvc - detected UnsignedFile.Multi.Generic ( 1 )

09:28:53.0545 0x0c38  Detect skipped due to KSN trusted

09:28:53.0545 0x0c38  BrYNSvc - ok

09:28:53.0577 0x0c38  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys

09:28:53.0629 0x0c38  BTHMODEM - ok

09:28:53.0664 0x0c38  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv         C:\Windows\system32\bthserv.dll

09:28:53.0730 0x0c38  bthserv - ok

09:28:53.0769 0x0c38  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys

09:28:53.0838 0x0c38  cdfs - ok

09:28:53.0885 0x0c38  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys

09:28:53.0934 0x0c38  cdrom - ok

09:28:53.0974 0x0c38  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc     C:\Windows\System32\certprop.dll

09:28:54.0044 0x0c38  CertPropSvc - ok

09:28:54.0077 0x0c38  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\Windows\system32\DRIVERS\circlass.sys

09:28:54.0123 0x0c38  circlass - ok

09:28:54.0163 0x0c38  [ 404B7DF9CA4D1CB675045AF220FF3285, 91FFADE2ABE5C48849E63134D5FFD20671FE0D1720F7D486F904391B3D142C96 ] CLFS            C:\Windows\system32\CLFS.sys

09:28:54.0203 0x0c38  CLFS - ok

09:28:54.0256 0x0c38  [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

09:28:54.0381 0x0c38  clr_optimization_v2.0.50727_32 - ok

09:28:54.0447 0x0c38  [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

09:28:54.0536 0x0c38  clr_optimization_v2.0.50727_64 - ok

09:28:54.0606 0x0c38  [ F5AB4D2E36625F355E81539239765107, 48E6AD65EEFD6C54F938F5753EF58377CDA77ADBB41CD8635F0040D61EFB92A4 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

09:28:54.0656 0x0c38  clr_optimization_v4.0.30319_32 - ok

09:28:54.0683 0x0c38  [ 9ACBE5EC13C2CC95833BFB7636CA8B1A, 6224DA9FB335D2A8374C60B8DEA539DD3A0E43230DB888B137B71A56EC57D6AF ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

09:28:54.0719 0x0c38  clr_optimization_v4.0.30319_64 - ok

09:28:54.0753 0x0c38  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys

09:28:54.0794 0x0c38  CmBatt - ok

09:28:54.0810 0x0c38  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\Windows\system32\drivers\cmdide.sys

09:28:54.0839 0x0c38  cmdide - ok

09:28:54.0878 0x0c38  [ 27667A788130A7F7A5858DE27572E6D7, 5501D80BCCB7A811ECCED3828DFD0A5D948BBED8504E9BCC4A3BFB840DD41CBC ] CNG             C:\Windows\system32\Drivers\cng.sys

09:28:54.0922 0x0c38  CNG - ok

09:28:54.0947 0x0c38  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys

09:28:54.0976 0x0c38  Compbatt - ok

09:28:55.0010 0x0c38  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys

09:28:55.0097 0x0c38  CompositeBus - ok

09:28:55.0120 0x0c38  COMSysApp - ok

09:28:55.0159 0x0c38  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys

09:28:55.0194 0x0c38  crcdisk - ok

09:28:55.0230 0x0c38  [ 1CD76A83B9E8E9A5A3519B39E28354D9, F9931743B99820FFBFB13136DFFD92F86802D543F9D8478648CDC554FB38899D ] CryptSvc        C:\Windows\system32\cryptsvc.dll

09:28:55.0282 0x0c38  CryptSvc - ok

09:28:55.0354 0x0c38  [ BA8E5B2291C01EF71CA80E25F0C79D55, 913C85EC00752AEEE2E29C6664085865DA45A091789C0F8CB015208D69F1915A ] ctxusbm         C:\Windows\system32\DRIVERS\ctxusbm.sys

09:28:55.0394 0x0c38  ctxusbm - ok

09:28:55.0443 0x0c38  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch      C:\Windows\system32\rpcss.dll

09:28:55.0526 0x0c38  DcomLaunch - ok

09:28:55.0571 0x0c38  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc       C:\Windows\System32\defragsvc.dll

09:28:55.0642 0x0c38  defragsvc - ok

09:28:55.0676 0x0c38  [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC            C:\Windows\system32\Drivers\dfsc.sys

09:28:55.0744 0x0c38  DfsC - ok

09:28:55.0782 0x0c38  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\Windows\system32\dhcpcore.dll

09:28:55.0837 0x0c38  Dhcp - ok

09:28:55.0918 0x0c38  [ EA8A3E8C674B03CB4AFA1D344DBD7BC1, 564D9370AE4D12973647997684B9637B2A5A7480F66B87018F789CE4E43C8191 ] DiagTrack       C:\Windows\system32\diagtrack.dll

09:28:56.0009 0x0c38  DiagTrack - ok

09:28:56.0044 0x0c38  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\Windows\system32\drivers\discache.sys

09:28:56.0115 0x0c38  discache - ok

09:28:56.0157 0x0c38  [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk            C:\Windows\system32\DRIVERS\disk.sys

09:28:56.0187 0x0c38  Disk - ok

09:28:56.0216 0x0c38  [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache        C:\Windows\System32\dnsrslvr.dll

09:28:56.0268 0x0c38  Dnscache - ok

09:28:56.0315 0x0c38  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc         C:\Windows\System32\dot3svc.dll

09:28:56.0396 0x0c38  dot3svc - ok

09:28:56.0438 0x0c38  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS             C:\Windows\system32\dps.dll

09:28:56.0517 0x0c38  DPS - ok

09:28:56.0567 0x0c38  [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys

09:28:56.0612 0x0c38  drmkaud - ok

09:28:56.0676 0x0c38  [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys

09:28:56.0730 0x0c38  DXGKrnl - ok

09:28:56.0769 0x0c38  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost         C:\Windows\System32\eapsvc.dll

09:28:56.0835 0x0c38  EapHost - ok

09:28:56.0955 0x0c38  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv           C:\Windows\system32\DRIVERS\evbda.sys

09:28:57.0107 0x0c38  ebdrv - ok

09:28:57.0143 0x0c38  [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] EFS             C:\Windows\System32\lsass.exe

09:28:57.0188 0x0c38  EFS - ok

09:28:57.0277 0x0c38  [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe

09:28:57.0348 0x0c38  ehRecvr - ok

09:28:57.0377 0x0c38  [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched         C:\Windows\ehome\ehsched.exe

09:28:57.0423 0x0c38  ehSched - ok

09:28:57.0476 0x0c38  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys

09:28:57.0518 0x0c38  elxstor - ok

09:28:57.0563 0x0c38  [ 9EAFB3B3B60B8AD958985152A9309ACA, EC58F487D50A125DA3F747670282EA2104580CCAAF709EA494B61C7549576AE6 ] epmntdrv        C:\Windows\system32\epmntdrv.sys

09:28:57.0598 0x0c38  epmntdrv - detected UnsignedFile.Multi.Generic ( 1 )

09:29:00.0103 0x0c38  Detect skipped due to KSN trusted

09:29:00.0103 0x0c38  epmntdrv - ok

09:29:00.0166 0x0c38  [ CA4ADE6C3929B70317BFDDF9ABBFE0CE, 824F3D26FDFBA38A5191C78E68379D48C915FB6F82BD353A1D5416537F8A0A42 ] epp64           C:\Windows\system32\DRIVERS\epp64.sys

09:29:00.0212 0x0c38  epp64 - ok

09:29:00.0244 0x0c38  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\Windows\system32\drivers\errdev.sys

09:29:00.0275 0x0c38  ErrDev - ok

09:29:00.0337 0x0c38  [ FB949ED2C93C878A189039F3D7730942, 857AFB9965F14C80C21948C05A44D37948BD206961101DFF087735D6A7CCAA8A ] EuGdiDrv        C:\Windows\system32\EuGdiDrv.sys

09:29:00.0368 0x0c38  EuGdiDrv - detected UnsignedFile.Multi.Generic ( 1 )

09:29:02.0989 0x0c38  Detect skipped due to KSN trusted

09:29:02.0989 0x0c38  EuGdiDrv - ok

09:29:03.0052 0x0c38  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem     C:\Windows\system32\es.dll

09:29:03.0145 0x0c38  EventSystem - ok

09:29:03.0161 0x0c38  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat           C:\Windows\system32\drivers\exfat.sys

09:29:03.0223 0x0c38  exfat - ok

09:29:03.0255 0x0c38  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat         C:\Windows\system32\drivers\fastfat.sys

09:29:03.0317 0x0c38  fastfat - ok

09:29:03.0379 0x0c38  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax             C:\Windows\system32\fxssvc.exe

09:29:03.0442 0x0c38  Fax - ok

09:29:03.0473 0x0c38  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc             C:\Windows\system32\DRIVERS\fdc.sys

09:29:03.0520 0x0c38  fdc - ok

09:29:03.0551 0x0c38  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost         C:\Windows\system32\fdPHost.dll

09:29:03.0613 0x0c38  fdPHost - ok

09:29:03.0613 0x0c38  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\Windows\system32\fdrespub.dll

09:29:03.0676 0x0c38  FDResPub - ok

09:29:03.0691 0x0c38  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys

09:29:03.0723 0x0c38  FileInfo - ok

09:29:03.0738 0x0c38  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys

09:29:03.0816 0x0c38  Filetrace - ok

09:29:03.0816 0x0c38  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys

09:29:03.0863 0x0c38  flpydisk - ok

09:29:03.0894 0x0c38  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys

09:29:03.0941 0x0c38  FltMgr - ok

09:29:04.0003 0x0c38  [ E612E86FA15EA1EF9A52433A2743C447, 8A66164541D2EE2334B6DE3995C31138EA85E3A06BC7FD901E60D345E4E1E8A8 ] FontCache       C:\Windows\system32\FntCache.dll

09:29:04.0081 0x0c38  FontCache - ok

09:29:04.0144 0x0c38  [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

09:29:04.0175 0x0c38  FontCache3.0.0.0 - ok

09:29:04.0206 0x0c38  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys

09:29:04.0237 0x0c38  FsDepends - ok

09:29:04.0269 0x0c38  [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys

09:29:04.0300 0x0c38  Fs_Rec - ok

09:29:04.0331 0x0c38  [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys

09:29:04.0378 0x0c38  fvevol - ok

09:29:04.0409 0x0c38  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys

09:29:04.0440 0x0c38  gagp30kx - ok

09:29:04.0503 0x0c38  [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc           C:\Windows\System32\gpsvc.dll

09:29:04.0581 0x0c38  gpsvc - ok

09:29:04.0612 0x0c38  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys

09:29:04.0659 0x0c38  hcw85cir - ok

09:29:04.0690 0x0c38  [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys

09:29:04.0737 0x0c38  HdAudAddService - ok

09:29:04.0768 0x0c38  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys

09:29:04.0815 0x0c38  HDAudBus - ok

09:29:04.0846 0x0c38  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys

09:29:04.0893 0x0c38  HidBatt - ok

09:29:04.0924 0x0c38  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys

09:29:04.0971 0x0c38  HidBth - ok

09:29:04.0986 0x0c38  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys

09:29:05.0033 0x0c38  HidIr - ok

09:29:05.0049 0x0c38  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv         C:\Windows\system32\hidserv.dll

09:29:05.0127 0x0c38  hidserv - ok

09:29:05.0158 0x0c38  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\Windows\system32\drivers\hidusb.sys

09:29:05.0189 0x0c38  HidUsb - ok

09:29:05.0220 0x0c38  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\Windows\system32\kmsvc.dll

09:29:05.0283 0x0c38  hkmsvc - ok

09:29:05.0314 0x0c38  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll

09:29:05.0376 0x0c38  HomeGroupListener - ok

09:29:05.0423 0x0c38  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll

09:29:05.0470 0x0c38  HomeGroupProvider - ok

09:29:05.0517 0x0c38  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys

09:29:05.0548 0x0c38  HpSAMD - ok

09:29:05.0595 0x0c38  [ F61634BEC53F73702A10DE69F6DCAF57, BBA7344CF3AB96A46D1A6F1D50F2758EA8D097FE558C38B4EF45C8C334AF96E1 ] HTTP            C:\Windows\system32\drivers\HTTP.sys

09:29:05.0673 0x0c38  HTTP - ok

09:29:05.0751 0x0c38  HWiNFO32 - ok

09:29:05.0782 0x0c38  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys

09:29:05.0813 0x0c38  hwpolicy - ok

09:29:05.0844 0x0c38  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys

09:29:05.0888 0x0c38  i8042prt - ok

09:29:05.0973 0x0c38  [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys

09:29:06.0059 0x0c38  iaStorV - ok

09:29:06.0223 0x0c38  [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

09:29:06.0325 0x0c38  idsvc - ok

09:29:06.0392 0x0c38  IEEtwCollectorService - ok

09:29:06.0600 0x0c38  [ 24CC43ECDEEFD4C19FBBEE4951B647F1, 416799965E6602F8F03E2A92E8BB42B1D5643C65EF09815FC5A56A2FA73E6773 ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys

09:29:06.0783 0x0c38  igfx - ok

09:29:06.0847 0x0c38  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys

09:29:06.0876 0x0c38  iirsp - ok

09:29:06.0923 0x0c38  [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT          C:\Windows\System32\ikeext.dll

09:29:06.0996 0x0c38  IKEEXT - ok

09:29:07.0037 0x0c38  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\Windows\system32\drivers\intelide.sys

09:29:07.0065 0x0c38  intelide - ok

09:29:07.0098 0x0c38  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys

09:29:07.0148 0x0c38  intelppm - ok

09:29:07.0179 0x0c38  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum       C:\Windows\system32\ipbusenum.dll

09:29:07.0252 0x0c38  IPBusEnum - ok

09:29:07.0296 0x0c38  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys

09:29:07.0349 0x0c38  IpFilterDriver - ok

09:29:07.0396 0x0c38  [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll

09:29:07.0454 0x0c38  iphlpsvc - ok

09:29:07.0497 0x0c38  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys

09:29:07.0546 0x0c38  IPMIDRV - ok

09:29:07.0582 0x0c38  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT           C:\Windows\system32\drivers\ipnat.sys

09:29:07.0643 0x0c38  IPNAT - ok

09:29:07.0666 0x0c38  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\Windows\system32\drivers\irenum.sys

09:29:07.0718 0x0c38  IRENUM - ok

09:29:07.0754 0x0c38  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\Windows\system32\drivers\isapnp.sys

09:29:07.0783 0x0c38  isapnp - ok

09:29:07.0823 0x0c38  [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys

09:29:07.0858 0x0c38  iScsiPrt - ok

09:29:07.0897 0x0c38  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\Windows\system32\drivers\kbdclass.sys

09:29:07.0928 0x0c38  kbdclass - ok

09:29:07.0966 0x0c38  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys

09:29:08.0065 0x0c38  kbdhid - ok

09:29:08.0094 0x0c38  [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] KeyIso          C:\Windows\system32\lsass.exe

09:29:08.0153 0x0c38  KeyIso - ok

09:29:08.0193 0x0c38  [ F7DFAE6040AC910B7C64EE208A34157D, AEF1100F12391692D9DB78519D843A90C97E199A80DDC4D43E3AF1919A9E8E56 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys

09:29:08.0255 0x0c38  KSecDD - ok

09:29:08.0293 0x0c38  [ 8FE94F2EF9BF444E93E35D87E210D02F, 78E8F6FD7C1EA3556194947707BE6893538A9E25A550C22045866C5B30251D14 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys

09:29:08.0335 0x0c38  KSecPkg - ok

09:29:08.0385 0x0c38  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys

09:29:08.0466 0x0c38  ksthunk - ok

09:29:08.0508 0x0c38  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm           C:\Windows\system32\msdtckrm.dll

09:29:08.0580 0x0c38  KtmRm - ok

09:29:08.0626 0x0c38  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\Windows\system32\srvsvc.dll

09:29:08.0696 0x0c38  LanmanServer - ok

09:29:08.0722 0x0c38  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll

09:29:08.0779 0x0c38  LanmanWorkstation - ok

09:29:08.0811 0x0c38  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys

09:29:08.0876 0x0c38  lltdio - ok

09:29:08.0924 0x0c38  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc         C:\Windows\System32\lltdsvc.dll

09:29:09.0004 0x0c38  lltdsvc - ok

09:29:09.0029 0x0c38  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts         C:\Windows\System32\lmhsvc.dll

09:29:09.0100 0x0c38  lmhosts - ok

09:29:09.0141 0x0c38  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys

09:29:09.0172 0x0c38  LSI_FC - ok

09:29:09.0208 0x0c38  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys

09:29:09.0240 0x0c38  LSI_SAS - ok

09:29:09.0265 0x0c38  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys

09:29:09.0297 0x0c38  LSI_SAS2 - ok

09:29:09.0321 0x0c38  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys

09:29:09.0353 0x0c38  LSI_SCSI - ok

09:29:09.0380 0x0c38  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv           C:\Windows\system32\drivers\luafv.sys

09:29:09.0448 0x0c38  luafv - ok

09:29:09.0489 0x0c38  [ 1E9E32AEC3E1EB1B31B8169F33168B56, 39114585E1FDBBA31E1F781C6A627281907183F94626EB347B08D1F78992ED2A ] MBAMProtector   C:\Windows\system32\drivers\mbam.sys

09:29:09.0517 0x0c38  MBAMProtector - ok

09:29:09.0605 0x0c38  [ 2B983F067AEE3F9EB4DF5E97F45D21D1, 0B9ED0E91FF01A5445927650113E320C3C0EA16F1401AA55A509DDBF704DF22F ] MBAMService     C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

09:29:09.0670 0x0c38  MBAMService - ok

09:29:09.0734 0x0c38  [ F49FB3C88E263AE9A246593B0BB29294, FB53D6FA4A98B98334DCFF81E40712265256D31A9E9FF36022887BABD50F39EB ] MBAMWebAccessControl C:\Windows\system32\drivers\mwac.sys

09:29:09.0765 0x0c38  MBAMWebAccessControl - ok

09:29:09.0797 0x0c38  [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll

09:29:09.0833 0x0c38  Mcx2Svc - ok

09:29:09.0883 0x0c38  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys

09:29:09.0929 0x0c38  megasas - ok

09:29:10.0023 0x0c38  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys

09:29:10.0096 0x0c38  MegaSR - ok

09:29:10.0139 0x0c38  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS           C:\Windows\system32\mmcss.dll

09:29:10.0209 0x0c38  MMCSS - ok

09:29:10.0229 0x0c38  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem           C:\Windows\system32\drivers\modem.sys

09:29:10.0293 0x0c38  Modem - ok

09:29:10.0335 0x0c38  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys

09:29:10.0382 0x0c38  monitor - ok

09:29:10.0417 0x0c38  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\Windows\system32\drivers\mouclass.sys

09:29:10.0448 0x0c38  mouclass - ok

09:29:10.0481 0x0c38  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys

09:29:10.0530 0x0c38  mouhid - ok

09:29:10.0567 0x0c38  [ 87BCD1034CBF33537D4D4C251D39BA26, CB9DD235B62B79383F99873D75E26EEA5EE7914CA89E4B75992207F83420437F ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys

09:29:10.0597 0x0c38  mountmgr - ok

09:29:10.0649 0x0c38  [ 9FC679D10A7377BB04ECC3D0E2E26B53, 24ACD4EC1618A052C29E4463138B28F62C8B78D442DB82F4925E64FC5849A096 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

09:29:10.0680 0x0c38  MozillaMaintenance - ok

09:29:10.0713 0x0c38  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\Windows\system32\drivers\mpio.sys

09:29:10.0745 0x0c38  mpio - ok

09:29:10.0780 0x0c38  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys

09:29:10.0835 0x0c38  mpsdrv - ok

09:29:10.0876 0x0c38  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\Windows\system32\mpssvc.dll

09:29:10.0968 0x0c38  MpsSvc - ok

09:29:11.0009 0x0c38  [ AE3334958D8F631FF14A0AEB3D7EFB3A, F5FD6B61F896104C20DFC43FEE2FCE6930B73F78DF876BD19A333EABB9139C6D ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys

09:29:11.0055 0x0c38  MRxDAV - ok

09:29:11.0092 0x0c38  [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys

09:29:11.0140 0x0c38  mrxsmb - ok

09:29:11.0167 0x0c38  [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys

09:29:11.0218 0x0c38  mrxsmb10 - ok

09:29:11.0247 0x0c38  [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys

09:29:11.0297 0x0c38  mrxsmb20 - ok

09:29:11.0335 0x0c38  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\Windows\system32\drivers\msahci.sys

09:29:11.0365 0x0c38  msahci - ok

09:29:11.0407 0x0c38  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm           C:\Windows\system32\drivers\msdsm.sys

09:29:11.0450 0x0c38  msdsm - ok

09:29:11.0480 0x0c38  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC           C:\Windows\System32\msdtc.exe

09:29:11.0529 0x0c38  MSDTC - ok

09:29:11.0579 0x0c38  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\Windows\system32\drivers\Msfs.sys

09:29:11.0643 0x0c38  Msfs - ok

09:29:11.0664 0x0c38  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys

09:29:11.0727 0x0c38  mshidkmdf - ok

09:29:11.0760 0x0c38  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys

09:29:11.0789 0x0c38  msisadrv - ok

09:29:11.0837 0x0c38  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll

09:29:11.0908 0x0c38  MSiSCSI - ok

09:29:11.0918 0x0c38  msiserver - ok

09:29:11.0966 0x0c38  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys

09:29:12.0017 0x0c38  MSKSSRV - ok

09:29:12.0039 0x0c38  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys

09:29:12.0103 0x0c38  MSPCLOCK - ok

09:29:12.0143 0x0c38  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys

09:29:12.0203 0x0c38  MSPQM - ok

09:29:12.0257 0x0c38  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys

09:29:12.0311 0x0c38  MsRPC - ok

09:29:12.0345 0x0c38  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys

09:29:12.0374 0x0c38  mssmbios - ok

09:29:12.0405 0x0c38  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys

09:29:12.0468 0x0c38  MSTEE - ok

09:29:12.0490 0x0c38  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys

09:29:12.0534 0x0c38  MTConfig - ok

09:29:12.0585 0x0c38  [ 03B7145C889603537E9FFEABB1AD1089, B3CD93B893D4A2370CBF382366C6F596372857F8711EF6FFF83BFE2B449F424E ] MTsensor        C:\Windows\system32\DRIVERS\ASACPI.sys

09:29:12.0629 0x0c38  MTsensor - ok

09:29:12.0662 0x0c38  [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup             C:\Windows\system32\Drivers\mup.sys

09:29:12.0693 0x0c38  Mup - ok

09:29:12.0737 0x0c38  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\Windows\system32\qagentRT.dll

09:29:12.0816 0x0c38  napagent - ok

09:29:12.0864 0x0c38  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys

09:29:12.0920 0x0c38  NativeWifiP - ok

09:29:12.0980 0x0c38  [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS            C:\Windows\system32\drivers\ndis.sys

09:29:13.0034 0x0c38  NDIS - ok

09:29:13.0068 0x0c38  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys

09:29:13.0137 0x0c38  NdisCap - ok

09:29:13.0170 0x0c38  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys

09:29:13.0233 0x0c38  NdisTapi - ok

09:29:13.0283 0x0c38  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys

09:29:13.0348 0x0c38  Ndisuio - ok

09:29:13.0380 0x0c38  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys

09:29:13.0446 0x0c38  NdisWan - ok

09:29:13.0476 0x0c38  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys

09:29:13.0544 0x0c38  NDProxy - ok

09:29:13.0587 0x0c38  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys

09:29:13.0652 0x0c38  NetBIOS - ok

09:29:13.0684 0x0c38  [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys

09:29:13.0756 0x0c38  NetBT - ok

09:29:13.0774 0x0c38  [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] Netlogon        C:\Windows\system32\lsass.exe

09:29:13.0806 0x0c38  Netlogon - ok

09:29:13.0843 0x0c38  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\Windows\System32\netman.dll

09:29:13.0921 0x0c38  Netman - ok

09:29:13.0969 0x0c38  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

09:29:14.0000 0x0c38  NetMsmqActivator - ok

09:29:14.0015 0x0c38  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

09:29:14.0047 0x0c38  NetPipeActivator - ok

09:29:14.0093 0x0c38  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\Windows\System32\netprofm.dll

09:29:14.0187 0x0c38  netprofm - ok

09:29:14.0218 0x0c38  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

09:29:14.0249 0x0c38  NetTcpActivator - ok

09:29:14.0265 0x0c38  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

09:29:14.0296 0x0c38  NetTcpPortSharing - ok

09:29:14.0343 0x0c38  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys

09:29:14.0374 0x0c38  nfrd960 - ok

09:29:14.0405 0x0c38  [ 8B301D474B478E9A92823BAB50A7BC49, 8181816035F41B1DABEC05E65E4F67BCD785F56760A61F1049E91BA39D42F01D ] NlaSvc          C:\Windows\System32\nlasvc.dll

09:29:14.0468 0x0c38  NlaSvc - ok

09:29:14.0483 0x0c38  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\Windows\system32\drivers\Npfs.sys

09:29:14.0546 0x0c38  Npfs - ok

09:29:14.0561 0x0c38  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi             C:\Windows\system32\nsisvc.dll

09:29:14.0624 0x0c38  nsi - ok

09:29:14.0639 0x0c38  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys

09:29:14.0702 0x0c38  nsiproxy - ok

09:29:14.0795 0x0c38  [ 1A29A59A4C5BA6F8C85062A613B7E2B2, CC137F499A12C724D4166C2D85E9F447413419A0683DAC6F1A802B7F210C77F1 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys

09:29:14.0889 0x0c38  Ntfs - ok

09:29:14.0920 0x0c38  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\Windows\system32\drivers\Null.sys

09:29:14.0998 0x0c38  Null - ok

09:29:15.0029 0x0c38  [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid          C:\Windows\system32\drivers\nvraid.sys

09:29:15.0061 0x0c38  nvraid - ok

09:29:15.0092 0x0c38  [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor          C:\Windows\system32\drivers\nvstor.sys

09:29:15.0123 0x0c38  nvstor - ok

09:29:15.0185 0x0c38  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys

09:29:15.0248 0x0c38  nv_agp - ok

09:29:15.0279 0x0c38  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys

09:29:15.0310 0x0c38  ohci1394 - ok

09:29:15.0357 0x0c38  [ 7A56CF3E3F12E8AF599963B16F50FB6A, 882C82BAE96D263138D4C0D6C425458B770B7B9C8E9C1D28AC918BF6BE94A5C2 ] ose             C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE

09:29:15.0388 0x0c38  ose - ok

09:29:15.0435 0x0c38  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll

09:29:15.0482 0x0c38  p2pimsvc - ok

09:29:15.0513 0x0c38  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\Windows\system32\p2psvc.dll

09:29:15.0575 0x0c38  p2psvc - ok

09:29:15.0607 0x0c38  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport         C:\Windows\system32\DRIVERS\parport.sys

09:29:15.0653 0x0c38  Parport - ok

09:29:15.0685 0x0c38  [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr         C:\Windows\system32\drivers\partmgr.sys

09:29:15.0716 0x0c38  partmgr - ok

09:29:15.0747 0x0c38  [ DB2D62AA2DF6B1F3D690A9EC9701AA2C, BEAC55E1AA0494565F1547DF5E6FE20FCEA66461764C016FCB68D8BFF0F0C375 ] PcaSvc          C:\Windows\System32\pcasvc.dll

09:29:15.0794 0x0c38  PcaSvc - ok

09:29:15.0841 0x0c38  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci             C:\Windows\system32\drivers\pci.sys

09:29:15.0887 0x0c38  pci - ok

09:29:15.0919 0x0c38  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\Windows\system32\drivers\pciide.sys

09:29:15.0950 0x0c38  pciide - ok

09:29:15.0997 0x0c38  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys

09:29:16.0028 0x0c38  pcmcia - ok

09:29:16.0059 0x0c38  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw             C:\Windows\system32\drivers\pcw.sys

09:29:16.0090 0x0c38  pcw - ok

09:29:16.0153 0x0c38  [ 7CADB4ABAE72390951886CF259791F5F, 9A0F4113F4E09911A44843F31E8C7047EEA39611AB490A4CF16FAE9D95310076 ] PDFProFiltSrvPP C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe

09:29:16.0231 0x0c38  PDFProFiltSrvPP - ok

09:29:16.0277 0x0c38  [ ED6E75158D28D33A2E2A020AC5B2B59D, 0F364D9A88304C45F31318605C417A70A9D0E4CF087D73E949B42C12CC76CD6C ] PEAUTH          C:\Windows\system32\drivers\peauth.sys

09:29:16.0340 0x0c38  PEAUTH - ok

09:29:16.0402 0x0c38  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\Windows\SysWow64\perfhost.exe

09:29:16.0465 0x0c38  PerfHost - ok

09:29:16.0589 0x0c38  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla             C:\Windows\system32\pla.dll

09:29:16.0683 0x0c38  pla - ok

09:29:16.0745 0x0c38  [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll

09:29:16.0792 0x0c38  PlugPlay - ok

09:29:16.0823 0x0c38  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll

09:29:16.0870 0x0c38  PNRPAutoReg - ok

09:29:16.0901 0x0c38  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll

09:29:16.0948 0x0c38  PNRPsvc - ok

09:29:16.0979 0x0c38  [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll

09:29:17.0057 0x0c38  PolicyAgent - ok

09:29:17.0104 0x0c38  [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power           C:\Windows\system32\umpo.dll

09:29:17.0182 0x0c38  Power - ok

09:29:17.0213 0x0c38  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys

09:29:17.0260 0x0c38  PptpMiniport - ok

09:29:17.0291 0x0c38  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor       C:\Windows\system32\DRIVERS\processr.sys

09:29:17.0338 0x0c38  Processor - ok

09:29:17.0401 0x0c38  [ B6A58491307B4CADA572583D863DC602, 5C44936605E52C9533E4CE22F18FAB8211475877F71EFD88DA4D02FD608C90A3 ] ProfSvc         C:\Windows\system32\profsvc.dll

09:29:17.0432 0x0c38  ProfSvc - ok

09:29:17.0463 0x0c38  [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] ProtectedStorage C:\Windows\system32\lsass.exe

09:29:17.0494 0x0c38  ProtectedStorage - ok

09:29:17.0525 0x0c38  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys

09:29:17.0588 0x0c38  Psched - ok

09:29:17.0650 0x0c38  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys

09:29:17.0728 0x0c38  ql2300 - ok

09:29:17.0775 0x0c38  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys

09:29:17.0806 0x0c38  ql40xx - ok

09:29:17.0837 0x0c38  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE           C:\Windows\system32\qwave.dll

09:29:17.0884 0x0c38  QWAVE - ok

09:29:17.0900 0x0c38  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys

09:29:17.0947 0x0c38  QWAVEdrv - ok

09:29:17.0993 0x0c38  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys

09:29:18.0056 0x0c38  RasAcd - ok

09:29:18.0087 0x0c38  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys

09:29:18.0149 0x0c38  RasAgileVpn - ok

09:29:18.0165 0x0c38  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto         C:\Windows\System32\rasauto.dll

09:29:18.0243 0x0c38  RasAuto - ok

09:29:18.0290 0x0c38  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys

09:29:18.0352 0x0c38  Rasl2tp - ok

09:29:18.0415 0x0c38  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\Windows\System32\rasmans.dll

09:29:18.0461 0x0c38  RasMan - ok

09:29:18.0524 0x0c38  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys

09:29:18.0586 0x0c38  RasPppoe - ok

09:29:18.0617 0x0c38  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys

09:29:18.0680 0x0c38  RasSstp - ok

09:29:18.0711 0x0c38  [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys

09:29:18.0789 0x0c38  rdbss - ok

09:29:18.0836 0x0c38  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys

09:29:18.0898 0x0c38  rdpbus - ok

09:29:18.0929 0x0c38  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys

09:29:18.0992 0x0c38  RDPCDD - ok

09:29:19.0023 0x0c38  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys

09:29:19.0101 0x0c38  RDPENCDD - ok

09:29:19.0132 0x0c38  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys

09:29:19.0179 0x0c38  RDPREFMP - ok

09:29:19.0273 0x0c38  [ 313F68E1A3E6345A4F47A36B07062F34, B8318A0AE06BDE278931CA52F960B9FE226FD9894B076858DDB755AE26E1E66F ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys

09:29:19.0351 0x0c38  RdpVideoMiniport - ok

09:29:19.0382 0x0c38  [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys

09:29:19.0444 0x0c38  RDPWD - ok

09:29:19.0491 0x0c38  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys

09:29:19.0522 0x0c38  rdyboost - ok

09:29:19.0553 0x0c38  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\Windows\System32\mprdim.dll

09:29:19.0616 0x0c38  RemoteAccess - ok

09:29:19.0663 0x0c38  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\Windows\system32\regsvc.dll

09:29:19.0725 0x0c38  RemoteRegistry - ok

09:29:19.0772 0x0c38  [ 9C3AC71A9934B884FAC567A8807E9C4D, 0B6B2970098E3C21E1E54A25785544903E8CD415B527FCEF86ABC7B33BEC83E7 ] Revoflt         C:\Windows\system32\DRIVERS\revoflt.sys

09:29:19.0803 0x0c38  Revoflt - ok

09:29:19.0850 0x0c38  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll

09:29:19.0897 0x0c38  RpcEptMapper - ok

09:29:19.0928 0x0c38  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\Windows\system32\locator.exe

09:29:19.0959 0x0c38  RpcLocator - ok

09:29:20.0006 0x0c38  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs           C:\Windows\system32\rpcss.dll

09:29:20.0068 0x0c38  RpcSs - ok

09:29:20.0115 0x0c38  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys

09:29:20.0177 0x0c38  rspndr - ok

09:29:20.0240 0x0c38  [ F65F171165FBB613F7AA3CC78E8CAB42, 9F1503372D2D1225DD057FA0C442B76DAC17007556D8C8AF70ED9BA0B4F45556 ] RTL8167         C:\Windows\system32\DRIVERS\Rt64win7.sys

09:29:20.0287 0x0c38  RTL8167 - ok

09:29:20.0302 0x0c38  [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] SamSs           C:\Windows\system32\lsass.exe

09:29:20.0333 0x0c38  SamSs - ok

09:29:20.0380 0x0c38  SANDRA - ok

09:29:20.0411 0x0c38  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys

09:29:20.0443 0x0c38  sbp2port - ok

09:29:20.0489 0x0c38  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\Windows\System32\SCardSvr.dll

09:29:20.0552 0x0c38  SCardSvr - ok

09:29:20.0583 0x0c38  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys

09:29:20.0645 0x0c38  scfilter - ok

09:29:20.0708 0x0c38  [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule        C:\Windows\system32\schedsvc.dll

09:29:20.0817 0x0c38  Schedule - ok

09:29:20.0848 0x0c38  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc     C:\Windows\System32\certprop.dll

09:29:20.0895 0x0c38  SCPolicySvc - ok

09:29:20.0942 0x0c38  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\Windows\System32\SDRSVC.dll

09:29:20.0973 0x0c38  SDRSVC - ok

09:29:21.0020 0x0c38  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys

09:29:21.0098 0x0c38  secdrv - ok

09:29:21.0129 0x0c38  [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon        C:\Windows\system32\seclogon.dll

09:29:21.0176 0x0c38  seclogon - ok

09:29:21.0207 0x0c38  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\Windows\System32\sens.dll

09:29:21.0285 0x0c38  SENS - ok

09:29:21.0316 0x0c38  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\Windows\system32\sensrsvc.dll

09:29:21.0347 0x0c38  SensrSvc - ok

09:29:21.0379 0x0c38  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys

09:29:21.0410 0x0c38  Serenum - ok

09:29:21.0441 0x0c38  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\Windows\system32\DRIVERS\serial.sys

09:29:21.0488 0x0c38  Serial - ok

09:29:21.0519 0x0c38  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys

09:29:21.0550 0x0c38  sermouse - ok

09:29:21.0613 0x0c38  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\Windows\system32\sessenv.dll

09:29:21.0659 0x0c38  SessionEnv - ok

09:29:21.0706 0x0c38  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys

09:29:21.0737 0x0c38  sffdisk - ok

09:29:21.0753 0x0c38  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys

09:29:21.0800 0x0c38  sffp_mmc - ok

09:29:21.0815 0x0c38  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys

09:29:21.0862 0x0c38  sffp_sd - ok

09:29:21.0909 0x0c38  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys

09:29:21.0940 0x0c38  sfloppy - ok

09:29:21.0987 0x0c38  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\Windows\System32\ipnathlp.dll

09:29:22.0065 0x0c38  SharedAccess - ok

09:29:22.0112 0x0c38  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll

09:29:22.0174 0x0c38  ShellHWDetection - ok

09:29:22.0205 0x0c38  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys

09:29:22.0237 0x0c38  SiSRaid2 - ok

09:29:22.0268 0x0c38  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys

09:29:22.0299 0x0c38  SiSRaid4 - ok

09:29:22.0346 0x0c38  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb             C:\Windows\system32\DRIVERS\smb.sys

09:29:22.0393 0x0c38  Smb - ok

09:29:22.0471 0x0c38  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe

09:29:22.0517 0x0c38  SNMPTRAP - ok

09:29:22.0564 0x0c38  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr           C:\Windows\system32\drivers\spldr.sys

09:29:22.0595 0x0c38  spldr - ok

09:29:22.0627 0x0c38  [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler         C:\Windows\System32\spoolsv.exe

09:29:22.0689 0x0c38  Spooler - ok

09:29:22.0829 0x0c38  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\Windows\system32\sppsvc.exe

09:29:23.0032 0x0c38  sppsvc - ok

09:29:23.0079 0x0c38  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify     C:\Windows\system32\sppuinotify.dll

09:29:23.0157 0x0c38  sppuinotify - ok

09:29:23.0204 0x0c38  [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv             C:\Windows\system32\DRIVERS\srv.sys

09:29:23.0251 0x0c38  srv - ok

09:29:23.0297 0x0c38  [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys

09:29:23.0344 0x0c38  srv2 - ok

09:29:23.0375 0x0c38  [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys

09:29:23.0422 0x0c38  srvnet - ok

09:29:23.0485 0x0c38  [ 8F8324ED1DE63FFC7B1A02CD2D963C72, E58603F81DEAFF1D45CB83FB6E625E6A13868741B833B1C9E60D672179D18EE0 ] ssadbus         C:\Windows\system32\DRIVERS\ssadbus.sys

09:29:23.0531 0x0c38  ssadbus - ok

09:29:23.0578 0x0c38  [ 58221EFCB74167B73667F0024C661CE0, D9B67A8897B4DC3E4729187F17ABEB4710CF57440D718E17ED828439198D34DB ] ssadmdfl        C:\Windows\system32\DRIVERS\ssadmdfl.sys

09:29:23.0625 0x0c38  ssadmdfl - ok

09:29:23.0656 0x0c38  [ 4DA7C71BFAC5AD71255B7E4CAB980163, 4CC0F9C8E96ECEF36EEB021E448A9734B63512D030516DC38B1A2EEAA1043AEC ] ssadmdm         C:\Windows\system32\DRIVERS\ssadmdm.sys

09:29:23.0719 0x0c38  ssadmdm - ok

09:29:23.0765 0x0c38  [ D33D1BD3EC0E766211A234F56A12726D, 53EEAA94865554F8422D111D717B548DF553B5B8647D2A45F3718BF4AEEBEC27 ] ssadserd        C:\Windows\system32\DRIVERS\ssadserd.sys

09:29:23.0812 0x0c38  ssadserd - ok

09:29:23.0859 0x0c38  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll

09:29:23.0921 0x0c38  SSDPSRV - ok

09:29:23.0953 0x0c38  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc         C:\Windows\system32\sstpsvc.dll

09:29:24.0015 0x0c38  SstpSvc - ok

09:29:24.0046 0x0c38  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys

09:29:24.0077 0x0c38  stexstor - ok

09:29:24.0140 0x0c38  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\Windows\System32\wiaservc.dll

09:29:24.0202 0x0c38  stisvc - ok

09:29:24.0249 0x0c38  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\Windows\system32\drivers\swenum.sys

09:29:24.0265 0x0c38  swenum - ok

09:29:24.0311 0x0c38  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv           C:\Windows\System32\swprv.dll

09:29:24.0374 0x0c38  swprv - ok

09:29:24.0452 0x0c38  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain         C:\Windows\system32\sysmain.dll

09:29:24.0577 0x0c38  SysMain - ok

09:29:24.0623 0x0c38  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll

09:29:24.0670 0x0c38  TabletInputService - ok

09:29:24.0701 0x0c38  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv         C:\Windows\System32\tapisrv.dll

09:29:24.0779 0x0c38  TapiSrv - ok

09:29:24.0811 0x0c38  [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS             C:\Windows\System32\tbssvc.dll

09:29:24.0889 0x0c38  TBS - ok

09:29:24.0982 0x0c38  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys

09:29:25.0076 0x0c38  Tcpip - ok

09:29:25.0169 0x0c38  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys

09:29:25.0247 0x0c38  TCPIP6 - ok

09:29:25.0279 0x0c38  [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys

09:29:25.0325 0x0c38  tcpipreg - ok

09:29:25.0372 0x0c38  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys

09:29:25.0403 0x0c38  TDPIPE - ok

09:29:25.0435 0x0c38  [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys

09:29:25.0466 0x0c38  TDTCP - ok

09:29:25.0513 0x0c38  [ 70988118145F5F10EF24720B97F35F65, F80C806417A68047FFB3D63214BC4AE5445315219AC594E043293006B704A63D ] tdx             C:\Windows\system32\DRIVERS\tdx.sys

09:29:25.0559 0x0c38  tdx - ok

09:29:25.0591 0x0c38  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\Windows\system32\drivers\termdd.sys

09:29:25.0622 0x0c38  TermDD - ok

09:29:25.0669 0x0c38  [ 008CD4EBFABCF78D0F19B3778492648C, 9050490EEE0AD86E73F0A82D83E4FC29DF84F6B6FDB389AE135FD712B5F425BE ] TermService     C:\Windows\System32\termsrv.dll

09:29:25.0731 0x0c38  TermService - ok

09:29:25.0762 0x0c38  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\Windows\system32\themeservice.dll

09:29:25.0809 0x0c38  Themes - ok

09:29:25.0840 0x0c38  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER     C:\Windows\system32\mmcss.dll

09:29:25.0903 0x0c38  THREADORDER - ok

09:29:25.0918 0x0c38  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\Windows\System32\trkwks.dll

09:29:25.0965 0x0c38  TrkWks - ok

09:29:26.0012 0x0c38  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe

09:29:26.0090 0x0c38  TrustedInstaller - ok

09:29:26.0152 0x0c38  [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys

09:29:26.0183 0x0c38  tssecsrv - ok

09:29:26.0215 0x0c38  [ E9981ECE8D894CEF7038FD1D040EB426, DCDDCE933CAECE8180A3447199B07F2F0413704EEC1A09606EE357901A84A7CF ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys

09:29:26.0261 0x0c38  TsUsbFlt - ok

09:29:26.0324 0x0c38  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys

09:29:26.0371 0x0c38  tunnel - ok

09:29:26.0402 0x0c38  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys

09:29:26.0433 0x0c38  uagp35 - ok

09:29:26.0480 0x0c38  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys

09:29:26.0542 0x0c38  udfs - ok

09:29:26.0605 0x0c38  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect       C:\Windows\system32\UI0Detect.exe

09:29:26.0651 0x0c38  UI0Detect - ok

09:29:26.0698 0x0c38  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys

09:29:26.0729 0x0c38  uliagpkx - ok

09:29:26.0776 0x0c38  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus           C:\Windows\system32\drivers\umbus.sys

09:29:26.0807 0x0c38  umbus - ok

09:29:26.0839 0x0c38  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys

09:29:26.0885 0x0c38  UmPass - ok

09:29:26.0932 0x0c38  [ 9DC07E73A4ABB9ACF692113B36A5009F, CA7176FC219515D58DCFA66EC61880ECE5617275C9B83701BB74D8B60E733D34 ] UnlockerDriver5 C:\Program Files (x86)\Unlocker\UnlockerDriver5.sys

09:29:26.0963 0x0c38  UnlockerDriver5 - ok

09:29:27.0010 0x0c38  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\Windows\System32\upnphost.dll

09:29:27.0073 0x0c38  upnphost - ok

09:29:27.0104 0x0c38  [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys

09:29:27.0151 0x0c38  usbccgp - ok

09:29:27.0197 0x0c38  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir          C:\Windows\system32\drivers\usbcir.sys

09:29:27.0244 0x0c38  usbcir - ok

09:29:27.0291 0x0c38  [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys

09:29:27.0338 0x0c38  usbehci - ok

09:29:27.0385 0x0c38  [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys

09:29:27.0431 0x0c38  usbhub - ok

09:29:27.0478 0x0c38  [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci         C:\Windows\system32\drivers\usbohci.sys

09:29:27.0525 0x0c38  usbohci - ok

09:29:27.0572 0x0c38  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys

09:29:27.0619 0x0c38  usbprint - ok

09:29:27.0665 0x0c38  [ 9661DA76B4531B2DA272ECCE25A8AF24, FEA93254A21E71A7EB8AD35FCCAD2C1E41F7329EC33B1734F5B41307A34D8637 ] usbscan         C:\Windows\system32\DRIVERS\usbscan.sys

09:29:27.0712 0x0c38  usbscan - ok

09:29:27.0743 0x0c38  [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS

09:29:27.0790 0x0c38  USBSTOR - ok

09:29:27.0837 0x0c38  [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci         C:\Windows\system32\DRIVERS\usbuhci.sys

09:29:27.0868 0x0c38  usbuhci - ok

09:29:27.0884 0x0c38  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms           C:\Windows\System32\uxsms.dll

09:29:27.0946 0x0c38  UxSms - ok

09:29:27.0977 0x0c38  [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] VaultSvc        C:\Windows\system32\lsass.exe

09:29:28.0009 0x0c38  VaultSvc - ok

09:29:28.0055 0x0c38  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys

09:29:28.0071 0x0c38  vdrvroot - ok

09:29:28.0133 0x0c38  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds             C:\Windows\System32\vds.exe

09:29:28.0211 0x0c38  vds - ok

09:29:28.0258 0x0c38  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys

09:29:28.0305 0x0c38  vga - ok

09:29:28.0336 0x0c38  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave         C:\Windows\System32\drivers\vga.sys

09:29:28.0383 0x0c38  VgaSave - ok

09:29:28.0430 0x0c38  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys

09:29:28.0461 0x0c38  vhdmp - ok

09:29:28.0508 0x0c38  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\Windows\system32\drivers\viaide.sys

09:29:28.0539 0x0c38  viaide - ok

09:29:28.0570 0x0c38  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\Windows\system32\drivers\volmgr.sys

09:29:28.0601 0x0c38  volmgr - ok

09:29:28.0648 0x0c38  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys

09:29:28.0679 0x0c38  volmgrx - ok

09:29:28.0726 0x0c38  [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap         C:\Windows\system32\drivers\volsnap.sys

09:29:28.0757 0x0c38  volsnap - ok

09:29:28.0804 0x0c38  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys

09:29:28.0851 0x0c38  vsmraid - ok

09:29:28.0929 0x0c38  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS             C:\Windows\system32\vssvc.exe

09:29:29.0023 0x0c38  VSS - ok

09:29:29.0069 0x0c38  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys

09:29:29.0116 0x0c38  vwifibus - ok

09:29:29.0163 0x0c38  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time         C:\Windows\system32\w32time.dll

09:29:29.0241 0x0c38  W32Time - ok

09:29:29.0288 0x0c38  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys

09:29:29.0319 0x0c38  WacomPen - ok

09:29:29.0366 0x0c38  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys

09:29:29.0444 0x0c38  WANARP - ok

09:29:29.0475 0x0c38  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys

09:29:29.0522 0x0c38  Wanarpv6 - ok

09:29:29.0615 0x0c38  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\Windows\system32\wbengine.exe

09:29:29.0709 0x0c38  wbengine - ok

09:29:29.0771 0x0c38  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll

09:29:29.0803 0x0c38  WbioSrvc - ok

09:29:29.0849 0x0c38  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc         C:\Windows\System32\wcncsvc.dll

09:29:29.0912 0x0c38  wcncsvc - ok

09:29:29.0959 0x0c38  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll

09:29:30.0005 0x0c38  WcsPlugInService - ok

09:29:30.0052 0x0c38  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\Windows\system32\DRIVERS\wd.sys

09:29:30.0083 0x0c38  Wd - ok

09:29:30.0130 0x0c38  [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys

09:29:30.0177 0x0c38  Wdf01000 - ok

09:29:30.0224 0x0c38  [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiServiceHost  C:\Windows\system32\wdi.dll

09:29:30.0271 0x0c38  WdiServiceHost - ok

09:29:30.0302 0x0c38  [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiSystemHost   C:\Windows\system32\wdi.dll

09:29:30.0333 0x0c38  WdiSystemHost - ok

09:29:30.0364 0x0c38  [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient       C:\Windows\System32\webclnt.dll

09:29:30.0427 0x0c38  WebClient - ok

09:29:30.0458 0x0c38  [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc          C:\Windows\system32\wecsvc.dll

09:29:30.0520 0x0c38  Wecsvc - ok

09:29:30.0551 0x0c38  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport   C:\Windows\System32\wercplsupport.dll

09:29:30.0614 0x0c38  wercplsupport - ok

09:29:30.0676 0x0c38  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\Windows\System32\WerSvc.dll

09:29:30.0754 0x0c38  WerSvc - ok

09:29:30.0785 0x0c38  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys

09:29:30.0832 0x0c38  WfpLwf - ok

09:29:30.0879 0x0c38  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys

09:29:30.0895 0x0c38  WIMMount - ok

09:29:30.0941 0x0c38  WinDefend - ok

09:29:30.0973 0x0c38  WinHttpAutoProxySvc - ok

09:29:31.0051 0x0c38  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll

09:29:31.0129 0x0c38  Winmgmt - ok

09:29:31.0207 0x0c38  [ D929ABD465A2DED963DA8B30946A8D5C, DE8DBFB01C11D2AE903CBD6A974D6F995E9813CE2D6484B7DA06EAE4C545842A ] WinRM           C:\Windows\system32\WsmSvc.dll

09:29:31.0331 0x0c38  WinRM - ok

09:29:31.0441 0x0c38  [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb          C:\Windows\system32\drivers\WinUsb.sys

09:29:31.0503 0x0c38  WinUsb - ok

09:29:31.0565 0x0c38  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc         C:\Windows\System32\wlansvc.dll

09:29:31.0643 0x0c38  Wlansvc - ok

09:29:31.0799 0x0c38  [ 357CABBF155AFD1D3926E62539D2A3A7, C43CFF84E7D930B4999DC061AB0766B57AAD7540B3E6EE54605B10ECE90825F5 ] wlidsvc         C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

09:29:31.0877 0x0c38  wlidsvc - ok

09:29:31.0924 0x0c38  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys

09:29:31.0955 0x0c38  WmiAcpi - ok

09:29:32.0002 0x0c38  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe

09:29:32.0065 0x0c38  wmiApSrv - ok

09:29:32.0096 0x0c38  WMPNetworkSvc - ok

09:29:32.0127 0x0c38  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\Windows\System32\wpcsvc.dll

09:29:32.0174 0x0c38  WPCSvc - ok

09:29:32.0221 0x0c38  [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll

09:29:32.0267 0x0c38  WPDBusEnum - ok

09:29:32.0299 0x0c38  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys

09:29:32.0361 0x0c38  ws2ifsl - ok

09:29:32.0408 0x0c38  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\Windows\System32\wscsvc.dll

09:29:32.0439 0x0c38  wscsvc - ok

09:29:32.0455 0x0c38  WSearch - ok

09:29:32.0579 0x0c38  [ 0814A74C853F50B354F08F83DDA9F7FB, 0A63BAA8DE451B8C2C71FEF961718E769B9BAC305C76D24048C664CB27D0DF28 ] wuauserv        C:\Windows\system32\wuaueng.dll

09:29:32.0735 0x0c38  wuauserv - ok

09:29:32.0798 0x0c38  [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys

09:29:32.0845 0x0c38  WudfPf - ok

09:29:32.0907 0x0c38  [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd          C:\Windows\system32\drivers\WUDFRd.sys

09:29:32.0954 0x0c38  WUDFRd - ok

09:29:32.0985 0x0c38  [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll

09:29:33.0032 0x0c38  wudfsvc - ok

09:29:33.0094 0x0c38  [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc         C:\Windows\System32\wwansvc.dll

09:29:33.0141 0x0c38  WwanSvc - ok

09:29:33.0172 0x0c38  ================ Scan global ===============================

09:29:33.0203 0x0c38  [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll

09:29:33.0235 0x0c38  [ D17DD01601460F5899E5C154B3FD0BFA, B2FCFDE4B6F87634EA1F6D8AEA6D9B3C641D41D999C68B76F95491539B19D422 ] C:\Windows\system32\winsrv.dll

09:29:33.0250 0x0c38  [ D17DD01601460F5899E5C154B3FD0BFA, B2FCFDE4B6F87634EA1F6D8AEA6D9B3C641D41D999C68B76F95491539B19D422 ] C:\Windows\system32\winsrv.dll

09:29:33.0297 0x0c38  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll

09:29:33.0328 0x0c38  [ 71C85477DF9347FE8E7BC55768473FCA, A86D6A6D1F5A0EFCD649792A06F3AE9B37158D48493D2ECA7F52DCC1CB9B6536 ] C:\Windows\system32\services.exe

09:29:33.0328 0x0c38  [ Global ] - ok

09:29:33.0328 0x0c38  ================ Scan MBR ==================================

09:29:33.0359 0x0c38  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0

09:29:33.0671 0x0c38  \Device\Harddisk0\DR0 - ok

09:29:33.0671 0x0c38  ================ Scan VBR ==================================

09:29:33.0671 0x0c38  [ 5E62F87F964BE1122AAF274369093795 ] \Device\Harddisk0\DR0\Partition1

09:29:33.0671 0x0c38  \Device\Harddisk0\DR0\Partition1 - ok

09:29:33.0703 0x0c38  [ 59184C30F3060DD278B0A37D89A295B6 ] \Device\Harddisk0\DR0\Partition2

09:29:33.0703 0x0c38  \Device\Harddisk0\DR0\Partition2 - ok

09:29:33.0703 0x0c38  [ B686D8C73A8F7D765DF9E1C3B3772B21 ] \Device\Harddisk0\DR0\Partition3

09:29:33.0749 0x0c38  \Device\Harddisk0\DR0\Partition3 - ok

09:29:33.0749 0x0c38  ================ Scan generic autorun ======================

09:29:33.0781 0x0c38  [ 92FDB0658CA16974B4AE80E248A5B118, 9E0CF6A9C845C5F9E4B80B9105DBECE15ACC27984FCBFD8774C00EBE20DB652F ] C:\Windows\system32\igfxtray.exe

09:29:33.0827 0x0c38  IgfxTray - ok

09:29:34.0155 0x0c38  [ 65C6AA484AD2287D20541C7735989437, 1842787640391F4A4CD9ED0A531298A61F4B2FB09BEC98FEE256313AFB458EDB ] C:\Program Files (x86)\AVAST Software\Avast\AvastUI.exe

09:29:34.0311 0x0c38  AvastUI.exe - ok

09:29:34.0576 0x0c38  [ 8FB1A3AB319F21CC8DB34198CB4A88E7, 2009DF76EF8356BCC1CA530CE8E1687B02C779CA51BCFDDFD7372E2E4CD19470 ] c:\program files (x86)\emsisoft anti-malware\a2guard.exe

09:29:34.0717 0x0c38  emsisoft anti-malware - ok

09:29:34.0795 0x0c38  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe

09:29:34.0857 0x0c38  Sidebar - ok

09:29:34.0904 0x0c38  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe

09:29:34.0951 0x0c38  mctadmin - ok

09:29:34.0997 0x0c38  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe

09:29:35.0060 0x0c38  Sidebar - ok

09:29:35.0060 0x0c38  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe

09:29:35.0107 0x0c38  mctadmin - ok

09:29:35.0107 0x0c38  Waiting for KSN requests completion. In queue: 306

09:29:36.0121 0x0c38  Waiting for KSN requests completion. In queue: 306

09:29:37.0135 0x0c38  Waiting for KSN requests completion. In queue: 306

09:29:38.0258 0x0c38  AV detected via SS2: avast! Antivirus, C:\Program Files (x86)\AVAST Software\Avast\VisthAux.exe ( 10.2.2218.942 ), 0x41000 ( enabled : updated )

09:29:38.0305 0x0c38  Win FW state via NFP2: enabled

09:29:40.0785 0x0c38  ============================================================

09:29:40.0785 0x0c38  Scan finished

09:29:40.0785 0x0c38  ============================================================

09:29:40.0801 0x00b0  Detected object count: 0

09:29:40.0801 0x00b0  Actual detected object count: 0

Danke und Gruß,
der PC Knecht

schrauber

05.06.2015 19:44

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

PC_Knecht

06.06.2015 11:35

Hallo, hier der log-file vom ComboFix

Beim Start von ComboFix wurde angemeckert, dass AVIRA noch aktiviert wäre, obwohl ich alle Funktionen vorher deaktiviert habe. Also bin ich nochmal in AVIRA rein und hab alles abgeschaltet, was abzuschalten geht. Ich hoffe, das Ergebnis ist nun nicht zu sehr verfälscht.

Code:

ComboFix 15-05-31.01 - Eltern 06.06.2015  12:07:38.1.2 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3062.1195 [GMT 2:00]

ausgeführt von:: c:\users\Eltern\Desktop\ComboFix.exe

AV: avast! Antivirus *Enabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}

SP: avast! Antivirus *Enabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files (x86)\7z.exe

c:\program files (x86)\CDex-win32-1.70-b4-2009.exe

c:\program files (x86)\forge-1.7.10-10.13.2.1230-installer-win.exe

c:\program files (x86)\mbam-setup-2.1.6.1022.exe

c:\program files (x86)\readme.txt

.

.

(((((((((((((((((((((((   Dateien erstellt von 2015-05-06 bis 2015-06-06  ))))))))))))))))))))))))))))))

.

.

2015-06-06 10:20 . 2015-06-06 10:20        --------        d-----w-        c:\users\Default\AppData\Local\temp

2015-06-06 10:11 . 2015-06-06 10:11        75888        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{0FF0215B-981F-41A8-A1AE-832EE26D0475}\offreg.3600.dll

2015-06-05 11:59 . 2015-05-03 03:16        12214312        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{0FF0215B-981F-41A8-A1AE-832EE26D0475}\mpengine.dll

2015-06-05 06:37 . 2015-06-05 07:23        --------        d-----w-        c:\programdata\Malwarebytes' Anti-Malware (portable)

2015-06-02 17:06 . 2015-06-02 17:06        --------        d-----w-        c:\program files (x86)\ESET

2015-06-02 15:09 . 2015-06-02 15:12        --------        d-----w-        C:\FRST

2015-06-02 12:26 . 2015-06-02 12:26        --------        d-----w-        c:\users\Eltern\AppData\Local\GWX

2015-06-01 17:21 . 2009-08-18 09:44        67584        ----a-w-        c:\windows\system32\RtNicProp64.dll

2015-06-01 17:21 . 2009-08-18 09:44        236544        ----a-w-        c:\windows\system32\drivers\Rt64win7.sys

2015-06-01 17:21 . 2009-07-22 16:24        97792        ----a-w-        c:\windows\system32\RTNUninst64.dll

2015-06-01 17:21 . 2015-06-01 17:21        --------        d-----w-        c:\program files (x86)\Realtek

2015-05-27 10:08 . 2015-05-28 15:09        --------        d-----w-        c:\program files (x86)\Mozilla Thunderbird

2015-05-27 09:25 . 2015-05-27 09:25        --------        d-----w-        c:\users\Eltern\AppData\Local\VS Revo Group

2015-05-27 09:25 . 2015-05-27 09:25        --------        d-----w-        c:\programdata\VS Revo Group

2015-05-27 09:25 . 2009-12-30 08:21        31800        ----a-w-        c:\windows\system32\drivers\revoflt.sys

2015-05-27 09:25 . 2015-05-27 09:25        --------        d-----w-        c:\program files\VS Revo Group

2015-05-26 06:44 . 2015-05-26 06:44        --------        d-----w-        c:\program files\avast software

2015-05-20 15:31 . 2015-01-31 03:48        3179520        ----a-w-        c:\windows\system32\rdpcorets.dll

2015-05-20 15:31 . 2015-01-31 03:48        16384        ----a-w-        c:\windows\system32\RdpGroupPolicyExtension.dll

2015-05-20 15:31 . 2015-01-30 23:56        243200        ----a-w-        c:\windows\system32\rdpudd.dll

2015-05-20 15:30 . 2014-12-11 17:47        87040        ----a-w-        c:\windows\system32\TSWbPrxy.exe

2015-05-19 18:02 . 2014-09-05 01:52        5703168        ----a-w-        c:\windows\SysWow64\mstscax.dll

2015-05-19 18:01 . 2014-09-05 02:11        6584320        ----a-w-        c:\windows\system32\mstscax.dll

2015-05-17 17:29 . 2015-05-17 17:29        --------        d-----w-        c:\programdata\Emsisoft

2015-05-17 17:11 . 2015-03-23 22:17        135800        ----a-w-        c:\windows\system32\drivers\epp64.sys

2015-05-17 17:11 . 2015-06-06 09:59        --------        d-----w-        c:\program files (x86)\Emsisoft Anti-Malware

2015-05-17 13:55 . 2012-08-23 14:10        19456        ----a-w-        c:\windows\system32\drivers\rdpvideominiport.sys

2015-05-17 13:55 . 2012-08-23 11:12        192000        ----a-w-        c:\windows\SysWow64\rdpendp_winip.dll

2015-05-17 13:55 . 2012-08-23 10:51        228864        ----a-w-        c:\windows\system32\rdpendp_winip.dll

2015-05-17 13:54 . 2015-03-14 03:21        82944        ----a-w-        c:\windows\system32\dwmapi.dll

2015-05-17 13:54 . 2015-03-14 03:21        1632768        ----a-w-        c:\windows\system32\dwmcore.dll

2015-05-17 13:54 . 2015-03-14 03:04        67584        ----a-w-        c:\windows\SysWow64\dwmapi.dll

2015-05-17 13:54 . 2015-03-14 03:04        1372160        ----a-w-        c:\windows\SysWow64\dwmcore.dll

2015-05-13 06:28 . 2015-05-01 13:17        124112        ----a-w-        c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll

2015-05-13 06:28 . 2015-05-01 13:16        102608        ----a-w-        c:\windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll

2015-05-13 06:18 . 2015-04-13 03:28        328704        ----a-w-        c:\windows\system32\services.exe

2015-05-13 06:17 . 2015-04-20 03:17        1647104        ----a-w-        c:\windows\system32\DWrite.dll

2015-05-10 14:11 . 2015-05-10 14:11        --------        d-----w-        c:\program files (x86)\PDF24

2015-05-10 14:08 . 2015-05-10 14:08        16342352        ----a-w-        c:\program files (x86)\pdf24-creator-6.9.2.exe

2015-05-10 14:06 . 2015-05-10 14:06        --------        d-----w-        c:\program files (x86)\Common Files\PDF Architect

2015-05-10 12:47 . 2015-05-10 13:06        --------        d-----w-        c:\program files (x86)\Unlocker

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2015-06-06 09:54 . 2015-04-26 12:00        136408        ----a-w-        c:\windows\system32\drivers\MBAMSwissArmy.sys

2015-06-05 06:34 . 2015-04-26 12:00        107736        ----a-w-        c:\windows\system32\drivers\mbamchameleon.sys

2015-05-13 06:32 . 2013-10-18 18:38        140425016        ----a-w-        c:\windows\system32\MRT.exe

2015-05-13 05:57 . 2015-02-04 17:56        778416        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2015-05-13 05:57 . 2015-02-04 17:56        142512        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2015-05-04 16:49 . 2015-05-04 16:48        10457912        ----a-w-        c:\program files (x86)\CMASetup.exe

2015-05-04 11:46 . 2015-04-26 14:08        137288        ----a-w-        c:\windows\system32\drivers\aswStm.sys

2015-05-04 11:46 . 2015-04-26 14:08        272248        ----a-w-        c:\windows\system32\drivers\aswVmm.sys

2015-05-04 11:46 . 2015-05-04 11:46        364472        ----a-w-        c:\windows\system32\aswBoot.exe

2015-05-04 11:46 . 2015-04-26 14:08        89944        ----a-w-        c:\windows\system32\drivers\aswMonFlt.sys

2015-05-04 11:46 . 2015-04-26 14:08        65736        ----a-w-        c:\windows\system32\drivers\aswRvrt.sys

2015-05-04 11:46 . 2015-04-26 14:08        442264        ----a-w-        c:\windows\system32\drivers\aswSP.sys

2015-05-04 11:46 . 2015-04-26 14:08        29168        ----a-w-        c:\windows\system32\drivers\aswHwid.sys

2015-05-04 11:46 . 2015-04-26 14:08        93528        ----a-w-        c:\windows\system32\drivers\aswRdr2.sys

2015-05-04 11:45 . 2015-05-04 11:45        43112        ----a-w-        c:\windows\avastSS.scr

2015-05-04 11:45 . 2015-04-26 14:08        1047320        ----a-w-        c:\windows\system32\drivers\aswSnx.sys

2015-04-27 19:04 . 2015-05-13 06:18        44032        ----a-w-        c:\windows\apppatch\acwow64.dll

2015-04-20 16:03 . 2015-04-20 15:59        190719264        ----a-w-        c:\program files (x86)\DraftSight64.exe

2015-04-19 17:39 . 2015-04-19 17:39        35344        ----a-w-        c:\windows\cc_20150419_193841_reg_datei.reg

2015-04-14 07:37 . 2015-04-26 12:00        63704        ----a-w-        c:\windows\system32\drivers\mwac.sys

2015-04-14 07:37 . 2015-04-26 12:00        25816        ----a-w-        c:\windows\system32\drivers\mbam.sys

2015-03-25 03:24 . 2015-04-15 14:54        98304        ----a-w-        c:\windows\system32\wudriver.dll

2015-03-25 03:24 . 2015-04-15 14:54        37376        ----a-w-        c:\windows\system32\wups2.dll

2015-03-25 03:24 . 2015-04-15 14:54        35328        ----a-w-        c:\windows\system32\wups.dll

2015-03-25 03:24 . 2015-04-15 14:54        3298816        ----a-w-        c:\windows\system32\wucltux.dll

2015-03-25 03:24 . 2015-04-15 14:54        2553856        ----a-w-        c:\windows\system32\wuaueng.dll

2015-03-25 03:24 . 2015-04-15 14:54        191488        ----a-w-        c:\windows\system32\wuwebv.dll

2015-03-25 03:24 . 2015-04-15 14:54        696320        ----a-w-        c:\windows\system32\wuapi.dll

2015-03-25 03:24 . 2015-04-15 14:54        60416        ----a-w-        c:\windows\system32\WinSetupUI.dll

2015-03-25 03:23 . 2015-04-15 14:54        12288        ----a-w-        c:\windows\system32\wu.upgrade.ps.dll

2015-03-25 03:23 . 2015-04-15 14:54        36864        ----a-w-        c:\windows\system32\wuapp.exe

2015-03-25 03:23 . 2015-04-15 14:54        135168        ----a-w-        c:\windows\system32\wuauclt.exe

2015-03-25 03:00 . 2015-04-15 14:54        92672        ----a-w-        c:\windows\SysWow64\wudriver.dll

2015-03-25 03:00 . 2015-04-15 14:54        566784        ----a-w-        c:\windows\SysWow64\wuapi.dll

2015-03-25 03:00 . 2015-04-15 14:54        29696        ----a-w-        c:\windows\SysWow64\wups.dll

2015-03-25 03:00 . 2015-04-15 14:54        173056        ----a-w-        c:\windows\SysWow64\wuwebv.dll

2015-03-25 03:00 . 2015-04-15 14:54        33792        ----a-w-        c:\windows\SysWow64\wuapp.exe

2015-03-23 03:25 . 2015-04-15 14:54        726528        ----a-w-        c:\windows\system32\generaltel.dll

2015-03-23 03:25 . 2015-04-15 14:54        769536        ----a-w-        c:\windows\system32\invagent.dll

2015-03-23 03:24 . 2015-04-15 14:54        419840        ----a-w-        c:\windows\system32\devinv.dll

2015-03-23 03:24 . 2015-04-15 14:54        957952        ----a-w-        c:\windows\system32\appraiser.dll

2015-03-23 03:24 . 2015-04-15 14:54        30720        ----a-w-        c:\windows\system32\acmigration.dll

2015-03-23 03:24 . 2015-04-15 14:54        227328        ----a-w-        c:\windows\system32\aepdu.dll

2015-03-23 03:24 . 2015-04-15 14:54        192000        ----a-w-        c:\windows\system32\aepic.dll

2015-03-23 03:17 . 2015-04-15 14:54        1111552        ----a-w-        c:\windows\system32\aeinv.dll

2015-03-10 03:25 . 2015-04-15 14:54        1882624        ----a-w-        c:\windows\system32\msxml3.dll

2015-03-10 03:21 . 2015-04-15 14:54        2048        ----a-w-        c:\windows\system32\msxml3r.dll

2015-03-10 03:08 . 2015-04-15 14:54        1237504        ----a-w-        c:\windows\SysWow64\msxml3.dll

2015-03-10 03:05 . 2015-04-15 14:54        2048        ----a-w-        c:\windows\SysWow64\msxml3r.dll

2015-01-03 10:29 . 2015-01-03 10:26        91670064        ----a-w-        c:\program files (x86)\gimp-2.8.14-setup.exe

2014-12-26 16:06 . 2014-12-26 16:06        181760        ----a-w-        c:\program files (x86)\7z.sfx

2014-12-26 16:06 . 2014-12-26 16:06        166400        ----a-w-        c:\program files (x86)\7zCon.sfx

2014-12-26 16:00 . 2014-12-26 16:00        1508352        ----a-w-        c:\program files (x86)\7z.dll

2014-12-26 15:50 . 2014-12-26 15:50        545792        ----a-w-        c:\program files (x86)\7zG.exe

2014-12-26 15:50 . 2014-12-26 15:50        803328        ----a-w-        c:\program files (x86)\7zFM.exe

2014-12-26 15:48 . 2014-12-26 15:48        80384        ----a-w-        c:\program files (x86)\7-zip.dll

2014-12-26 15:48 . 2014-12-26 15:48        50176        ----a-w-        c:\program files (x86)\7-zip32.dll

2014-11-07 11:28 . 2014-11-07 11:28        12436848        ----a-w-        c:\program files (x86)\CitrixOnlinePluginWeb.exe

2014-08-22 06:11 . 2014-08-22 06:08        149527616        ----a-w-        c:\program files (x86)\avira_free_antivirus_de_14.0.6.570.exe

2014-08-04 13:16 . 2014-08-04 13:16        10410712        ----a-w-        c:\program files\CMASetup.exe

2014-02-17 18:22 . 2014-02-17 18:22        774144        ----a-w-        c:\program files\NBTExplorer-2.7.0.msi

2014-02-17 16:56 . 2014-02-17 16:56        675988        ----a-w-        c:\program files\Minecraft.exe

2014-02-15 17:34 . 2014-02-15 17:34        921000        ----a-w-        c:\program files\jxpiinstall.exe

2013-10-15 14:49 . 2013-11-15 17:51        537818        ----a-w-        c:\program files\pcwFixMyRights.exe

2013-10-14 23:28 . 2013-11-15 17:51        3294168        ----a-w-        c:\program files\ccsetup406_slim.exe

2012-10-11 20:21 . 2013-11-15 17:51        11766024        ----a-w-        c:\program files\epm911.exe

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"AvastUI.exe"="c:\program files (x86)\AVAST Software\Avast\AvastUI.exe" [2015-05-12 5515496]

"emsisoft anti-malware"="c:\program files (x86)\emsisoft anti-malware\a2guard.exe" [2015-05-26 4923832]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"SoftwareSASGeneration"= 1 (0x1)

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]

R3 BrYNSvc;BrYNSvc;c:\program files (x86)\Browny02\BrYNSvc.exe;c:\program files (x86)\Browny02\BrYNSvc.exe [x]

R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys;c:\windows\SYSNATIVE\epmntdrv.sys [x]

R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys;c:\windows\SYSNATIVE\EuGdiDrv.sys [x]

R3 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\users\Eltern\AppData\Local\Temp\HWiNFO64A.SYS;c:\users\Eltern\AppData\Local\Temp\HWiNFO64A.SYS [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]

R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys;c:\windows\SYSNATIVE\DRIVERS\revoflt.sys [x]

R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]

R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]

R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]

R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys;c:\windows\SYSNATIVE\DRIVERS\ssadserd.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R4 PDFProFiltSrvPP;PDFProFiltSrvPP;c:\program files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe;c:\program files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [x]

S0 aswRvrt;avast! Revert; [x]

S0 aswVmm;avast! VM Monitor; [x]

S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]

S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]

S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys;c:\windows\SYSNATIVE\DRIVERS\ctxusbm.sys [x]

S1 epp64;epp64;c:\windows\system32\DRIVERS\epp64.sys;c:\windows\SYSNATIVE\DRIVERS\epp64.sys [x]

S2 a2AntiMalware;Emsisoft Protection Service;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe [x]

S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]

S2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]

S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]

S3 BrSerIb;Brother Serial Interface Driver(WDM);c:\windows\system32\DRIVERS\BrSerIb.sys;c:\windows\SYSNATIVE\DRIVERS\BrSerIb.sys [x]

S3 BrUsbSIb;Brother Serial USB Driver(WDM);c:\windows\system32\DRIVERS\BrUsbSIb.sys;c:\windows\SYSNATIVE\DRIVERS\BrUsbSIb.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

.

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2015-05-04 11:46        722400        ----a-w-        c:\program files (x86)\AVAST Software\Avast\ashShA64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 165912]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = https://www.google.de/

mDefault_Search_URL = about:blank

mDefault_Page_URL = about:blank

mStart Page = about:blank

mLocal Page = c:\windows\SysWOW64\blank.htm

mSearch Page = about:blank

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\Eltern\AppData\Roaming\Mozilla\Firefox\Profiles\myv9y403.default-1432651667587\

FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-2127788250-3807647062-608468377-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]

@Denied: (2) (S-1-5-21-2127788250-3807647062-608468377-1000)

@Denied: (2) (LocalSystem)

"Progid"="ThunderbirdEML"

.

[HKEY_USERS\S-1-5-21-2127788250-3807647062-608468377-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.VCard.1"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2015-06-06  12:24:47

ComboFix-quarantined-files.txt  2015-06-06 10:24

.

Vor Suchlauf: 13 Verzeichnis(se), 19.671.588.864 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 19.627.470.848 Bytes frei

.

- - End Of File - - 249AB5817D8ACA67F3184C7E852D3EA7

A36C5E4F47E84449FF07ED3517B43A31

Danke und Gruß,
PC Knecht

schrauber

07.06.2015 09:25

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

PC_Knecht

07.06.2015 12:49

Hallo Schrauber,

hier die mbam.txt

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 07.06.2015

Suchlauf-Zeit: 12:08:55

Logdatei: MBAM_07062015.txt

Administrator: Ja
 

Version: 2.01.6.1022

Malware Datenbank: v2015.06.07.02

Rootkit Datenbank: v2015.06.02.01

Lizenz: Kostenlos

Malware Schutz: Deaktiviert

Bösartiger Webseiten Schutz: Deaktiviert

Selbstschutz: Deaktiviert
 

Betriebssystem: Windows 7 Service Pack 1

CPU: x64

Dateisystem: NTFS

Benutzer: Eltern
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 362498

Verstrichene Zeit: 31 Min, 12 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Aktiviert

Heuristik: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(Keine schädliche Elemente gefunden)
 

Module: 0

(Keine schädliche Elemente gefunden)
 

Registrierungsschlüssel: 0

(Keine schädliche Elemente gefunden)
 

Registrierungswerte: 0

(Keine schädliche Elemente gefunden)
 

Registrierungsdaten: 0

(Keine schädliche Elemente gefunden)
 

Ordner: 0

(Keine schädliche Elemente gefunden)
 

Dateien: 0

(Keine schädliche Elemente gefunden)
 

Physische Sektoren: 0

(Keine schädliche Elemente gefunden)
 
 

(end)

nun die AdwCleaner

Code:

# AdwCleaner v4.206 - Bericht erstellt 07/06/2015 um 12:47:59

# Aktualisiert 01/06/2015 von Xplode

# Datenbank : 2015-06-05.1 [Server]

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)

# Benutzername : Eltern - ELTERN-PC

# Gestarted von : C:\Users\Eltern\Downloads\AdwCleaner_4.206.exe

# Option : Löschen
 

***** [ Dienste ] *****
 
 

***** [ Dateien / Ordner ] *****
 
 

***** [ Geplante Tasks ] *****
 
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 
 

***** [ Internetbrowser ] *****
 

-\\ Internet Explorer v11.0.9600.17801
 
 

-\\ Mozilla Firefox v38.0.5 (x86 de)
 
 

*************************
 

AdwCleaner[R0].txt - [1764 Bytes] - [26/04/2015 13:54:48]

AdwCleaner[R1].txt - [913 Bytes] - [26/04/2015 13:59:04]

AdwCleaner[R2].txt - [1185 Bytes] - [14/05/2015 19:50:06]

AdwCleaner[R3].txt - [1092 Bytes] - [07/06/2015 12:46:14]

AdwCleaner[S0].txt - [1645 Bytes] - [26/04/2015 13:56:30]

AdwCleaner[S1].txt - [1245 Bytes] - [14/05/2015 19:54:40]

AdwCleaner[S2].txt - [1013 Bytes] - [07/06/2015 12:47:59]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1072  Bytes] ##########

jetzt die JRT.txt

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.8.9 (06.06.2015:1)

OS: Windows 7 Home Premium x64

Ran by Eltern on 07.06.2015 at 13:21:46,01

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Tasks
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 
 
 

~~~ Folders
 

Successfully deleted: [Folder] C:\Users\Eltern\appdata\local\crashrpt
 
 
 

~~~ FireFox
 

Emptied folder: C:\Users\Eltern\AppData\Roaming\mozilla\firefox\profiles\myv9y403.default-1432651667587\minidumps [1 files]
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 07.06.2015 at 13:30:27,99

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

und zum Schluß noch die FRST-Dateien

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:06-06-2015

Ran by Eltern (administrator) on ELTERN-PC on 07-06-2015 13:41:57

Running from C:\Users\Eltern\Desktop

Loaded Profiles: Eltern (Available Profiles: Eltern)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe

(Avast Software s.r.o.) C:\Program Files (x86)\AVAST Software\Avast\AvastSvc.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files (x86)\AVAST Software\Avast\AvastUI.exe [5515496 2015-05-12] (Avast Software s.r.o.)

HKLM-x32\...\Run: [emsisoft anti-malware] => c:\program files (x86)\emsisoft anti-malware\a2guard.exe [4923832 2015-05-26] (Emsisoft Ltd)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files (x86)\AVAST Software\Avast\ashShA64.dll [2015-05-04] (Avast Software s.r.o.)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKU\S-1-5-21-2127788250-3807647062-608468377-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files (x86)\AVAST Software\Avast\aswWebRepIE64.dll [2015-05-04] (Avast Software s.r.o.)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)

BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll [2009-02-06] (Zeon Corporation)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files (x86)\AVAST Software\Avast\aswWebRepIE.dll [2015-05-04] (Avast Software s.r.o.)

BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)

Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-03-11] (Citrix Systems, Inc.)

Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-03-11] (Citrix Systems, Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Eltern\AppData\Roaming\Mozilla\Firefox\Profiles\myv9y403.default-1432651667587

FF Homepage: https://www.google.de/

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-13] ()

FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-13] ()

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)

FF Extension: Adblock Plus - C:\Users\Eltern\AppData\Roaming\Mozilla\Firefox\Profiles\myv9y403.default-1432651667587\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-05-26]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files (x86)\AVAST Software\Avast\WebRep\FF

FF Extension: Avast Online Security - C:\Program Files (x86)\AVAST Software\Avast\WebRep\FF [2015-04-26]
 

Chrome: 

=======

CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files (x86)\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-26]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [5155576 2015-05-26] (Emsisoft Ltd)

R2 avast! Antivirus; C:\Program Files (x86)\AVAST Software\Avast\AvastSvc.exe [343336 2015-05-04] (Avast Software s.r.o.)

S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112 2013-09-25] (Brother Industries, Ltd.) [File not signed]

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)

S4 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [145256 2011-08-02] (Nuance Communications, Inc.)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-05-04] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-05-04] (Avast Software s.r.o.)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-05-04] (Avast Software s.r.o.)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-05-04] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-05-04] (Avast Software s.r.o.)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-05-04] (Avast Software s.r.o.)

S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-05-04] (Avast Software s.r.o.)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-05-04] ()

S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2011-07-29] () [File not signed]

S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [14216 2011-07-29] () [File not signed]

R1 epp64; C:\Windows\System32\DRIVERS\epp64.sys [135800 2015-03-24] (Emsisoft GmbH)

S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2011-07-29] () [File not signed]

S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [8456 2011-07-29] () [File not signed]

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 HWiNFO32; \??\C:\Users\Eltern\AppData\Local\Temp\HWiNFO64A.SYS [X]

S3 SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP6\WNt500x64\Sandra.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 

==================== One Month Created files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-06-07 13:41 - 2015-06-07 13:42 - 00009239 _____ C:\Users\Eltern\Desktop\FRST.txt

2015-06-07 13:38 - 2015-06-07 13:38 - 02108928 _____ (Farbar) C:\Users\Eltern\Desktop\FRST64.exe

2015-06-07 13:37 - 2015-06-07 13:37 - 00000000 ____D C:\Users\Eltern\Desktop\Virenreiniung

2015-06-07 13:30 - 2015-06-07 13:30 - 00000820 _____ C:\Users\Eltern\Desktop\JRT.txt

2015-06-07 13:21 - 2015-06-07 13:21 - 00000207 _____ C:\Windows\tweaking.com-regbackup-ELTERN-PC-Windows-7-Home-Premium-(64-bit).dat

2015-06-07 13:21 - 2015-06-07 13:21 - 00000000 ____D C:\RegBackup

2015-06-07 12:58 - 2015-06-07 12:58 - 02942406 _____ (Thisisu) C:\Users\Eltern\Desktop\JRT.exe

2015-06-07 12:52 - 2015-06-07 12:52 - 00001152 _____ C:\Users\Eltern\Desktop\AdwCleaner[S2].txt

2015-06-07 12:44 - 2015-06-07 12:45 - 02231296 _____ C:\Users\Eltern\Downloads\AdwCleaner_4.206.exe

2015-06-07 12:42 - 2015-06-07 12:42 - 00001219 _____ C:\Users\Eltern\Desktop\MBAM_07062015.txt

2015-06-06 12:24 - 2015-06-06 12:24 - 00017628 _____ C:\ComboFix.txt

2015-06-06 12:05 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe

2015-06-06 12:05 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe

2015-06-06 12:05 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2015-06-06 12:05 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2015-06-06 12:05 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2015-06-06 12:05 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe

2015-06-06 12:05 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe

2015-06-06 12:05 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe

2015-06-06 12:01 - 2015-06-06 12:24 - 00000000 ____D C:\Qoobox

2015-06-06 12:01 - 2015-06-06 12:22 - 00000000 ____D C:\Windows\erdnt

2015-06-06 11:33 - 2015-06-06 11:33 - 05628238 ____R (Swearware) C:\Users\Eltern\Desktop\ComboFix.exe

2015-06-05 08:37 - 2015-06-05 09:23 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2015-06-05 08:32 - 2015-06-05 08:32 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Eltern\Downloads\mbar-1.09.1.1004.exe

2015-06-03 11:26 - 2015-06-03 16:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2015-06-02 19:06 - 2015-06-02 19:06 - 00000000 ____D C:\Program Files (x86)\ESET

2015-06-02 19:05 - 2015-06-02 19:05 - 02870984 _____ (ESET) C:\Users\Eltern\Downloads\esetsmartinstaller_deu.exe

2015-06-02 17:09 - 2015-06-07 13:41 - 00000000 ____D C:\FRST

2015-06-02 17:04 - 2015-06-02 17:04 - 00000000 _____ C:\Users\Eltern\defogger_reenable

2015-06-02 14:26 - 2015-06-02 14:26 - 00000000 ____D C:\Users\Eltern\AppData\Local\GWX

2015-06-01 19:21 - 2015-06-01 19:21 - 00000000 ____D C:\Program Files (x86)\Realtek

2015-06-01 19:21 - 2009-08-18 11:44 - 00236544 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys

2015-06-01 19:21 - 2009-08-18 11:44 - 00067584 _____ C:\Windows\system32\RtNicProp64.dll

2015-06-01 19:21 - 2009-07-22 18:24 - 00097792 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll

2015-06-01 16:49 - 2015-06-01 16:49 - 00000000 ____D C:\Users\Eltern\Documents\hw64_462-1

2015-05-27 12:08 - 2015-05-28 17:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird

2015-05-27 11:25 - 2015-05-27 11:25 - 00001051 _____ C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk

2015-05-27 11:25 - 2015-05-27 11:25 - 00001051 _____ C:\ProgramData\Desktop\Revo Uninstaller Pro.lnk

2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D C:\Users\Eltern\AppData\Local\VS Revo Group

2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D C:\ProgramData\VS Revo Group

2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro

2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D C:\Program Files\VS Revo Group

2015-05-27 11:25 - 2009-12-30 10:21 - 00031800 _____ (VS Revo Group) C:\Windows\system32\Drivers\revoflt.sys

2015-05-27 11:17 - 2015-05-27 11:18 - 10801480 _____ (VS Revo Group ) C:\Users\Eltern\Downloads\RevoUninProSetup-312.exe

2015-05-26 16:47 - 2015-05-26 16:47 - 00000000 ____D C:\Users\Eltern\Desktop\Alte Firefox-Daten

2015-05-26 16:44 - 2015-05-26 16:44 - 00494857 _____ C:\Users\Eltern\Desktop\bookmarks.html

2015-05-26 08:44 - 2015-05-26 08:44 - 00000000 ____D C:\Program Files\avast software

2015-05-20 17:31 - 2015-01-31 05:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll

2015-05-20 17:31 - 2015-01-31 05:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll

2015-05-20 17:31 - 2015-01-31 01:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll

2015-05-20 17:30 - 2014-12-11 19:47 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2015-05-19 20:02 - 2014-09-05 03:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2015-05-19 20:01 - 2014-09-05 04:11 - 06584320 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2015-05-17 19:29 - 2015-05-17 19:29 - 00000000 ____D C:\ProgramData\Emsisoft

2015-05-17 19:11 - 2015-06-07 13:30 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware

2015-05-17 19:11 - 2015-05-17 19:11 - 00001105 _____ C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk

2015-05-17 19:11 - 2015-05-17 19:11 - 00001105 _____ C:\ProgramData\Desktop\Emsisoft Anti-Malware.lnk

2015-05-17 19:11 - 2015-05-17 19:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware

2015-05-17 19:11 - 2015-03-24 00:17 - 00135800 _____ (Emsisoft GmbH) C:\Windows\system32\Drivers\epp64.sys

2015-05-17 19:01 - 2015-05-17 19:10 - 161426392 _____ (Emsisoft Ltd. ) C:\Users\Eltern\Downloads\emsisoftantimalwaresetup.exe

2015-05-17 17:22 - 2015-05-17 17:22 - 21545848 _____ (Malwarebytes Corporation ) C:\Users\Eltern\Downloads\Anti-Malware.exe

2015-05-17 15:56 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys

2015-05-17 15:56 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe

2015-05-17 15:56 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll

2015-05-17 15:56 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll

2015-05-17 15:56 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll

2015-05-17 15:56 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll

2015-05-17 15:56 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll

2015-05-17 15:56 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll

2015-05-17 15:56 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll

2015-05-17 15:56 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll

2015-05-17 15:56 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe

2015-05-17 15:56 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll

2015-05-17 15:56 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe

2015-05-17 15:56 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll

2015-05-17 15:56 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe

2015-05-17 15:55 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys

2015-05-17 15:55 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll

2015-05-17 15:55 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll

2015-05-17 15:54 - 2015-03-14 05:21 - 01632768 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll

2015-05-17 15:54 - 2015-03-14 05:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll

2015-05-17 15:54 - 2015-03-14 05:04 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll

2015-05-17 15:54 - 2015-03-14 05:04 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll

2015-05-17 13:56 - 2015-05-17 10:57 - 00008969 _____ C:\Users\Eltern\Documents\Arbeitszeitreduzierung.tmd

2015-05-14 19:49 - 2015-05-14 19:49 - 02209792 _____ C:\Users\Eltern\Downloads\adwcleaner_4.204.exe

2015-05-13 08:28 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll

2015-05-13 08:28 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll

2015-05-13 08:19 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2015-05-13 08:19 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2015-05-13 08:19 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2015-05-13 08:19 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2015-05-13 08:19 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2015-05-13 08:19 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2015-05-13 08:19 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2015-05-13 08:19 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2015-05-13 08:19 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2015-05-13 08:19 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec

2015-05-13 08:19 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2015-05-13 08:19 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2015-05-13 08:19 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2015-05-13 08:19 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2015-05-13 08:19 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2015-05-13 08:19 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2015-05-13 08:19 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2015-05-13 08:19 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2015-05-13 08:19 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2015-05-13 08:19 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2015-05-13 08:19 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2015-05-13 08:19 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2015-05-13 08:19 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2015-05-13 08:19 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2015-05-13 08:19 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2015-05-13 08:19 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2015-05-13 08:19 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2015-05-13 08:19 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2015-05-13 08:19 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2015-05-13 08:19 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec

2015-05-13 08:19 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2015-05-13 08:19 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2015-05-13 08:19 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2015-05-13 08:19 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2015-05-13 08:19 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2015-05-13 08:19 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2015-05-13 08:19 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2015-05-13 08:19 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2015-05-13 08:19 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2015-05-13 08:19 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2015-05-13 08:19 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2015-05-13 08:19 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2015-05-13 08:19 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2015-05-13 08:19 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2015-05-13 08:19 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2015-05-13 08:19 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2015-05-13 08:19 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2015-05-13 08:19 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2015-05-13 08:19 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2015-05-13 08:19 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2015-05-13 08:19 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2015-05-13 08:19 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2015-05-13 08:19 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2015-05-13 08:19 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2015-05-13 08:19 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2015-05-13 08:19 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2015-05-13 08:19 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2015-05-13 08:19 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2015-05-13 08:19 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2015-05-13 08:19 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2015-05-13 08:19 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2015-05-13 08:19 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2015-05-13 08:19 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll

2015-05-13 08:19 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll

2015-05-13 08:18 - 2015-04-27 21:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-05-13 08:18 - 2015-04-27 21:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2015-05-13 08:18 - 2015-04-27 21:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2015-05-13 08:18 - 2015-04-27 21:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2015-05-13 08:18 - 2015-04-27 21:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe

2015-05-13 08:18 - 2015-04-27 21:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe

2015-05-13 08:18 - 2015-04-27 21:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2015-05-13 08:18 - 2015-04-27 21:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe

2015-05-13 08:18 - 2015-04-27 21:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe

2015-05-13 08:18 - 2015-04-27 21:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe

2015-05-13 08:18 - 2015-04-27 21:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe

2015-05-13 08:18 - 2015-04-27 21:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2015-05-13 08:18 - 2015-04-27 21:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe

2015-05-13 08:18 - 2015-04-27 21:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe

2015-05-13 08:18 - 2015-04-27 21:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2015-05-13 08:18 - 2015-04-27 21:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2015-05-13 08:18 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2015-05-13 08:18 - 2015-04-27 21:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2015-05-13 08:18 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll

2015-05-13 08:18 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2015-05-13 08:18 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2015-05-13 08:18 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2015-05-13 08:18 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll

2015-05-13 08:18 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2015-05-13 08:18 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2015-05-13 08:18 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2015-05-13 08:18 - 2015-04-27 21:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2015-05-13 08:18 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll

2015-05-13 08:18 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2015-05-13 08:18 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe

2015-05-13 08:18 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe

2015-05-13 08:18 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe

2015-05-13 08:18 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe

2015-05-13 08:18 - 2015-04-27 21:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2015-05-13 08:18 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2015-05-13 08:18 - 2015-04-27 21:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2015-05-13 08:18 - 2015-04-27 21:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2015-05-13 08:18 - 2015-04-27 21:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2015-05-13 08:18 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe

2015-05-13 08:18 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe

2015-05-13 08:18 - 2015-04-27 21:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2015-05-13 08:18 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2015-05-13 08:18 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll

2015-05-13 08:18 - 2015-04-27 19:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2015-05-13 08:18 - 2015-04-27 19:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2015-05-13 08:18 - 2015-04-27 19:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

2015-05-13 08:18 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe

2015-05-13 08:17 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2015-05-13 08:17 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll

2015-05-13 08:17 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2015-05-13 08:17 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2015-05-13 08:17 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll

2015-05-13 08:17 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll

2015-05-13 08:17 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll

2015-05-13 08:17 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll

2015-05-13 08:17 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll

2015-05-13 08:17 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe

2015-05-13 08:17 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll

2015-05-13 08:17 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll

2015-05-13 08:17 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll

2015-05-13 08:17 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe

2015-05-13 08:17 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe

2015-05-13 08:17 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe

2015-05-13 08:17 - 2015-01-29 05:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll

2015-05-13 08:17 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll

2015-05-10 16:11 - 2015-05-10 16:11 - 00001093 _____ C:\Users\Public\Desktop\PDF24 Creator.lnk

2015-05-10 16:11 - 2015-05-10 16:11 - 00001093 _____ C:\ProgramData\Desktop\PDF24 Creator.lnk

2015-05-10 16:11 - 2015-05-10 16:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24

2015-05-10 16:11 - 2015-05-10 16:11 - 00000000 ____D C:\Program Files (x86)\PDF24

2015-05-10 16:08 - 2015-05-10 16:08 - 16342352 _____ (Geek Software GmbH ) C:\Program Files (x86)\pdf24-creator-6.9.2.exe

2015-05-10 15:30 - 2015-05-10 15:31 - 27837984 _____ (pdfforge ) C:\Users\Eltern\Downloads\PDFCreator-2_1_1-setup.exe

2015-05-10 15:06 - 2015-05-10 15:06 - 00000000 ____D C:\Users\Eltern\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker

2015-05-10 14:47 - 2015-05-10 15:06 - 00000000 ____D C:\Program Files (x86)\Unlocker

2015-05-10 13:14 - 2015-05-10 13:14 - 00001138 _____ C:\Users\Eltern\Desktop\PK.vbs

2015-05-10 10:50 - 2015-05-10 10:50 - 00002562 _____ C:\Windows\diagwrn.xml

2015-05-10 10:50 - 2015-05-10 10:50 - 00001908 _____ C:\Windows\diagerr.xml

2015-05-09 14:08 - 2015-05-10 15:27 - 00000000 ____D C:\Windows\pss
 

==================== One Month Modified files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-06-07 13:20 - 2015-04-26 14:00 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-06-07 13:00 - 2009-07-14 06:45 - 00023168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-06-07 13:00 - 2009-07-14 06:45 - 00023168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-06-07 12:55 - 2013-10-14 21:23 - 01949560 _____ C:\Windows\WindowsUpdate.log

2015-06-07 12:50 - 2015-04-19 19:41 - 00005509 _____ C:\Windows\setupact.log

2015-06-07 12:50 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-06-07 12:48 - 2015-04-26 13:54 - 00000000 ____D C:\AdwCleaner

2015-06-06 17:57 - 2015-04-26 16:08 - 00004194 _____ C:\Windows\System32\Tasks\avast! Emergency Update

2015-06-06 17:55 - 2015-04-26 13:57 - 00010678 _____ C:\Windows\PFRO.log

2015-06-06 12:59 - 2013-10-14 21:31 - 00000000 ____D C:\Users\Eltern

2015-06-06 12:20 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini

2015-06-05 08:34 - 2015-04-26 14:00 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-06-03 16:27 - 2013-10-14 23:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2015-06-02 16:29 - 2013-10-14 23:52 - 00000000 ____D C:\Users\Eltern\AppData\Roaming\vlc

2015-06-02 15:14 - 2009-07-14 19:58 - 00699416 _____ C:\Windows\system32\perfh007.dat

2015-06-02 15:14 - 2009-07-14 19:58 - 00149556 _____ C:\Windows\system32\perfc007.dat

2015-06-02 15:14 - 2009-07-14 07:13 - 01620612 _____ C:\Windows\system32\PerfStringBackup.INI

2015-06-02 10:20 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration

2015-06-01 19:21 - 2014-06-25 19:42 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2015-05-30 19:17 - 2014-06-25 19:46 - 00007887 _____ C:\Windows\BRRBCOM.INI

2015-05-30 18:44 - 2013-10-15 14:51 - 00000000 ____D C:\Windows\rescache

2015-05-28 11:06 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF

2015-05-27 12:03 - 2013-10-17 00:31 - 01593956 _____ C:\Windows\SysWOW64\PerfStringBackup.INI

2015-05-20 18:32 - 2015-04-04 12:12 - 00000000 ___SD C:\Windows\SysWOW64\GWX

2015-05-20 18:32 - 2015-04-04 12:12 - 00000000 ___SD C:\Windows\system32\GWX

2015-05-17 17:54 - 2015-04-26 14:00 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-05-17 16:04 - 2009-07-14 05:20 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

2015-05-17 16:01 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions

2015-05-16 09:18 - 2013-10-17 21:16 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2015-05-14 20:46 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\Resources

2015-05-13 14:17 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2015-05-13 10:45 - 2009-07-14 06:45 - 00287472 _____ C:\Windows\system32\FNTCACHE.DAT

2015-05-13 10:42 - 2013-11-15 19:52 - 00000000 ____D C:\Program Files\Windows Journal

2015-05-13 10:42 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\AdvancedInstallers

2015-05-13 08:35 - 2013-10-18 20:38 - 00000000 ____D C:\Windows\system32\MRT

2015-05-13 08:32 - 2013-10-18 20:38 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-05-13 07:57 - 2015-02-04 19:56 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-05-13 07:57 - 2015-02-04 19:56 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-05-10 10:50 - 2015-04-19 19:41 - 00000000 _____ C:\Windows\setuperr.log
 

==================== Files in the root of some directories =======
 

2013-11-15 19:51 - 2013-10-15 01:28 - 3294168 _____ (Piriform Ltd) C:\Program Files\ccsetup406_slim.exe

2014-08-04 15:16 - 2014-08-04 15:16 - 10410712 _____ (Sony Computer Entertainment Inc.                             ) C:\Program Files\CMASetup.exe

2013-11-15 19:51 - 2012-10-11 22:21 - 11766024 _____ (EASEUS                                                      ) C:\Program Files\epm911.exe

2014-02-15 19:34 - 2014-02-15 19:34 - 0921000 _____ (Oracle Corporation) C:\Program Files\jxpiinstall.exe

2014-02-17 18:56 - 2014-02-17 18:56 - 0675988 _____ () C:\Program Files\Minecraft.exe

2014-02-17 20:22 - 2014-02-17 20:22 - 0774144 _____ () C:\Program Files\NBTExplorer-2.7.0.msi

2013-11-15 19:51 - 2013-10-15 16:49 - 0537818 _____ (IDG Magazine Media GmbH                                     ) C:\Program Files\pcwFixMyRights.exe

2014-12-26 17:14 - 2014-12-26 17:14 - 0095662 _____ () C:\Program Files (x86)\7-zip.chm

2014-12-26 17:48 - 2014-12-26 17:48 - 0080384 _____ (Igor Pavlov) C:\Program Files (x86)\7-zip.dll

2014-12-26 17:48 - 2014-12-26 17:48 - 0050176 _____ (Igor Pavlov) C:\Program Files (x86)\7-zip32.dll

2014-12-26 18:00 - 2014-12-26 18:00 - 1508352 _____ (Igor Pavlov) C:\Program Files (x86)\7z.dll

2014-12-26 18:06 - 2014-12-26 18:06 - 0181760 _____ (Igor Pavlov) C:\Program Files (x86)\7z.sfx

2014-12-26 18:06 - 2014-12-26 18:06 - 0166400 _____ (Igor Pavlov) C:\Program Files (x86)\7zCon.sfx

2014-12-26 17:50 - 2014-12-26 17:50 - 0803328 _____ (Igor Pavlov) C:\Program Files (x86)\7zFM.exe

2014-12-26 17:50 - 2014-12-26 17:50 - 0545792 _____ (Igor Pavlov) C:\Program Files (x86)\7zG.exe

2014-08-22 08:08 - 2014-08-22 08:11 - 149527616 _____ () C:\Program Files (x86)\avira_free_antivirus_de_14.0.6.570.exe

2014-11-07 13:28 - 2014-11-07 13:28 - 12436848 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\CitrixOnlinePluginWeb.exe

2015-05-04 18:48 - 2015-05-04 18:49 - 10457912 _____ (Sony Computer Entertainment Inc.                             ) C:\Program Files (x86)\CMASetup.exe

2011-04-04 17:54 - 2011-04-04 17:54 - 0000366 _____ () C:\Program Files (x86)\descript.ion

2015-04-20 17:59 - 2015-04-20 18:03 - 190719264 _____ (Microsoft Corporation) C:\Program Files (x86)\DraftSight64.exe

2015-01-03 12:26 - 2015-01-03 12:29 - 91670064 _____ (The GIMP Team                                               ) C:\Program Files (x86)\gimp-2.8.14-setup.exe

2014-12-26 18:06 - 2014-12-26 18:06 - 0040769 _____ () C:\Program Files (x86)\History.txt

2014-06-12 22:02 - 2014-06-12 22:02 - 0001927 _____ () C:\Program Files (x86)\License.txt

2015-05-10 16:08 - 2015-05-10 16:08 - 16342352 _____ (Geek Software GmbH                                          ) C:\Program Files (x86)\pdf24-creator-6.9.2.exe

2015-01-07 21:39 - 2015-01-07 21:39 - 0001551 _____ () C:\Users\Eltern\AppData\Local\recently-used.xbel
 

Some files in TEMP:

====================

C:\Users\Eltern\AppData\Local\Temp\Quarantine.exe

C:\Users\Eltern\AppData\Local\Temp\sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-06-05 15:47
 

==================== End of log ============================

--- --- ---

[CODE]Additional
FRST Logfile:

Code:

scan result of Farbar Recovery Scan Tool (x64) Version:06-06-2015

Ran by Eltern at 2015-06-07 13:42:55

Running from C:\Users\Eltern\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Accounts: =============================
 

Administrator (S-1-5-21-2127788250-3807647062-608468377-500 - Administrator - Disabled)

Eltern (S-1-5-21-2127788250-3807647062-608468377-1000 - Administrator - Enabled) => C:\Users\Eltern

Gast (S-1-5-21-2127788250-3807647062-608468377-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-2127788250-3807647062-608468377-1002 - Limited - Enabled)
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AV: Emsisoft Anti-Malware (Disabled - Up to date) {2F44E1F9-850B-1C7A-0E56-EB2E0A3E20C9}

AS: Emsisoft Anti-Malware (Disabled - Up to date) {9425001D-A331-13F4-34E6-D05C71B96A74}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

7-Zip 9.36 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0936-000001000000}) (Version: 9.36.00.0 - Igor Pavlov)

Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)

Amazon Music (HKU\S-1-5-21-2127788250-3807647062-608468377-1000\...\Amazon Amazon Music) (Version: 3.7.1.698 - Amazon Services LLC)

Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.2.2218 - AVAST Software)

Brother MFL-Pro Suite MFC-J245 (HKLM-x32\...\{B742757A-7658-4E09-A51A-085CF0F7F4D3}) (Version: 1.0.0.0 - Brother Industries, Ltd.)

CDex - Open Source Digital Audio CD Extractor (HKLM-x32\...\CDex) (Version: 1.70.4.2009 - Georgy Berdyshev)

Citrix Online Plug-in - Web (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 12.0.0.6410 - Citrix Systems, Inc.)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

DriveImage XML (Private Edition) (HKLM-x32\...\{F7E1CA14-B39D-452A-960B-39423DDDD933}) (Version: 2.44.000 - Runtime Software)

EASEUS Partition Master 9.1.1 Home Edition (HKLM-x32\...\EASEUS Partition Master Home Edition_is1) (Version:  - EASEUS)

ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 16.0.20150211 - Landesfinanzdirektion Thüringen)

Emsisoft Anti-Malware (HKLM-x32\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 10.0 - Emsisoft Ltd.)

ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )

Free YouTube to MP3 Converter version 3.12.54.128 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.54.128 - DVDVideoSoft Ltd.)

GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)

Inhaltsmanager-Assistent für PlayStation(R) (HKLM-x32\...\{961D5D7E-3DEC-4E3B-9065-EA8074923B18}) (Version: 3.31.7643.1 - Sony Computer Entertainment Inc.)

Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)

Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)

Junk Mail filter update (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)

Mozilla Firefox 38.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.5 (x86 de)) (Version: 38.0.5 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 37.0.2 - Mozilla)

Mozilla Thunderbird 31.7.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.7.0 (x86 de)) (Version: 31.7.0 - Mozilla)

MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)

NBTExplorer (HKLM-x32\...\{273D5BF1-EC9C-4549-880D-D8C293296A36}) (Version: 2.7.0.0 - Justin Aquadro)

Nuance PaperPort 12 (HKLM-x32\...\{869FCC6C-5669-4B0B-827E-2BBAACD88A87}) (Version: 12.1.0006 - Nuance Communications, Inc.)

Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc)

PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 14.00.0000 - Nuance Communications, Inc.)

PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)

Pusteblume Sachunterricht 3 (HKLM-x32\...\Pusteblume Sachunterricht 3) (Version:  - Bildungshaus Schulbuchverlage Westermann Schroedel Diesterweg Schöningh Winklers GmbH)

Realtek Ethernet Controller  Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0008 - Realtek)

Revo Uninstaller Pro 3.1.2 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.1.2 - VS Revo Group, Ltd.)

Scansoft PDF Professional (x32 Version:  - ) Hidden

SoftMaker FreeOffice (HKLM-x32\...\{8EBB8452-274B-465D-8324-00B0832FBB02}) (Version: 1.0.3395 - SoftMaker Software GmbH)

Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)

VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
 

==================== Custom CLSID (Whitelisted): ==========================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 

==================== Restore Points =========================
 

05-06-2015 13:58:00 Windows Update
 

==================== Hosts content: ===============================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 04:34 - 2015-06-06 12:20 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (Whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

Task: {0051A1AD-0606-4209-BFFE-5DC7ED6C9B20} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-07] (Microsoft Corporation)

Task: {2A8DE333-7E1A-413D-A3F3-B61EDE484B8C} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks

Task: {2F1A7095-145D-4C60-A610-DAACD9B595A9} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)

Task: {31E02CA9-C51E-4460-BA97-B7E21A651C34} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)

Task: {50535350-84E1-4323-9DDE-0CD437D0DE7A} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)

Task: {C16F411F-5A38-4010-8311-B2469B0D6545} - System32\Tasks\avast! Emergency Update => C:\Program Files (x86)\AVAST Software\Avast\AvastEmUpdate.exe [2015-05-04] (Avast Software s.r.o.)

Task: {FE44BCD0-794F-4565-A45A-58A9B824A0F2} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
 

==================== Loaded Modules (Whitelisted) ==============
 

2015-05-04 13:45 - 2015-05-04 13:45 - 00104400 _____ () C:\Program Files (x86)\AVAST Software\Avast\log.dll

2015-05-04 13:45 - 2015-05-04 13:45 - 00081728 _____ () C:\Program Files (x86)\AVAST Software\Avast\JsonRpcServer.dll

2015-06-07 11:31 - 2015-06-07 11:31 - 02952192 _____ () C:\Program Files (x86)\AVAST Software\Avast\defs\15060700\algo.dll
 

==================== Alternate Data Streams (Whitelisted) =========
 

(If an entry is included in the fixlist, only the ADS will be removed.)
 
 

==================== Safe Mode (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (Whitelisted) ===============
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 

==================== Internet Explorer trusted/restricted ===============
 

(If an entry is included in the fixlist, it will be removed from the registry.)
 
 

==================== Other Areas ============================
 

(Currently there is no automatic fix for this section.)
 

HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Eltern\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 192.168.2.1
 

==================== MSCONFIG/TASK MANAGER disabled items ==
 

(Currently there is no automatic fix for this section.)
 

MSCONFIG\Services: PDFProFiltSrvPP => 2

MSCONFIG\Services: wscsvc => 2

MSCONFIG\Services: WSearch => 2

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Inhaltsmanager-Assistent für PlayStation(R).lnk => C:\Windows\pss\Inhaltsmanager-Assistent für PlayStation(R).lnk.CommonStartup

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

MSCONFIG\startupreg: Amazon Music => "C:\Users\Eltern\AppData\Local\Amazon Music\Amazon Music Helper.exe"

MSCONFIG\startupreg: BrHelp => C:\Program Files (x86)\Brother\Brother Help\BrotherHelp.exe /AUTORUN

MSCONFIG\startupreg: BrStsMon00 => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN

MSCONFIG\startupreg: ConnectionCenter => "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup

MSCONFIG\startupreg: ControlCenter4 => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe /autorun

MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe

MSCONFIG\startupreg: IndexSearch => "C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe"

MSCONFIG\startupreg: ISUSPM => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler

MSCONFIG\startupreg: PaperPort PTD => "C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe"

MSCONFIG\startupreg: PDF5 Registry Controller => C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe

MSCONFIG\startupreg: PDFHook => C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe

MSCONFIG\startupreg: PDFPrint => C:\Program Files (x86)\PDF24\pdf24.exe

MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe
 

==================== FirewallRules (Whitelisted) ===============
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

FirewallRules: [{1B5878FA-F799-4C68-A2DA-8E7A57B40EFB}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

FirewallRules: [{AF0730C6-8801-41FD-9979-03A14518E175}] => (Allow) LPort=2869

FirewallRules: [{639EFFE0-6DC2-43C2-A676-855C8FEF6F89}] => (Allow) LPort=1900

FirewallRules: [TCP Query User{7A9608B7-A0ED-423F-BE89-7991B131A01B}C:\program files\videolan\vlc\vlc.exe] => (Block) C:\program files\videolan\vlc\vlc.exe

FirewallRules: [UDP Query User{BA917422-0A70-45A0-88FF-CEA25E4D4AA8}C:\program files\videolan\vlc\vlc.exe] => (Block) C:\program files\videolan\vlc\vlc.exe

FirewallRules: [TCP Query User{074F9C1C-051B-4319-BF7A-A98FD2FDF065}C:\program files (x86)\java\jre1.8.0_31\bin\java.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\java.exe

FirewallRules: [UDP Query User{55D30EF6-0A63-403F-900B-656D36616F2B}C:\program files (x86)\java\jre1.8.0_31\bin\java.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\java.exe

FirewallRules: [TCP Query User{362F5215-85FC-421B-B914-ABE6EA456261}C:\program files\firefox.exe] => (Block) C:\program files\firefox.exe

FirewallRules: [UDP Query User{BE7C41C2-E1AB-4E12-9414-4D0DA7F81B6F}C:\program files\firefox.exe] => (Block) C:\program files\firefox.exe

FirewallRules: [{1023DE4E-B766-48DA-AAA2-EF53ED9DE278}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{4F66FC22-FD46-46BE-87E1-A8C2AD47AF02}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
 

==================== Faulty Device Manager Devices =============
 

Name: Microsoft PS/2-Maus

Description: Microsoft PS/2-Maus

Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: i8042prt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (06/07/2015 00:58:28 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
 

Error: (06/07/2015 00:52:54 PM) (Source: ESENT) (EventID: 439) (User: )

Description: Windows (3064) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032.
 

Error: (06/07/2015 00:52:54 PM) (Source: ESENT) (EventID: 490) (User: )

Description: Windows (3064) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 

Error: (06/06/2015 00:12:23 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: PEV.exe, Version: 0.0.0.0, Zeitstempel: 0x4e06cfe8

Name des fehlerhaften Moduls: PEV.exe, Version: 0.0.0.0, Zeitstempel: 0x4e06cfe8

Ausnahmecode: 0x40000015

Fehleroffset: 0x0008d1c0

ID des fehlerhaften Prozesses: 0x978

Startzeit der fehlerhaften Anwendung: 0xPEV.exe0

Pfad der fehlerhaften Anwendung: PEV.exe1

Pfad des fehlerhaften Moduls: PEV.exe2

Berichtskennung: PEV.exe3
 

Error: (06/06/2015 11:33:43 AM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
 

Error: (06/06/2015 10:20:39 AM) (Source: ESENT) (EventID: 439) (User: )

Description: Windows (2924) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032.
 

Error: (06/06/2015 10:20:39 AM) (Source: ESENT) (EventID: 490) (User: )

Description: Windows (2924) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 

Error: (06/05/2015 03:47:59 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
 

Error: (06/05/2015 08:33:13 AM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
 

Error: (06/03/2015 09:33:32 AM) (Source: ESENT) (EventID: 439) (User: )

Description: Windows (2720) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032.
 
 

System errors:

=============

Error: (06/07/2015 01:23:18 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (06/07/2015 01:23:18 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Adobe Acrobat Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (06/07/2015 01:23:18 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Druckwarteschlange" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (06/07/2015 01:23:18 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Avast Antivirus" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (06/07/2015 01:23:17 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Emsisoft Protection Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (06/07/2015 00:48:00 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (06/07/2015 00:47:59 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (06/07/2015 00:47:59 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (06/07/2015 00:47:58 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Druckwarteschlange" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (06/07/2015 00:47:58 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Windows Live ID Sign-in Assistant" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
 
 

Microsoft Office:

=========================

Error: (06/07/2015 00:58:28 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Users\Eltern\Downloads\esetsmartinstaller_deu.exe
 

Error: (06/07/2015 00:52:54 PM) (Source: ESENT) (EventID: 439) (User: )

Description: Windows3064Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032
 

Error: (06/07/2015 00:52:54 PM) (Source: ESENT) (EventID: 490) (User: )

Description: Windows3064Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
 

Error: (06/06/2015 00:12:23 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: PEV.exe0.0.0.04e06cfe8PEV.exe0.0.0.04e06cfe8400000150008d1c097801d0a0414730849fC:\ComboFix\PEV.exeC:\ComboFix\PEV.exe85e7a99e-0c34-11e5-a6ee-002618b7a239
 

Error: (06/06/2015 11:33:43 AM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Users\Eltern\Downloads\esetsmartinstaller_deu.exe
 

Error: (06/06/2015 10:20:39 AM) (Source: ESENT) (EventID: 439) (User: )

Description: Windows2924Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032
 

Error: (06/06/2015 10:20:39 AM) (Source: ESENT) (EventID: 490) (User: )

Description: Windows2924Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
 

Error: (06/05/2015 03:47:59 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe
 

Error: (06/05/2015 08:33:13 AM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Users\Eltern\Downloads\esetsmartinstaller_deu.exe
 

Error: (06/03/2015 09:33:32 AM) (Source: ESENT) (EventID: 439) (User: )

Description: Windows2720Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032
 
 

CodeIntegrity Errors:

===================================

  Date: 2015-06-06 12:19:46.478

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2015-06-06 12:19:46.415

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Processor: Pentium(R) Dual-Core CPU E5200 @ 2.50GHz

Percentage of memory in use: 44%

Total physical RAM: 3062.18 MB

Available physical RAM: 1701.97 MB

Total Pagefile: 6122.57 MB

Available Pagefile: 4272.17 MB

Total Virtual: 8192 MB

Available Virtual: 8191.84 MB
 

==================== Drives ================================
 

Drive c: (Eigene Dateien) (Fixed) (Total:58.64 GB) (Free:17.97 GB) NTFS

Drive d: () (Fixed) (Total:43.95 GB) (Free:25.15 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive e: (Eigene Bilder Filme) (Fixed) (Total:39.21 GB) (Free:21.26 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: 102C102B)

Partition 1: (Active) - (Size=43.9 GB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=39.2 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=58.6 GB) - (Type=OF Extended)
 

==================== End of log ============================

--- --- ---

Danke und Gruß,
PC Knecht

schrauber

08.06.2015 06:13

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

PC_Knecht

08.06.2015 11:55

Hallo Schrauber,

hier der ESET-log

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# EOSSerial=244c790ca5aef84b9561031e19287d2d

# end=init

# utc_time=2015-06-02 05:06:16

# local_time=2015-06-02 07:06:16 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# osver=6.1.7601 NT Service Pack 1

Update Init

Update Download

Update Finalize

Updated modules version: 24137

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# EOSSerial=244c790ca5aef84b9561031e19287d2d

# end=updated

# utc_time=2015-06-02 05:08:56

# local_time=2015-06-02 07:08:56 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# osver=6.1.7601 NT Service Pack 1

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7777

# api_version=3.1.1

# EOSSerial=244c790ca5aef84b9561031e19287d2d

# engine=24137

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2015-06-02 07:15:38

# local_time=2015-06-02 09:15:38 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='avast! Antivirus'

# compatibility_mode=783 16777213 71 91 1775998 3215262 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776573 100 94 39284 184902388 0 0

# scanned=248785

# found=16

# cleaned=0

# scan_time=7602

sh=A39B69896808E15089E263A59E4EA37AC4DF24E4 ft=1 fh=38ecfff37c8e3154 vn="Variante von Win32/OpenCandy.C potenziell unsichere Anwendung" ac=I fn="C:\Users\Eltern\Downloads\FreeYouTubeToMP354Converter.exe"

sh=9434866971DD357600C9F2B1E31B7893C3A070F0 ft=1 fh=4f14aeb246e47811 vn="Win32/InstallMonetizer.AQ evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\Users\Eltern\Downloads\PDFCreator-1_7_1_setup.exe"

sh=F218CB4810038F0B9E1DAA6A8E73FA258D620A8C ft=1 fh=719afe2b4494447f vn="Win32/InstallMonetizer.AQ evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\Users\Eltern\Downloads\PDFCreator-2_1_1-setup.exe"

sh=A39B69896808E15089E263A59E4EA37AC4DF24E4 ft=1 fh=38ecfff37c8e3154 vn="Variante von Win32/OpenCandy.C potenziell unsichere Anwendung" ac=I fn="D:\Documents and Settings\Eltern\Downloads\FreeYouTubeToMP354Converter.exe"

sh=9434866971DD357600C9F2B1E31B7893C3A070F0 ft=1 fh=4f14aeb246e47811 vn="Win32/InstallMonetizer.AQ evtl. unerwÃ¼nschte Anwendung" ac=I fn="D:\Documents and Settings\Eltern\Downloads\PDFCreator-1_7_1_setup.exe"

sh=F218CB4810038F0B9E1DAA6A8E73FA258D620A8C ft=1 fh=719afe2b4494447f vn="Win32/InstallMonetizer.AQ evtl. unerwÃ¼nschte Anwendung" ac=I fn="D:\Documents and Settings\Eltern\Downloads\PDFCreator-2_1_1-setup.exe"

sh=B056F41A0C3F1E000172372AED6837CE29D99F0F ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H Anwendung" ac=I fn="D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SaveByclick\dfnfldhlfgmlpgfacmffbnonedjmpjag.crx"

sh=9ED22B17AF956934B73F176C0AEB87AFA2F2B5B3 ft=1 fh=f57fa58ae860c262 vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="D:\RECYCLER\S-1-5-21-1606980848-1390067357-839522115-1003\Dc14.exe"

sh=EECD91D95BF7D5D30F5965414066CA6243280D8C ft=0 fh=0000000000000000 vn="Variante von Win32/Systweak.L evtl. unerwÃ¼nschte Anwendung" ac=I fn="D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP171\A0038320.msi"

sh=EECD91D95BF7D5D30F5965414066CA6243280D8C ft=0 fh=0000000000000000 vn="Variante von Win32/Systweak.L evtl. unerwÃ¼nschte Anwendung" ac=I fn="D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP172\A0038322.msi"

sh=FB778E2059BA0B1EA0A817CB1407F48FBECC9A3A ft=1 fh=99106c1b10a40924 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP175\A0039051.exe"

sh=C89865B729E1F6027A461E7B48CFA68A54590A2D ft=1 fh=30a236b0a4800cbe vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040097.dll"

sh=FDC2005CED8ACF86C68FE1B86B0698D0539E8CE0 ft=1 fh=1aa6a68885750335 vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040098.exe"

sh=085E2EFA6A258EEC88044241035A37DFF3DE3AE9 ft=1 fh=561b7be0126badba vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040099.exe"

sh=7D7C7305298E11EE810078A7FA0640B484A1EA10 ft=1 fh=6ce22f5640248296 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP213\A0046627.exe"

sh=70DAA6E8A3B51AAE267238F9FFD2EB4398ABBEFB ft=1 fh=c46134338f638506 vn="Variante von Win32/OpenCandy.C potenziell unsichere Anwendung" ac=I fn="D:\Unser Kram\Erik\FreeYouTubeToMP3Converter3.12.44.908.exe"

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# EOSSerial=244c790ca5aef84b9561031e19287d2d

# end=init

# utc_time=2015-06-08 08:16:09

# local_time=2015-06-08 10:16:09 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# osver=6.1.7601 NT Service Pack 1

Update Init

Update Download

Update Finalize

Updated modules version: 24218

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# EOSSerial=244c790ca5aef84b9561031e19287d2d

# end=updated

# utc_time=2015-06-08 08:17:38

# local_time=2015-06-08 10:17:38 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# osver=6.1.7601 NT Service Pack 1

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7777

# api_version=3.1.1

# EOSSerial=244c790ca5aef84b9561031e19287d2d

# engine=24218

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2015-06-08 10:17:53

# local_time=2015-06-08 12:17:53 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='avast! Antivirus'

# compatibility_mode=783 16777213 71 91 2262133 3701397 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776573 100 94 82681 185388523 0 0

# scanned=291287

# found=10

# cleaned=0

# scan_time=7214

sh=9434866971DD357600C9F2B1E31B7893C3A070F0 ft=1 fh=4f14aeb246e47811 vn="Win32/InstallMonetizer.AQ evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\Users\Eltern\Downloads\PDFCreator-1_7_1_setup.exe"

sh=F218CB4810038F0B9E1DAA6A8E73FA258D620A8C ft=1 fh=719afe2b4494447f vn="Win32/InstallMonetizer.AQ evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\Users\Eltern\Downloads\PDFCreator-2_1_1-setup.exe"

sh=9434866971DD357600C9F2B1E31B7893C3A070F0 ft=1 fh=4f14aeb246e47811 vn="Win32/InstallMonetizer.AQ evtl. unerwÃ¼nschte Anwendung" ac=I fn="D:\Documents and Settings\Eltern\Downloads\PDFCreator-1_7_1_setup.exe"

sh=F218CB4810038F0B9E1DAA6A8E73FA258D620A8C ft=1 fh=719afe2b4494447f vn="Win32/InstallMonetizer.AQ evtl. unerwÃ¼nschte Anwendung" ac=I fn="D:\Documents and Settings\Eltern\Downloads\PDFCreator-2_1_1-setup.exe"

sh=B056F41A0C3F1E000172372AED6837CE29D99F0F ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H Anwendung" ac=I fn="D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SaveByclick\dfnfldhlfgmlpgfacmffbnonedjmpjag.crx"

sh=EECD91D95BF7D5D30F5965414066CA6243280D8C ft=0 fh=0000000000000000 vn="Variante von Win32/Systweak.L evtl. unerwÃ¼nschte Anwendung" ac=I fn="D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP171\A0038320.msi"

sh=EECD91D95BF7D5D30F5965414066CA6243280D8C ft=0 fh=0000000000000000 vn="Variante von Win32/Systweak.L evtl. unerwÃ¼nschte Anwendung" ac=I fn="D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP172\A0038322.msi"

sh=FB778E2059BA0B1EA0A817CB1407F48FBECC9A3A ft=1 fh=99106c1b10a40924 vn="Variante von Win32/Toolbar.Visicom.A evtl. unerwÃ¼nschte Anwendung" ac=I fn="D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP175\A0039051.exe"

sh=B01F17C4FA8997A4BB6005B7F58440E4F19E712F ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="H:\Daten PC Stube\LW D\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\41\cb37ca9-1225f21c"

sh=861B8C5750DDE6A54C0265426CAFF61F45259B34 ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.ONO Trojaner" ac=I fn="H:\Daten PC Stube\LW D\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\56\2fdd1af8-783131e5"

nun die SecurityCheck-log

Code:

 Results of screen317's Security Check version 1.002  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 11  
 ``````````````Antivirus/Firewall Check:`````````````` 

avast! Antivirus   

 Antivirus up to date!  (On Access scanning disabled!) 
 `````````Anti-malware/Other Utilities Check:````````` 

 Java 8 Update 31  

 Java version 32-bit out of Date! 

 Adobe Flash Player 17.0.0.188  

 Adobe Reader XI  

 Mozilla Firefox (38.0.5) 

 Mozilla Thunderbird (31.7.0) 
 ````````Process Check: objlist.exe by Laurent````````  

 AVAST Software Avast AvastSvc.exe  

 AVAST Software Avast avastui.exe  
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

und hier FRST + Addition

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:06-06-2015

Ran by Eltern (administrator) on ELTERN-PC on 08-06-2015 12:36:50

Running from C:\Users\Eltern\Desktop

Loaded Profiles: Eltern (Available Profiles: Eltern)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(Avast Software s.r.o.) C:\Program Files (x86)\AVAST Software\Avast\AvastSvc.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Avast Software s.r.o.) C:\Program Files (x86)\AVAST Software\Avast\avastui.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files (x86)\AVAST Software\Avast\AvastUI.exe [5515496 2015-05-12] (Avast Software s.r.o.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files (x86)\AVAST Software\Avast\ashShA64.dll [2015-05-04] (Avast Software s.r.o.)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKU\S-1-5-21-2127788250-3807647062-608468377-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files (x86)\AVAST Software\Avast\aswWebRepIE64.dll [2015-05-04] (Avast Software s.r.o.)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)

BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll [2009-02-06] (Zeon Corporation)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files (x86)\AVAST Software\Avast\aswWebRepIE.dll [2015-05-04] (Avast Software s.r.o.)

BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)

Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-03-11] (Citrix Systems, Inc.)

Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-03-11] (Citrix Systems, Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
 

FireFox:

========

FF ProfilePath: C:\Users\Eltern\AppData\Roaming\Mozilla\Firefox\Profiles\myv9y403.default-1432651667587

FF Homepage: https://www.google.de/

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-13] ()

FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-13] ()

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)

FF Extension: Adblock Plus - C:\Users\Eltern\AppData\Roaming\Mozilla\Firefox\Profiles\myv9y403.default-1432651667587\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-05-26]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files (x86)\AVAST Software\Avast\WebRep\FF

FF Extension: Avast Online Security - C:\Program Files (x86)\AVAST Software\Avast\WebRep\FF [2015-04-26]
 

Chrome: 

=======

CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files (x86)\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-26]
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avast! Antivirus; C:\Program Files (x86)\AVAST Software\Avast\AvastSvc.exe [343336 2015-05-04] (Avast Software s.r.o.)

S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112 2013-09-25] (Brother Industries, Ltd.) [File not signed]

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)

S4 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [145256 2011-08-02] (Nuance Communications, Inc.)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-05-04] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-05-04] (Avast Software s.r.o.)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-05-04] (Avast Software s.r.o.)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-05-04] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-05-04] (Avast Software s.r.o.)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-05-04] (Avast Software s.r.o.)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-05-04] (Avast Software s.r.o.)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-05-04] ()

S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2011-07-29] () [File not signed]

S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [14216 2011-07-29] () [File not signed]

S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2011-07-29] () [File not signed]

S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [8456 2011-07-29] () [File not signed]

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 HWiNFO32; \??\C:\Users\Eltern\AppData\Local\Temp\HWiNFO64A.SYS [X]

S3 SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP6\WNt500x64\Sandra.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 

==================== One Month Created files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-06-08 12:36 - 2015-06-08 12:37 - 00009021 _____ C:\Users\Eltern\Desktop\FRST.txt

2015-06-08 12:36 - 2015-06-08 12:36 - 00000874 _____ C:\Users\Eltern\Desktop\checkup.txt

2015-06-08 12:33 - 2015-06-08 12:33 - 00852639 _____ C:\Users\Eltern\Downloads\SecurityCheck.exe

2015-06-08 10:15 - 2015-06-08 10:15 - 02870984 _____ (ESET) C:\Users\Eltern\Downloads\esetsmartinstaller_deu(1).exe

2015-06-07 13:38 - 2015-06-07 13:38 - 02108928 _____ (Farbar) C:\Users\Eltern\Desktop\FRST64.exe

2015-06-07 13:37 - 2015-06-08 10:00 - 00000000 ____D C:\Users\Eltern\Desktop\Virenreiniung

2015-06-07 13:21 - 2015-06-07 13:21 - 00000207 _____ C:\Windows\tweaking.com-regbackup-ELTERN-PC-Windows-7-Home-Premium-(64-bit).dat

2015-06-07 13:21 - 2015-06-07 13:21 - 00000000 ____D C:\RegBackup

2015-06-07 12:44 - 2015-06-07 12:45 - 02231296 _____ C:\Users\Eltern\Downloads\AdwCleaner_4.206.exe

2015-06-06 12:24 - 2015-06-06 12:24 - 00017628 _____ C:\ComboFix.txt

2015-06-06 12:05 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe

2015-06-06 12:05 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe

2015-06-06 12:05 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2015-06-06 12:05 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2015-06-06 12:05 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2015-06-06 12:05 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe

2015-06-06 12:05 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe

2015-06-06 12:05 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe

2015-06-06 12:01 - 2015-06-06 12:24 - 00000000 ____D C:\Qoobox

2015-06-06 12:01 - 2015-06-06 12:22 - 00000000 ____D C:\Windows\erdnt

2015-06-05 08:37 - 2015-06-05 09:23 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2015-06-05 08:32 - 2015-06-05 08:32 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Eltern\Downloads\mbar-1.09.1.1004.exe

2015-06-03 11:26 - 2015-06-03 16:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2015-06-02 19:06 - 2015-06-02 19:06 - 00000000 ____D C:\Program Files (x86)\ESET

2015-06-02 19:05 - 2015-06-02 19:05 - 02870984 _____ (ESET) C:\Users\Eltern\Downloads\esetsmartinstaller_deu.exe

2015-06-02 17:09 - 2015-06-08 12:36 - 00000000 ____D C:\FRST

2015-06-02 17:04 - 2015-06-02 17:04 - 00000000 _____ C:\Users\Eltern\defogger_reenable

2015-06-02 14:26 - 2015-06-02 14:26 - 00000000 ____D C:\Users\Eltern\AppData\Local\GWX

2015-06-01 19:21 - 2015-06-01 19:21 - 00000000 ____D C:\Program Files (x86)\Realtek

2015-06-01 19:21 - 2009-08-18 11:44 - 00236544 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys

2015-06-01 19:21 - 2009-08-18 11:44 - 00067584 _____ C:\Windows\system32\RtNicProp64.dll

2015-06-01 19:21 - 2009-07-22 18:24 - 00097792 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll

2015-06-01 16:49 - 2015-06-01 16:49 - 00000000 ____D C:\Users\Eltern\Documents\hw64_462-1

2015-05-27 12:08 - 2015-05-28 17:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird

2015-05-27 11:25 - 2015-05-27 11:25 - 00001051 _____ C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk

2015-05-27 11:25 - 2015-05-27 11:25 - 00001051 _____ C:\ProgramData\Desktop\Revo Uninstaller Pro.lnk

2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D C:\Users\Eltern\AppData\Local\VS Revo Group

2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D C:\ProgramData\VS Revo Group

2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro

2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D C:\Program Files\VS Revo Group

2015-05-27 11:25 - 2009-12-30 10:21 - 00031800 _____ (VS Revo Group) C:\Windows\system32\Drivers\revoflt.sys

2015-05-27 11:17 - 2015-05-27 11:18 - 10801480 _____ (VS Revo Group ) C:\Users\Eltern\Downloads\RevoUninProSetup-312.exe

2015-05-26 16:47 - 2015-05-26 16:47 - 00000000 ____D C:\Users\Eltern\Desktop\Alte Firefox-Daten

2015-05-26 16:44 - 2015-05-26 16:44 - 00494857 _____ C:\Users\Eltern\Desktop\bookmarks.html

2015-05-26 08:44 - 2015-05-26 08:44 - 00000000 ____D C:\Program Files\avast software

2015-05-20 17:31 - 2015-01-31 05:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll

2015-05-20 17:31 - 2015-01-31 05:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll

2015-05-20 17:31 - 2015-01-31 01:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll

2015-05-20 17:30 - 2014-12-11 19:47 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2015-05-19 20:02 - 2014-09-05 03:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2015-05-19 20:01 - 2014-09-05 04:11 - 06584320 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2015-05-17 19:29 - 2015-05-17 19:29 - 00000000 ____D C:\ProgramData\Emsisoft

2015-05-17 19:01 - 2015-05-17 19:10 - 161426392 _____ (Emsisoft Ltd. ) C:\Users\Eltern\Downloads\emsisoftantimalwaresetup.exe

2015-05-17 17:22 - 2015-05-17 17:22 - 21545848 _____ (Malwarebytes Corporation ) C:\Users\Eltern\Downloads\Anti-Malware.exe

2015-05-17 15:56 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys

2015-05-17 15:56 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe

2015-05-17 15:56 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll

2015-05-17 15:56 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll

2015-05-17 15:56 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll

2015-05-17 15:56 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll

2015-05-17 15:56 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll

2015-05-17 15:56 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll

2015-05-17 15:56 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll

2015-05-17 15:56 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll

2015-05-17 15:56 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe

2015-05-17 15:56 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll

2015-05-17 15:56 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe

2015-05-17 15:56 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll

2015-05-17 15:56 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe

2015-05-17 15:55 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys

2015-05-17 15:55 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll

2015-05-17 15:55 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll

2015-05-17 15:54 - 2015-03-14 05:21 - 01632768 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll

2015-05-17 15:54 - 2015-03-14 05:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll

2015-05-17 15:54 - 2015-03-14 05:04 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll

2015-05-17 15:54 - 2015-03-14 05:04 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll

2015-05-17 13:56 - 2015-05-17 10:57 - 00008969 _____ C:\Users\Eltern\Documents\Arbeitszeitreduzierung.tmd

2015-05-14 19:49 - 2015-05-14 19:49 - 02209792 _____ C:\Users\Eltern\Downloads\adwcleaner_4.204.exe

2015-05-13 08:28 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll

2015-05-13 08:28 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll

2015-05-13 08:19 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2015-05-13 08:19 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2015-05-13 08:19 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2015-05-13 08:19 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2015-05-13 08:19 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2015-05-13 08:19 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2015-05-13 08:19 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2015-05-13 08:19 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2015-05-13 08:19 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2015-05-13 08:19 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec

2015-05-13 08:19 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2015-05-13 08:19 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2015-05-13 08:19 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2015-05-13 08:19 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2015-05-13 08:19 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2015-05-13 08:19 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2015-05-13 08:19 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2015-05-13 08:19 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2015-05-13 08:19 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2015-05-13 08:19 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2015-05-13 08:19 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2015-05-13 08:19 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2015-05-13 08:19 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2015-05-13 08:19 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2015-05-13 08:19 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2015-05-13 08:19 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2015-05-13 08:19 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2015-05-13 08:19 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2015-05-13 08:19 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2015-05-13 08:19 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec

2015-05-13 08:19 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2015-05-13 08:19 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2015-05-13 08:19 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2015-05-13 08:19 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2015-05-13 08:19 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2015-05-13 08:19 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2015-05-13 08:19 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2015-05-13 08:19 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2015-05-13 08:19 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2015-05-13 08:19 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2015-05-13 08:19 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2015-05-13 08:19 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2015-05-13 08:19 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2015-05-13 08:19 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2015-05-13 08:19 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2015-05-13 08:19 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2015-05-13 08:19 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2015-05-13 08:19 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2015-05-13 08:19 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2015-05-13 08:19 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2015-05-13 08:19 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2015-05-13 08:19 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2015-05-13 08:19 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2015-05-13 08:19 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2015-05-13 08:19 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2015-05-13 08:19 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2015-05-13 08:19 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2015-05-13 08:19 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2015-05-13 08:19 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2015-05-13 08:19 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2015-05-13 08:19 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2015-05-13 08:19 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2015-05-13 08:19 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll

2015-05-13 08:19 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll

2015-05-13 08:18 - 2015-04-27 21:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-05-13 08:18 - 2015-04-27 21:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2015-05-13 08:18 - 2015-04-27 21:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2015-05-13 08:18 - 2015-04-27 21:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2015-05-13 08:18 - 2015-04-27 21:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2015-05-13 08:18 - 2015-04-27 21:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe

2015-05-13 08:18 - 2015-04-27 21:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe

2015-05-13 08:18 - 2015-04-27 21:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2015-05-13 08:18 - 2015-04-27 21:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe

2015-05-13 08:18 - 2015-04-27 21:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe

2015-05-13 08:18 - 2015-04-27 21:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe

2015-05-13 08:18 - 2015-04-27 21:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe

2015-05-13 08:18 - 2015-04-27 21:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2015-05-13 08:18 - 2015-04-27 21:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe

2015-05-13 08:18 - 2015-04-27 21:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe

2015-05-13 08:18 - 2015-04-27 21:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2015-05-13 08:18 - 2015-04-27 21:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2015-05-13 08:18 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2015-05-13 08:18 - 2015-04-27 21:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2015-05-13 08:18 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll

2015-05-13 08:18 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2015-05-13 08:18 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2015-05-13 08:18 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2015-05-13 08:18 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll

2015-05-13 08:18 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2015-05-13 08:18 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2015-05-13 08:18 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2015-05-13 08:18 - 2015-04-27 21:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2015-05-13 08:18 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll

2015-05-13 08:18 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2015-05-13 08:18 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe

2015-05-13 08:18 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe

2015-05-13 08:18 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe

2015-05-13 08:18 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe

2015-05-13 08:18 - 2015-04-27 21:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2015-05-13 08:18 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2015-05-13 08:18 - 2015-04-27 21:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2015-05-13 08:18 - 2015-04-27 21:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2015-05-13 08:18 - 2015-04-27 21:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2015-05-13 08:18 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe

2015-05-13 08:18 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe

2015-05-13 08:18 - 2015-04-27 21:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2015-05-13 08:18 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2015-05-13 08:18 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 20:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll

2015-05-13 08:18 - 2015-04-27 19:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2015-05-13 08:18 - 2015-04-27 19:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2015-05-13 08:18 - 2015-04-27 19:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

2015-05-13 08:18 - 2015-04-27 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

2015-05-13 08:18 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe

2015-05-13 08:17 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2015-05-13 08:17 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll

2015-05-13 08:17 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2015-05-13 08:17 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2015-05-13 08:17 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll

2015-05-13 08:17 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll

2015-05-13 08:17 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll

2015-05-13 08:17 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll

2015-05-13 08:17 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll

2015-05-13 08:17 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe

2015-05-13 08:17 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll

2015-05-13 08:17 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll

2015-05-13 08:17 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll

2015-05-13 08:17 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe

2015-05-13 08:17 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe

2015-05-13 08:17 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe

2015-05-13 08:17 - 2015-01-29 05:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll

2015-05-13 08:17 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll

2015-05-10 16:11 - 2015-05-10 16:11 - 00001093 _____ C:\Users\Public\Desktop\PDF24 Creator.lnk

2015-05-10 16:11 - 2015-05-10 16:11 - 00001093 _____ C:\ProgramData\Desktop\PDF24 Creator.lnk

2015-05-10 16:11 - 2015-05-10 16:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24

2015-05-10 16:11 - 2015-05-10 16:11 - 00000000 ____D C:\Program Files (x86)\PDF24

2015-05-10 16:08 - 2015-05-10 16:08 - 16342352 _____ (Geek Software GmbH ) C:\Program Files (x86)\pdf24-creator-6.9.2.exe

2015-05-10 15:30 - 2015-05-10 15:31 - 27837984 _____ (pdfforge ) C:\Users\Eltern\Downloads\PDFCreator-2_1_1-setup.exe

2015-05-10 15:06 - 2015-05-10 15:06 - 00000000 ____D C:\Users\Eltern\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker

2015-05-10 14:47 - 2015-05-10 15:06 - 00000000 ____D C:\Program Files (x86)\Unlocker

2015-05-10 13:14 - 2015-05-10 13:14 - 00001138 _____ C:\Users\Eltern\Desktop\PK.vbs

2015-05-10 10:50 - 2015-05-10 10:50 - 00002562 _____ C:\Windows\diagwrn.xml

2015-05-10 10:50 - 2015-05-10 10:50 - 00001908 _____ C:\Windows\diagerr.xml

2015-05-09 14:08 - 2015-05-10 15:27 - 00000000 ____D C:\Windows\pss
 

==================== One Month Modified files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-06-08 11:33 - 2013-10-14 21:23 - 01986729 _____ C:\Windows\WindowsUpdate.log

2015-06-08 10:15 - 2009-07-14 06:45 - 00023168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-06-08 10:15 - 2009-07-14 06:45 - 00023168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-06-08 10:07 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-06-08 10:06 - 2015-04-19 19:41 - 00005677 _____ C:\Windows\setupact.log

2015-06-07 17:37 - 2015-04-26 13:57 - 00011822 _____ C:\Windows\PFRO.log

2015-06-07 13:20 - 2015-04-26 14:00 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-06-07 12:48 - 2015-04-26 13:54 - 00000000 ____D C:\AdwCleaner

2015-06-06 17:57 - 2015-04-26 16:08 - 00004194 _____ C:\Windows\System32\Tasks\avast! Emergency Update

2015-06-06 12:59 - 2013-10-14 21:31 - 00000000 ____D C:\Users\Eltern

2015-06-06 12:20 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini

2015-06-05 08:34 - 2015-04-26 14:00 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-06-03 16:27 - 2013-10-14 23:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2015-06-02 16:29 - 2013-10-14 23:52 - 00000000 ____D C:\Users\Eltern\AppData\Roaming\vlc

2015-06-02 15:14 - 2009-07-14 19:58 - 00699416 _____ C:\Windows\system32\perfh007.dat

2015-06-02 15:14 - 2009-07-14 19:58 - 00149556 _____ C:\Windows\system32\perfc007.dat

2015-06-02 15:14 - 2009-07-14 07:13 - 01620612 _____ C:\Windows\system32\PerfStringBackup.INI

2015-06-02 10:20 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration

2015-06-01 19:21 - 2014-06-25 19:42 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2015-05-30 19:17 - 2014-06-25 19:46 - 00007887 _____ C:\Windows\BRRBCOM.INI

2015-05-30 18:44 - 2013-10-15 14:51 - 00000000 ____D C:\Windows\rescache

2015-05-28 11:06 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF

2015-05-27 12:03 - 2013-10-17 00:31 - 01593956 _____ C:\Windows\SysWOW64\PerfStringBackup.INI

2015-05-20 18:32 - 2015-04-04 12:12 - 00000000 ___SD C:\Windows\SysWOW64\GWX

2015-05-20 18:32 - 2015-04-04 12:12 - 00000000 ___SD C:\Windows\system32\GWX

2015-05-17 17:54 - 2015-04-26 14:00 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-05-17 16:04 - 2009-07-14 05:20 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

2015-05-17 16:01 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions

2015-05-16 09:18 - 2013-10-17 21:16 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2015-05-14 20:46 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\Resources

2015-05-13 14:17 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT

2015-05-13 10:45 - 2009-07-14 06:45 - 00287472 _____ C:\Windows\system32\FNTCACHE.DAT

2015-05-13 10:42 - 2013-11-15 19:52 - 00000000 ____D C:\Program Files\Windows Journal

2015-05-13 10:42 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\AdvancedInstallers

2015-05-13 08:35 - 2013-10-18 20:38 - 00000000 ____D C:\Windows\system32\MRT

2015-05-13 08:32 - 2013-10-18 20:38 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-05-13 07:57 - 2015-02-04 19:56 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-05-13 07:57 - 2015-02-04 19:56 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-05-10 10:50 - 2015-04-19 19:41 - 00000000 _____ C:\Windows\setuperr.log
 

==================== Files in the root of some directories =======
 

2013-11-15 19:51 - 2013-10-15 01:28 - 3294168 _____ (Piriform Ltd) C:\Program Files\ccsetup406_slim.exe

2014-08-04 15:16 - 2014-08-04 15:16 - 10410712 _____ (Sony Computer Entertainment Inc.                             ) C:\Program Files\CMASetup.exe

2013-11-15 19:51 - 2012-10-11 22:21 - 11766024 _____ (EASEUS                                                      ) C:\Program Files\epm911.exe

2014-02-15 19:34 - 2014-02-15 19:34 - 0921000 _____ (Oracle Corporation) C:\Program Files\jxpiinstall.exe

2014-02-17 18:56 - 2014-02-17 18:56 - 0675988 _____ () C:\Program Files\Minecraft.exe

2014-02-17 20:22 - 2014-02-17 20:22 - 0774144 _____ () C:\Program Files\NBTExplorer-2.7.0.msi

2013-11-15 19:51 - 2013-10-15 16:49 - 0537818 _____ (IDG Magazine Media GmbH                                     ) C:\Program Files\pcwFixMyRights.exe

2014-12-26 17:14 - 2014-12-26 17:14 - 0095662 _____ () C:\Program Files (x86)\7-zip.chm

2014-12-26 17:48 - 2014-12-26 17:48 - 0080384 _____ (Igor Pavlov) C:\Program Files (x86)\7-zip.dll

2014-12-26 17:48 - 2014-12-26 17:48 - 0050176 _____ (Igor Pavlov) C:\Program Files (x86)\7-zip32.dll

2014-12-26 18:00 - 2014-12-26 18:00 - 1508352 _____ (Igor Pavlov) C:\Program Files (x86)\7z.dll

2014-12-26 18:06 - 2014-12-26 18:06 - 0181760 _____ (Igor Pavlov) C:\Program Files (x86)\7z.sfx

2014-12-26 18:06 - 2014-12-26 18:06 - 0166400 _____ (Igor Pavlov) C:\Program Files (x86)\7zCon.sfx

2014-12-26 17:50 - 2014-12-26 17:50 - 0803328 _____ (Igor Pavlov) C:\Program Files (x86)\7zFM.exe

2014-12-26 17:50 - 2014-12-26 17:50 - 0545792 _____ (Igor Pavlov) C:\Program Files (x86)\7zG.exe

2014-08-22 08:08 - 2014-08-22 08:11 - 149527616 _____ () C:\Program Files (x86)\avira_free_antivirus_de_14.0.6.570.exe

2014-11-07 13:28 - 2014-11-07 13:28 - 12436848 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\CitrixOnlinePluginWeb.exe

2015-05-04 18:48 - 2015-05-04 18:49 - 10457912 _____ (Sony Computer Entertainment Inc.                             ) C:\Program Files (x86)\CMASetup.exe

2011-04-04 17:54 - 2011-04-04 17:54 - 0000366 _____ () C:\Program Files (x86)\descript.ion

2015-04-20 17:59 - 2015-04-20 18:03 - 190719264 _____ (Microsoft Corporation) C:\Program Files (x86)\DraftSight64.exe

2015-01-03 12:26 - 2015-01-03 12:29 - 91670064 _____ (The GIMP Team                                               ) C:\Program Files (x86)\gimp-2.8.14-setup.exe

2014-12-26 18:06 - 2014-12-26 18:06 - 0040769 _____ () C:\Program Files (x86)\History.txt

2014-06-12 22:02 - 2014-06-12 22:02 - 0001927 _____ () C:\Program Files (x86)\License.txt

2015-05-10 16:08 - 2015-05-10 16:08 - 16342352 _____ (Geek Software GmbH                                          ) C:\Program Files (x86)\pdf24-creator-6.9.2.exe

2015-01-07 21:39 - 2015-01-07 21:39 - 0001551 _____ () C:\Users\Eltern\AppData\Local\recently-used.xbel
 

Some files in TEMP:

====================

C:\Users\Eltern\AppData\Local\Temp\Quarantine.exe

C:\Users\Eltern\AppData\Local\Temp\sqlite3.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-06-05 15:47
 

==================== End of log ============================

--- --- ---

[CODE]Additional
FRST Logfile:

Code:

scan result of Farbar Recovery Scan Tool (x64) Version:06-06-2015

Ran by Eltern at 2015-06-08 12:38:08

Running from C:\Users\Eltern\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Accounts: =============================
 

Administrator (S-1-5-21-2127788250-3807647062-608468377-500 - Administrator - Disabled)

Eltern (S-1-5-21-2127788250-3807647062-608468377-1000 - Administrator - Enabled) => C:\Users\Eltern

Gast (S-1-5-21-2127788250-3807647062-608468377-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-2127788250-3807647062-608468377-1002 - Limited - Enabled)
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

7-Zip 9.36 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0936-000001000000}) (Version: 9.36.00.0 - Igor Pavlov)

Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)

Amazon Music (HKU\S-1-5-21-2127788250-3807647062-608468377-1000\...\Amazon Amazon Music) (Version: 3.7.1.698 - Amazon Services LLC)

Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.2.2218 - AVAST Software)

Brother MFL-Pro Suite MFC-J245 (HKLM-x32\...\{B742757A-7658-4E09-A51A-085CF0F7F4D3}) (Version: 1.0.0.0 - Brother Industries, Ltd.)

CDex - Open Source Digital Audio CD Extractor (HKLM-x32\...\CDex) (Version: 1.70.4.2009 - Georgy Berdyshev)

Citrix Online Plug-in - Web (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 12.0.0.6410 - Citrix Systems, Inc.)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

DriveImage XML (Private Edition) (HKLM-x32\...\{F7E1CA14-B39D-452A-960B-39423DDDD933}) (Version: 2.44.000 - Runtime Software)

EASEUS Partition Master 9.1.1 Home Edition (HKLM-x32\...\EASEUS Partition Master Home Edition_is1) (Version:  - EASEUS)

ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 16.0.20150211 - Landesfinanzdirektion Thüringen)

ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )

Free YouTube to MP3 Converter version 3.12.54.128 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.54.128 - DVDVideoSoft Ltd.)

GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)

Inhaltsmanager-Assistent für PlayStation(R) (HKLM-x32\...\{961D5D7E-3DEC-4E3B-9065-EA8074923B18}) (Version: 3.31.7643.1 - Sony Computer Entertainment Inc.)

Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)

Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)

Junk Mail filter update (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)

Mozilla Firefox 38.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.5 (x86 de)) (Version: 38.0.5 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 37.0.2 - Mozilla)

Mozilla Thunderbird 31.7.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.7.0 (x86 de)) (Version: 31.7.0 - Mozilla)

MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)

NBTExplorer (HKLM-x32\...\{273D5BF1-EC9C-4549-880D-D8C293296A36}) (Version: 2.7.0.0 - Justin Aquadro)

Nuance PaperPort 12 (HKLM-x32\...\{869FCC6C-5669-4B0B-827E-2BBAACD88A87}) (Version: 12.1.0006 - Nuance Communications, Inc.)

Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc)

PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 14.00.0000 - Nuance Communications, Inc.)

PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)

Pusteblume Sachunterricht 3 (HKLM-x32\...\Pusteblume Sachunterricht 3) (Version:  - Bildungshaus Schulbuchverlage Westermann Schroedel Diesterweg Schöningh Winklers GmbH)

Realtek Ethernet Controller  Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0008 - Realtek)

Revo Uninstaller Pro 3.1.2 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.1.2 - VS Revo Group, Ltd.)

Scansoft PDF Professional (x32 Version:  - ) Hidden

SoftMaker FreeOffice (HKLM-x32\...\{8EBB8452-274B-465D-8324-00B0832FBB02}) (Version: 1.0.3395 - SoftMaker Software GmbH)

Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)

VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
 

==================== Custom CLSID (Whitelisted): ==========================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 

==================== Restore Points =========================
 

05-06-2015 13:58:00 Windows Update

08-06-2015 10:02:33 Revo Uninstaller Pro's restore point - Emsisoft Anti-Malware
 

==================== Hosts content: ===============================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 04:34 - 2015-06-06 12:20 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (Whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

Task: {0051A1AD-0606-4209-BFFE-5DC7ED6C9B20} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-07] (Microsoft Corporation)

Task: {23F31262-F54E-4455-9D7F-0B5E1EAA016E} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)

Task: {31E02CA9-C51E-4460-BA97-B7E21A651C34} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)

Task: {50535350-84E1-4323-9DDE-0CD437D0DE7A} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)

Task: {75E4A4DD-0A3B-429A-B31B-D27696231BBB} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks

Task: {AE7B86A3-5C9A-4947-9E30-BCABB5CE2FE1} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)

Task: {C16F411F-5A38-4010-8311-B2469B0D6545} - System32\Tasks\avast! Emergency Update => C:\Program Files (x86)\AVAST Software\Avast\AvastEmUpdate.exe [2015-05-04] (Avast Software s.r.o.)
 

==================== Loaded Modules (Whitelisted) ==============
 

2015-05-04 13:45 - 2015-05-04 13:45 - 00104400 _____ () C:\Program Files (x86)\AVAST Software\Avast\log.dll

2015-05-04 13:45 - 2015-05-04 13:45 - 00081728 _____ () C:\Program Files (x86)\AVAST Software\Avast\JsonRpcServer.dll

2015-06-07 11:31 - 2015-06-07 11:31 - 02952192 _____ () C:\Program Files (x86)\AVAST Software\Avast\defs\15060700\algo.dll

2015-04-26 16:08 - 2015-04-26 16:08 - 40540672 _____ () C:\Program Files (x86)\AVAST Software\Avast\libcef.dll
 

==================== Alternate Data Streams (Whitelisted) =========
 

(If an entry is included in the fixlist, only the ADS will be removed.)
 
 

==================== Safe Mode (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (Whitelisted) ===============
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 

==================== Internet Explorer trusted/restricted ===============
 

(If an entry is included in the fixlist, it will be removed from the registry.)
 
 

==================== Other Areas ============================
 

(Currently there is no automatic fix for this section.)
 

HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Eltern\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 192.168.2.1
 

==================== MSCONFIG/TASK MANAGER disabled items ==
 

(Currently there is no automatic fix for this section.)
 

MSCONFIG\Services: PDFProFiltSrvPP => 2

MSCONFIG\Services: wscsvc => 2

MSCONFIG\Services: WSearch => 2

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Inhaltsmanager-Assistent für PlayStation(R).lnk => C:\Windows\pss\Inhaltsmanager-Assistent für PlayStation(R).lnk.CommonStartup

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

MSCONFIG\startupreg: Amazon Music => "C:\Users\Eltern\AppData\Local\Amazon Music\Amazon Music Helper.exe"

MSCONFIG\startupreg: BrHelp => C:\Program Files (x86)\Brother\Brother Help\BrotherHelp.exe /AUTORUN

MSCONFIG\startupreg: BrStsMon00 => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN

MSCONFIG\startupreg: ConnectionCenter => "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup

MSCONFIG\startupreg: ControlCenter4 => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe /autorun

MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe

MSCONFIG\startupreg: IndexSearch => "C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe"

MSCONFIG\startupreg: ISUSPM => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler

MSCONFIG\startupreg: PaperPort PTD => "C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe"

MSCONFIG\startupreg: PDF5 Registry Controller => C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe

MSCONFIG\startupreg: PDFHook => C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe

MSCONFIG\startupreg: PDFPrint => C:\Program Files (x86)\PDF24\pdf24.exe

MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe
 

==================== FirewallRules (Whitelisted) ===============
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

FirewallRules: [{1B5878FA-F799-4C68-A2DA-8E7A57B40EFB}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

FirewallRules: [{AF0730C6-8801-41FD-9979-03A14518E175}] => (Allow) LPort=2869

FirewallRules: [{639EFFE0-6DC2-43C2-A676-855C8FEF6F89}] => (Allow) LPort=1900

FirewallRules: [TCP Query User{7A9608B7-A0ED-423F-BE89-7991B131A01B}C:\program files\videolan\vlc\vlc.exe] => (Block) C:\program files\videolan\vlc\vlc.exe

FirewallRules: [UDP Query User{BA917422-0A70-45A0-88FF-CEA25E4D4AA8}C:\program files\videolan\vlc\vlc.exe] => (Block) C:\program files\videolan\vlc\vlc.exe

FirewallRules: [TCP Query User{074F9C1C-051B-4319-BF7A-A98FD2FDF065}C:\program files (x86)\java\jre1.8.0_31\bin\java.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\java.exe

FirewallRules: [UDP Query User{55D30EF6-0A63-403F-900B-656D36616F2B}C:\program files (x86)\java\jre1.8.0_31\bin\java.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\java.exe

FirewallRules: [TCP Query User{362F5215-85FC-421B-B914-ABE6EA456261}C:\program files\firefox.exe] => (Block) C:\program files\firefox.exe

FirewallRules: [UDP Query User{BE7C41C2-E1AB-4E12-9414-4D0DA7F81B6F}C:\program files\firefox.exe] => (Block) C:\program files\firefox.exe

FirewallRules: [{1023DE4E-B766-48DA-AAA2-EF53ED9DE278}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{4F66FC22-FD46-46BE-87E1-A8C2AD47AF02}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
 

==================== Faulty Device Manager Devices =============
 

Name: Microsoft PS/2-Maus

Description: Microsoft PS/2-Maus

Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: i8042prt

Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)

Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.

Devices stay in this state if they have been prepared for removal.

After you remove the device, this error disappears.Remove the device, and this error should be resolved.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (06/08/2015 00:23:12 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
 

Error: (06/08/2015 10:15:58 AM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
 

Error: (06/08/2015 10:15:51 AM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
 

Error: (06/08/2015 10:02:33 AM) (Source: VSS) (EventID: 8194) (User: )

Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert

.

Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
 
 

Vorgang:

   Generatordaten werden gesammelt
 

Kontext:

   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}

   Generatorname: System Writer

   Generatorinstanz-ID: {9e649322-fc6c-412c-96cc-90ab128553c6}
 

Error: (06/07/2015 00:58:28 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
 

Error: (06/07/2015 00:52:54 PM) (Source: ESENT) (EventID: 439) (User: )

Description: Windows (3064) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032.
 

Error: (06/07/2015 00:52:54 PM) (Source: ESENT) (EventID: 490) (User: )

Description: Windows (3064) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
 

Error: (06/06/2015 00:12:23 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: PEV.exe, Version: 0.0.0.0, Zeitstempel: 0x4e06cfe8

Name des fehlerhaften Moduls: PEV.exe, Version: 0.0.0.0, Zeitstempel: 0x4e06cfe8

Ausnahmecode: 0x40000015

Fehleroffset: 0x0008d1c0

ID des fehlerhaften Prozesses: 0x978

Startzeit der fehlerhaften Anwendung: 0xPEV.exe0

Pfad der fehlerhaften Anwendung: PEV.exe1

Pfad des fehlerhaften Moduls: PEV.exe2

Berichtskennung: PEV.exe3
 

Error: (06/06/2015 11:33:43 AM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.

Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
 

Error: (06/06/2015 10:20:39 AM) (Source: ESENT) (EventID: 439) (User: )

Description: Windows (2924) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032.
 
 

System errors:

=============

Error: (06/08/2015 10:17:35 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1275
 

Error: (06/08/2015 10:17:35 AM) (Source: Application Popup) (EventID: 1060) (User: )

Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Users\Eltern\AppData\Local\Temp\ehdrv.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
 

Error: (06/08/2015 10:17:34 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1275
 

Error: (06/08/2015 10:17:34 AM) (Source: Application Popup) (EventID: 1060) (User: )

Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Users\Eltern\AppData\Local\Temp\ehdrv.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
 

Error: (06/08/2015 10:17:34 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1275
 

Error: (06/08/2015 10:17:34 AM) (Source: Application Popup) (EventID: 1060) (User: )

Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Users\Eltern\AppData\Local\Temp\ehdrv.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
 

Error: (06/08/2015 10:17:06 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1275
 

Error: (06/08/2015 10:17:06 AM) (Source: Application Popup) (EventID: 1060) (User: )

Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Users\Eltern\AppData\Local\Temp\ehdrv.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
 

Error: (06/08/2015 10:17:05 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1275
 

Error: (06/08/2015 10:17:05 AM) (Source: Application Popup) (EventID: 1060) (User: )

Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Users\Eltern\AppData\Local\Temp\ehdrv.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
 
 

Microsoft Office:

=========================

Error: (06/08/2015 00:23:12 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
 

Error: (06/08/2015 10:15:58 AM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Users\Eltern\Downloads\esetsmartinstaller_deu(1).exe
 

Error: (06/08/2015 10:15:51 AM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Users\Eltern\Downloads\esetsmartinstaller_deu(1).exe
 

Error: (06/08/2015 10:02:33 AM) (Source: VSS) (EventID: 8194) (User: )

Description: 0x80070005, Zugriff verweigert
 
 

Vorgang:

   Generatordaten werden gesammelt
 

Kontext:

   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}

   Generatorname: System Writer

   Generatorinstanz-ID: {9e649322-fc6c-412c-96cc-90ab128553c6}
 

Error: (06/07/2015 00:58:28 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Users\Eltern\Downloads\esetsmartinstaller_deu.exe
 

Error: (06/07/2015 00:52:54 PM) (Source: ESENT) (EventID: 439) (User: )

Description: Windows3064Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032
 

Error: (06/07/2015 00:52:54 PM) (Source: ESENT) (EventID: 490) (User: )

Description: Windows3064Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
 

Error: (06/06/2015 00:12:23 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: PEV.exe0.0.0.04e06cfe8PEV.exe0.0.0.04e06cfe8400000150008d1c097801d0a0414730849fC:\ComboFix\PEV.exeC:\ComboFix\PEV.exe85e7a99e-0c34-11e5-a6ee-002618b7a239
 

Error: (06/06/2015 11:33:43 AM) (Source: SideBySide) (EventID: 80) (User: )

Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Users\Eltern\Downloads\esetsmartinstaller_deu.exe
 

Error: (06/06/2015 10:20:39 AM) (Source: ESENT) (EventID: 439) (User: )

Description: Windows2924Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032
 
 

CodeIntegrity Errors:

===================================

  Date: 2015-06-06 12:19:46.478

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 

  Date: 2015-06-06 12:19:46.415

  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
 
 

==================== Memory info =========================== 
 

Processor: Pentium(R) Dual-Core CPU E5200 @ 2.50GHz

Percentage of memory in use: 51%

Total physical RAM: 3062.18 MB

Available physical RAM: 1496.37 MB

Total Pagefile: 6122.57 MB

Available Pagefile: 4485.25 MB

Total Virtual: 8192 MB

Available Virtual: 8191.84 MB
 

==================== Drives ================================
 

Drive c: (Eigene Dateien) (Fixed) (Total:58.64 GB) (Free:17.35 GB) NTFS

Drive d: () (Fixed) (Total:43.95 GB) (Free:25.15 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive e: (Eigene Bilder Filme) (Fixed) (Total:39.21 GB) (Free:21.26 GB) NTFS

Drive h: (TOSHIBA EXT) (Fixed) (Total:465.76 GB) (Free:352.05 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: 102C102B)

Partition 1: (Active) - (Size=43.9 GB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=39.2 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=58.6 GB) - (Type=OF Extended)
 

========================================================

Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 5BBE54C7)

Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)
 

==================== End of log ============================

--- --- ---

Win-Explorer und Firefox starten nun schneller, der Thunderbird leider noch nicht.
Zudem ist es so, dass beim Start des Firefox manchmal ein leerer TAB geladen wird, statt der Startseite (bei mir Google). Außerdem sieht es im Firefox manchmal so aus, als würde für den Bruchteil einer Sekunde ein Fenster öffnen und sich gleich wieder schließen bzw. unsichtbar im Hintergrund bleiben. Im Task-Man. ist aber nichts zu sehen.
Ist da immer noch irgendein penetranter Schädling am Werke?

Danke und Gruß,
PC Knecht

schrauber

08.06.2015 20:33

Logs sind sauber.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

C:\Users\Eltern\Downloads\FreeYouTubeToMP354Converter.exe
 

C:\Users\Eltern\Downloads\PDFCreator-1_7_1_setup.exe
 

C:\Users\Eltern\Downloads\PDFCreator-2_1_1-setup.exe
 

D:\Documents and Settings\Eltern\Downloads\FreeYouTubeToMP354Converter.exe
 

D:\Documents and Settings\Eltern\Downloads\PDFCreator-1_7_1_setup.exe
 

D:\Documents and Settings\Eltern\Downloads\PDFCreator-2_1_1-setup.exe
 

D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SaveByclick\dfnfldhlfgmlpgfacmffbnonedjmpjag.crx
 

D:\RECYCLER\S-1-5-21-1606980848-1390067357-839522115-1003\Dc14.exe
 

D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP171\A0038320.msi
 

D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP172\A0038322.msi
 

D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP175\A0039051.exe
 

D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040097.dll
 

D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040098.exe
 

D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040099.exe
 

D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP213\A0046627.exe
 

D:\Unser Kram\Erik\FreeYouTubeToMP3Converter3.12.44.908.exe
 

H:\Daten PC Stube\LW D\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\41\cb37ca9-1225f21c
 

H:\Daten PC Stube\LW D\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\56\2fdd1af8-783131e5

Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Revo Uninstaller - Download - Filepony
damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.mozilla.org/de/kb/fi...einfach-loesen

PC_Knecht

09.06.2015 07:38

Hallo Schrauber,

hier der Fixlog

Code:

Fix result of Farbar Recovery Scan Tool (x64) Version:06-06-2015

Ran by Eltern at 2015-06-09 08:00:50 Run:1

Running from C:\Users\Eltern\Desktop

Loaded Profiles: Eltern (Available Profiles: Eltern)

Boot Mode: Normal

==============================================
 

fixlist content:

*****************

C:\Users\Eltern\Downloads\FreeYouTubeToMP354Converter.exe
 

C:\Users\Eltern\Downloads\PDFCreator-1_7_1_setup.exe
 

C:\Users\Eltern\Downloads\PDFCreator-2_1_1-setup.exe
 

D:\Documents and Settings\Eltern\Downloads\FreeYouTubeToMP354Converter.exe
 

D:\Documents and Settings\Eltern\Downloads\PDFCreator-1_7_1_setup.exe
 

D:\Documents and Settings\Eltern\Downloads\PDFCreator-2_1_1-setup.exe
 

D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SaveByclick\dfnfldhlfgmlpgfacmffbnonedjmpjag.crx
 

D:\RECYCLER\S-1-5-21-1606980848-1390067357-839522115-1003\Dc14.exe
 

D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP171\A0038320.msi
 

D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP172\A0038322.msi
 

D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP175\A0039051.exe
 

D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040097.dll
 

D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040098.exe
 

D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040099.exe
 

D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP213\A0046627.exe
 

D:\Unser Kram\Erik\FreeYouTubeToMP3Converter3.12.44.908.exe
 

H:\Daten PC Stube\LW D\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\41\cb37ca9-1225f21c
 

H:\Daten PC Stube\LW D\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\56\2fdd1af8-783131e5

Emptytemp:

         

*****************
 

C:\Users\Eltern\Downloads\FreeYouTubeToMP354Converter.exe => moved successfully.

C:\Users\Eltern\Downloads\PDFCreator-1_7_1_setup.exe => moved successfully.

C:\Users\Eltern\Downloads\PDFCreator-2_1_1-setup.exe => moved successfully.

"D:\Documents and Settings\Eltern\Downloads\FreeYouTubeToMP354Converter.exe" => File/Folder not found.

"D:\Documents and Settings\Eltern\Downloads\PDFCreator-1_7_1_setup.exe" => File/Folder not found.

"D:\Documents and Settings\Eltern\Downloads\PDFCreator-2_1_1-setup.exe" => File/Folder not found.

D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SaveByclick\dfnfldhlfgmlpgfacmffbnonedjmpjag.crx => moved successfully.

"D:\RECYCLER\S-1-5-21-1606980848-1390067357-839522115-1003\Dc14.exe" => File/Folder not found.

D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP171\A0038320.msi => moved successfully.

D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP172\A0038322.msi => moved successfully.

D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP175\A0039051.exe => moved successfully.

D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040097.dll => moved successfully.

D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040098.exe => moved successfully.

D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040099.exe => moved successfully.

D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP213\A0046627.exe => moved successfully.

D:\Unser Kram\Erik\FreeYouTubeToMP3Converter3.12.44.908.exe => moved successfully.

H:\Daten PC Stube\LW D\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\41\cb37ca9-1225f21c => moved successfully.

H:\Daten PC Stube\LW D\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\56\2fdd1af8-783131e5 => moved successfully.

Habe FF per Revo deinstalliert und FF wieder neu installiert und restauriert.
Allerdings stürzte FF nun einmal ab, was vorher noch nie der Fall war. Ich habe den Absturzbericht als txt auf meinem Desktop. Wäre dieser für Dich von Interesse?

Vielen Dank und Gruß,
PC_Knecht

schrauber

09.06.2015 20:25

Ja, poste mal, ich schau mal rein :)

Alle Zeitangaben in WEZ +1. Es ist jetzt 17:25 Uhr.

Seite 1 von 2

100 Beiträge dieses Themas auf einer Seite anzeigen

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19