Dateien mit "kryptischen" u. chinesische Zeichen verfolgen Registry MRUListEx

M4xNamara · 11.12.2013, 14:50

Hallo,

ich brauche Euren Experten-Rat: Das Problem scheint recht kompliziert.

Situation:

Im Verzeichnis: WindowsApps\ habe ich diese Ordner und Dateien mit "kryptischer" Syntax gefunden, z.B.:

microsoft.windowscommunicationsapps_16.4.4406.1205_x64__8wekyb3d8bbwe\ModernShar eAnything

Ordner: 1) \ÇuôÒ╠.┼Ù! 2) |±êÜV┬ï.³╚ 3) b`Y¥§à.¯û usw.

Im Verzeichnis befinden sich auch Dateien mit den gleichen "kryptischen" Namen.

Zudem die Dateien haben kein bekanntes Datei-Format. Die Datei-Typen heißen z.B. ¯î╩-Datei.
Die Dateien sind zwischen 1 MB - 4 MB schwer und haben merkwürdige Änderungsdaten, wie 18.10.2051.

Die Ordner und Dateien lassen sich nicht öffnen oder löschen, da Windows die Syntax nicht zuordnen kann.

Ich vermute, der Rechner wurde kompromittiert, von einem Trojaner / Backdoor - asiatischen Ursprungs.

Das Problem:

- Obwohl ich den Rechner mehrfach formatiert und Windows neu installiert habe, finde ich nach einer Weile diese Objekte
immer wieder aufs Neue ! Auf einem zweiten Rechner habe die selben Dateien gefunden.

- Es waren keine weitere Software installiert, außer Windows und Wise365 (ist sauber). Es wurde eine Internet-Verbindung
(aus einem Benutzer-Account nicht Admin) genutzt, um die Windows-, IE und Kaspersky-Updates runterzuladen.

- Die bisherigen Sicherheitsmaßnahmen haben nicht funktioniert oder nichts gefunden:

> Kaspersky Sicherheit, geschützte Fritz!Box 7270v2 von Kabel-Deutschland
> Anti-Malware und Root-Kit Scan mit allen bekannten Software, ob im laufenden Betrieb oder als Live-CD (BitDefender, DE- und Kaspersky Rescue 10)
> Deaktivieren Auto-Run / Autoplay
> Deaktivieren Remote-Verbindung / Netzwerk-Datei-Druckerfreigabe
> Deaktivieren DLL in in Registry (Windows NT)

- Aufgefallen sind mir die Dateien nachdem ich mit Wise365 feststellte, das diese Dateien mit chinesischen Namen
den Benutzerverlauf meiner geöffneten und bearbeiteten Dateien in der Registry mit verfolgte.

z.B:
HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ComDlg32\OpenSavePidlMRU\*\MRUListEx

.... \StreamMRU
.... \RecentDocs\Folder\MRUList
.... \RecentDocs\.txt\MRUList
.... \RecentDocs\.png\MRUList usw.

Frage:

Wo vermutet ihr die Sicherheitslücke?

- Malware in der Fritz!Box (trotz aktueller Firmware, da 2. Rechner auch infiziert)
- BIOS
- UPnP (ist aktiviert laut Fritz!Box - vermute wegen Kabel Deutschland)
- infizierte USB, externe HDD (kann die Malware, trotz deaktivierten Auto-Run überspringen ?)

Zunächst aber hier die Log-Files

schrauber · 11.12.2013, 15:02

hi,

ich warte dann mal auf die Logs

M4xNamara · 11.12.2013, 15:50

Danke für die schnelle Antwort. FRST Siehe unten...

FRST Addition

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-12-2013
Ran by Admin at 2013-12-06 00:18:02
Running from C:\Users\Admin\Downloads
Boot Mode: Safe Mode (with Networking)
==========================================================


==================== Security Center ========================

AV: Kaspersky Internet Security (Disabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Disabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}

==================== Installed Programs ======================

ActiveX контрола на Windows Live Mesh за отдалечени връзки (x32 Version: 15.4.5722.2)
ActiveX-kontroll för fjärranslutningar för Windows Live Mesh (x32 Version: 15.4.5722.2)
Adobe AIR (x32 Version: 2.5.1.17730)
Adobe Flash Player 10 ActiveX (x32 Version: 10.2.152.26)
Adobe Flash Player 10 Plugin (x32 Version: 10.2.152.26)
Adobe Reader X MUI (x32 Version: 10.0.0)
Alps Pointing-device for VAIO
ArcSoft Magic-i Visual Effects 2 (x32 Version: 2.0.1.142)
ArcSoft WebCam Companion 4 (x32 Version: 4.0.21.392)
Bing Bar (x32 Version: 7.0.610.0)
Bluetooth Win7 Suite (64) (Version: 7.3.0.100)
Conexant HD Audio (Version: 8.54.0.53)
Control ActiveX Windows Live Mesh pentru conexiuni la distanță (x32 Version: 15.4.5722.2)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (x32 Version: 15.4.5722.2)
Controlo ActiveX do Windows Live Mesh para Ligações Remotas (x32 Version: 15.4.5722.2)
D3DX10 (x32 Version: 15.4.2368.0902)
Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsługę połączeń zdalnych (x32 Version: 15.4.5722.2)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922)
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922)
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922)
Galerie foto Windows Live (x32 Version: 15.4.3502.0922)
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)
Intel(R) Rapid Storage Technology (x32 Version: 10.0.0.1046)
Java Auto Updater (x32 Version: 2.0.2.4)
Java(TM) 6 Update 22 (64-bit) (Version: 6.0.220)
Java(TM) 6 Update 22 (x32 Version: 6.0.220)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Kaspersky Internet Security (x32 Version: 14.0.0.4651)
Media Gallery (Version: 1.5.0.16020)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Silverlight (x32 Version: 4.0.50401.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
NVIDIA 3D Vision Treiber 267.21 (Version: 267.21)
NVIDIA Grafiktreiber 267.21 (Version: 267.21)
NVIDIA HD-Audiotreiber 1.2.19.0 (Version: 1.2.19.0)
NVIDIA Install Application (Version: 2.265.39.0)
NVIDIA PhysX (x32 Version: 9.10.0514)
NVIDIA PhysX-Systemsoftware 9.10.0514 (Version: 9.10.0514)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6721)
NVIDIA Systemsteuerung 267.21 (Version: 267.21)
Ovládací prvek ActiveX platformy Windows Live Mesh pro vzdálená připojení (x32 Version: 15.4.5722.2)
Ovládací prvok ActiveX programu Windows Live Mesh pre vzdialené pripojenia (x32 Version: 15.4.5722.2)
PMB (x32 Version: 5.5.02.12220)
PMB VAIO Edition Plug-in (Version: 1.5.10.05300)
PMB VAIO Edition Plug-in (x32 Version: 1.6.00.06010)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922)
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922)
Realtek PCIE Card Reader (x32 Version: 6.1.7600.77)
Remote Keyboard (x32 Version: 1.1.1.03020)
Remote Play with PlayStation 3 (x32 Version: 1.1.0.15070)
Skype™ 5.1 (x32 Version: 5.1.104)
Sony Corporation (Version: 1.0.0)
SSLx64 (Version: 1.0.0)
SSLx86 (x32 Version: 1.0.0)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3)
Uzak Bağlantılar İçin Windows Live Mesh ActiveX Denetimi (x32 Version: 15.4.5722.2)
VAIO - Media Gallery (x32 Version: 1.5.0.16020)
VAIO - PMB VAIO Edition Guide (x32 Version: 1.6.00.06030)
VAIO - PMB VAIO Edition Plug-in (x32 Version: 1.6.00.06140)
VAIO - Remote Play mit PlayStation®3 (x32 Version: 1.1.0.15070)
VAIO - Remote-Tastatur  (x32 Version: 1.0.1.03020)
VAIO Care (x32 Version: 6.4.0.15030)
VAIO Control Center (x32 Version: 4.5.0.03040)
VAIO Data Restore Tool (x32 Version: 1.6.0.13140)
VAIO Easy Connect (x32 Version: 1.1.1.12200)
VAIO Event Service (x32 Version: 5.5.0.03040)
VAIO Gate (x32 Version: 2.3.0.11090)
VAIO Gate Default (x32 Version: 2.4.0.10090)
VAIO Hardware Diagnostics (x32 Version: 4.2.0.14280)
VAIO Hero Screensaver - Summer 2011 Screensaver (x32)
VAIO Improvement (x32 Version: 1.0.0.14150)
VAIO Improvement Validation (Version: 1.0.4.01190)
VAIO Quick Web Access (x32 Version: 1.4.5.3)
VAIO Sample Contents (x32 Version: 1.4.2.09010)
VAIO Smart Network (x32 Version: 3.5.0.02280)
VAIO Update (x32 Version: 6.3.0.08010)
VAIO-Handbuch (x32 Version: 2.0.0.02250)
VAIO-Support für Übertragungen (x32 Version: 1.4.0.14230)
VCCx86 (x32 Version: 1.0.0)
VESx64 (Version: 1.0.0)
VESx86 (x32 Version: 1.0.0)
VIx64 (Version: 1.0.0)
VIx86 (x32 Version: 1.0.0)
VSNx64 (Version: 1.0.0)
VU5x64 (Version: 1.1.0)
VU5x86 (x32 Version: 1.1.0)
VWSTx86 (x32 Version: 1.0.0)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3508.1109)
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922)
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922)
Windows Live Fotótár (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3508.1109)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (x32 Version: 15.4.5722.2)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX-kontroll for eksterne tilkoblinger (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX-objekt til fjernforbindelser (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX-vezérlő távoli kapcsolatokhoz (x32 Version: 15.4.5722.2)
Windows Live Meshin etäyhteyksien ActiveX-komponentti (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922)
Windows Liven sähköposti (x32 Version: 15.4.3502.0922)
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922)
Wise Care 365 version 2.88 (x32 Version: 2.88)
Wise Registry Cleaner 7.88 (x32 Version: 7.88)
Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις (x32 Version: 15.4.5722.2)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922)
Елемент керування Windows Live Mesh ActiveX для віддалених підключень (x32 Version: 15.4.5722.2)
Основи Windows Live (x32 Version: 15.4.3502.0922)
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922)
Почта Windows Live (x32 Version: 15.4.3502.0922)
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922)
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922)
Фотоколекція Windows Live (x32 Version: 15.4.3502.0922)
Элемент управления Windows Live Mesh ActiveX для удаленных подключений (x32 Version: 15.4.5722.2)

==================== Restore Points  =========================

03-12-2013 18:24:29 Geplanter Prüfpunkt
04-12-2013 09:13:38 Created by Wise Care 365
04-12-2013 09:40:20 Windows Update
04-12-2013 09:52:21 Windows Update
04-12-2013 10:17:23 VAIO Care Automatic Restore Point
04-12-2013 10:30:50 Windows Update
04-12-2013 12:42:12 Entfernt VAIO Update 5
04-12-2013 12:42:32 Installiert VAIO Update
04-12-2013 12:54:57 Created by Wise Care 365
04-12-2013 13:02:51 Windows Update
05-12-2013 17:40:25 Windows Update

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0CB1582B-961A-469F-BDAE-51D35FB697B4} - System32\Tasks\Sony Corporation\VAIO Care\VAIO Care => C:\Program Files\Sony\VAIO Care\VCsystray.exe [2011-02-16] (Sony Corporation)
Task: {15B89A3D-4395-46F9-AB4B-6B0D15A3A3C3} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update Self Repair => C:\Program Files\Sony\VAIO Update\VUSR.exe [2013-08-01] (Sony Corporation)
Task: {25FA6036-ECB0-484F-8905-3263664A5ECF} - System32\Tasks\Wise Turbo Checker => C:\Program Files (x86)\Wise\Wise Care 365\WiseTurbo.exe [2013-08-22] (WiseCleaner.COM)
Task: {4AE89992-9C29-4A83-9EEC-6264F573FDD9} - System32\Tasks\Sony Corporation\VAIO Care\VCOneClick => C:\Program Files\Sony\VAIO Care\VCOneClick.exe [2011-02-16] (Sony Corporation)
Task: {8122E9C0-50C2-4AEA-B589-93AFD331016A} - System32\Tasks\Sony Corporation\VAIO Improvement Validation\VAIO Improvement Validation => C:\Program Files\Sony\VAIO Improvement Validation\viv.exe [2011-01-20] (Sony Corporation)
Task: {881EE455-351F-4B14-A788-E5A01FE2184F} - System32\Tasks\Sony Corporation\VAIO Smart Network\VSN Logon Start => C:\Program Files\Sony\VAIO Smart Network\VSNClient
Task: {9DE02170-A59B-4384-8883-5EE3812A0171} - System32\Tasks\SONY\VAIO Gate\VAIO Gate => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2010-11-16] (Sony Corporation)
Task: {A55D82E4-2AD8-452D-B9CA-D82C764ECB79} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update => C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe [2013-08-01] (Sony Corporation)
Task: {BAEC5DE2-A596-4757-BB5F-445F3E1095BE} - System32\Tasks\Sony Corporation\VAIO Improvement\VAIOImprovementUploader => C:\Program Files\Sony\VAIO Improvement\viuploader.exe [2011-02-15] (Sony Corporation)
Task: {CCF1F4CD-924A-41E8-A7E9-665A4D353943} - System32\Tasks\Wise Care 365 => C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe [2013-08-23] (WiseCleaner.com)
Task: {DCE7C1B1-4768-4B59-84D9-A5656AF5954F} - System32\Tasks\SONY\VAIO Gate\StartExecuteProxy => C:\Program Files\Sony\VAIO Gate\ExecutionProxy.exe [2010-11-16] (Sony Corporation)
Task: C:\Windows\Tasks\User_Feed_Synchronization-{4568D104-D8EB-439E-946B-4BD51DB99973}.job => C:\Windows\system32\msfeedssync.exe
Task: C:\Windows\Tasks\Wise Care 365.job => C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe
Task: C:\Windows\Tasks\Wise Turbo Checker.job => C:\Program Files (x86)\Wise\Wise Care 365\WiseTurbo.exe

==================== Loaded Modules (whitelisted) =============


==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2"

==================== Faulty Device Manager Devices =============

Name: Security Processor Loader Driver
Description: Security Processor Loader Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: spldr
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (12/05/2013 11:06:30 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/05/2013 10:12:12 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (12/05/2013 10:11:42 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.


System errors:
=============
Error: (12/06/2013 00:04:28 AM) (Source: DCOM) (User: )
Description: 1068stisvc{A1F4E726-8CF1-11D1-BF92-0060081ED811}


Microsoft Office Sessions:
=========================
Error: (12/05/2013 11:06:30 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Admin\Downloads\esetsmartinstaller_enu.exe

Error: (12/05/2013 10:12:12 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Admin\Downloads\esetsmartinstaller_enu.exe

Error: (12/05/2013 10:11:42 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Admin\Downloads\esetsmartinstaller_enu.exe


CodeIntegrity Errors:
===================================
  Date: 2013-12-04 15:52:45.153
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume5\00_Backup Updates_*****\Program Files\Windows Defender\MsMpEng.exe" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-04 15:52:45.153
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume5\00_Backup Updates_*****\Program Files\Windows Defender\MsMpEng.exe" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-04 15:52:45.137
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume5\00_Backup Updates_*****\Program Files\Windows Defender\MsMpEng.exe" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-04 15:52:44.560
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume5\00_Backup Updates_*****\Program Files\Windows Defender\MpCmdRun.exe" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-04 15:52:44.529
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume5\00_Backup Updates_*****\Program Files\Windows Defender\MpCmdRun.exe" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-04 15:52:44.498
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume5\00_Backup Updates_*****\Program Files\Windows Defender\MpCmdRun.exe" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-04 15:47:20.001
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume5\00_Backup Updates_*****\Program Files\Common Files\microsoft shared\ink\TabTip.exe" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-04 15:47:19.970
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume5\00_Backup Updates_*****\Program Files\Common Files\microsoft shared\ink\TabTip.exe" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-04 15:47:19.923
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume5\00_Backup Updates_*****\Program Files\Common Files\microsoft shared\ink\TabTip.exe" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-12-04 15:38:19.429
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume5\00_Backup Updates_*****\Programme (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 21%
Total physical RAM: 4077.86 MB
Available physical RAM: 3182.42 MB
Total Pagefile: 8153.9 MB
Available Pagefile: 7446.93 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:581.96 GB) (Free:541.53 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596 GB) (Disk ID: C8AA45A3)
Partition 1: (Not Active) - (Size=14 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=582 GB) - (Type=07 NTFS)

==================== End Of Log ============================

M4xNamara · 11.12.2013, 15:51

GMER

Code:

ATTFilter

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-12-09 16:42:16
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD64 rev.01.0 596,17GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Admin\AppData\Local\Temp\uxrdapod.sys


---- Kernel code sections - GMER 2.1 ----

.text   C:\Windows\System32\win32k.sys!EngAssociateSurface + 328                                                                                                                  fffff960000480f8 8 bytes [E0, B9, 71, 04, 80, F8, FF, ...]
.text   C:\Windows\System32\win32k.sys!W32pServiceTable                                                                                                                           fffff96000114100 7 bytes [C0, 92, F3, FF, 01, 9C, F0]
.text   C:\Windows\System32\win32k.sys!W32pServiceTable + 9                                                                                                                       fffff96000114109 2 bytes [06, 02]
.text   ...                                                                                                                                                                       * 108
.text   C:\Windows\System32\win32k.sys!BRUSHOBJ_pvGetRbrush + 432                                                                                                                 fffff960001cbc88 8 bytes [B8, B5, 71, 04, 80, F8, FF, ...]
.text   C:\Windows\System32\win32k.sys!CLIPOBJ_bEnum + 740                                                                                                                        fffff960001cc158 8 bytes [74, B6, 71, 04, 80, F8, FF, ...]
.text   C:\Windows\System32\win32k.sys!EngAcquireSemaphoreNoWait + 76                                                                                                             fffff960001cc7e8 8 bytes [40, B7, 71, 04, 80, F8, FF, ...]
.text   C:\Windows\System32\win32k.sys!EngIsSemaphoreSharedByCurrentThread + 24                                                                                                   fffff960001cc8c8 8 bytes [58, B9, 71, 04, 80, F8, FF, ...]
.text   C:\Windows\System32\win32k.sys!EngDeleteSafeSemaphore + 52                                                                                                                fffff960001cc998 8 bytes [04, C0, 71, 04, 80, F8, FF, ...]
.text   C:\Windows\System32\win32k.sys!EngMapSection + 240                                                                                                                        fffff960001cd408 8 bytes [24, B4, 71, 04, 80, F8, FF, ...]
.text   C:\Windows\System32\win32k.sys!EngGetProcessHandle + 386                                                                                                                  fffff960001d2d06 6 bytes {JMP QWORD [RIP+0x3b38c]}
.text   C:\Windows\System32\win32k.sys!EngCreateBitmap + 44                                                                                                                       fffff960001d4828 8 bytes [F8, B7, 71, 04, 80, F8, FF, ...]
.text   C:\Windows\System32\win32k.sys!EngCreateEvent + 88                                                                                                                        fffff960001dd1d8 8 bytes [30, BC, 71, 04, 80, F8, FF, ...]
.text   C:\Windows\System32\win32k.sys!EngDeleteEvent + 40                                                                                                                        fffff960001dd208 8 bytes [98, C8, 71, 04, 80, F8, FF, ...]
.text   C:\Windows\System32\win32k.sys!EngRectInRgn + 48                                                                                                                          fffff960001dd678 8 bytes [38, BD, 71, 04, 80, F8, FF, ...]
.text   C:\Windows\System32\win32k.sys!EngSetRectRgn + 84                                                                                                                         fffff960001dd7f8 8 bytes [F0, C0, 71, 04, 80, F8, FF, ...]
.text   C:\Windows\System32\win32k.sys!EngGetCurrentCodePage + 20                                                                                                                 fffff960001de018 8 bytes [70, CD, 71, 04, 80, F8, FF, ...]
.text   C:\Windows\System32\win32k.sys!EngLockDriverObj + 36                                                                                                                      fffff960001f7c98 8 bytes [28, B3, 71, 04, 80, F8, FF, ...]
.text   C:\Windows\System32\win32k.sys!EngCreatePath + 148                                                                                                                        fffff960001f87e8 8 bytes [D4, BC, 71, 04, 80, F8, FF, ...]
.text   C:\Windows\System32\win32k.sys!EngGetPrinterData + 24                                                                                                                     fffff960001fe638 8 bytes [C4, C4, 71, 04, 80, F8, FF, ...]
.text   C:\Windows\System32\win32k.sys!EngGetTickCount + 24                                                                                                                       fffff960001fe658 8 bytes [50, BE, 71, 04, 80, F8, FF, ...]
.text   C:\Windows\System32\win32k.sys!EngLoadModuleForWrite + 16                                                                                                                 fffff9600020e5e8 8 bytes {CALL QWORD [RAX+0x471c74c]}

---- User code sections - GMER 2.1 ----

.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                0000000077071465 2 bytes [07, 77]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                               00000000770714bb 2 bytes [07, 77]
.text   ...                                                                                                                                                                       * 2
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                   00000000776111f5 8 bytes {JMP 0xd}
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                 0000000077611390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                        000000007761143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                        000000007761158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                000000007761191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                0000000077611b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                               0000000077611bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                  0000000077611d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                  0000000077611eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                      0000000077611edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                     0000000077611f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                    0000000077611fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                            0000000077611fd7 8 bytes {JMP 0xb}
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                        0000000077612272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                        0000000077612301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578             0000000077612792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                    00000000776127b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                  00000000776127d2 8 bytes {JMP 0x10}
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79   000000007761282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176  0000000077612890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                                       * 2
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299          0000000077612d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367          0000000077612d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                                       * 3
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                  0000000077613023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                      000000007761323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                      00000000776133c0 16 bytes {JMP 0x4e}
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                     0000000077613a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                     0000000077613ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197         0000000077613b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611         0000000077613d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                  0000000077614190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                            0000000077661380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                          0000000077661500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                0000000077661530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                              0000000077661650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                  0000000077661700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                  0000000077661d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                0000000077661f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                00000000776627e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312              0000000074f913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471              0000000074f9146b 8 bytes {JMP 0xffffffffffffffb0}
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                           0000000074f916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                             0000000074f916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                        0000000074f919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                        0000000074f919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                  0000000074f91a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                    0000000074f91a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                  0000000074f91a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[1928] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                       0000000074f91a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                        00000000776111f5 8 bytes {JMP 0xd}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                      0000000077611390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                             000000007761143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                             000000007761158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                     000000007761191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                     0000000077611b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                    0000000077611bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                       0000000077611d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                       0000000077611eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                           0000000077611edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                          0000000077611f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                         0000000077611fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                 0000000077611fd7 8 bytes {JMP 0xb}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                             0000000077612272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                             0000000077612301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                  0000000077612792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                         00000000776127b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                       00000000776127d2 8 bytes {JMP 0x10}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79        000000007761282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176       0000000077612890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                                       * 2
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299               0000000077612d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367               0000000077612d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                                       * 3
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                       0000000077613023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                           000000007761323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                           00000000776133c0 16 bytes {JMP 0x4e}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                          0000000077613a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                          0000000077613ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197              0000000077613b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611              0000000077613d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                       0000000077614190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                 0000000077661380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                               0000000077661500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                     0000000077661530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                   0000000077661650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                       0000000077661700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                       0000000077661d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                     0000000077661f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                     00000000776627e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                   0000000074f913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                   0000000074f9146b 8 bytes {JMP 0xffffffffffffffb0}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                0000000074f916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                  0000000074f916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                             0000000074f919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                             0000000074f919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                       0000000074f91a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                         0000000074f91a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                       0000000074f91a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1904] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                            0000000074f91a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                               00000000776111f5 8 bytes {JMP 0xd}
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                             0000000077611390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                    000000007761143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                    000000007761158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                            000000007761191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                            0000000077611b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                           0000000077611bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                              0000000077611d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                              0000000077611eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                  0000000077611edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                 0000000077611f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                0000000077611fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                        0000000077611fd7 8 bytes {JMP 0xb}
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                    0000000077612272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                    0000000077612301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                         0000000077612792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                00000000776127b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                              00000000776127d2 8 bytes {JMP 0x10}
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79               000000007761282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176              0000000077612890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                                       * 2
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                      0000000077612d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                      0000000077612d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                                       * 3
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                              0000000077613023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                  000000007761323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                  00000000776133c0 16 bytes {JMP 0x4e}
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                 0000000077613a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                 0000000077613ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                     0000000077613b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                     0000000077613d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                              0000000077614190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                        0000000077661380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                      0000000077661500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                            0000000077661530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                          0000000077661650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                              0000000077661700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                              0000000077661d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                            0000000077661f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                            00000000776627e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                          0000000074f913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                          0000000074f9146b 8 bytes {JMP 0xffffffffffffffb0}
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                       0000000074f916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                         0000000074f916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                    0000000074f919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                    0000000074f919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                              0000000074f91a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                0000000074f91a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                              0000000074f91a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                   0000000074f91a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                     0000000077071465 2 bytes [07, 77]
.text   C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                    00000000770714bb 2 bytes [07, 77]
.text   ...                                                                                                                                                                       * 2
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                        00000000776111f5 8 bytes {JMP 0xd}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                      0000000077611390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                             000000007761143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                             000000007761158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                     000000007761191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                     0000000077611b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                    0000000077611bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                       0000000077611d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                       0000000077611eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                           0000000077611edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                          0000000077611f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                         0000000077611fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                 0000000077611fd7 8 bytes {JMP 0xb}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                             0000000077612272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                             0000000077612301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                  0000000077612792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                         00000000776127b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                       00000000776127d2 8 bytes {JMP 0x10}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79        000000007761282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176       0000000077612890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                                       * 2
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299               0000000077612d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367               0000000077612d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                                       * 3
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                       0000000077613023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                           000000007761323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                           00000000776133c0 16 bytes {JMP 0x4e}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                          0000000077613a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                          0000000077613ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197              0000000077613b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611              0000000077613d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                       0000000077614190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                 0000000077661380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                               0000000077661500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                     0000000077661530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                   0000000077661650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                       0000000077661700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                       0000000077661d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                     0000000077661f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                     00000000776627e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                   0000000074f913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                   0000000074f9146b 8 bytes {JMP 0xffffffffffffffb0}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                0000000074f916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                  0000000074f916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                             0000000074f919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                             0000000074f919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                       0000000074f91a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                         0000000074f91a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                       0000000074f91a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3412] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                            0000000074f91a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                          00000000776111f5 8 bytes {JMP 0xd}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                        0000000077611390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                               000000007761143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                               000000007761158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                       000000007761191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                       0000000077611b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                      0000000077611bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                         0000000077611d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                         0000000077611eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                             0000000077611edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                            0000000077611f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                           0000000077611fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                   0000000077611fd7 8 bytes {JMP 0xb}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                               0000000077612272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                               0000000077612301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                    0000000077612792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                           00000000776127b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                         00000000776127d2 8 bytes {JMP 0x10}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                          000000007761282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                         0000000077612890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                                       * 2
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                 0000000077612d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                 0000000077612d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                                       * 3
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                         0000000077613023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                             000000007761323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                             00000000776133c0 16 bytes {JMP 0x4e}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                            0000000077613a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                            0000000077613ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                0000000077613b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                0000000077613d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                         0000000077614190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                   0000000077661380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                 0000000077661500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                       0000000077661530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                     0000000077661650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                         0000000077661700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                         0000000077661d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                       0000000077661f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                       00000000776627e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                     0000000074f913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                     0000000074f9146b 8 bytes {JMP 0xffffffffffffffb0}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                  0000000074f916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                    0000000074f916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                               0000000074f919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                               0000000074f919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                         0000000074f91a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                           0000000074f91a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                         0000000074f91a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3892] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                              0000000074f91a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                         00000000776111f5 8 bytes {JMP 0xd}
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                       0000000077611390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                              000000007761143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                              000000007761158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                      000000007761191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                      0000000077611b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                     0000000077611bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                        0000000077611d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                        0000000077611eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                            0000000077611edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                           0000000077611f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                          0000000077611fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                  0000000077611fd7 8 bytes {JMP 0xb}
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                              0000000077612272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                              0000000077612301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                   0000000077612792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                          00000000776127b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                        00000000776127d2 8 bytes {JMP 0x10}
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                         000000007761282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                        0000000077612890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                                       * 2
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                0000000077612d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                0000000077612d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                                       * 3
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                        0000000077613023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                            000000007761323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                            00000000776133c0 16 bytes {JMP 0x4e}
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                           0000000077613a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                           0000000077613ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                               0000000077613b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                               0000000077613d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                        0000000077614190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                  0000000077661380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                0000000077661500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                      0000000077661530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                    0000000077661650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                        0000000077661700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                        0000000077661d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                      0000000077661f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                      00000000776627e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                    0000000074f913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                    0000000074f9146b 8 bytes {JMP 0xffffffffffffffb0}
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                 0000000074f916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                   0000000074f916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                              0000000074f919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                              0000000074f919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                        0000000074f91a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                          0000000074f91a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                        0000000074f91a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\VCService.exe[4680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                             0000000074f91a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                          00000000776111f5 8 bytes {JMP 0xd}
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                        0000000077611390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                               000000007761143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                               000000007761158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                       000000007761191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                       0000000077611b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                      0000000077611bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                         0000000077611d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                         0000000077611eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                             0000000077611edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                            0000000077611f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                           0000000077611fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                   0000000077611fd7 8 bytes {JMP 0xb}
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                               0000000077612272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                               0000000077612301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                    0000000077612792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                           00000000776127b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                         00000000776127d2 8 bytes {JMP 0x10}
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                          000000007761282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                         0000000077612890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                                       * 2
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                 0000000077612d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                 0000000077612d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                                       * 3
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                         0000000077613023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                             000000007761323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                             00000000776133c0 16 bytes {JMP 0x4e}
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                            0000000077613a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                            0000000077613ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                0000000077613b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                0000000077613d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                         0000000077614190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                   0000000077661380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                 0000000077661500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                       0000000077661530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                     0000000077661650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                         0000000077661700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                         0000000077661d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                       0000000077661f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                       00000000776627e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                     0000000074f913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                     0000000074f9146b 8 bytes {JMP 0xffffffffffffffb0}
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                  0000000074f916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                    0000000074f916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                               0000000074f919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                               0000000074f919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                         0000000074f91a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                           0000000074f91a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                         0000000074f91a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                              0000000074f91a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                0000000077071465 2 bytes [07, 77]
.text   C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                               00000000770714bb 2 bytes [07, 77]
.text   ...                                                                                                                                                                       * 2
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                          00000000776111f5 8 bytes {JMP 0xd}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                        0000000077611390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                               000000007761143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                               000000007761158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                       000000007761191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                       0000000077611b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                      0000000077611bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                         0000000077611d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                         0000000077611eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                             0000000077611edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                            0000000077611f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                           0000000077611fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                   0000000077611fd7 8 bytes {JMP 0xb}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                               0000000077612272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                               0000000077612301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                    0000000077612792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                           00000000776127b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                         00000000776127d2 8 bytes {JMP 0x10}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                          000000007761282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                         0000000077612890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                                       * 2
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                 0000000077612d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                 0000000077612d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                                       * 3
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                         0000000077613023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                             000000007761323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                             00000000776133c0 16 bytes {JMP 0x4e}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                            0000000077613a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                            0000000077613ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                0000000077613b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                0000000077613d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                         0000000077614190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                   0000000077661380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                 0000000077661500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                       0000000077661530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                     0000000077661650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                         0000000077661700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                         0000000077661d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                       0000000077661f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                       00000000776627e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                     0000000074f913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                     0000000074f9146b 8 bytes {JMP 0xffffffffffffffb0}
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                  0000000074f916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                    0000000074f916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                               0000000074f919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                               0000000074f919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                         0000000074f91a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                           0000000074f91a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                         0000000074f91a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Program Files\Sony\VAIO Care\listener.exe[3548] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                              0000000074f91a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5                                                                             00000000776111f5 8 bytes {JMP 0xd}
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416                                                                           0000000077611390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                  000000007761143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492                                                                  000000007761158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                          000000007761191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636                                                                          0000000077611b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204                                                                         0000000077611bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                            0000000077611d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691                                                            0000000077611eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                0000000077611edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84                                                                               0000000077611f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81                                                                              0000000077611fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7                                                                      0000000077611fd7 8 bytes {JMP 0xb}
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658                                                                  0000000077612272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801                                                                  0000000077612301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578                                                       0000000077612792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                              00000000776127b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                            00000000776127d2 8 bytes {JMP 0x10}
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                             000000007761282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176                                            0000000077612890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                                       * 2
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                    0000000077612d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367                                                    0000000077612d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   ...                                                                                                                                                                       * 3
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483                                                            0000000077613023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                000000007761323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912                                                                00000000776133c0 16 bytes {JMP 0x4e}
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                               0000000077613a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                               0000000077613ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                   0000000077613b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611                                                   0000000077613d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                            0000000077614190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                      0000000077661380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                    0000000077661500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                          0000000077661530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                        0000000077661650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                            0000000077661700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                            0000000077661d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                          0000000077661f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                          00000000776627e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                        0000000074f913cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                        0000000074f9146b 8 bytes {JMP 0xffffffffffffffb0}
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                     0000000074f916d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3                                                                       0000000074f916e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                  0000000074f919db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                  0000000074f919fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23                                                            0000000074f91a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3                                                              0000000074f91a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                            0000000074f91a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text   C:\Users\Admin\Desktop\gmer_2.1.19163.exe[4344] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3                                                                 0000000074f91a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

---- Kernel IAT/EAT - GMER 2.1 ----

IAT     C:\Windows\System32\win32k.sys[ntoskrnl.exe!KeUserModeCallback]                                                                                                           [fffff8800477deb8] \SystemRoot\system32\DRIVERS\klif.sys [PAGE]

---- Threads - GMER 2.1 ----

Thread   [1892:856]                                                                                                                                                               0000000077842e65
Thread   [1892:1480]                                                                                                                                                              0000000074617950
Thread   [1892:2380]                                                                                                                                                              00000000747bc59c
Thread   [1892:2352]                                                                                                                                                              00000000747bc59c
Thread   [1892:3640]                                                                                                                                                              00000000747bc59c
Thread   [1892:3644]                                                                                                                                                              00000000747bc59c
Thread   [1892:3208]                                                                                                                                                              00000000738233a8
Thread   [1892:3276]                                                                                                                                                              000000007388f5d0
Thread   [1892:3652]                                                                                                                                                              000000007388f5d0
Thread   [1892:1924]                                                                                                                                                              00000000663c91c4
Thread   [1892:3596]                                                                                                                                                              000000007269786a
Thread   [1892:3656]                                                                                                                                                              000000005f60fed7
Thread   [1892:3852]                                                                                                                                                              000000005f148cba
Thread   [1892:3608]                                                                                                                                                              000000005f148cba
Thread   [1892:1752]                                                                                                                                                              000000005f148cba
Thread   [1892:2600]                                                                                                                                                              00000000770912e5
Thread   [1892:2084]                                                                                                                                                              00000000770912e5
Thread   [1892:1720]                                                                                                                                                              0000000077843e85
Thread   [1892:2864]                                                                                                                                                              000000005f148cba
Thread   [1892:3572]                                                                                                                                                              00000000747bc59c
Thread   [1892:4232]                                                                                                                                                              0000000077843e85
Thread   [1892:4372]                                                                                                                                                              0000000077843e85

---- Registry - GMER 2.1 ----

Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\90004eb9dbaa                                                                                               
Reg     HKLM\SYSTEM\CurrentControlSet\services\KLIF\Parameters@LastProcessedRevision                                                                                              11007287
Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\90004eb9dbaa (not active ControlSet)                                                                           

---- EOF - GMER 2.1 ----

M4xNamara · 11.12.2013, 16:01

Hier die FRST Teil 1

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-12-2013
Ran by Admin (administrator) on KA-LAPTOP on 09-12-2013 17:58:14
Running from C:\Users\Admin\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(WiseCleaner.com) C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
(Sony Corporation) C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCPerfService.exe
(Sony of America Corporation) C:\Program Files\Sony\VAIO Care\listener.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [cAudioFilterAgent] - C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe [518784 2011-03-29] (Conexant Systems, Inc.)
HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [790688 2011-04-29] (Atheros Communications)
HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [657568 2011-04-29] (Atheros Commnucations)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint\Apoint.exe [226672 2011-10-17] (Alps Electric Co., Ltd.)
HKCU\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKLM-x32\...\Run: [PMBVolumeWatcher] - C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [648032 2010-11-27] (Sony Corporation)
HKLM-x32\...\Run: [ISBMgr.exe] - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [2757312 2011-02-15] (Sony Corporation)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-09-13] (Intel Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://vaioportal.sony.eu
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://sony.msn.com
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {27191D46-A9A3-4050-9B0D-4D0A0BA67973} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-27/4?mpre=hxxp://shop.ebay.de/?oemInLn=ieSrch-Q311&_nkw={searchTerms}
SearchScopes: HKCU - {DB5CB5D2-0E2B-4131-BE34-62FC778F1736} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
BHO: No Name - {27B4851A-3207-45A2-B947-BE8AFE6163AB} -  No File
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: No Name - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -  No File
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: No Name - {27B4851A-3207-45A2-B947-BE8AFE6163AB} -  No File
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: No Name - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -  No File
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

==================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [146592 2011-04-29] (Atheros)
S2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-12-04] (Kaspersky Lab ZAO)
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [259192 2011-01-29] (Sony Corporation)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [105024 2011-02-23] (ArcSoft, Inc.)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [887000 2011-01-20] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1368624 2013-08-01] (Sony Corporation)
S2 WiseBootAssistant; C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe [580232 2013-04-25] (WiseCleaner.com)

==================== Drivers (Whitelisted) ====================

R1 A2DDA; C:\EEK\RUN\a2ddax64.sys [26176 2013-08-20] (Emsisoft GmbH)
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
S3 cleanhlp; C:\EEK\RUN\cleanhlp64.sys [57024 2013-12-05] (Emsisoft GmbH)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2013-12-04] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [112224 2013-06-08] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [623200 2013-12-04] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-12-04] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-12-04] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-12-04] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178784 2013-06-06] (Kaspersky Lab ZAO)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
U3 uxrdapod; \??\C:\Users\Admin\AppData\Local\Temp\uxrdapod.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-09 17:58 - 2013-12-09 17:58 - 00011581 _____ C:\Users\Admin\Desktop\FRST.txt
2013-12-09 17:51 - 2013-12-09 17:51 - 00291132 _____ C:\Users\Admin\Desktop\OTL.Txt
2013-12-09 17:51 - 2013-12-09 17:51 - 00083524 _____ C:\Users\Admin\Desktop\Extras.Txt
2013-12-09 17:01 - 2013-12-09 17:01 - 00339936 _____ C:\Windows\Minidump\120913-36629-01.dmp
2013-12-09 17:01 - 2013-12-09 17:01 - 00000000 ____D C:\Windows\Minidump
2013-12-09 17:00 - 2013-12-09 17:00 - 669890749 _____ C:\Windows\MEMORY.DMP
2013-12-09 16:43 - 2013-12-09 16:43 - 00117321 _____ C:\Users\Admin\Desktop\GMER-RootkitScan_09122013.txt
2013-12-08 18:08 - 2013-12-08 18:08 - 00000000 ____D C:\Users\*****\AppData\Local\Adobe
2013-12-06 19:19 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2013-12-06 19:15 - 2013-12-06 19:16 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-06 19:15 - 2013-12-06 19:15 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-06 19:15 - 2013-12-06 19:15 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-06 19:15 - 2013-12-06 19:15 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-06 19:15 - 2013-12-06 19:15 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-12-06 19:15 - 2013-12-06 19:15 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-06 19:15 - 2013-12-06 19:15 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-06 19:15 - 2013-12-06 19:15 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-12-06 19:15 - 2013-12-06 19:15 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-06 19:15 - 2013-12-06 19:15 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-12-06 19:15 - 2013-12-06 19:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-06 19:14 - 2013-12-06 19:19 - 00010277 _____ C:\Windows\IE11_main.log
2013-12-06 16:25 - 2013-04-17 08:02 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-12-06 16:25 - 2013-04-17 07:24 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-12-06 16:25 - 2012-02-11 07:36 - 00559104 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2013-12-06 16:25 - 2012-02-11 07:36 - 00067072 _____ (Microsoft Corporation) C:\Windows\splwow64.exe
2013-12-06 16:18 - 2013-12-09 17:07 - 00245706 _____ C:\Windows\WindowsUpdate.log
2013-12-06 16:16 - 2013-12-06 16:16 - 00000346 _____ C:\Windows\PFRO.log
2013-12-06 01:32 - 2013-12-06 01:32 - 00000000 ____D C:\ProgramData\Licenses
2013-12-06 01:32 - 2011-11-04 05:13 - 01070352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCOMCTL.OCX
2013-12-06 01:32 - 2009-03-24 12:52 - 00129872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSSTDFMT.DLL
2013-12-06 00:37 - 2013-12-06 00:37 - 00000000 ____D C:\Program Files (x86)\BillP Studios
2013-12-06 00:31 - 2013-12-09 17:03 - 00003484 _____ C:\Windows\setupact.log
2013-12-06 00:31 - 2013-12-06 00:31 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-12-06 00:31 - 2013-12-06 00:31 - 00000000 _____ C:\Windows\setuperr.log
2013-12-06 00:17 - 2013-12-06 00:17 - 00000000 ____D C:\FRST
2013-12-06 00:15 - 2013-12-06 00:15 - 00000000 ____D C:\AdwCleaner
2013-12-05 23:56 - 2013-12-05 23:59 - 222867736 _____ (Emsisoft GmbH                                               ) C:\Users\Admin\Downloads\EmsisoftAntiMalwareSetup.exe
2013-12-05 23:44 - 2013-12-05 23:45 - 05049344 _____ (Crawler.com                                                 ) C:\Users\Admin\Downloads\SpywareTerminatorSetup.exe
2013-12-05 23:44 - 2013-12-05 23:44 - 00910888 _____ (BillP Studios) C:\Users\Admin\Downloads\wpsetup.exe
2013-12-05 23:43 - 2013-12-05 23:43 - 04095448 _____ (BrightFort LLC                                              ) C:\Users\Admin\Downloads\spywareblastersetup50.exe
2013-12-05 23:42 - 2013-12-05 23:44 - 12413440 _____ C:\Users\Admin\Downloads\avgas-setup-7.5.1.43.exe
2013-12-05 23:42 - 2013-12-05 23:42 - 01793648 _____ (Malwarebytes                                                ) C:\Users\Admin\Downloads\mbae-setup-0.09.4.2000.exe
2013-12-05 23:41 - 2013-12-05 23:41 - 10264904 _____ (SurfRight B.V.) C:\Users\Admin\Downloads\HitmanPro_x64.exe
2013-12-05 23:40 - 2013-12-05 23:40 - 01339288 _____ C:\Users\Admin\Downloads\sar_15_sfx.exe
2013-12-05 23:38 - 2013-12-09 17:03 - 00000422 _____ C:\Windows\Tasks\Wise Care 365.job
2013-12-05 23:37 - 2013-12-05 23:37 - 00000603 _____ C:\Users\Admin\Downloads\UpdateInfo.txt
2013-12-05 23:35 - 2013-12-05 23:35 - 01925140 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2013-12-05 23:33 - 2013-12-05 23:33 - 00891200 _____ C:\Users\Admin\Downloads\SecurityCheck.exe
2013-12-05 23:28 - 2013-12-05 23:28 - 00000546 _____ C:\Users\Admin\Desktop\Emsisoft Emergency Kit.lnk
2013-12-05 23:28 - 2013-12-05 23:28 - 00000000 ____D C:\EEK
2013-12-05 23:06 - 2013-12-05 23:06 - 04166144 _____ C:\Users\Admin\Downloads\RogueKillerX64.exe
2013-12-05 22:08 - 2013-12-05 22:08 - 00000000 ____D C:\Windows\ERUNT
2013-12-05 22:07 - 2013-12-05 22:07 - 00066104 _____ C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-05 22:07 - 2013-12-05 22:07 - 00000000 ____D C:\ProgramData\AVAST Software
2013-12-05 22:05 - 2013-12-05 23:26 - 00000000 ____D C:\Users\Admin\Desktop\RK_Quarantine
2013-12-05 22:02 - 2013-12-06 00:36 - 00000000 ____D C:\ProgramData\HitmanPro
2013-12-05 22:02 - 2013-12-05 22:02 - 00000000 ____D C:\Users\Admin\Desktop\rkill
2013-12-05 21:51 - 2013-12-05 21:51 - 00000013 _____ C:\fix.bat
2013-12-05 18:44 - 2013-12-05 18:44 - 00116440 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-05 18:43 - 2013-12-05 19:16 - 00000000 ____D C:\mbar
2013-12-05 18:43 - 2013-12-05 18:43 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-05 18:28 - 2013-12-05 18:28 - 00000603 _____ C:\Users\*****\Downloads\UpdateInfo.txt
2013-12-04 19:42 - 2013-12-04 19:43 - 79671920 _____ (Sophos Limited) C:\Users\Admin\Downloads\Sophos Virus Removal Tool.exe
2013-12-04 19:40 - 2013-12-04 19:40 - 01668154 _____ C:\Users\Admin\Downloads\fb_add_on@avm.de.xpi
2013-12-04 19:31 - 2013-12-04 19:38 - 189820904 _____ C:\Users\Admin\Downloads\EmsisoftEmergencyKit_4.0.0.13.exe
2013-12-04 19:28 - 2013-12-04 19:28 - 02347384 _____ (ESET) C:\Users\Admin\Downloads\esetsmartinstaller_enu.exe
2013-12-04 19:23 - 2013-12-04 19:23 - 03075631 _____ C:\Users\Admin\Downloads\VirusTotalScanner_3.0.zip
2013-12-04 19:22 - 2013-12-04 19:23 - 09452704 _____ (SurfRight B.V.) C:\Users\Admin\Downloads\HitmanPro3.7.8.208.exe
2013-12-04 19:19 - 2013-12-04 19:20 - 03580416 _____ C:\Users\Admin\Downloads\RogueKiller.exe
2013-12-04 19:08 - 2013-12-04 19:08 - 00000000 ____D C:\TDSSKiller_Quarantine
2013-12-04 19:02 - 2013-12-04 19:02 - 00000000 ____D C:\Users\Admin\Desktop\tdsskiller
2013-12-04 18:52 - 2013-12-05 22:08 - 00000512 _____ C:\Users\Admin\Desktop\MBR.dat
2013-12-04 18:51 - 2013-12-04 18:51 - 00000420 _____ C:\Users\Admin\Downloads\isconfig.dat
2013-12-04 18:51 - 2010-04-08 14:17 - 00136568 _____ (Symantec Corporation) C:\Users\Admin\Downloads\SYMCCHECKER.DLL
2013-12-04 18:36 - 2013-12-04 18:36 - 01034531 _____ (Thisisu) C:\Users\Admin\Downloads\JRT.exe
2013-12-04 18:35 - 2013-12-04 18:35 - 00602112 _____ (OldTimer Tools) C:\Users\Admin\Desktop\OTL.exe
2013-12-04 18:33 - 2013-12-04 18:33 - 01110034 _____ C:\Users\Admin\Downloads\AdwCleaner.exe
2013-12-04 18:29 - 2013-12-04 18:29 - 01937144 _____ (Bleeping Computer, LLC) C:\Users\Admin\Downloads\iExplore.exe
2013-12-04 18:27 - 2013-12-04 18:27 - 01937144 _____ (Bleeping Computer, LLC) C:\Users\Admin\Downloads\rkill.exe
2013-12-04 18:25 - 2013-12-04 18:25 - 04733496 _____ (AVAST Software) C:\Users\Admin\Downloads\avast_free_antivirus_setup_online_fdi-b.exe
2013-12-04 18:22 - 2013-12-04 18:22 - 04745728 _____ (AVAST Software) C:\Users\Admin\Downloads\aswmbr (1).exe
2013-12-04 18:17 - 2013-12-04 18:17 - 04745728 _____ (AVAST Software) C:\Users\Admin\Downloads\aswmbr.exe
2013-12-04 18:15 - 2013-12-04 18:15 - 04101441 _____ C:\Users\Admin\Desktop\tdsskiller.zip
2013-12-04 14:55 - 2013-12-04 14:55 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2013-12-04 14:40 - 2013-12-05 19:16 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-04 14:40 - 2013-12-04 14:40 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-04 14:38 - 2013-12-04 14:53 - 00000000 ____D C:\Users\Admin\Desktop\mbar
2013-12-04 14:09 - 2013-11-04 00:12 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Admin\Desktop\mbar-1.07.0.1007.exe
2013-12-04 14:09 - 2013-11-03 23:36 - 00377856 _____ C:\Users\Admin\Desktop\gmer_2.1.19163.exe
2013-12-04 14:09 - 2013-11-03 23:28 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Admin\Desktop\mbam-setup-1.75.0.1300.exe
2013-12-04 13:38 - 2013-12-08 18:08 - 00000000 ____D C:\Users\*****\AppData\Roaming\Adobe
2013-12-04 13:37 - 2013-12-04 13:37 - 00000000 ____D C:\Update
2013-12-04 13:28 - 2013-12-04 13:28 - 00003538 _____ C:\Windows\System32\Tasks\CreateChoiceProcessTask
2013-12-04 13:28 - 2013-12-04 13:28 - 00001754 _____ C:\Users\Public\Desktop\Browserwahl.lnk
2013-12-04 13:28 - 2013-12-04 13:28 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Adobe
2013-12-04 12:27 - 2013-12-04 12:27 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 02776576 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 02284544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 01988096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 01175552 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00604160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00010752 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00010752 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00009728 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00009728 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00002560 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00002560 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-12-04 12:15 - 2010-02-23 09:16 - 00294912 _____ (Microsoft Corporation) C:\Windows\system32\browserchoice.exe
2013-12-04 11:57 - 2012-07-26 04:08 - 00744448 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll
2013-12-04 11:57 - 2012-07-26 04:08 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe
2013-12-04 11:57 - 2012-07-26 04:08 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll
2013-12-04 11:57 - 2012-07-26 04:08 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll
2013-12-04 11:57 - 2012-07-26 04:08 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll
2013-12-04 11:57 - 2012-07-26 03:26 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys
2013-12-04 11:57 - 2012-07-26 03:26 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys
2013-12-04 11:57 - 2012-06-02 15:57 - 00000003 _____ C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
2013-12-04 11:49 - 2013-12-04 11:51 - 00000000 ____D C:\Windows\system32\MRT
2013-12-04 11:48 - 2013-11-07 16:00 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-04 11:29 - 2012-11-30 06:45 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-12-04 11:29 - 2012-11-30 06:45 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-12-04 11:29 - 2012-11-30 06:43 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-12-04 11:29 - 2012-11-30 00:17 - 00420064 _____ C:\Windows\SysWOW64\locale.nls
2013-12-04 11:29 - 2012-11-30 00:15 - 00420064 _____ C:\Windows\system32\locale.nls
2013-12-04 11:28 - 2013-09-08 03:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-12-04 11:28 - 2013-09-08 03:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-12-04 11:28 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-12-04 11:28 - 2013-02-27 07:02 - 00111448 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2013-12-04 11:28 - 2013-02-27 06:47 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2013-12-04 11:28 - 2012-12-07 14:20 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\Wpc.dll
2013-12-04 11:28 - 2012-12-07 14:15 - 02746368 _____ (Microsoft Corporation) C:\Windows\system32\gameux.dll
2013-12-04 11:28 - 2012-12-07 13:26 - 00308736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wpc.dll
2013-12-04 11:28 - 2012-12-07 13:20 - 02576384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gameux.dll
2013-12-04 11:28 - 2012-12-07 12:20 - 00045568 _____ (Microsoft) C:\Windows\system32\oflc-nz.rs
2013-12-04 11:28 - 2012-12-07 12:20 - 00044544 _____ (Microsoft) C:\Windows\system32\pegibbfc.rs
2013-12-04 11:28 - 2012-12-07 12:20 - 00043520 _____ (Microsoft) C:\Windows\system32\csrr.rs
2013-12-04 11:28 - 2012-12-07 12:20 - 00030720 _____ (Microsoft) C:\Windows\system32\usk.rs
2013-12-04 11:28 - 2012-12-07 12:20 - 00023552 _____ (Microsoft) C:\Windows\system32\oflc.rs
2013-12-04 11:28 - 2012-12-07 12:20 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-pt.rs
2013-12-04 11:28 - 2012-12-07 12:20 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-fi.rs
2013-12-04 11:28 - 2012-12-07 12:19 - 00055296 _____ (Microsoft) C:\Windows\system32\cero.rs
2013-12-04 11:28 - 2012-12-07 12:19 - 00051712 _____ (Microsoft) C:\Windows\system32\esrb.rs
2013-12-04 11:28 - 2012-12-07 12:19 - 00046592 _____ (Microsoft) C:\Windows\system32\fpb.rs
2013-12-04 11:28 - 2012-12-07 12:19 - 00040960 _____ (Microsoft) C:\Windows\system32\cob-au.rs
2013-12-04 11:28 - 2012-12-07 12:19 - 00021504 _____ (Microsoft) C:\Windows\system32\grb.rs
2013-12-04 11:28 - 2012-12-07 12:19 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi.rs
2013-12-04 11:28 - 2012-12-07 12:19 - 00015360 _____ (Microsoft) C:\Windows\system32\djctq.rs
2013-12-04 11:28 - 2012-12-07 11:46 - 00055296 _____ (Microsoft) C:\Windows\SysWOW64\cero.rs
2013-12-04 11:28 - 2012-12-07 11:46 - 00051712 _____ (Microsoft) C:\Windows\SysWOW64\esrb.rs
2013-12-04 11:28 - 2012-12-07 11:46 - 00046592 _____ (Microsoft) C:\Windows\SysWOW64\fpb.rs
2013-12-04 11:28 - 2012-12-07 11:46 - 00045568 _____ (Microsoft) C:\Windows\SysWOW64\oflc-nz.rs
2013-12-04 11:28 - 2012-12-07 11:46 - 00044544 _____ (Microsoft) C:\Windows\SysWOW64\pegibbfc.rs
2013-12-04 11:28 - 2012-12-07 11:46 - 00043520 _____ (Microsoft) C:\Windows\SysWOW64\csrr.rs
2013-12-04 11:28 - 2012-12-07 11:46 - 00040960 _____ (Microsoft) C:\Windows\SysWOW64\cob-au.rs
2013-12-04 11:28 - 2012-12-07 11:46 - 00030720 _____ (Microsoft) C:\Windows\SysWOW64\usk.rs
2013-12-04 11:28 - 2012-12-07 11:46 - 00023552 _____ (Microsoft) C:\Windows\SysWOW64\oflc.rs
2013-12-04 11:28 - 2012-12-07 11:46 - 00021504 _____ (Microsoft) C:\Windows\SysWOW64\grb.rs
2013-12-04 11:28 - 2012-12-07 11:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-pt.rs
2013-12-04 11:28 - 2012-12-07 11:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-fi.rs
2013-12-04 11:28 - 2012-12-07 11:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi.rs
2013-12-04 11:28 - 2012-12-07 11:46 - 00015360 _____ (Microsoft) C:\Windows\SysWOW64\djctq.rs
2013-12-04 11:27 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-12-04 11:27 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-12-04 11:27 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-12-04 11:27 - 2013-08-29 03:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-12-04 11:27 - 2013-08-29 03:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-12-04 11:27 - 2013-08-29 03:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-12-04 11:27 - 2013-08-29 03:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-12-04 11:27 - 2013-08-29 03:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-12-04 11:27 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-12-04 11:27 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-12-04 11:27 - 2013-08-29 02:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-12-04 11:27 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-12-04 11:27 - 2013-08-29 02:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-12-04 11:27 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-12-04 11:27 - 2013-08-29 01:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-12-04 11:27 - 2013-08-29 01:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-12-04 11:27 - 2013-08-29 01:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-12-04 11:27 - 2013-08-29 01:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-12-04 11:27 - 2013-08-02 03:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-12-04 11:27 - 2013-08-02 03:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-12-04 11:27 - 2013-08-02 03:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-12-04 11:27 - 2013-08-02 02:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 02:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-12-04 11:27 - 2013-08-02 01:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-12-04 11:27 - 2013-08-02 01:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 01:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 01:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-12-04 11:27 - 2013-08-02 01:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-12-04 11:27 - 2013-07-25 10:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-12-04 11:27 - 2013-07-25 09:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-12-04 11:27 - 2013-07-09 06:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-12-04 11:27 - 2013-07-09 06:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-12-04 11:27 - 2013-07-09 05:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-12-04 11:27 - 2013-07-09 05:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-12-04 11:27 - 2013-04-26 00:30 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-12-04 11:27 - 2013-03-31 23:52 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-12-04 11:27 - 2012-01-04 11:44 - 00509952 _____ (Microsoft Corporation) C:\Windows\system32\ntshrui.dll
2013-12-04 11:27 - 2012-01-04 09:58 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntshrui.dll
2013-12-04 11:27 - 2011-10-26 06:25 - 01572864 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2013-12-04 11:27 - 2011-10-26 06:25 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2013-12-04 11:27 - 2011-10-26 05:32 - 01328128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2013-12-04 11:27 - 2011-10-26 05:32 - 00514560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2013-12-04 11:27 - 2011-04-09 07:58 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2013-12-04 11:27 - 2011-04-09 06:56 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2013-12-04 11:26 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-12-04 11:26 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-12-04 11:26 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-12-04 11:26 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-12-04 11:26 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-12-04 11:26 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-12-04 11:26 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-12-04 11:26 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-12-04 11:26 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-12-04 11:26 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-12-04 11:26 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-12-04 11:26 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-12-04 11:26 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-12-04 11:26 - 2013-07-09 06:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-12-04 11:26 - 2013-07-09 05:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-12-04 11:26 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-12-04 11:26 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-12-04 11:26 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-12-04 11:26 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-12-04 11:26 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-12-04 11:26 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2013-12-04 11:26 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2013-12-04 11:26 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2013-12-04 11:26 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-12-04 11:26 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-12-04 11:26 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-12-04 11:26 - 2013-04-12 15:45 - 01656680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2013-12-04 11:26 - 2011-11-17 07:35 - 00395776 _____ (Microsoft Corporation) C:\Windows\system32\webio.dll
2013-12-04 11:26 - 2011-11-17 06:35 - 00314880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webio.dll
2013-12-04 11:25 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-12-04 11:25 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-12-04 11:25 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-12-04 11:25 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-12-04 11:25 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-12-04 11:25 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-12-04 11:25 - 2013-08-28 02:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-04 11:25 - 2013-08-05 03:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-12-04 11:25 - 2013-07-19 02:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-04 11:25 - 2013-07-19 02:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-04 11:25 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-12-04 11:25 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-12-04 11:25 - 2013-07-09 06:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-12-04 11:25 - 2013-07-09 05:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-12-04 11:25 - 2013-07-04 13:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-12-04 11:25 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-12-04 11:25 - 2013-07-04 13:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-12-04 11:25 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2013-12-04 11:25 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2013-12-04 11:25 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-12-04 11:25 - 2013-07-04 11:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-12-04 11:25 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-12-04 11:25 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-12-04 11:25 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-12-04 11:25 - 2013-06-15 05:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-12-04 11:25 - 2013-03-19 06:53 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2013-12-04 11:25 - 2013-03-19 06:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll
2013-12-04 11:25 - 2013-02-15 07:08 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2013-12-04 11:25 - 2013-02-15 07:06 - 03717632 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2013-12-04 11:25 - 2013-02-15 07:02 - 00158720 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2013-12-04 11:25 - 2013-02-15 05:37 - 03217408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2013-12-04 11:25 - 2013-02-15 05:34 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2013-12-04 11:25 - 2013-02-15 04:25 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2013-12-04 11:25 - 2013-02-12 05:12 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2013-12-04 11:25 - 2012-11-28 23:56 - 00054376 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2013-12-04 11:25 - 2012-11-28 23:56 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll
2013-12-04 11:25 - 2012-11-28 23:56 - 00000003 _____ C:\Windows\system32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
2013-12-04 11:25 - 2012-11-01 06:43 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2013-12-04 11:25 - 2012-11-01 06:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2013-12-04 11:25 - 2012-11-01 05:47 - 01389568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2013-12-04 11:25 - 2012-11-01 05:47 - 01236992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2013-12-04 11:25 - 2012-10-09 19:17 - 00226816 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore6.dll
2013-12-04 11:25 - 2012-10-09 19:17 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc6.dll
2013-12-04 11:25 - 2012-10-09 18:40 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcore6.dll
2013-12-04 11:25 - 2012-10-09 18:40 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcsvc6.dll
2013-12-04 11:25 - 2012-08-22 19:12 - 00950128 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2013-12-04 11:25 - 2012-08-11 01:56 - 00715776 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

M4xNamara · 11.12.2013, 16:02

FRST Teil 2

Code:

ATTFilter

2013-12-04 11:25 - 2012-08-11 00:56 - 00542208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2013-12-04 11:25 - 2012-07-06 21:07 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys
2013-12-04 11:25 - 2012-07-04 21:26 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\RNDISMP.sys
2013-12-04 11:25 - 2012-04-26 06:41 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2013-12-04 11:25 - 2012-04-26 06:41 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\rdpwsx.dll
2013-12-04 11:25 - 2012-04-26 06:34 - 00009216 _____ (Microsoft Corporation) C:\Windows\system32\rdrmemptylst.exe
2013-12-04 11:25 - 2012-04-07 13:31 - 03216384 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2013-12-04 11:25 - 2012-04-07 12:26 - 02342400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2013-12-04 11:25 - 2011-12-30 07:26 - 00515584 _____ (Microsoft Corporation) C:\Windows\system32\timedate.cpl
2013-12-04 11:25 - 2011-12-30 06:27 - 00478720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\timedate.cpl
2013-12-04 11:25 - 2010-06-26 04:55 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2013-12-04 11:25 - 2010-06-26 04:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2013-12-04 11:24 - 2013-07-26 03:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-12-04 11:24 - 2013-07-26 03:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-12-04 11:24 - 2013-07-26 02:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-12-04 11:24 - 2013-07-26 02:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-12-04 11:24 - 2012-10-03 18:44 - 00303104 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2013-12-04 11:24 - 2012-10-03 18:44 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\netcorehc.dll
2013-12-04 11:24 - 2012-10-03 18:44 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2013-12-04 11:24 - 2012-10-03 18:44 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2013-12-04 11:24 - 2012-10-03 18:44 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\netevent.dll
2013-12-04 11:24 - 2012-10-03 18:42 - 00569344 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll
2013-12-04 11:24 - 2012-10-03 17:42 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcorehc.dll
2013-12-04 11:24 - 2012-10-03 17:42 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2013-12-04 11:24 - 2012-10-03 17:42 - 00018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netevent.dll
2013-12-04 11:24 - 2012-10-03 17:07 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2013-12-04 11:24 - 2012-04-28 04:55 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2013-12-04 11:24 - 2012-01-13 08:12 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2013-12-04 11:23 - 2013-06-04 07:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-12-04 11:23 - 2013-06-04 05:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-12-04 11:23 - 2012-11-22 06:44 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2013-12-04 11:23 - 2012-11-22 05:45 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2013-12-04 11:23 - 2012-11-02 06:59 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\dpnet.dll
2013-12-04 11:23 - 2012-11-02 06:11 - 00376832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnet.dll
2013-12-04 11:23 - 2012-09-25 23:47 - 00078336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\synceng.dll
2013-12-04 11:23 - 2012-09-25 23:46 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\synceng.dll
2013-12-04 11:23 - 2012-08-21 22:01 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\OxpsConverter.exe
2013-12-04 11:23 - 2012-05-01 06:40 - 00209920 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2013-12-04 11:23 - 2012-03-17 08:58 - 00075120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\partmgr.sys
2013-12-04 11:18 - 2013-04-26 06:51 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2013-12-04 11:18 - 2013-04-26 05:55 - 00492544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-12-04 11:17 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-12-04 11:17 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-12-04 11:17 - 2012-11-23 04:13 - 00068608 _____ (Microsoft Corporation) C:\Windows\system32\taskhost.exe
2013-12-04 11:17 - 2012-07-04 23:16 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\netapi32.dll
2013-12-04 11:17 - 2012-07-04 23:13 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\browser.dll
2013-12-04 11:17 - 2012-07-04 23:13 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\browcli.dll
2013-12-04 11:17 - 2012-07-04 22:16 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netapi32.dll
2013-12-04 11:17 - 2012-07-04 22:14 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\browcli.dll
2013-12-04 11:15 - 2013-05-10 06:49 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2013-12-04 11:15 - 2013-05-10 04:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-12-04 11:14 - 2013-05-13 06:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-12-04 11:14 - 2013-05-13 04:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-12-04 11:14 - 2013-05-13 04:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-12-04 11:14 - 2013-05-13 04:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-12-04 11:14 - 2011-10-15 07:31 - 00723456 _____ (Microsoft Corporation) C:\Windows\system32\EncDec.dll
2013-12-04 11:14 - 2011-10-15 06:38 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EncDec.dll
2013-12-04 11:13 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-12-04 11:13 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-12-04 11:13 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-12-04 11:13 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-12-04 11:13 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-12-04 11:13 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-12-04 11:13 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-12-04 11:13 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2013-12-04 11:13 - 2013-04-10 07:01 - 00265064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2013-12-04 11:13 - 2013-01-24 07:01 - 00223752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys
2013-12-04 11:13 - 2013-01-03 07:00 - 00288088 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2013-12-04 11:13 - 2012-08-22 19:12 - 00376688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2013-12-04 11:13 - 2012-06-06 07:02 - 01133568 _____ (Microsoft Corporation) C:\Windows\system32\cdosys.dll
2013-12-04 11:13 - 2012-06-06 06:03 - 00805376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll
2013-12-04 11:13 - 2012-05-14 06:26 - 00956928 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2013-12-04 11:13 - 2012-05-05 09:36 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2013-12-04 11:13 - 2012-05-05 08:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2013-12-04 11:13 - 2011-12-16 09:46 - 00634880 _____ (Microsoft Corporation) C:\Windows\system32\msvcrt.dll
2013-12-04 11:13 - 2011-12-16 08:52 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcrt.dll
2013-12-04 11:13 - 2011-02-03 12:25 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2013-12-04 11:12 - 2013-08-28 02:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-12-04 11:12 - 2011-11-19 15:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2013-12-04 11:12 - 2011-11-19 15:01 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2013-12-04 11:11 - 2013-12-04 11:11 - 00000493 _____ C:\Users\*****\Desktop\Windows Update.lnk
2013-12-04 11:10 - 2013-12-09 15:23 - 00003942 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{64D30E60-F753-4481-9534-1182FE8E58B2}
2013-12-04 11:08 - 2013-12-04 11:08 - 00000104 _____ C:\Users\Admin\Desktop\Systemsteuerung.lnk
2013-12-04 11:04 - 2013-12-04 13:38 - 00066104 _____ C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-04 11:04 - 2013-12-04 11:04 - 00002334 _____ C:\Users\*****\Desktop\Sicherer Zahlungsverkehr.lnk
2013-12-04 11:04 - 2013-12-04 11:04 - 00000000 ____D C:\Users\*****\AppData\Roaming\Intel Corporation
2013-12-04 11:04 - 2013-12-04 11:04 - 00000000 ____D C:\Users\*****\AppData\Roaming\Atheros
2013-12-04 11:03 - 2013-12-08 16:01 - 00001425 _____ C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-12-04 11:03 - 2013-12-04 13:38 - 00000000 ___RD C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-04 11:03 - 2013-12-04 13:38 - 00000000 ___RD C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-12-04 11:03 - 2013-12-04 11:03 - 00000000 ____D C:\Users\*****\AppData\Local\VirtualStore
2013-12-04 11:02 - 2013-12-04 11:04 - 00000000 ____D C:\Users\*****\AppData\Roaming\Sony Corporation
2013-12-04 11:02 - 2013-12-04 11:03 - 00000000 ____D C:\Users\*****
2013-12-04 11:02 - 2013-12-04 11:02 - 00000020 ___SH C:\Users\*****\ntuser.ini
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\Vorlagen
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\Startmenü
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\Netzwerkumgebung
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\Lokale Einstellungen
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\Eigene Dateien
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\Druckumgebung
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\Documents\Eigene Musik
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\Documents\Eigene Bilder
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\AppData\Local\Verlauf
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\AppData\Local\Anwendungsdaten
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\Anwendungsdaten
2013-12-04 11:02 - 2013-12-03 17:58 - 00000000 ____D C:\Users\*****\AppData\Roaming\Macromedia
2013-12-04 11:02 - 2009-07-14 05:54 - 00000000 ___RD C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-04 11:02 - 2009-07-14 05:49 - 00000000 ___RD C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-04 10:52 - 2012-03-01 07:46 - 00023408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fs_rec.sys
2013-12-04 10:52 - 2012-03-01 07:33 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-04 10:52 - 2012-03-01 07:28 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\wmi.dll
2013-12-04 10:52 - 2012-03-01 06:33 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-04 10:52 - 2012-03-01 06:29 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmi.dll
2013-12-04 10:45 - 2012-02-17 07:38 - 01031680 _____ (Microsoft Corporation) C:\Windows\system32\rdpcore.dll
2013-12-04 10:45 - 2012-02-17 06:34 - 00826880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpcore.dll
2013-12-04 10:45 - 2012-02-17 05:57 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdtcp.sys
2013-12-04 10:40 - 2012-06-02 23:19 - 02428952 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2013-12-04 10:40 - 2012-06-02 23:19 - 00701976 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2013-12-04 10:40 - 2012-06-02 23:19 - 00057880 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2013-12-04 10:40 - 2012-06-02 23:19 - 00044056 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2013-12-04 10:40 - 2012-06-02 23:19 - 00038424 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2013-12-04 10:40 - 2012-06-02 23:15 - 02622464 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2013-12-04 10:40 - 2012-06-02 23:15 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2013-12-04 10:40 - 2012-06-02 15:19 - 00186752 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2013-12-04 10:40 - 2012-06-02 15:15 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2013-12-04 10:31 - 2013-12-04 11:07 - 00002334 _____ C:\Users\Admin\Desktop\Sicherer Zahlungsverkehr.lnk
2013-12-04 10:30 - 2013-12-04 10:30 - 00001124 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2013-12-04 10:30 - 2013-05-06 09:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll
2013-12-04 10:29 - 2013-12-09 17:03 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-12-04 10:29 - 2013-12-04 10:46 - 00623200 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2013-12-04 10:29 - 2013-12-04 10:29 - 00000000 ____D C:\Windows\ELAMBKUP
2013-12-04 10:29 - 2013-12-04 10:29 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-12-04 10:29 - 2013-06-08 20:18 - 00112224 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2013-12-04 10:18 - 2013-12-04 10:23 - 00000402 _____ C:\Windows\Tasks\Wise Turbo Checker.job
2013-12-04 10:18 - 2013-12-04 10:18 - 00003218 _____ C:\Windows\System32\Tasks\Wise Turbo Checker
2013-12-04 10:18 - 2013-12-04 10:18 - 00002848 _____ C:\Windows\System32\Tasks\Wise Care 365
2013-12-04 10:12 - 2013-12-09 17:04 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Wise Care 365
2013-12-04 10:12 - 2013-12-04 10:12 - 00001160 _____ C:\Users\Public\Desktop\Wise Care 365.lnk
2013-12-04 10:10 - 2013-12-04 10:12 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Wise Registry Cleaner
2013-12-04 10:10 - 2013-12-04 10:12 - 00000000 ____D C:\Program Files (x86)\Wise
2013-12-04 09:50 - 2013-12-04 09:50 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2013-12-03 18:50 - 2013-12-09 17:09 - 00003934 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{4568D104-D8EB-439E-946B-4BD51DB99973}
2013-12-03 18:40 - 2013-12-03 18:40 - 00000000 ____D C:\Users\Admin\Documents\Bluetooth Folder
2013-12-03 18:40 - 2013-12-03 18:40 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Intel Corporation
2013-12-03 18:40 - 2013-12-03 18:40 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Atheros
2013-12-03 18:40 - 2013-12-03 18:40 - 00000000 ____D C:\Users\Admin\AppData\Local\BMExplorer
2013-12-03 18:39 - 2013-12-09 14:58 - 00001425 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-12-03 18:39 - 2013-12-04 13:29 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-03 18:39 - 2013-12-04 13:29 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-12-03 18:39 - 2013-12-03 18:39 - 00000000 ___RH C:\Windows\SysWOW64\Drivers\104D_Sony_VPCEH1S1E.mrk
2013-12-03 18:39 - 2013-12-03 18:39 - 00000000 ___RH C:\Windows\system32\Drivers\104D_Sony_VPCEH1S1E.mrk
2013-12-03 18:39 - 2013-12-03 18:39 - 00000000 ___HD C:\Windows\msdownld.tmp
2013-12-03 18:39 - 2013-12-03 18:39 - 00000000 ____D C:\Users\Admin\AppData\Local\VirtualStore
2013-12-03 18:30 - 2013-12-03 18:35 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Sony Corporation
2013-12-03 18:30 - 2013-12-03 18:30 - 00000000 ____D C:\Windows\SysWOW64\VAIO Startup Setting Tool
2013-12-03 18:30 - 2013-12-03 18:30 - 00000000 ____D C:\Windows\pss
2013-12-03 18:29 - 2013-12-03 18:39 - 00000000 ____D C:\Users\Admin
2013-12-03 18:29 - 2013-12-03 18:29 - 00000020 ___SH C:\Users\Admin\ntuser.ini
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\Vorlagen
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\Startmenü
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\Netzwerkumgebung
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\Lokale Einstellungen
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\Eigene Dateien
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\Druckumgebung
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Musik
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Bilder
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\AppData\Local\Verlauf
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\AppData\Local\Anwendungsdaten
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\Anwendungsdaten
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Musik
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Bilder
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Verlauf
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Anwendungsdaten
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\Vorlagen
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\Startmenü
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\Netzwerkumgebung
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\Lokale Einstellungen
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\Eigene Dateien
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\Druckumgebung
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\Documents\Eigene Musik
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\Documents\Eigene Bilder
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\AppData\Local\Verlauf
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\AppData\Local\Anwendungsdaten
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\Anwendungsdaten
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Programme
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\ProgramData\Vorlagen
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\ProgramData\Startmenü
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\ProgramData\Favoriten
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\ProgramData\Dokumente
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\ProgramData\Anwendungsdaten
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Program Files\Gemeinsame Dateien
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Dokumente und Einstellungen
2013-12-03 18:29 - 2013-12-03 17:58 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Macromedia
2013-12-03 18:29 - 2009-07-14 05:54 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-03 18:29 - 2009-07-14 05:49 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-03 18:26 - 2013-12-03 18:40 - 00000000 ____D C:\ProgramData\Atheros
2013-12-03 18:26 - 2013-12-03 18:26 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_btath_hcrp_01009.Wdf
2013-12-03 18:15 - 2013-12-03 18:15 - 00262144 _____ C:\Windows\ocsetup_install_OEMHelpCustomization.etl
2013-12-03 18:15 - 2013-12-03 18:15 - 00028728 _____ C:\Windows\ocsetup_cbs_install_OEMHelpCustomization.txt
2013-12-03 18:15 - 2013-12-03 18:15 - 00000000 ____D C:\VAIO Sample Contents
2013-12-03 18:14 - 2013-12-03 18:14 - 97167020 _____ (Axialis Software) C:\Windows\system32\VAIO Hero Screensaver - Summer 2011.scr
2013-12-03 18:14 - 2013-12-03 18:14 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-03 18:14 - 2013-12-03 18:14 - 00000000 ____D C:\ProgramData\Skype
2013-12-03 18:14 - 2013-12-03 18:14 - 00000000 ____D C:\Program Files (x86)\Nascom
2013-12-03 18:14 - 2011-02-18 16:09 - 00000007 _____ C:\Windows\SysWOW64\scr_version.txt
2013-12-03 18:12 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2013-12-03 18:12 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2013-12-03 18:11 - 2013-12-03 18:11 - 00321196 _____ C:\lv.log
2013-12-03 18:11 - 2013-12-03 18:11 - 00000000 ___HD C:\SPLASH.SYS
2013-12-03 18:11 - 2013-12-03 18:11 - 00000000 ___HD C:\SPLASH.000
2013-12-03 18:11 - 2013-12-03 18:11 - 00000000 ____D C:\Program Files (x86)\Downloaded Installations
2013-12-03 18:06 - 2013-12-03 18:06 - 00000000 ____D C:\Program Files (x86)\MSXML 4.0
2013-12-03 18:06 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2013-12-03 18:06 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2013-12-03 18:06 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2013-12-03 18:04 - 2013-12-03 18:04 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-12-03 18:02 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2013-12-03 18:02 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2013-12-03 18:02 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2013-12-03 18:02 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2013-12-03 18:02 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2013-12-03 18:02 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2013-12-03 18:02 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2013-12-03 18:02 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2013-12-03 18:02 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2013-12-03 18:02 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2013-12-03 18:02 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2013-12-03 18:02 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2013-12-03 18:02 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2013-12-03 18:02 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2013-12-03 18:02 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2013-12-03 18:02 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2013-12-03 18:00 - 2013-12-03 18:00 - 00000000 ____D C:\ProgramData\ArcSoft
2013-12-03 18:00 - 2013-12-03 18:00 - 00000000 ____D C:\Program Files (x86)\ArcSoft
2013-12-03 18:00 - 2009-05-26 14:32 - 00019968 _____ (ArcSoft, Inc.) C:\Windows\system32\Drivers\ArcSoftKsUFilter.sys
2013-12-03 18:00 - 2008-09-04 17:06 - 00055808 _____ (ArcSoft, Inc.) C:\Windows\system\ArcSoftKsUFilter.dll
2013-12-03 18:00 - 2005-04-27 16:36 - 00245408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\unicows.dll
2013-12-03 18:00 - 2003-03-18 22:14 - 00499712 ____R (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2013-12-03 18:00 - 2003-02-21 04:42 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2013-12-03 18:00 - 1995-07-31 13:44 - 00212480 _____ (Eastman Kodak) C:\Windows\SysWOW64\PCDLIB32.DLL
2013-12-03 17:59 - 2013-12-03 17:59 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2013-12-03 17:58 - 2013-12-08 18:09 - 00000000 ____D C:\ProgramData\Adobe
2013-12-03 17:58 - 2013-12-03 17:59 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-12-03 17:58 - 2013-12-03 17:58 - 00000000 ____D C:\Windows\en
2013-12-03 17:58 - 2013-12-03 17:58 - 00000000 ____D C:\Users\Default\AppData\Roaming\Macromedia
2013-12-03 17:58 - 2013-12-03 17:58 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\uk
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\tr
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\sv
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\sk
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\ru
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\ro
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\pl
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\no
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\nl
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\it
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\hu
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\fr
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\fi
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\el
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\de
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\da
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\cs
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\bg
2013-12-03 17:55 - 2013-12-03 17:55 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2013-12-03 17:52 - 2013-12-03 17:57 - 00000000 ____D C:\Program Files (x86)\Windows Live
2013-12-03 17:51 - 2013-12-03 17:51 - 00000000 ____D C:\Windows\PCHEALTH
2013-12-03 17:51 - 2013-12-03 17:51 - 00000000 ____D C:\Program Files\Windows Live
2013-12-03 17:51 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2013-12-03 17:51 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2013-12-03 17:51 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2013-12-03 17:51 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2013-12-03 17:51 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2013-12-03 17:51 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2013-12-03 17:50 - 2013-12-03 17:50 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-12-03 17:48 - 2013-12-04 11:20 - 00002029 _____ C:\Users\*****\Desktop\VAIO Update.lnk
2013-12-03 17:48 - 2013-12-03 18:30 - 00000000 ____D C:\Windows\System32\Tasks\SONY
2013-12-03 17:48 - 2013-12-03 17:48 - 00000000 ____D C:\Documentation
2013-12-03 17:48 - 2013-12-03 17:48 - 00000000 ____D C:\_FS_SWRINFO
2013-12-03 17:47 - 2013-12-03 17:48 - 00000000 ____D C:\Windows\Sonysys
2013-12-03 17:45 - 2013-12-04 13:43 - 00000000 ____D C:\Windows\System32\Tasks\Sony Corporation
2013-12-03 17:45 - 2013-12-03 18:15 - 00000000 ____D C:\Program Files (x86)\Sony
2013-12-03 17:45 - 2013-12-03 18:01 - 00000000 ____D C:\Program Files\Common Files\Sony Shared
2013-12-03 17:45 - 2013-12-03 17:45 - 00521448 _____ (Sun Microsystems, Inc.) C:\Windows\system32\deployJava1.dll
2013-12-03 17:45 - 2013-12-03 17:45 - 00472808 _____ (Sun Microsystems, Inc.) C:\Windows\SysWOW64\deployJava1.dll
2013-12-03 17:45 - 2013-12-03 17:45 - 00189216 _____ (Sun Microsystems, Inc.) C:\Windows\system32\javaws.exe
2013-12-03 17:45 - 2013-12-03 17:45 - 00171808 _____ (Sun Microsystems, Inc.) C:\Windows\system32\javaw.exe
2013-12-03 17:45 - 2013-12-03 17:45 - 00171808 _____ (Sun Microsystems, Inc.) C:\Windows\system32\java.exe
2013-12-03 17:45 - 2013-12-03 17:45 - 00153376 _____ (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaws.exe
2013-12-03 17:45 - 2013-12-03 17:45 - 00145184 _____ (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaw.exe
2013-12-03 17:45 - 2013-12-03 17:45 - 00145184 _____ (Sun Microsystems, Inc.) C:\Windows\SysWOW64\java.exe
2013-12-03 17:45 - 2013-12-03 17:45 - 00000000 ____D C:\ProgramData\Sun
2013-12-03 17:45 - 2013-12-03 17:45 - 00000000 ____D C:\Program Files\Java
2013-12-03 17:45 - 2013-12-03 17:45 - 00000000 ____D C:\Program Files (x86)\Java
2013-12-03 17:43 - 2013-12-03 17:43 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_Apfiltr_01009.Wdf
2013-12-03 17:43 - 2013-12-03 17:43 - 00000000 ____D C:\Windows\SysWOW64\sda
2013-12-03 17:43 - 2013-12-03 17:43 - 00000000 ____D C:\Program Files\Apoint
2013-12-03 17:43 - 2013-12-03 17:43 - 00000000 ____D C:\Program Files (x86)\Realtek
2013-12-03 17:43 - 2011-03-29 07:16 - 09888360 _____ (Realtek Semiconductor Corp.) C:\Windows\SysWOW64\RtsPStorIcon.dll
2013-12-03 17:43 - 2011-03-29 07:15 - 00335464 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RtsPStor.sys
2013-12-03 17:42 - 2013-12-09 17:03 - 00000000 ____D C:\ProgramData\NVIDIA
2013-12-03 17:42 - 2013-12-03 17:42 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-12-03 17:42 - 2011-02-01 13:06 - 00008192 _____ C:\Windows\system32\Drivers\IntelMEFWVer.dll
2013-12-03 17:42 - 2010-10-19 16:34 - 00056344 _____ (Intel Corporation) C:\Windows\system32\Drivers\HECIx64.sys
2013-12-03 17:41 - 2013-12-03 17:41 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-12-03 17:41 - 2013-12-03 17:41 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-12-03 17:41 - 2011-03-29 10:14 - 01359976 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco642040.dll
2013-12-03 17:41 - 2011-03-29 10:14 - 00173160 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2013-12-03 17:41 - 2011-03-29 10:14 - 00029288 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2013-12-03 17:41 - 2011-03-29 10:13 - 20456552 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2013-12-03 17:41 - 2011-03-29 10:13 - 15039080 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2013-12-03 17:41 - 2011-03-29 10:13 - 13056488 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2013-12-03 17:41 - 2011-03-29 10:13 - 07715944 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2013-12-03 17:41 - 2011-03-29 10:13 - 05639784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2013-12-03 17:41 - 2011-03-29 10:13 - 01359976 _____ (NVIDIA Corporation) C:\Windows\system32\nvgenco642040.dll
2013-12-03 17:41 - 2011-03-29 10:13 - 00007621 _____ C:\Windows\system32\nvinfo.pb
2013-12-03 17:41 - 2011-03-29 10:12 - 12840040 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2013-12-03 17:41 - 2011-03-29 10:12 - 10059368 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2013-12-03 17:41 - 2011-03-29 10:12 - 03182184 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2013-12-03 17:41 - 2011-03-29 10:12 - 02954856 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2013-12-03 17:41 - 2011-03-29 10:12 - 02871400 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2013-12-03 17:41 - 2011-03-29 10:12 - 02579560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2013-12-03 17:41 - 2011-03-29 10:12 - 01614440 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco642090.dll
2013-12-03 17:41 - 2011-03-29 10:11 - 18580072 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2013-12-03 17:41 - 2011-03-29 10:11 - 13011560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2013-12-03 17:41 - 2011-03-29 10:11 - 06597736 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2013-12-03 17:41 - 2011-03-29 10:11 - 04936808 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2013-12-03 17:41 - 2011-03-29 10:11 - 02206312 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2013-12-03 17:41 - 2011-03-29 10:11 - 01969768 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2013-12-03 17:41 - 2011-03-29 10:11 - 00067176 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2013-12-03 17:41 - 2011-03-29 10:11 - 00057960 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2013-12-03 17:41 - 2011-03-29 10:11 - 00011240 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvBridge.kmd
2013-12-03 17:39 - 2013-12-03 17:40 - 00000000 ____D C:\Program Files (x86)\Bluetooth Suite
2013-12-03 17:39 - 2013-12-03 17:39 - 00000000 ____D C:\Program Files\CONEXANT
2013-12-03 17:37 - 2013-12-04 13:43 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-03 17:36 - 2013-12-03 17:42 - 00000000 ____D C:\Program Files (x86)\Intel
2013-12-03 17:36 - 2011-02-16 13:34 - 00053248 _____ (Windows XP Bundled build C-Centric Single User) C:\Windows\SysWOW64\CSVer.dll
2013-12-03 17:35 - 2013-12-03 17:35 - 00000000 ____D C:\Intel
2013-12-03 17:34 - 2011-03-11 07:41 - 00410496 _____ (Intel Corporation) C:\Windows\system32\Drivers\iaStorV.sys
2013-12-03 17:34 - 2011-03-11 07:41 - 00189824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2013-12-03 17:34 - 2011-03-11 07:41 - 00166272 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvstor.sys
2013-12-03 17:34 - 2011-03-11 07:41 - 00148352 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvraid.sys
2013-12-03 17:34 - 2011-03-11 07:41 - 00107904 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdsata.sys
2013-12-03 17:34 - 2011-03-11 07:41 - 00027008 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdxata.sys
2013-12-03 17:34 - 2011-03-11 07:33 - 02565632 _____ (Microsoft Corporation) C:\Windows\system32\esent.dll
2013-12-03 17:34 - 2011-03-11 07:30 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\fsutil.exe
2013-12-03 17:34 - 2011-03-11 06:33 - 01699328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\esent.dll
2013-12-03 17:34 - 2011-03-11 06:31 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fsutil.exe
2013-12-03 17:34 - 2011-03-11 05:37 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2013-12-03 17:32 - 2013-12-04 13:43 - 00000000 ____D C:\ProgramData\Sony Corporation
2013-12-03 17:26 - 2013-12-04 13:51 - 00000000 ____D C:\Program Files\Sony
2013-12-03 17:26 - 2012-01-06 10:09 - 00437272 ____R (Intel Corporation) C:\Windows\system32\Drivers\iaStor.sys
2013-12-03 17:24 - 2013-12-09 17:42 - 00697068 _____ C:\Windows\system32\perfh007.dat
2013-12-03 17:24 - 2013-12-09 17:42 - 00148332 _____ C:\Windows\system32\perfc007.dat
2013-12-03 17:24 - 2013-12-03 17:24 - 00295922 _____ C:\Windows\system32\perfi007.dat
2013-12-03 17:24 - 2013-12-03 17:24 - 00038104 _____ C:\Windows\system32\perfd007.dat
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\SysWOW64\winrm
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\SysWOW64\WCN
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\SysWOW64\sysprep
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\SysWOW64\slmgr
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\SysWOW64\Printing_Admin_Scripts
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\SysWOW64\de
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\SysWOW64\0407
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\system32\winrm
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\system32\WCN
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\system32\slmgr
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\system32\Printing_Admin_Scripts
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\system32\de
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\system32\0407

==================== One Month Modified Files and Folders =======

2013-12-09 17:58 - 2013-12-09 17:58 - 00011581 _____ C:\Users\Admin\Desktop\FRST.txt
2013-12-09 17:51 - 2013-12-09 17:51 - 00291132 _____ C:\Users\Admin\Desktop\OTL.Txt
2013-12-09 17:51 - 2013-12-09 17:51 - 00083524 _____ C:\Users\Admin\Desktop\Extras.Txt
2013-12-09 17:42 - 2013-12-03 17:24 - 00697068 _____ C:\Windows\system32\perfh007.dat
2013-12-09 17:42 - 2013-12-03 17:24 - 00148332 _____ C:\Windows\system32\perfc007.dat
2013-12-09 17:42 - 2009-07-14 06:13 - 01613280 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-09 17:11 - 2009-07-14 05:45 - 00020992 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-09 17:11 - 2009-07-14 05:45 - 00020992 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-09 17:09 - 2013-12-03 18:50 - 00003934 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{4568D104-D8EB-439E-946B-4BD51DB99973}
2013-12-09 17:07 - 2013-12-06 16:18 - 00245706 _____ C:\Windows\WindowsUpdate.log
2013-12-09 17:04 - 2013-12-04 10:12 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Wise Care 365
2013-12-09 17:03 - 2013-12-06 00:31 - 00003484 _____ C:\Windows\setupact.log
2013-12-09 17:03 - 2013-12-05 23:38 - 00000422 _____ C:\Windows\Tasks\Wise Care 365.job
2013-12-09 17:03 - 2013-12-04 10:29 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-12-09 17:03 - 2013-12-03 17:42 - 00000000 ____D C:\ProgramData\NVIDIA
2013-12-09 17:03 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-09 17:01 - 2013-12-09 17:01 - 00339936 _____ C:\Windows\Minidump\120913-36629-01.dmp
2013-12-09 17:01 - 2013-12-09 17:01 - 00000000 ____D C:\Windows\Minidump
2013-12-09 17:00 - 2013-12-09 17:00 - 669890749 _____ C:\Windows\MEMORY.DMP
2013-12-09 16:43 - 2013-12-09 16:43 - 00117321 _____ C:\Users\Admin\Desktop\GMER-RootkitScan_09122013.txt
2013-12-09 15:23 - 2013-12-04 11:10 - 00003942 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{64D30E60-F753-4481-9534-1182FE8E58B2}
2013-12-09 14:58 - 2013-12-03 18:39 - 00001425 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-12-08 18:09 - 2013-12-03 17:58 - 00000000 ____D C:\ProgramData\Adobe
2013-12-08 18:08 - 2013-12-08 18:08 - 00000000 ____D C:\Users\*****\AppData\Local\Adobe
2013-12-08 18:08 - 2013-12-04 13:38 - 00000000 ____D C:\Users\*****\AppData\Roaming\Adobe
2013-12-08 16:54 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-08 16:01 - 2013-12-04 11:03 - 00001425 _____ C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-12-08 16:00 - 2011-02-10 23:48 - 00000000 ____D C:\Windows\Panther
2013-12-08 15:59 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-12-06 19:19 - 2013-12-06 19:14 - 00010277 _____ C:\Windows\IE11_main.log
2013-12-06 19:16 - 2013-12-06 19:15 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-06 19:15 - 2013-12-06 19:15 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-06 19:15 - 2013-12-06 19:15 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-06 19:15 - 2013-12-06 19:15 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-06 19:15 - 2013-12-06 19:15 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-12-06 19:15 - 2013-12-06 19:15 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-06 19:15 - 2013-12-06 19:15 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-06 19:15 - 2013-12-06 19:15 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-12-06 19:15 - 2013-12-06 19:15 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-06 19:15 - 2013-12-06 19:15 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-12-06 19:15 - 2013-12-06 19:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-12-06 19:15 - 2013-12-06 19:15 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-12-06 19:15 - 2013-12-06 19:15 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-06 16:16 - 2013-12-06 16:16 - 00000346 _____ C:\Windows\PFRO.log
2013-12-06 01:32 - 2013-12-06 01:32 - 00000000 ____D C:\ProgramData\Licenses
2013-12-06 00:37 - 2013-12-06 00:37 - 00000000 ____D C:\Program Files (x86)\BillP Studios
2013-12-06 00:36 - 2013-12-05 22:02 - 00000000 ____D C:\ProgramData\HitmanPro
2013-12-06 00:31 - 2013-12-06 00:31 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2013-12-06 00:31 - 2013-12-06 00:31 - 00000000 _____ C:\Windows\setuperr.log
2013-12-06 00:17 - 2013-12-06 00:17 - 00000000 ____D C:\FRST
2013-12-06 00:15 - 2013-12-06 00:15 - 00000000 ____D C:\AdwCleaner
2013-12-05 23:59 - 2013-12-05 23:56 - 222867736 _____ (Emsisoft GmbH                                               ) C:\Users\Admin\Downloads\EmsisoftAntiMalwareSetup.exe
2013-12-05 23:45 - 2013-12-05 23:44 - 05049344 _____ (Crawler.com                                                 ) C:\Users\Admin\Downloads\SpywareTerminatorSetup.exe
2013-12-05 23:44 - 2013-12-05 23:44 - 00910888 _____ (BillP Studios) C:\Users\Admin\Downloads\wpsetup.exe
2013-12-05 23:44 - 2013-12-05 23:42 - 12413440 _____ C:\Users\Admin\Downloads\avgas-setup-7.5.1.43.exe
2013-12-05 23:43 - 2013-12-05 23:43 - 04095448 _____ (BrightFort LLC                                              ) C:\Users\Admin\Downloads\spywareblastersetup50.exe
2013-12-05 23:42 - 2013-12-05 23:42 - 01793648 _____ (Malwarebytes                                                ) C:\Users\Admin\Downloads\mbae-setup-0.09.4.2000.exe
2013-12-05 23:41 - 2013-12-05 23:41 - 10264904 _____ (SurfRight B.V.) C:\Users\Admin\Downloads\HitmanPro_x64.exe
2013-12-05 23:40 - 2013-12-05 23:40 - 01339288 _____ C:\Users\Admin\Downloads\sar_15_sfx.exe
2013-12-05 23:37 - 2013-12-05 23:37 - 00000603 _____ C:\Users\Admin\Downloads\UpdateInfo.txt
2013-12-05 23:35 - 2013-12-05 23:35 - 01925140 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2013-12-05 23:33 - 2013-12-05 23:33 - 00891200 _____ C:\Users\Admin\Downloads\SecurityCheck.exe
2013-12-05 23:28 - 2013-12-05 23:28 - 00000546 _____ C:\Users\Admin\Desktop\Emsisoft Emergency Kit.lnk
2013-12-05 23:28 - 2013-12-05 23:28 - 00000000 ____D C:\EEK
2013-12-05 23:26 - 2013-12-05 22:05 - 00000000 ____D C:\Users\Admin\Desktop\RK_Quarantine
2013-12-05 23:06 - 2013-12-05 23:06 - 04166144 _____ C:\Users\Admin\Downloads\RogueKillerX64.exe
2013-12-05 22:08 - 2013-12-05 22:08 - 00000000 ____D C:\Windows\ERUNT
2013-12-05 22:08 - 2013-12-04 18:52 - 00000512 _____ C:\Users\Admin\Desktop\MBR.dat
2013-12-05 22:07 - 2013-12-05 22:07 - 00066104 _____ C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-05 22:07 - 2013-12-05 22:07 - 00000000 ____D C:\ProgramData\AVAST Software
2013-12-05 22:02 - 2013-12-05 22:02 - 00000000 ____D C:\Users\Admin\Desktop\rkill
2013-12-05 21:51 - 2013-12-05 21:51 - 00000013 _____ C:\fix.bat
2013-12-05 19:16 - 2013-12-05 18:43 - 00000000 ____D C:\mbar
2013-12-05 19:16 - 2013-12-04 14:40 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-05 18:44 - 2013-12-05 18:44 - 00116440 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-05 18:43 - 2013-12-05 18:43 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-12-05 18:28 - 2013-12-05 18:28 - 00000603 _____ C:\Users\*****\Downloads\UpdateInfo.txt
2013-12-04 19:43 - 2013-12-04 19:42 - 79671920 _____ (Sophos Limited) C:\Users\Admin\Downloads\Sophos Virus Removal Tool.exe
2013-12-04 19:40 - 2013-12-04 19:40 - 01668154 _____ C:\Users\Admin\Downloads\fb_add_on@avm.de.xpi
2013-12-04 19:38 - 2013-12-04 19:31 - 189820904 _____ C:\Users\Admin\Downloads\EmsisoftEmergencyKit_4.0.0.13.exe
2013-12-04 19:28 - 2013-12-04 19:28 - 02347384 _____ (ESET) C:\Users\Admin\Downloads\esetsmartinstaller_enu.exe
2013-12-04 19:23 - 2013-12-04 19:23 - 03075631 _____ C:\Users\Admin\Downloads\VirusTotalScanner_3.0.zip
2013-12-04 19:23 - 2013-12-04 19:22 - 09452704 _____ (SurfRight B.V.) C:\Users\Admin\Downloads\HitmanPro3.7.8.208.exe
2013-12-04 19:20 - 2013-12-04 19:19 - 03580416 _____ C:\Users\Admin\Downloads\RogueKiller.exe
2013-12-04 19:08 - 2013-12-04 19:08 - 00000000 ____D C:\TDSSKiller_Quarantine
2013-12-04 19:02 - 2013-12-04 19:02 - 00000000 ____D C:\Users\Admin\Desktop\tdsskiller
2013-12-04 18:51 - 2013-12-04 18:51 - 00000420 _____ C:\Users\Admin\Downloads\isconfig.dat
2013-12-04 18:36 - 2013-12-04 18:36 - 01034531 _____ (Thisisu) C:\Users\Admin\Downloads\JRT.exe
2013-12-04 18:35 - 2013-12-04 18:35 - 00602112 _____ (OldTimer Tools) C:\Users\Admin\Desktop\OTL.exe
2013-12-04 18:33 - 2013-12-04 18:33 - 01110034 _____ C:\Users\Admin\Downloads\AdwCleaner.exe
2013-12-04 18:29 - 2013-12-04 18:29 - 01937144 _____ (Bleeping Computer, LLC) C:\Users\Admin\Downloads\iExplore.exe
2013-12-04 18:27 - 2013-12-04 18:27 - 01937144 _____ (Bleeping Computer, LLC) C:\Users\Admin\Downloads\rkill.exe
2013-12-04 18:25 - 2013-12-04 18:25 - 04733496 _____ (AVAST Software) C:\Users\Admin\Downloads\avast_free_antivirus_setup_online_fdi-b.exe
2013-12-04 18:22 - 2013-12-04 18:22 - 04745728 _____ (AVAST Software) C:\Users\Admin\Downloads\aswmbr (1).exe
2013-12-04 18:17 - 2013-12-04 18:17 - 04745728 _____ (AVAST Software) C:\Users\Admin\Downloads\aswmbr.exe
2013-12-04 18:15 - 2013-12-04 18:15 - 04101441 _____ C:\Users\Admin\Desktop\tdsskiller.zip
2013-12-04 14:55 - 2013-12-04 14:55 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2013-12-04 14:53 - 2013-12-04 14:38 - 00000000 ____D C:\Users\Admin\Desktop\mbar
2013-12-04 14:40 - 2013-12-04 14:40 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-12-04 13:51 - 2013-12-03 17:26 - 00000000 ____D C:\Program Files\Sony
2013-12-04 13:43 - 2013-12-03 17:45 - 00000000 ____D C:\Windows\System32\Tasks\Sony Corporation
2013-12-04 13:43 - 2013-12-03 17:37 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-04 13:43 - 2013-12-03 17:32 - 00000000 ____D C:\ProgramData\Sony Corporation
2013-12-04 13:38 - 2013-12-04 11:04 - 00066104 _____ C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-04 13:38 - 2013-12-04 11:03 - 00000000 ___RD C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-04 13:38 - 2013-12-04 11:03 - 00000000 ___RD C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-12-04 13:37 - 2013-12-04 13:37 - 00000000 ____D C:\Update
2013-12-04 13:29 - 2013-12-03 18:39 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-04 13:29 - 2013-12-03 18:39 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-12-04 13:28 - 2013-12-04 13:28 - 00003538 _____ C:\Windows\System32\Tasks\CreateChoiceProcessTask
2013-12-04 13:28 - 2013-12-04 13:28 - 00001754 _____ C:\Users\Public\Desktop\Browserwahl.lnk
2013-12-04 13:28 - 2013-12-04 13:28 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Adobe
2013-12-04 13:25 - 2009-07-14 05:45 - 00301536 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-04 13:20 - 2011-12-28 20:21 - 00000000 ____D C:\Program Files\Windows Journal
2013-12-04 13:20 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-12-04 13:20 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-12-04 13:20 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\zh-HK
2013-12-04 13:20 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\tr-TR
2013-12-04 13:20 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\zh-HK
2013-12-04 13:20 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\tr-TR
2013-12-04 13:20 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\System
2013-12-04 13:09 - 2011-02-11 00:03 - 01591174 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-12-04 12:27 - 2013-12-04 12:27 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 02776576 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 02284544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 01988096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 01175552 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00604160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00010752 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00010752 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00009728 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00009728 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00002560 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-12-04 12:27 - 2013-12-04 12:27 - 00002560 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-12-04 11:51 - 2013-12-04 11:49 - 00000000 ____D C:\Windows\system32\MRT
2013-12-04 11:20 - 2013-12-03 17:48 - 00002029 _____ C:\Users\*****\Desktop\VAIO Update.lnk
2013-12-04 11:11 - 2013-12-04 11:11 - 00000493 _____ C:\Users\*****\Desktop\Windows Update.lnk
2013-12-04 11:08 - 2013-12-04 11:08 - 00000104 _____ C:\Users\Admin\Desktop\Systemsteuerung.lnk
2013-12-04 11:07 - 2013-12-04 10:31 - 00002334 _____ C:\Users\Admin\Desktop\Sicherer Zahlungsverkehr.lnk
2013-12-04 11:04 - 2013-12-04 11:04 - 00002334 _____ C:\Users\*****\Desktop\Sicherer Zahlungsverkehr.lnk
2013-12-04 11:04 - 2013-12-04 11:04 - 00000000 ____D C:\Users\*****\AppData\Roaming\Intel Corporation
2013-12-04 11:04 - 2013-12-04 11:04 - 00000000 ____D C:\Users\*****\AppData\Roaming\Atheros
2013-12-04 11:04 - 2013-12-04 11:02 - 00000000 ____D C:\Users\*****\AppData\Roaming\Sony Corporation
2013-12-04 11:03 - 2013-12-04 11:03 - 00000000 ____D C:\Users\*****\AppData\Local\VirtualStore
2013-12-04 11:03 - 2013-12-04 11:02 - 00000000 ____D C:\Users\*****
2013-12-04 11:02 - 2013-12-04 11:02 - 00000020 ___SH C:\Users\*****\ntuser.ini
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\Vorlagen
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\Startmenü
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\Netzwerkumgebung
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\Lokale Einstellungen
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\Eigene Dateien
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\Druckumgebung
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\Documents\Eigene Musik
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\Documents\Eigene Bilder
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\AppData\Local\Verlauf
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\AppData\Local\Anwendungsdaten
2013-12-04 11:02 - 2013-12-04 11:02 - 00000000 _SHDL C:\Users\*****\Anwendungsdaten
2013-12-04 10:46 - 2013-12-04 10:29 - 00623200 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2013-12-04 10:46 - 2013-06-10 12:27 - 00029792 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klim6.sys
2013-12-04 10:46 - 2013-05-06 09:22 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2013-12-04 10:46 - 2013-05-05 22:42 - 00029280 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klmouflt.sys
2013-12-04 10:46 - 2013-05-05 22:42 - 00029280 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klkbdflt.sys
2013-12-04 10:30 - 2013-12-04 10:30 - 00001124 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2013-12-04 10:29 - 2013-12-04 10:29 - 00000000 ____D C:\Windows\ELAMBKUP
2013-12-04 10:29 - 2013-12-04 10:29 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-12-04 10:23 - 2013-12-04 10:18 - 00000402 _____ C:\Windows\Tasks\Wise Turbo Checker.job
2013-12-04 10:18 - 2013-12-04 10:18 - 00003218 _____ C:\Windows\System32\Tasks\Wise Turbo Checker
2013-12-04 10:18 - 2013-12-04 10:18 - 00002848 _____ C:\Windows\System32\Tasks\Wise Care 365
2013-12-04 10:12 - 2013-12-04 10:12 - 00001160 _____ C:\Users\Public\Desktop\Wise Care 365.lnk
2013-12-04 10:12 - 2013-12-04 10:10 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Wise Registry Cleaner
2013-12-04 10:12 - 2013-12-04 10:10 - 00000000 ____D C:\Program Files (x86)\Wise
2013-12-04 09:50 - 2013-12-04 09:50 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2013-12-03 19:24 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\restore
2013-12-03 18:40 - 2013-12-03 18:40 - 00000000 ____D C:\Users\Admin\Documents\Bluetooth Folder
2013-12-03 18:40 - 2013-12-03 18:40 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Intel Corporation
2013-12-03 18:40 - 2013-12-03 18:40 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Atheros
2013-12-03 18:40 - 2013-12-03 18:40 - 00000000 ____D C:\Users\Admin\AppData\Local\BMExplorer
2013-12-03 18:40 - 2013-12-03 18:26 - 00000000 ____D C:\ProgramData\Atheros
2013-12-03 18:39 - 2013-12-03 18:39 - 00000000 ___RH C:\Windows\SysWOW64\Drivers\104D_Sony_VPCEH1S1E.mrk
2013-12-03 18:39 - 2013-12-03 18:39 - 00000000 ___RH C:\Windows\system32\Drivers\104D_Sony_VPCEH1S1E.mrk
2013-12-03 18:39 - 2013-12-03 18:39 - 00000000 ___HD C:\Windows\msdownld.tmp
2013-12-03 18:39 - 2013-12-03 18:39 - 00000000 ____D C:\Users\Admin\AppData\Local\VirtualStore
2013-12-03 18:39 - 2013-12-03 18:29 - 00000000 ____D C:\Users\Admin
2013-12-03 18:35 - 2013-12-03 18:30 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Sony Corporation
2013-12-03 18:30 - 2013-12-03 18:30 - 00000000 ____D C:\Windows\SysWOW64\VAIO Startup Setting Tool
2013-12-03 18:30 - 2013-12-03 18:30 - 00000000 ____D C:\Windows\pss
2013-12-03 18:30 - 2013-12-03 17:48 - 00000000 ____D C:\Windows\System32\Tasks\SONY
2013-12-03 18:29 - 2013-12-03 18:29 - 00000020 ___SH C:\Users\Admin\ntuser.ini
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\Vorlagen
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\Startmenü
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\Netzwerkumgebung
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\Lokale Einstellungen
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\Eigene Dateien
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\Druckumgebung
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Musik
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Bilder
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\AppData\Local\Verlauf
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\AppData\Local\Anwendungsdaten
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default\Anwendungsdaten
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Musik
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Bilder
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Verlauf
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Anwendungsdaten
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\Vorlagen
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\Startmenü
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\Netzwerkumgebung
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\Lokale Einstellungen
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\Eigene Dateien
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\Druckumgebung
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\Documents\Eigene Musik
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\Documents\Eigene Bilder
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\AppData\Local\Verlauf
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\AppData\Local\Anwendungsdaten
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Users\Admin\Anwendungsdaten
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Programme
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\ProgramData\Vorlagen
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\ProgramData\Startmenü
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\ProgramData\Favoriten
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\ProgramData\Dokumente
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\ProgramData\Anwendungsdaten
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Program Files\Gemeinsame Dateien
2013-12-03 18:29 - 2013-12-03 18:29 - 00000000 _SHDL C:\Dokumente und Einstellungen
2013-12-03 18:29 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default
2013-12-03 18:29 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Windows NT
2013-12-03 18:26 - 2013-12-03 18:26 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_btath_hcrp_01009.Wdf
2013-12-03 18:26 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\sysprep
2013-12-03 18:15 - 2013-12-03 18:15 - 00262144 _____ C:\Windows\ocsetup_install_OEMHelpCustomization.etl
2013-12-03 18:15 - 2013-12-03 18:15 - 00028728 _____ C:\Windows\ocsetup_cbs_install_OEMHelpCustomization.txt
2013-12-03 18:15 - 2013-12-03 18:15 - 00000000 ____D C:\VAIO Sample Contents
2013-12-03 18:15 - 2013-12-03 17:45 - 00000000 ____D C:\Program Files (x86)\Sony
2013-12-03 18:15 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Help
2013-12-03 18:14 - 2013-12-03 18:14 - 97167020 _____ (Axialis Software) C:\Windows\system32\VAIO Hero Screensaver - Summer 2011.scr
2013-12-03 18:14 - 2013-12-03 18:14 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-03 18:14 - 2013-12-03 18:14 - 00000000 ____D C:\ProgramData\Skype
2013-12-03 18:14 - 2013-12-03 18:14 - 00000000 ____D C:\Program Files (x86)\Nascom
2013-12-03 18:11 - 2013-12-03 18:11 - 00321196 _____ C:\lv.log
2013-12-03 18:11 - 2013-12-03 18:11 - 00000000 ___HD C:\SPLASH.SYS
2013-12-03 18:11 - 2013-12-03 18:11 - 00000000 ___HD C:\SPLASH.000
2013-12-03 18:11 - 2013-12-03 18:11 - 00000000 ____D C:\Program Files (x86)\Downloaded Installations
2013-12-03 18:11 - 2010-11-18 12:03 - 00000087 ____H C:\splash.idx
2013-12-03 18:06 - 2013-12-03 18:06 - 00000000 ____D C:\Program Files (x86)\MSXML 4.0
2013-12-03 18:04 - 2013-12-03 18:04 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2013-12-03 18:01 - 2013-12-03 17:45 - 00000000 ____D C:\Program Files\Common Files\Sony Shared
2013-12-03 18:00 - 2013-12-03 18:00 - 00000000 ____D C:\ProgramData\ArcSoft
2013-12-03 18:00 - 2013-12-03 18:00 - 00000000 ____D C:\Program Files (x86)\ArcSoft
2013-12-03 18:00 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system
2013-12-03 17:59 - 2013-12-03 17:59 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2013-12-03 17:59 - 2013-12-03 17:58 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-12-03 17:58 - 2013-12-04 11:02 - 00000000 ____D C:\Users\*****\AppData\Roaming\Macromedia
2013-12-03 17:58 - 2013-12-03 18:29 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Macromedia
2013-12-03 17:58 - 2013-12-03 17:58 - 00000000 ____D C:\Windows\en
2013-12-03 17:58 - 2013-12-03 17:58 - 00000000 ____D C:\Users\Default\AppData\Roaming\Macromedia
2013-12-03 17:58 - 2013-12-03 17:58 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia
2013-12-03 17:57 - 2013-12-03 17:52 - 00000000 ____D C:\Program Files (x86)\Windows Live
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\uk
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\tr
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\sv
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\sk
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\ru
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\ro
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\pl
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\no
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\nl
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\it
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\hu
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\fr
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\fi
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\el
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\de
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\da
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\cs
2013-12-03 17:56 - 2013-12-03 17:56 - 00000000 ____D C:\Windows\bg
2013-12-03 17:55 - 2013-12-03 17:55 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2013-12-03 17:51 - 2013-12-03 17:51 - 00000000 ____D C:\Windows\PCHEALTH
2013-12-03 17:51 - 2013-12-03 17:51 - 00000000 ____D C:\Program Files\Windows Live
2013-12-03 17:51 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-12-03 17:50 - 2013-12-03 17:50 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-12-03 17:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\oobe
2013-12-03 17:48 - 2013-12-03 17:48 - 00000000 ____D C:\Documentation
2013-12-03 17:48 - 2013-12-03 17:48 - 00000000 ____D C:\_FS_SWRINFO
2013-12-03 17:48 - 2013-12-03 17:47 - 00000000 ____D C:\Windows\Sonysys
2013-12-03 17:48 - 2011-02-10 23:52 - 00000012 _____ C:\Windows\csup.txt
2013-12-03 17:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Resources
2013-12-03 17:47 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\oobe
2013-12-03 17:45 - 2013-12-03 17:45 - 00521448 _____ (Sun Microsystems, Inc.) C:\Windows\system32\deployJava1.dll
2013-12-03 17:45 - 2013-12-03 17:45 - 00472808 _____ (Sun Microsystems, Inc.) C:\Windows\SysWOW64\deployJava1.dll
2013-12-03 17:45 - 2013-12-03 17:45 - 00189216 _____ (Sun Microsystems, Inc.) C:\Windows\system32\javaws.exe
2013-12-03 17:45 - 2013-12-03 17:45 - 00171808 _____ (Sun Microsystems, Inc.) C:\Windows\system32\javaw.exe
2013-12-03 17:45 - 2013-12-03 17:45 - 00171808 _____ (Sun Microsystems, Inc.) C:\Windows\system32\java.exe
2013-12-03 17:45 - 2013-12-03 17:45 - 00153376 _____ (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaws.exe
2013-12-03 17:45 - 2013-12-03 17:45 - 00145184 _____ (Sun Microsystems, Inc.) C:\Windows\SysWOW64\javaw.exe
2013-12-03 17:45 - 2013-12-03 17:45 - 00145184 _____ (Sun Microsystems, Inc.) C:\Windows\SysWOW64\java.exe
2013-12-03 17:45 - 2013-12-03 17:45 - 00000000 ____D C:\ProgramData\Sun
2013-12-03 17:45 - 2013-12-03 17:45 - 00000000 ____D C:\Program Files\Java
2013-12-03 17:45 - 2013-12-03 17:45 - 00000000 ____D C:\Program Files (x86)\Java
2013-12-03 17:43 - 2013-12-03 17:43 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_Apfiltr_01009.Wdf
2013-12-03 17:43 - 2013-12-03 17:43 - 00000000 ____D C:\Windows\SysWOW64\sda
2013-12-03 17:43 - 2013-12-03 17:43 - 00000000 ____D C:\Program Files\Apoint
2013-12-03 17:43 - 2013-12-03 17:43 - 00000000 ____D C:\Program Files (x86)\Realtek
2013-12-03 17:42 - 2013-12-03 17:42 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-12-03 17:42 - 2013-12-03 17:36 - 00000000 ____D C:\Program Files (x86)\Intel
2013-12-03 17:41 - 2013-12-03 17:41 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-12-03 17:41 - 2013-12-03 17:41 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-12-03 17:40 - 2013-12-03 17:39 - 00000000 ____D C:\Program Files (x86)\Bluetooth Suite
2013-12-03 17:40 - 2011-04-29 17:14 - 00246804 _____ C:\Windows\system32\Drivers\AtherosBt.bin
2013-12-03 17:40 - 2011-04-29 17:14 - 00001274 _____ C:\Windows\system32\Drivers\ramps_0x01020200_26.dfu
2013-12-03 17:40 - 2011-04-29 17:14 - 00001204 _____ C:\Windows\system32\Drivers\ramps_0x01020200_40_0x02.dfu
2013-12-03 17:40 - 2011-04-29 17:14 - 00001204 _____ C:\Windows\system32\Drivers\ramps_0x01020200_40.dfu
2013-12-03 17:39 - 2013-12-03 17:39 - 00000000 ____D C:\Program Files\CONEXANT
2013-12-03 17:36 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Globalization
2013-12-03 17:35 - 2013-12-03 17:35 - 00000000 ____D C:\Intel
2013-12-03 17:25 - 2009-07-14 06:38 - 00025600 ___SH C:\Windows\system32\config\BCD-Template.LOG
2013-12-03 17:25 - 2009-07-14 06:32 - 00028672 _____ C:\Windows\system32\config\BCD-Template
2013-12-03 17:24 - 2013-12-03 17:24 - 00295922 _____ C:\Windows\system32\perfi007.dat
2013-12-03 17:24 - 2013-12-03 17:24 - 00038104 _____ C:\Windows\system32\perfd007.dat
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\SysWOW64\winrm
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\SysWOW64\WCN
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\SysWOW64\sysprep
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\SysWOW64\slmgr
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\SysWOW64\Printing_Admin_Scripts
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\SysWOW64\de
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\SysWOW64\0407
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\system32\winrm
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\system32\WCN
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\system32\slmgr
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\system32\Printing_Admin_Scripts
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\system32\de
2013-12-03 17:24 - 2013-12-03 17:24 - 00000000 ____D C:\Windows\system32\0407
2013-12-03 17:24 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\DigitalLocker
2013-12-03 17:24 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\WinBioPlugIns
2013-12-03 17:24 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Sidebar
2013-12-03 17:24 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2013-12-03 17:24 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\DVD Maker
2013-12-03 17:24 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar
2013-12-03 17:24 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2013-12-03 17:24 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\Setup
2013-12-03 17:24 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\MUI
2013-12-03 17:24 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\migwiz
2013-12-03 17:24 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\Dism
2013-12-03 17:24 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\com
2013-12-03 17:24 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\Setup
2013-12-03 17:24 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\MUI
2013-12-03 17:24 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\migwiz
2013-12-03 17:24 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\Dism
2013-12-03 17:24 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\com
2013-12-03 17:24 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Speech
2013-12-03 17:24 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\servicing
2013-12-03 17:24 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\IME

Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\ntdll_dump.dll
C:\Users\Admin\AppData\Local\Temp\_TinDel.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-03 19:17

==================== End Of Log ============================

M4xNamara · 11.12.2013, 16:26

OTL

Code:

ATTFilter

OTL logfile created on: 09.12.2013 17:47:32 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Admin\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.16428)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,98 Gb Total Physical Memory | 2,47 Gb Available Physical Memory | 61,93% Memory free
7,96 Gb Paging File | 6,43 Gb Available in Paging File | 80,76% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 581,96 Gb Total Space | 538,43 Gb Free Space | 92,52% Space Free | Partition Type: NTFS
Drive F: | 3,82 Gb Total Space | 3,81 Gb Free Space | 99,62% Space Free | Partition Type: FAT32
 
Computer Name: KA-LAPTOP | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Admin\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe (WiseCleaner.com)
PRC - C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Atheros)
PRC - C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
PRC - C:\Programme\Sony\VAIO Care\VCService.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Programme\Sony\VAIO Care\listener.exe (Sony of America Corporation)
PRC - C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe (Sony Corporation)
PRC - c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\34002b75cd0faab68bf8079299c1aa46\IAStorCommon.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\ebdb3050959d9be47d33d2c77d6cc291\IAStorUtil.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\d473c19e69818875b9c739cad8f386a5\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ef0a534be135cd8f0d99d938d8b1814a\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5aa44bce7933e4de09d935848f868a4b\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\4eef5a3a4d0ed6d6fd882947a70df530\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\09db78d6068543df01862a023aca785a\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\29f3ae8d313e62b4daed1107ccd29f9f\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\5d22a30e587e2cac106b81fb351e7c08\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (IEEtwCollectorService) -- C:\Windows\SysNative\IEEtwCollector.exe (Microsoft Corporation)
SRV:64bit: - (SampleCollector) -- C:\Program Files\Sony\VAIO Care\VCPerfService.exe (Sony Corporation)
SRV - (AVP) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe (Kaspersky Lab ZAO)
SRV - (VUAgent) -- C:\Programme\Sony\VAIO Update\VUAgent.exe (Sony Corporation)
SRV - (WiseBootAssistant) -- C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe (WiseCleaner.com)
SRV - (VcmIAlzMgr) -- C:\Programme\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe (Sony Corporation)
SRV - (Atheros Bt&Wlan Coex Agent) -- C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Atheros)
SRV - (AtherosSvc) -- C:\Program Files (x86)\Bluetooth Suite\adminservice.exe (Atheros Commnucations)
SRV - (IconMan_R) -- C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe (Realsil Microelectronics Inc.)
SRV - (VAIO Event Service) -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation)
SRV - (BBSvc) -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (VSNService) -- C:\Programme\Sony\VAIO Smart Network\VSNService.exe (Sony Corporation)
SRV - (SeaPort) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (uCamMonitor) -- C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (ArcSoft, Inc.)
SRV - (SOHCImp) -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe (Sony Corporation)
SRV - (SOHDs) -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe (Sony Corporation)
SRV - (VcmXmlIfHelper) -- C:\Programme\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe (Sony Corporation)
SRV - (VcmINSMgr) -- C:\Programme\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe (Sony Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (VCService) -- C:\Programme\Sony\VAIO Care\VCService.exe (Sony Corporation)
SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (SpfService) -- C:\Programme\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe (Sony Corporation)
SRV - (VCFw) -- C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe (Sony Corporation)
SRV - (PMBDeviceInfoProvider) -- c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)
SRV - (wlcrasvc) -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ACDaemon) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (KLIF) -- C:\Windows\SysNative\drivers\klif.sys (Kaspersky Lab ZAO)
DRV:64bit: - (KLIM6) -- C:\Windows\SysNative\drivers\klim6.sys (Kaspersky Lab ZAO)
DRV:64bit: - (klmouflt) -- C:\Windows\SysNative\drivers\klmouflt.sys (Kaspersky Lab ZAO)
DRV:64bit: - (klkbdflt) -- C:\Windows\SysNative\drivers\klkbdflt.sys (Kaspersky Lab ZAO)
DRV:64bit: - (kl1) -- C:\Windows\SysNative\drivers\kl1.sys (Kaspersky Lab ZAO)
DRV:64bit: - (klflt) -- C:\Windows\SysNative\drivers\klflt.sys (Kaspersky Lab ZAO)
DRV:64bit: - (kneps) -- C:\Windows\SysNative\drivers\kneps.sys (Kaspersky Lab ZAO)
DRV:64bit: - (kltdi) -- C:\Windows\SysNative\drivers\kltdi.sys (Kaspersky Lab ZAO)
DRV:64bit: - (klpd) -- C:\Windows\SysNative\drivers\klpd.sys (Kaspersky Lab ZAO)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (ApfiltrService) -- C:\Windows\SysNative\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV:64bit: - (BtFilter) -- C:\Windows\SysNative\drivers\btfilter.sys (Atheros)
DRV:64bit: - (BTATH_RCP) -- C:\Windows\SysNative\drivers\btath_rcp.sys (Atheros)
DRV:64bit: - (BTATH_HCRP) -- C:\Windows\SysNative\drivers\btath_hcrp.sys (Atheros)
DRV:64bit: - (btath_avdt) -- C:\Windows\SysNative\drivers\btath_avdt.sys (Atheros)
DRV:64bit: - (BTATH_LWFLT) -- C:\Windows\SysNative\drivers\btath_lwflt.sys (Atheros)
DRV:64bit: - (AthBTPort) -- C:\Windows\SysNative\drivers\btath_flt.sys (Atheros)
DRV:64bit: - (BTATH_BUS) -- C:\Windows\SysNative\drivers\btath_bus.sys (Atheros)
DRV:64bit: - (BTATH_A2DP) -- C:\Windows\SysNative\drivers\btath_a2dp.sys (Atheros)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (RSPCIESTOR) -- C:\Windows\SysNative\drivers\RtsPStor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (CnxtHdAudService) -- C:\Windows\SysNative\drivers\CHDRT64.sys (Conexant Systems Inc.)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (SFEP) -- C:\Windows\SysNative\drivers\SFEP.sys (Sony Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (e1yexpress) -- C:\Windows\SysNative\drivers\e1y60x64.sys (Intel Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (ArcSoftKsUFilter) -- C:\Windows\SysNative\drivers\ArcSoftKsUFilter.sys (ArcSoft, Inc.)
DRV - (cleanhlp) -- C:\EEK\Run\cleanhlp64.sys (Emsisoft GmbH)
DRV - (A2DDA) -- C:\EEK\Run\a2ddax64.sys (Emsisoft GmbH)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=SNYEDF&pc=MASE&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=SNYEDF&pc=MASE&src=IE-SearchBox
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2236987307-1683447080-3745446454-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://vaioportal.sony.eu
IE - HKU\S-1-5-21-2236987307-1683447080-3745446454-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://sony.msn.com [binary data]
IE - HKU\S-1-5-21-2236987307-1683447080-3745446454-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
IE - HKU\S-1-5-21-2236987307-1683447080-3745446454-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2236987307-1683447080-3745446454-1000\..\SearchScopes\{27191D46-A9A3-4050-9B0D-4D0A0BA67973}: "URL" = hxxp://rover.ebay.com/rover/1/707-37276-16609-27/4?mpre=hxxp://shop.ebay.de/?oemInLn=ieSrch-Q311&_nkw={searchTerms}
IE - HKU\S-1-5-21-2236987307-1683447080-3745446454-1000\..\SearchScopes\{DB5CB5D2-0E2B-4131-BE34-62FC778F1736}: "URL" = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
IE - HKU\S-1-5-21-2236987307-1683447080-3745446454-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2236987307-1683447080-3745446454-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\url_advisor@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2013.12.04 10:47:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtual_keyboard@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2013.12.04 10:47:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\content_blocker@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2013.12.04 10:47:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\anti_banner@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2013.12.04 10:47:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\online_banking@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2013.12.04 10:47:06 | 000,000,000 | ---D | M]
 
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (no name) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No CLSID value found.
O2:64bit: - BHO: (Content Blocker Plugin) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (Virtual Keyboard Plugin) - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Safe Money Plugin) - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - No CLSID value found.
O2:64bit: - BHO: (URL Advisor Plugin) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (no name) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No CLSID value found.
O2 - BHO: (Content Blocker Plugin) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (Virtual Keyboard Plugin) - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O2 - BHO: (Safe Money Plugin) - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
O2 - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - No CLSID value found.
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (URL Advisor Plugin) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O4:64bit: - HKLM..\Run: [Apoint] C:\Programme\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4:64bit: - HKLM..\Run: [AthBtTray] C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations)
O4:64bit: - HKLM..\Run: [AtherosBtStack] C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Communications)
O4:64bit: - HKLM..\Run: [cAudioFilterAgent] C:\Programme\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Conexant Systems, Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [PMBVolumeWatcher] c:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe (Sony Corporation)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-2236987307-1683447080-3745446454-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 221
O7 - HKU\S-1-5-21-2236987307-1683447080-3745446454-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O9:64bit: - Extra Button: Virtuelle Tastatur - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O9:64bit: - Extra Button: Link-Untersuchung - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Virtuelle Tastatur - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O9 - Extra Button: Link-Untersuchung - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7CC99825-7FDB-41C2-982F-83CB0A9C713D}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D58BECE6-1CEA-43B4-ACF4-8F8F1648CC49}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\dssrequest - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\sacore - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\dssrequest - No CLSID value found
O18 - Protocol\Handler\sacore - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.12.09 17:01:10 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2013.12.06 19:19:25 | 000,028,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\IEUDINIT.EXE
[2013.12.06 19:15:59 | 000,940,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2013.12.06 19:15:59 | 000,194,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\elshyph.dll
[2013.12.06 19:15:54 | 005,765,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013.12.06 19:15:54 | 001,993,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2013.12.06 19:15:54 | 001,926,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2013.12.06 19:15:54 | 001,228,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll
[2013.12.06 19:15:54 | 001,051,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll
[2013.12.06 19:15:54 | 000,942,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jsIntl.dll
[2013.12.06 19:15:54 | 000,817,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2013.12.06 19:15:54 | 000,774,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013.12.06 19:15:54 | 000,708,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll
[2013.12.06 19:15:54 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2013.12.06 19:15:54 | 000,645,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jsIntl.dll
[2013.12.06 19:15:54 | 000,626,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013.12.06 19:15:54 | 000,616,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dat
[2013.12.06 19:15:54 | 000,616,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dat
[2013.12.06 19:15:54 | 000,610,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013.12.06 19:15:54 | 000,574,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013.12.06 19:15:54 | 000,553,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll
[2013.12.06 19:15:54 | 000,548,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2013.12.06 19:15:54 | 000,453,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2013.12.06 19:15:54 | 000,440,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013.12.06 19:15:54 | 000,413,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2013.12.06 19:15:54 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2013.12.06 19:15:54 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2013.12.06 19:15:54 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll
[2013.12.06 19:15:54 | 000,235,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2013.12.06 19:15:54 | 000,235,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\elshyph.dll
[2013.12.06 19:15:54 | 000,233,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2013.12.06 19:15:54 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013.12.06 19:15:54 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2013.12.06 19:15:54 | 000,167,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iexpress.exe
[2013.12.06 19:15:54 | 000,164,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2013.12.06 19:15:54 | 000,151,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iexpress.exe
[2013.12.06 19:15:54 | 000,147,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll
[2013.12.06 19:15:54 | 000,143,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wextract.exe
[2013.12.06 19:15:54 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wextract.exe
[2013.12.06 19:15:54 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2013.12.06 19:15:54 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2013.12.06 19:15:54 | 000,131,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll
[2013.12.06 19:15:54 | 000,127,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll
[2013.12.06 19:15:54 | 000,116,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2013.12.06 19:15:54 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2013.12.06 19:15:54 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe
[2013.12.06 19:15:54 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\IEAdvpack.dll
[2013.12.06 19:15:54 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013.12.06 19:15:54 | 000,101,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll
[2013.12.06 19:15:54 | 000,090,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SetIEInstalledDate.exe
[2013.12.06 19:15:54 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013.12.06 19:15:54 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013.12.06 19:15:54 | 000,084,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2013.12.06 19:15:54 | 000,083,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll
[2013.12.06 19:15:54 | 000,083,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll
[2013.12.06 19:15:54 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll
[2013.12.06 19:15:54 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx
[2013.12.06 19:15:54 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\SetIEInstalledDate.exe
[2013.12.06 19:15:54 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013.12.06 19:15:54 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2013.12.06 19:15:54 | 000,069,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\icardie.dll
[2013.12.06 19:15:54 | 000,066,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013.12.06 19:15:54 | 000,062,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx
[2013.12.06 19:15:54 | 000,062,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll
[2013.12.06 19:15:54 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll
[2013.12.06 19:15:54 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013.12.06 19:15:54 | 000,056,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\pngfilt.dll
[2013.12.06 19:15:54 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll
[2013.12.06 19:15:54 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmler.dll
[2013.12.06 19:15:54 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll
[2013.12.06 19:15:54 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll
[2013.12.06 19:15:54 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll
[2013.12.06 19:15:54 | 000,040,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll
[2013.12.06 19:15:54 | 000,034,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
[2013.12.06 19:15:54 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013.12.06 19:15:54 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013.12.06 19:15:54 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2013.12.06 19:15:54 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2013.12.06 19:15:54 | 000,013,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshta.exe
[2013.12.06 19:15:54 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2013.12.06 19:15:54 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2013.12.06 19:15:54 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll
[2013.12.06 16:25:28 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll
[2013.12.06 16:25:27 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\splwow64.exe
[2013.12.06 01:32:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Licenses
[2013.12.06 01:32:51 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2013.12.06 01:32:49 | 001,070,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCOMCTL.OCX
[2013.12.06 01:32:49 | 000,129,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSSTDFMT.DLL
[2013.12.06 00:37:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BillP Studios
[2013.12.06 00:17:12 | 000,000,000 | ---D | C] -- C:\FRST
[2013.12.06 00:15:29 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2013.12.05 23:35:23 | 001,925,140 | ---- | C] (Farbar) -- C:\Users\Admin\Desktop\FRST64.exe
[2013.12.05 23:28:10 | 000,000,000 | ---D | C] -- C:\EEK
[2013.12.05 22:08:59 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013.12.05 22:07:09 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2013.12.05 22:05:56 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\RK_Quarantine
[2013.12.05 22:02:58 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\rkill
[2013.12.05 22:02:33 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro
[2013.12.05 18:44:52 | 000,116,440 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2013.12.05 18:43:55 | 000,091,352 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys
[2013.12.05 18:43:51 | 000,000,000 | ---D | C] -- C:\mbar
[2013.12.04 19:08:52 | 000,000,000 | ---D | C] -- C:\TDSSKiller_Quarantine
[2013.12.04 19:02:21 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\tdsskiller
[2013.12.04 18:35:49 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
[2013.12.04 14:55:07 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Malwarebytes
[2013.12.04 14:40:23 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\ElevatedDiagnostics
[2013.12.04 14:40:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.12.04 14:40:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
[2013.12.04 14:38:49 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\mbar
[2013.12.04 14:09:31 | 010,285,040 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Admin\Desktop\mbam-setup-1.75.0.1300.exe
[2013.12.04 14:09:28 | 012,576,792 | ---- | C] (Malwarebytes Corp.) -- C:\Users\Admin\Desktop\mbar-1.07.0.1007.exe
[2013.12.04 13:37:39 | 000,000,000 | ---D | C] -- C:\Update
[2013.12.04 13:28:44 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Adobe
[2013.12.04 12:39:36 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\wdf01000.sys.mui
[2013.12.04 12:27:29 | 003,928,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d2d1.dll
[2013.12.04 12:27:29 | 002,776,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll
[2013.12.04 12:27:29 | 002,565,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll
[2013.12.04 12:27:29 | 002,284,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msmpeg2vdec.dll
[2013.12.04 12:27:29 | 001,682,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll
[2013.12.04 12:27:29 | 001,643,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll
[2013.12.04 12:27:29 | 001,238,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10.dll
[2013.12.04 12:27:29 | 001,158,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsPrint.dll
[2013.12.04 12:27:29 | 000,648,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll
[2013.12.04 12:27:29 | 000,522,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll
[2013.12.04 12:27:29 | 000,465,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMPhoto.dll
[2013.12.04 12:27:29 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMPhoto.dll
[2013.12.04 12:27:29 | 000,364,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsGdiConverter.dll
[2013.12.04 12:27:29 | 000,363,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxgi.dll
[2013.12.04 12:27:29 | 000,333,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1core.dll
[2013.12.04 12:27:29 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10core.dll
[2013.12.04 12:27:29 | 000,245,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecsExt.dll
[2013.12.04 12:27:29 | 000,221,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\UIAnimation.dll
[2013.12.04 12:27:29 | 000,194,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll
[2013.12.04 12:27:29 | 000,187,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\UIAnimation.dll
[2013.12.04 12:27:29 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.12.04 12:27:29 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.12.04 12:27:29 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.12.04 12:27:29 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.12.04 12:27:29 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.12.04 12:27:29 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.12.04 12:27:29 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.12.04 12:27:29 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.12.04 12:27:29 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.12.04 12:27:29 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.12.04 12:27:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.12.04 12:27:29 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.12.04 12:27:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
[2013.12.04 12:27:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll
[2013.12.04 12:27:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.12.04 12:27:29 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.12.04 12:27:29 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.12.04 12:27:29 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.12.04 12:15:03 | 000,294,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browserchoice.exe
[2013.12.04 11:57:23 | 000,194,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFPlatform.dll
[2013.12.04 11:57:22 | 000,744,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFx.dll
[2013.12.04 11:57:22 | 000,229,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFHost.exe
[2013.12.04 11:57:22 | 000,045,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFCoinstaller.dll
[2013.12.04 11:49:01 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\MRT
[2013.12.04 11:33:43 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013.12.04 11:29:05 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
[2013.12.04 11:29:05 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
[2013.12.04 11:29:05 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
[2013.12.04 11:28:50 | 002,746,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gameux.dll
[2013.12.04 11:28:50 | 000,441,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Wpc.dll
[2013.12.04 11:28:50 | 000,046,592 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\fpb.rs
[2013.12.04 11:28:50 | 000,046,592 | ---- | C] (Microsoft) -- C:\Windows\SysNative\fpb.rs
[2013.12.04 11:28:50 | 000,045,568 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\oflc-nz.rs
[2013.12.04 11:28:50 | 000,045,568 | ---- | C] (Microsoft) -- C:\Windows\SysNative\oflc-nz.rs
[2013.12.04 11:28:50 | 000,044,544 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegibbfc.rs
[2013.12.04 11:28:50 | 000,044,544 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegibbfc.rs
[2013.12.04 11:28:50 | 000,043,520 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\csrr.rs
[2013.12.04 11:28:50 | 000,043,520 | ---- | C] (Microsoft) -- C:\Windows\SysNative\csrr.rs
[2013.12.04 11:28:50 | 000,040,960 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\cob-au.rs
[2013.12.04 11:28:50 | 000,040,960 | ---- | C] (Microsoft) -- C:\Windows\SysNative\cob-au.rs
[2013.12.04 11:28:50 | 000,030,720 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\usk.rs
[2013.12.04 11:28:50 | 000,030,720 | ---- | C] (Microsoft) -- C:\Windows\SysNative\usk.rs
[2013.12.04 11:28:50 | 000,021,504 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\grb.rs
[2013.12.04 11:28:50 | 000,021,504 | ---- | C] (Microsoft) -- C:\Windows\SysNative\grb.rs
[2013.12.04 11:28:50 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi-pt.rs
[2013.12.04 11:28:50 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi-pt.rs
[2013.12.04 11:28:50 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi.rs
[2013.12.04 11:28:50 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi.rs
[2013.12.04 11:28:50 | 000,015,360 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\djctq.rs
[2013.12.04 11:28:50 | 000,015,360 | ---- | C] (Microsoft) -- C:\Windows\SysNative\djctq.rs
[2013.12.04 11:28:49 | 002,576,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\gameux.dll
[2013.12.04 11:28:49 | 000,308,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\Wpc.dll
[2013.12.04 11:28:48 | 000,055,296 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\cero.rs
[2013.12.04 11:28:48 | 000,055,296 | ---- | C] (Microsoft) -- C:\Windows\SysNative\cero.rs
[2013.12.04 11:28:48 | 000,051,712 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\esrb.rs
[2013.12.04 11:28:48 | 000,051,712 | ---- | C] (Microsoft) -- C:\Windows\SysNative\esrb.rs
[2013.12.04 11:28:48 | 000,023,552 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\oflc.rs
[2013.12.04 11:28:48 | 000,023,552 | ---- | C] (Microsoft) -- C:\Windows\SysNative\oflc.rs
[2013.12.04 11:28:48 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysWow64\pegi-fi.rs
[2013.12.04 11:28:48 | 000,020,480 | ---- | C] (Microsoft) -- C:\Windows\SysNative\pegi-fi.rs
[2013.12.04 11:28:09 | 000,111,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\consent.exe
[2013.12.04 11:27:38 | 001,474,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2013.12.04 11:27:38 | 000,139,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2013.12.04 11:27:28 | 005,549,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2013.12.04 11:27:28 | 003,969,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2013.12.04 11:27:28 | 003,914,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2013.12.04 11:27:27 | 001,732,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
[2013.12.04 11:27:27 | 000,878,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\advapi32.dll
[2013.12.04 11:27:27 | 000,859,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tdh.dll
[2013.12.04 11:27:27 | 000,619,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tdh.dll
[2013.12.04 11:27:27 | 000,243,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
[2013.12.04 11:27:27 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2013.12.04 11:27:27 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2013.12.04 11:27:27 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2013.12.04 11:27:27 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2013.12.04 11:27:27 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2013.12.04 11:27:25 | 001,572,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\quartz.dll
[2013.12.04 11:27:25 | 001,328,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\quartz.dll
[2013.12.04 11:27:25 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qdvd.dll
[2013.12.04 11:27:25 | 000,366,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qdvd.dll
[2013.12.04 11:27:23 | 001,887,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d11.dll
[2013.12.04 11:27:23 | 001,505,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll
[2013.12.04 11:27:22 | 001,161,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
[2013.12.04 11:27:22 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2013.12.04 11:27:21 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
[2013.12.04 11:27:21 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2013.12.04 11:27:21 | 000,112,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\smss.exe
[2013.12.04 11:27:21 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
[2013.12.04 11:27:21 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\apisetschema.dll
[2013.12.04 11:27:21 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\apisetschema.dll
[2013.12.04 11:27:21 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2013.12.04 11:27:21 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2013.12.04 11:27:21 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2013.12.04 11:27:21 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2013.12.04 11:27:21 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2013.12.04 11:27:21 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2013.12.04 11:27:21 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2013.12.04 11:27:21 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2013.12.04 11:27:21 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2013.12.04 11:27:21 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2013.12.04 11:27:21 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2013.12.04 11:27:21 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2013.12.04 11:27:21 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2013.12.04 11:27:21 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2013.12.04 11:27:21 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2013.12.04 11:27:21 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2013.12.04 11:27:21 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2013.12.04 11:27:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2013.12.04 11:27:13 | 001,888,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMVDECOD.DLL
[2013.12.04 11:27:13 | 000,142,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\poqexec.exe
[2013.12.04 11:27:13 | 000,123,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\poqexec.exe
[2013.12.04 11:27:12 | 001,620,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMVDECOD.DLL
[2013.12.04 11:27:10 | 000,509,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntshrui.dll
[2013.12.04 11:26:27 | 000,395,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\webio.dll
[2013.12.04 11:26:27 | 000,314,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\webio.dll
[2013.12.04 11:26:21 | 001,447,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll
[2013.12.04 11:26:21 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2013.12.04 11:26:21 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll
[2013.12.04 11:26:21 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll
[2013.12.04 11:26:21 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll
[2013.12.04 11:26:16 | 000,368,128 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysNative\atmfd.dll
[2013.12.04 11:26:16 | 000,295,424 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\atmfd.dll
[2013.12.04 11:26:16 | 000,100,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\fontsub.dll
[2013.12.04 11:26:16 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\fontsub.dll
[2013.12.04 11:26:16 | 000,046,080 | ---- | C] (Adobe Systems) -- C:\Windows\SysNative\atmlib.dll
[2013.12.04 11:26:16 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lpk.dll
[2013.12.04 11:26:16 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\SysWow64\atmlib.dll
[2013.12.04 11:26:16 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dciman32.dll
[2013.12.04 11:26:15 | 000,224,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
[2013.12.04 11:25:59 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll
[2013.12.04 11:25:59 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll
[2013.12.04 11:25:57 | 001,930,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\authui.dll
[2013.12.04 11:25:57 | 001,796,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\authui.dll
[2013.12.04 11:25:57 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\credui.dll
[2013.12.04 11:25:57 | 000,190,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SmartcardCredentialProvider.dll
[2013.12.04 11:25:57 | 000,152,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\SmartcardCredentialProvider.dll
[2013.12.04 11:25:46 | 000,226,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcore6.dll
[2013.12.04 11:25:46 | 000,193,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dhcpcore6.dll
[2013.12.04 11:25:46 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcsvc6.dll
[2013.12.04 11:25:41 | 000,155,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\ataport.sys
[2013.12.04 11:25:41 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdrmemptylst.exe
[2013.12.04 11:25:40 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll
[2013.12.04 11:25:40 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll
[2013.12.04 11:25:38 | 003,216,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msi.dll
[2013.12.04 11:25:36 | 000,515,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\timedate.cpl
[2013.12.04 11:25:36 | 000,478,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\timedate.cpl
[2013.12.04 11:25:28 | 001,217,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rpcrt4.dll
[2013.12.04 11:25:26 | 003,717,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstscax.dll
[2013.12.04 11:25:25 | 003,217,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstscax.dll
[2013.12.04 11:25:24 | 000,158,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aaclient.dll
[2013.12.04 11:25:24 | 000,131,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\aaclient.dll
[2013.12.04 11:25:24 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tsgqec.dll
[2013.12.04 11:25:24 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tsgqec.dll
[2013.12.04 11:25:09 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wwanprotdim.dll
[2013.12.04 11:25:09 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\RNDISMP.sys
[2013.12.04 11:25:08 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\hidclass.sys
[2013.12.04 11:25:08 | 000,032,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\hidparse.sys
[2013.12.04 11:25:06 | 000,633,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\comctl32.dll
[2013.12.04 11:25:05 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\usb8023.sys
[2013.12.04 11:25:03 | 000,102,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\davclnt.dll
[2013.12.04 11:25:03 | 000,054,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\WdfLdr.sys
[2013.12.04 11:25:03 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Wdfres.dll
[2013.12.04 11:24:20 | 000,246,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netcorehc.dll
[2013.12.04 11:24:20 | 000,216,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncsi.dll
[2013.12.04 11:24:20 | 000,175,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netcorehc.dll
[2013.12.04 11:24:20 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ncsi.dll
[2013.12.04 11:24:20 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netevent.dll
[2013.12.04 11:24:20 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netevent.dll
[2013.12.04 11:24:09 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\shdocvw.dll
[2013.12.04 11:23:58 | 000,800,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\usp10.dll
[2013.12.04 11:23:57 | 000,245,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\OxpsConverter.exe
[2013.12.04 11:23:53 | 000,095,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\synceng.dll
[2013.12.04 11:23:52 | 000,624,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qedit.dll
[2013.12.04 11:23:52 | 000,509,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qedit.dll
[2013.12.04 11:23:52 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\synceng.dll
[2013.12.04 11:23:49 | 000,478,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dpnet.dll
[2013.12.04 11:23:49 | 000,376,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dpnet.dll
[2013.12.04 11:18:36 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll
[2013.12.04 11:18:36 | 000,492,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll
[2013.12.04 11:17:13 | 000,404,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gdi32.dll
[2013.12.04 11:17:10 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netapi32.dll
[2013.12.04 11:17:10 | 000,068,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\taskhost.exe
[2013.12.04 11:17:10 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browcli.dll
[2013.12.04 11:17:10 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\browcli.dll
[2013.12.04 11:15:13 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptdlg.dll
[2013.12.04 11:15:13 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cryptdlg.dll
[2013.12.04 11:14:42 | 001,192,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certutil.exe
[2013.12.04 11:14:42 | 000,903,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certutil.exe
[2013.12.04 11:14:41 | 000,052,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certenc.dll
[2013.12.04 11:14:41 | 000,043,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certenc.dll
[2013.12.04 11:14:06 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll
[2013.12.04 11:14:06 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll
[2013.12.04 11:13:46 | 000,376,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\netio.sys
[2013.12.04 11:13:46 | 000,288,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS
[2013.12.04 11:13:44 | 000,956,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\localspl.dll
[2013.12.04 11:13:34 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll
[2013.12.04 11:13:32 | 000,102,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll
[2013.12.04 11:13:31 | 000,124,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\PresentationCFFRasterizerNative_v0300.dll
[2013.12.04 11:13:23 | 000,634,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msvcrt.dll
[2013.12.04 11:13:22 | 000,265,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\dxgmms1.sys
[2013.12.04 11:13:22 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdd.dll
[2013.12.04 11:13:17 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll
[2013.12.04 11:13:16 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll
[2013.12.04 11:13:07 | 000,324,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\FWPUCLNT.DLL
[2013.12.04 11:13:06 | 000,830,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\nshwfp.dll
[2013.12.04 11:13:06 | 000,656,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\nshwfp.dll
[2013.12.04 11:13:06 | 000,216,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\FWPUCLNT.DLL
[2013.12.04 11:12:31 | 000,461,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\scavengeui.dll
[2013.12.04 11:12:26 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\packager.dll
[2013.12.04 11:12:26 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\packager.dll
[2013.12.04 10:52:48 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imagehlp.dll
[2013.12.04 10:52:48 | 000,023,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\fs_rec.sys
[2013.12.04 10:45:19 | 001,031,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcore.dll
[2013.12.04 10:45:19 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpcore.dll
[2013.12.04 10:40:52 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll
[2013.12.04 10:40:52 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe
[2013.12.04 10:40:52 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
[2013.12.04 10:40:42 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll
[2013.12.04 10:40:42 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll
[2013.12.04 10:40:42 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll
[2013.12.04 10:40:32 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll
[2013.12.04 10:40:32 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe
[2013.12.04 10:30:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
[2013.12.04 10:30:36 | 000,110,176 | ---- | C] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\klfphc.dll
[2013.12.04 10:29:38 | 000,000,000 | ---D | C] -- C:\Windows\ELAMBKUP
[2013.12.04 10:29:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab

M4xNamara · 11.12.2013, 16:27

OTL Teil 2

Code:

ATTFilter

[2013.12.04 10:29:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Kaspersky Lab
[2013.12.04 10:29:19 | 000,623,200 | ---- | C] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\klif.sys
[2013.12.04 10:29:19 | 000,112,224 | ---- | C] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\klflt.sys
[2013.12.04 10:12:26 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Wise Care 365
[2013.12.04 10:12:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Care 365
[2013.12.04 10:10:57 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Wise Registry Cleaner
[2013.12.04 10:10:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Registry Cleaner
[2013.12.04 10:10:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Wise
[2013.12.04 10:10:38 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Programs
[2013.12.03 18:40:11 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Intel Corporation
[2013.12.03 18:40:09 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\BMExplorer
[2013.12.03 18:40:09 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\Bluetooth Folder
[2013.12.03 18:40:07 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Atheros
[2013.12.03 18:39:58 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2013.12.03 18:39:58 | 000,000,000 | R--D | C] -- C:\Users\Admin\Searches
[2013.12.03 18:39:58 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2013.12.03 18:39:49 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Identities
[2013.12.03 18:39:47 | 000,000,000 | R--D | C] -- C:\Users\Admin\Contacts
[2013.12.03 18:39:45 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\VirtualStore
[2013.12.03 18:30:26 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\VAIO Startup Setting Tool
[2013.12.03 18:30:26 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2013.12.03 18:30:18 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Sony Corporation
[2013.12.03 18:29:43 | 000,000,000 | --SD | C] -- C:\Users\Admin\AppData\Roaming\Microsoft
[2013.12.03 18:29:43 | 000,000,000 | R--D | C] -- C:\Users\Admin\Videos
[2013.12.03 18:29:43 | 000,000,000 | R--D | C] -- C:\Users\Admin\Saved Games
[2013.12.03 18:29:43 | 000,000,000 | R--D | C] -- C:\Users\Admin\Pictures
[2013.12.03 18:29:43 | 000,000,000 | R--D | C] -- C:\Users\Admin\Music
[2013.12.03 18:29:43 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2013.12.03 18:29:43 | 000,000,000 | R--D | C] -- C:\Users\Admin\Links
[2013.12.03 18:29:43 | 000,000,000 | R--D | C] -- C:\Users\Admin\Favorites
[2013.12.03 18:29:43 | 000,000,000 | R--D | C] -- C:\Users\Admin\Downloads
[2013.12.03 18:29:43 | 000,000,000 | R--D | C] -- C:\Users\Admin\Documents
[2013.12.03 18:29:43 | 000,000,000 | R--D | C] -- C:\Users\Admin\Desktop
[2013.12.03 18:29:43 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2013.12.03 18:29:43 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Vorlagen
[2013.12.03 18:29:43 | 000,000,000 | -HSD | C] -- C:\Users\Admin\AppData\Local\Verlauf
[2013.12.03 18:29:43 | 000,000,000 | -HSD | C] -- C:\Users\Admin\AppData\Local\Temporary Internet Files
[2013.12.03 18:29:43 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Startmenü
[2013.12.03 18:29:43 | 000,000,000 | -HSD | C] -- C:\Users\Admin\SendTo
[2013.12.03 18:29:43 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Recent
[2013.12.03 18:29:43 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Netzwerkumgebung
[2013.12.03 18:29:43 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Lokale Einstellungen
[2013.12.03 18:29:43 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Documents\Eigene Videos
[2013.12.03 18:29:43 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Documents\Eigene Musik
[2013.12.03 18:29:43 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Eigene Dateien
[2013.12.03 18:29:43 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Documents\Eigene Bilder
[2013.12.03 18:29:43 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Druckumgebung
[2013.12.03 18:29:43 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Cookies
[2013.12.03 18:29:43 | 000,000,000 | -HSD | C] -- C:\Users\Admin\AppData\Local\Anwendungsdaten
[2013.12.03 18:29:43 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Anwendungsdaten
[2013.12.03 18:29:43 | 000,000,000 | -H-D | C] -- C:\Users\Admin\AppData
[2013.12.03 18:29:43 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Temp
[2013.12.03 18:29:43 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Microsoft
[2013.12.03 18:29:43 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Media Center Programs
[2013.12.03 18:29:43 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Macromedia
[2013.12.03 18:29:24 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2013.12.03 18:29:24 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2013.12.03 18:29:24 | 000,000,000 | -HSD | C] -- C:\Programme
[2013.12.03 18:29:24 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2013.12.03 18:29:24 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2013.12.03 18:29:24 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2013.12.03 18:29:24 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2013.12.03 18:29:24 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2013.12.03 18:29:24 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2013.12.03 18:29:24 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2013.12.03 18:29:24 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2013.12.03 18:26:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Atheros
[2013.12.03 18:16:25 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Care
[2013.12.03 18:15:17 | 000,000,000 | ---D | C] -- C:\VAIO Sample Contents
[2013.12.03 18:15:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
[2013.12.03 18:14:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013.12.03 18:14:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2013.12.03 18:14:21 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2013.12.03 18:14:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2013.12.03 18:14:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Nascom
[2013.12.03 18:14:01 | 097,167,020 | ---- | C] (Axialis Software) -- C:\Windows\SysNative\VAIO Hero Screensaver - Summer 2011.scr
[2013.12.03 18:12:32 | 002,475,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_42.dll
[2013.12.03 18:12:32 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_42.dll
[2013.12.03 18:12:16 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayStation Extras
[2013.12.03 18:11:48 | 000,000,000 | -H-D | C] -- C:\SPLASH.000
[2013.12.03 18:11:32 | 000,000,000 | -H-D | C] -- C:\SPLASH.SYS
[2013.12.03 18:11:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Downloaded Installations
[2013.12.03 18:06:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0
[2013.12.03 18:06:19 | 005,073,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_35.dll
[2013.12.03 18:06:18 | 003,927,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_30.dll
[2013.12.03 18:06:18 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_30.dll
[2013.12.03 18:06:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PMB
[2013.12.03 18:04:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office
[2013.12.03 18:02:07 | 002,526,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_43.dll
[2013.12.03 18:02:07 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_43.dll
[2013.12.03 18:02:07 | 001,907,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dcsx_43.dll
[2013.12.03 18:02:07 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_43.dll
[2013.12.03 18:02:07 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_7.dll
[2013.12.03 18:02:07 | 000,518,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_7.dll
[2013.12.03 18:02:07 | 000,276,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx11_43.dll
[2013.12.03 18:02:07 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_43.dll
[2013.12.03 18:02:07 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_7.dll
[2013.12.03 18:02:07 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_7.dll
[2013.12.03 18:02:07 | 000,077,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_5.dll
[2013.12.03 18:02:07 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_5.dll
[2013.12.03 18:02:06 | 002,401,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_43.dll
[2013.12.03 18:02:06 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_43.dll
[2013.12.03 18:02:06 | 000,511,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_43.dll
[2013.12.03 18:02:06 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_43.dll
[2013.12.03 18:00:35 | 000,212,480 | ---- | C] (Eastman Kodak) -- C:\Windows\SysWow64\PCDLIB32.DLL
[2013.12.03 18:00:33 | 000,055,808 | ---- | C] (ArcSoft, Inc.) -- C:\Windows\System\ArcSoftKsUFilter.dll
[2013.12.03 18:00:33 | 000,019,968 | ---- | C] (ArcSoft, Inc.) -- C:\Windows\SysNative\drivers\ArcSoftKsUFilter.sys
[2013.12.03 18:00:32 | 000,245,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\unicows.dll
[2013.12.03 18:00:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcSoft Webcam Suite
[2013.12.03 18:00:26 | 000,000,000 | ---D | C] -- C:\ProgramData\ArcSoft
[2013.12.03 18:00:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ArcSoft
[2013.12.03 18:00:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ArcSoft
[2013.12.03 18:00:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield
[2013.12.03 17:59:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe
[2013.12.03 17:59:02 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
[2013.12.03 17:58:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2013.12.03 17:58:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe AIR
[2013.12.03 17:58:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe
[2013.12.03 17:58:03 | 000,000,000 | ---D | C] -- C:\Windows\en
[2013.12.03 17:56:57 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
[2013.12.03 17:56:55 | 000,000,000 | ---D | C] -- C:\Windows\uk
[2013.12.03 17:56:52 | 000,000,000 | ---D | C] -- C:\Windows\tr
[2013.12.03 17:56:49 | 000,000,000 | ---D | C] -- C:\Windows\sv
[2013.12.03 17:56:46 | 000,000,000 | ---D | C] -- C:\Windows\sk
[2013.12.03 17:56:43 | 000,000,000 | ---D | C] -- C:\Windows\ru
[2013.12.03 17:56:40 | 000,000,000 | ---D | C] -- C:\Windows\ro
[2013.12.03 17:56:37 | 000,000,000 | ---D | C] -- C:\Windows\pt-pt
[2013.12.03 17:56:34 | 000,000,000 | ---D | C] -- C:\Windows\pl
[2013.12.03 17:56:31 | 000,000,000 | ---D | C] -- C:\Windows\no
[2013.12.03 17:56:29 | 000,000,000 | ---D | C] -- C:\Windows\it
[2013.12.03 17:56:26 | 000,000,000 | ---D | C] -- C:\Windows\hu
[2013.12.03 17:56:23 | 000,000,000 | ---D | C] -- C:\Windows\el
[2013.12.03 17:56:20 | 000,000,000 | ---D | C] -- C:\Windows\de
[2013.12.03 17:56:17 | 000,000,000 | ---D | C] -- C:\Windows\fr
[2013.12.03 17:56:15 | 000,000,000 | ---D | C] -- C:\Windows\fi
[2013.12.03 17:56:12 | 000,000,000 | ---D | C] -- C:\Windows\nl
[2013.12.03 17:56:09 | 000,000,000 | ---D | C] -- C:\Windows\da
[2013.12.03 17:56:05 | 000,000,000 | ---D | C] -- C:\Windows\cs
[2013.12.03 17:56:02 | 000,000,000 | ---D | C] -- C:\Windows\bg
[2013.12.03 17:55:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
[2013.12.03 17:52:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live
[2013.12.03 17:51:35 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2013.12.03 17:51:28 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live
[2013.12.03 17:51:15 | 000,523,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_42.dll
[2013.12.03 17:51:15 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_5.dll
[2013.12.03 17:51:15 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_42.dll
[2013.12.03 17:51:15 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_3.dll
[2013.12.03 17:51:11 | 004,398,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_32.dll
[2013.12.03 17:51:11 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_32.dll
[2013.12.03 17:51:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2013.12.03 17:50:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight
[2013.12.03 17:50:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Windows Live
[2013.12.03 17:49:04 | 000,000,000 | ---D | C] -- C:\temp
[2013.12.03 17:49:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft
[2013.12.03 17:48:43 | 000,000,000 | ---D | C] -- C:\_FS_SWRINFO
[2013.12.03 17:48:42 | 000,000,000 | ---D | C] -- C:\Documentation
[2013.12.03 17:47:55 | 000,000,000 | ---D | C] -- C:\Windows\Sonysys
[2013.12.03 17:45:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2013.12.03 17:45:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013.12.03 17:45:50 | 000,472,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll
[2013.12.03 17:45:50 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2013.12.03 17:45:50 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2013.12.03 17:45:50 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2013.12.03 17:45:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2013.12.03 17:45:41 | 000,521,448 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\deployJava1.dll
[2013.12.03 17:45:41 | 000,189,216 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\javaws.exe
[2013.12.03 17:45:41 | 000,171,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\javaw.exe
[2013.12.03 17:45:41 | 000,171,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\java.exe
[2013.12.03 17:45:39 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2013.12.03 17:45:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Sony Shared
[2013.12.03 17:45:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Sony Shared
[2013.12.03 17:45:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sony
[2013.12.03 17:43:22 | 000,000,000 | ---D | C] -- C:\Program Files\Apoint
[2013.12.03 17:43:08 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\sda
[2013.12.03 17:43:04 | 009,888,360 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysWow64\RtsPStorIcon.dll
[2013.12.03 17:43:04 | 000,335,464 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\drivers\RtsPStor.sys
[2013.12.03 17:43:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek
[2013.12.03 17:42:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\postureAgent
[2013.12.03 17:42:48 | 000,056,344 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\drivers\HECIx64.sys
[2013.12.03 17:42:15 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA
[2013.12.03 17:42:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation
[2013.12.03 17:41:44 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation
[2013.12.03 17:41:29 | 020,456,552 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglv64.dll
[2013.12.03 17:41:29 | 018,580,072 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcompiler.dll
[2013.12.03 17:41:29 | 015,039,080 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglv32.dll
[2013.12.03 17:41:29 | 013,011,560 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcompiler.dll
[2013.12.03 17:41:29 | 012,840,040 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvd3dumx.dll
[2013.12.03 17:41:29 | 010,059,368 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvd3dum.dll
[2013.12.03 17:41:29 | 007,715,944 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvwgf2umx.dll
[2013.12.03 17:41:29 | 006,597,736 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuda.dll
[2013.12.03 17:41:29 | 005,639,784 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvwgf2um.dll
[2013.12.03 17:41:29 | 004,936,808 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuda.dll
[2013.12.03 17:41:29 | 003,182,184 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvid.dll
[2013.12.03 17:41:29 | 002,954,856 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvid.dll
[2013.12.03 17:41:29 | 002,871,400 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvenc.dll
[2013.12.03 17:41:29 | 002,579,560 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvenc.dll
[2013.12.03 17:41:29 | 002,206,312 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvapi64.dll
[2013.12.03 17:41:29 | 001,969,768 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvapi.dll
[2013.12.03 17:41:29 | 001,614,440 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco642090.dll
[2013.12.03 17:41:29 | 001,359,976 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvhdagenco642040.dll
[2013.12.03 17:41:29 | 001,359,976 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvgenco642040.dll
[2013.12.03 17:41:29 | 000,173,160 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\drivers\nvhda64v.sys
[2013.12.03 17:41:29 | 000,067,176 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll
[2013.12.03 17:41:29 | 000,057,960 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll
[2013.12.03 17:41:29 | 000,029,288 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvhdap64.dll
[2013.12.03 17:41:29 | 000,011,240 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\drivers\nvBridge.kmd
[2013.12.03 17:41:24 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation
[2013.12.03 17:40:02 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BT Program
[2013.12.03 17:40:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Atheros
[2013.12.03 17:39:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bluetooth Suite
[2013.12.03 17:39:07 | 000,000,000 | ---D | C] -- C:\Program Files\CONEXANT
[2013.12.03 17:37:50 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
[2013.12.03 17:37:37 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information
[2013.12.03 17:36:03 | 000,053,248 | ---- | C] (Windows XP Bundled build C-Centric Single User) -- C:\Windows\SysWow64\CSVer.dll
[2013.12.03 17:36:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Intel
[2013.12.03 17:35:59 | 000,000,000 | ---D | C] -- C:\Intel
[2013.12.03 17:34:29 | 001,699,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\esent.dll
[2013.12.03 17:34:29 | 000,189,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\storport.sys
[2013.12.03 17:34:29 | 000,107,904 | ---- | C] (Advanced Micro Devices) -- C:\Windows\SysNative\drivers\amdsata.sys
[2013.12.03 17:34:29 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\fsutil.exe
[2013.12.03 17:34:29 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\fsutil.exe
[2013.12.03 17:34:29 | 000,027,008 | ---- | C] (Advanced Micro Devices) -- C:\Windows\SysNative\drivers\amdxata.sys
[2013.12.03 17:34:28 | 002,565,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\esent.dll
[2013.12.03 17:32:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Sony Corporation
[2013.12.03 17:29:48 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2013.12.03 17:26:46 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2013.12.03 17:26:11 | 000,000,000 | ---D | C] -- C:\Program Files\Sony
[2013.12.03 17:26:04 | 000,437,272 | R--- | C] (Intel Corporation) -- C:\Windows\SysNative\drivers\iaStor.sys
[2013.12.03 17:24:11 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\XPSViewer
[2013.12.03 17:24:11 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\winrm
[2013.12.03 17:24:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\winrm
[2013.12.03 17:24:11 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\WCN
[2013.12.03 17:24:11 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\UMDF
[2013.12.03 17:24:11 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\sysprep
[2013.12.03 17:24:11 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\slmgr
[2013.12.03 17:24:11 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Printing_Admin_Scripts
[2013.12.03 17:24:11 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\UMDF\de-DE
[2013.12.03 17:24:11 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\de-DE
[2013.12.03 17:24:11 | 000,000,000 | ---D | C] -- C:\Windows\de-DE
[2013.12.03 17:24:11 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\de
[2013.12.03 17:24:11 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0407
[2013.12.03 17:24:10 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\WCN
[2013.12.03 17:24:10 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\slmgr
[2013.12.03 17:24:10 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Printing_Admin_Scripts
[2013.12.03 17:24:10 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\de-DE
[2013.12.03 17:24:10 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\de
[2013.12.03 17:24:10 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0407
[2013.12.03 17:23:43 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\usbrpm.sys.mui
[2013.12.03 17:23:39 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\fvevol.sys.mui
[2013.12.03 17:23:29 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\qwavedrv.sys.mui
[2013.12.03 17:23:28 | 000,017,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\nwifi.sys.mui
[2013.12.03 17:23:28 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\qwavedrv.sys.mui
[2013.12.03 17:23:25 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\volsnap.sys.mui
[2013.12.03 17:23:25 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\usbport.sys.mui
[2013.12.03 17:23:25 | 000,020,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\processr.sys.mui
[2013.12.03 17:23:25 | 000,020,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\intelppm.sys.mui
[2013.12.03 17:23:25 | 000,020,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\amdppm.sys.mui
[2013.12.03 17:23:25 | 000,020,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\amdk8.sys.mui
[2013.12.03 17:23:25 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\usbhub.sys.mui
[2013.12.03 17:23:25 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\serial.sys.mui
[2013.12.03 17:23:25 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ohci1394.sys.mui
[2013.12.03 17:23:25 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\1394ohci.sys.mui
[2013.12.03 17:23:25 | 000,011,776 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerId.sys.mui
[2013.12.03 17:23:25 | 000,011,776 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerIb.sys.mui
[2013.12.03 17:23:25 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\i8042prt.sys.mui
[2013.12.03 17:23:25 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\acpi.sys.mui
[2013.12.03 17:23:25 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\battc.sys.mui
[2013.12.03 17:23:25 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\pci.sys.mui
[2013.12.03 17:23:25 | 000,006,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\IPMIDrv.sys.mui
[2013.12.03 17:23:25 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\sermouse.sys.mui
[2013.12.03 17:23:25 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\kbdclass.sys.mui
[2013.12.03 17:23:25 | 000,004,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\vdrvroot.sys.mui
[2013.12.03 17:23:25 | 000,004,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\mouclass.sys.mui
[2013.12.03 17:23:25 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\wacompen.sys.mui
[2013.12.03 17:23:25 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\vhdmp.sys.mui
[2013.12.03 17:23:25 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\tpm.sys.mui
[2013.12.03 17:23:25 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\isapnp.sys.mui
[2013.12.03 17:23:25 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\hdaudbus.sys.mui
[2013.12.03 17:23:25 | 000,003,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\parport.sys.mui
[2013.12.03 17:23:25 | 000,003,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ataport.sys.mui
[2013.12.03 17:23:25 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\umbus.sys.mui
[2013.12.03 17:23:25 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\mssmbios.sys.mui
[2013.12.03 17:23:25 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\mouhid.sys.mui
[2013.12.03 17:23:25 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\vwifibus.sys.mui
[2013.12.03 17:23:25 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ULIAGPKX.SYS.mui
[2013.12.03 17:23:25 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\UAGP35.SYS.mui
[2013.12.03 17:23:25 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\NV_AGP.SYS.mui
[2013.12.03 17:23:25 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\MTConfig.sys.mui
[2013.12.03 17:23:25 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\kbdhid.sys.mui
[2013.12.03 17:23:25 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\GAGP30KX.SYS.mui
[2013.12.03 17:23:25 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\disk.sys.mui
[2013.12.03 17:23:25 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\AGP440.sys.mui
[2013.12.03 17:23:25 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\wd.sys.mui
[2013.12.03 17:23:25 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\cdrom.sys.mui
[2013.12.03 17:23:25 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\amdide.sys.mui
[2013.12.03 17:23:24 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\tcpip.sys.mui
[2013.12.03 17:23:24 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\mpio.sys.mui
[2013.12.03 17:23:24 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\bthport.sys.mui
[2013.12.03 17:23:24 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\msdsm.sys.mui
[2013.12.03 17:23:24 | 000,004,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\pcmcia.sys.mui
[2013.12.03 17:23:24 | 000,004,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\bthpan.sys.mui
[2013.12.03 17:23:24 | 000,004,096 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\de-DE\pscr.sys.mui
[2013.12.03 17:23:24 | 000,003,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\tsusbflt.sys.mui
[2013.12.03 17:23:24 | 000,003,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\portcls.sys.mui
[2013.12.03 17:23:24 | 000,003,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\HdAudio.sys.mui
[2013.12.03 17:23:24 | 000,003,584 | ---- | C] (ATI Technologies Inc.) -- C:\Windows\SysNative\drivers\de-DE\atikmdag.sys.mui
[2013.12.03 17:23:24 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\serscan.sys.mui
[2013.12.03 17:23:24 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\rndismpx.sys.mui
[2013.12.03 17:23:24 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\rndismp6.sys.mui
[2013.12.03 17:23:24 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\hidbth.sys.mui
[2013.12.03 17:23:24 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\pnpmem.sys.mui
[2013.12.03 17:23:24 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\Dot4usb.sys.mui
[2013.12.03 17:23:24 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\BTHUSB.SYS.mui
[2013.12.03 17:23:24 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrParwdm.sys.mui
[2013.12.03 17:23:24 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ws2ifsl.sys.mui
[2013.12.03 17:23:24 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\bthenum.sys.mui
[2013.12.03 17:23:20 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\pacer.sys.mui
[2013.12.03 17:23:19 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\rdpwd.sys.mui
[2013.12.03 17:23:18 | 000,029,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\bfe.dll.mui
[2013.12.03 17:23:18 | 000,003,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\modem.sys.mui
[2013.12.03 17:23:18 | 000,003,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ipnat.sys.mui
[2013.12.03 17:23:18 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\volmgrx.sys.mui
[2013.12.03 17:23:17 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\afd.sys.mui
[2013.12.03 17:23:16 | 000,072,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ntfs.sys.mui
[2013.12.03 17:23:16 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\tunnel.sys.mui
[2013.12.03 17:23:16 | 000,007,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\luafv.sys.mui
[2013.12.03 17:23:16 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\ndiscap.sys.mui
[2013.12.03 17:23:16 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\rdbss.sys.mui
[2013.12.03 17:23:16 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\srv.sys.mui
[2013.12.03 17:23:16 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\scfilter.sys.mui
[2013.12.03 17:23:15 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\partmgr.sys.mui
[2013.12.03 17:23:14 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ndisuio.sys.mui
[2013.12.03 17:23:14 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\mountmgr.sys.mui
[2013.12.03 17:23:13 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ndiscap.sys.mui
[2013.12.03 17:23:13 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\RNDISMP.sys.mui
[2013.12.03 17:23:13 | 000,002,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\scfilter.sys.mui
[2013.12.03 17:23:12 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\tcpip.sys.mui
[2013.12.03 17:23:10 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ndis.sys.mui
[2013.12.03 17:23:10 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\fltmgr.sys.mui
[2013.12.03 17:23:09 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\http.sys.mui
[2013.12.03 17:23:09 | 000,029,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\bfe.dll.mui
[2013.12.03 17:23:09 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\pacer.sys.mui
[2013.12.03 17:23:09 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\scsiport.sys.mui
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.12.09 17:42:39 | 000,697,068 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.12.09 17:42:39 | 000,652,346 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.12.09 17:42:39 | 000,148,332 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.12.09 17:42:39 | 000,121,278 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.12.09 17:42:38 | 001,613,280 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.12.09 17:11:04 | 000,020,992 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.12.09 17:11:04 | 000,020,992 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.12.09 17:03:45 | 000,000,422 | ---- | M] () -- C:\Windows\tasks\Wise Care 365.job
[2013.12.09 17:03:28 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.12.09 17:03:20 | 3206,959,104 | -HS- | M] () -- C:\hiberfil.sys
[2013.12.09 17:00:50 | 669,890,749 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013.12.06 19:16:00 | 000,194,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\elshyph.dll
[2013.12.06 19:15:59 | 000,940,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2013.12.06 19:15:54 | 005,765,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013.12.06 19:15:54 | 001,993,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2013.12.06 19:15:54 | 001,926,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2013.12.06 19:15:54 | 001,228,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll
[2013.12.06 19:15:54 | 001,051,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll
[2013.12.06 19:15:54 | 000,942,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jsIntl.dll
[2013.12.06 19:15:54 | 000,817,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2013.12.06 19:15:54 | 000,774,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013.12.06 19:15:54 | 000,708,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll
[2013.12.06 19:15:54 | 000,703,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2013.12.06 19:15:54 | 000,645,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jsIntl.dll
[2013.12.06 19:15:54 | 000,626,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013.12.06 19:15:54 | 000,616,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dat
[2013.12.06 19:15:54 | 000,616,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dat
[2013.12.06 19:15:54 | 000,610,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013.12.06 19:15:54 | 000,574,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013.12.06 19:15:54 | 000,553,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll
[2013.12.06 19:15:54 | 000,548,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2013.12.06 19:15:54 | 000,453,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2013.12.06 19:15:54 | 000,440,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013.12.06 19:15:54 | 000,413,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2013.12.06 19:15:54 | 000,337,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2013.12.06 19:15:54 | 000,296,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2013.12.06 19:15:54 | 000,247,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll
[2013.12.06 19:15:54 | 000,235,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2013.12.06 19:15:54 | 000,235,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\elshyph.dll
[2013.12.06 19:15:54 | 000,233,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2013.12.06 19:15:54 | 000,218,624 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013.12.06 19:15:54 | 000,195,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2013.12.06 19:15:54 | 000,167,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iexpress.exe
[2013.12.06 19:15:54 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2013.12.06 19:15:54 | 000,151,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iexpress.exe
[2013.12.06 19:15:54 | 000,147,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll
[2013.12.06 19:15:54 | 000,143,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wextract.exe
[2013.12.06 19:15:54 | 000,139,264 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\wextract.exe
[2013.12.06 19:15:54 | 000,139,264 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2013.12.06 19:15:54 | 000,135,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2013.12.06 19:15:54 | 000,131,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll
[2013.12.06 19:15:54 | 000,127,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll
[2013.12.06 19:15:54 | 000,116,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2013.12.06 19:15:54 | 000,112,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2013.12.06 19:15:54 | 000,111,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe
[2013.12.06 19:15:54 | 000,111,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\IEAdvpack.dll
[2013.12.06 19:15:54 | 000,105,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013.12.06 19:15:54 | 000,101,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll
[2013.12.06 19:15:54 | 000,090,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\SetIEInstalledDate.exe
[2013.12.06 19:15:54 | 000,086,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013.12.06 19:15:54 | 000,086,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013.12.06 19:15:54 | 000,084,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2013.12.06 19:15:54 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll
[2013.12.06 19:15:54 | 000,083,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll
[2013.12.06 19:15:54 | 000,081,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll
[2013.12.06 19:15:54 | 000,077,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx
[2013.12.06 19:15:54 | 000,074,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\SetIEInstalledDate.exe
[2013.12.06 19:15:54 | 000,071,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013.12.06 19:15:54 | 000,069,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2013.12.06 19:15:54 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\icardie.dll
[2013.12.06 19:15:54 | 000,066,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013.12.06 19:15:54 | 000,062,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx
[2013.12.06 19:15:54 | 000,062,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll
[2013.12.06 19:15:54 | 000,061,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll
[2013.12.06 19:15:54 | 000,061,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013.12.06 19:15:54 | 000,056,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\pngfilt.dll
[2013.12.06 19:15:54 | 000,051,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll
[2013.12.06 19:15:54 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmler.dll
[2013.12.06 19:15:54 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll
[2013.12.06 19:15:54 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll
[2013.12.06 19:15:54 | 000,048,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll
[2013.12.06 19:15:54 | 000,040,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll
[2013.12.06 19:15:54 | 000,034,816 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
[2013.12.06 19:15:54 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013.12.06 19:15:54 | 000,032,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013.12.06 19:15:54 | 000,030,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2013.12.06 19:15:54 | 000,024,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2013.12.06 19:15:54 | 000,016,284 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.12.06 19:15:54 | 000,016,284 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2013.12.06 19:15:54 | 000,013,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshta.exe
[2013.12.06 19:15:54 | 000,013,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2013.12.06 19:15:54 | 000,012,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2013.12.06 19:15:54 | 000,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll
[2013.12.06 00:31:17 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2013.12.05 23:35:28 | 001,925,140 | ---- | M] (Farbar) -- C:\Users\Admin\Desktop\FRST64.exe
[2013.12.05 23:28:28 | 000,000,546 | ---- | M] () -- C:\Users\Admin\Desktop\Emsisoft Emergency Kit.lnk
[2013.12.05 22:08:24 | 000,000,512 | ---- | M] () -- C:\Users\Admin\Desktop\MBR.dat
[2013.12.05 21:51:06 | 000,000,013 | ---- | M] () -- C:\fix.bat
[2013.12.05 18:44:52 | 000,116,440 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2013.12.05 18:43:55 | 000,091,352 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys
[2013.12.04 18:35:49 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
[2013.12.04 18:15:31 | 004,101,441 | ---- | M] () -- C:\Users\Admin\Desktop\tdsskiller.zip
[2013.12.04 13:28:32 | 000,001,754 | ---- | M] () -- C:\Users\Public\Desktop\Browserwahl.lnk
[2013.12.04 13:25:52 | 000,301,536 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.12.04 13:09:06 | 001,591,174 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013.12.04 12:27:29 | 003,928,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d2d1.dll
[2013.12.04 12:27:29 | 002,776,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll
[2013.12.04 12:27:29 | 002,565,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll
[2013.12.04 12:27:29 | 002,284,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msmpeg2vdec.dll
[2013.12.04 12:27:29 | 001,682,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll
[2013.12.04 12:27:29 | 001,643,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll
[2013.12.04 12:27:29 | 001,238,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10.dll
[2013.12.04 12:27:29 | 001,158,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsPrint.dll
[2013.12.04 12:27:29 | 000,648,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll
[2013.12.04 12:27:29 | 000,522,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll
[2013.12.04 12:27:29 | 000,465,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WMPhoto.dll
[2013.12.04 12:27:29 | 000,417,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\WMPhoto.dll
[2013.12.04 12:27:29 | 000,364,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsGdiConverter.dll
[2013.12.04 12:27:29 | 000,363,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxgi.dll
[2013.12.04 12:27:29 | 000,333,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1core.dll
[2013.12.04 12:27:29 | 000,296,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10core.dll
[2013.12.04 12:27:29 | 000,245,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecsExt.dll
[2013.12.04 12:27:29 | 000,221,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\UIAnimation.dll
[2013.12.04 12:27:29 | 000,194,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll
[2013.12.04 12:27:29 | 000,187,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\UIAnimation.dll
[2013.12.04 12:27:29 | 000,010,752 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.12.04 12:27:29 | 000,010,752 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.12.04 12:27:29 | 000,009,728 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.12.04 12:27:29 | 000,009,728 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.12.04 12:27:29 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.12.04 12:27:29 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.12.04 12:27:29 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.12.04 12:27:29 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.12.04 12:27:29 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.12.04 12:27:29 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.12.04 12:27:29 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.12.04 12:27:29 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.12.04 12:27:29 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
[2013.12.04 12:27:29 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll
[2013.12.04 12:27:29 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.12.04 12:27:29 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.12.04 12:27:29 | 000,002,560 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.12.04 12:27:29 | 000,002,560 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.12.04 11:08:48 | 000,000,104 | ---- | M] () -- C:\Users\Admin\Desktop\Systemsteuerung.lnk
[2013.12.04 11:07:49 | 000,002,334 | ---- | M] () -- C:\Users\Admin\Desktop\Sicherer Zahlungsverkehr.lnk
[2013.12.04 10:46:46 | 000,623,200 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\klif.sys
[2013.12.04 10:46:46 | 000,029,792 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\klim6.sys
[2013.12.04 10:46:46 | 000,029,280 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\klmouflt.sys
[2013.12.04 10:46:46 | 000,029,280 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\klkbdflt.sys
[2013.12.04 10:46:45 | 000,458,336 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\kl1.sys
[2013.12.04 10:30:37 | 000,001,124 | ---- | M] () -- C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
[2013.12.04 10:23:34 | 000,000,402 | ---- | M] () -- C:\Windows\tasks\Wise Turbo Checker.job
[2013.12.04 10:12:19 | 000,001,160 | ---- | M] () -- C:\Users\Public\Desktop\Wise Care 365.lnk
[2013.12.04 09:50:36 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2013.12.03 18:39:42 | 000,000,000 | RH-- | M] () -- C:\Windows\SysWow64\drivers\104D_Sony_VPCEH1S1E.mrk
[2013.12.03 18:39:42 | 000,000,000 | RH-- | M] () -- C:\Windows\SysNative\drivers\104D_Sony_VPCEH1S1E.mrk
[2013.12.03 18:28:45 | 000,159,772 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2013.12.03 18:28:45 | 000,159,772 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2013.12.03 18:26:23 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_btath_hcrp_01009.Wdf
[2013.12.03 18:15:51 | 000,262,144 | ---- | M] () -- C:\Windows\ocsetup_install_OEMHelpCustomization.etl
[2013.12.03 18:14:02 | 097,167,020 | ---- | M] (Axialis Software) -- C:\Windows\SysNative\VAIO Hero Screensaver - Summer 2011.scr
[2013.12.03 18:11:49 | 000,000,087 | -H-- | M] () -- C:\splash.idx
[2013.12.03 17:45:48 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll
[2013.12.03 17:45:48 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2013.12.03 17:45:48 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2013.12.03 17:45:48 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2013.12.03 17:45:39 | 000,521,448 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\deployJava1.dll
[2013.12.03 17:45:39 | 000,189,216 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\javaws.exe
[2013.12.03 17:45:39 | 000,171,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\javaw.exe
[2013.12.03 17:45:39 | 000,171,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysNative\java.exe
[2013.12.03 17:43:23 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_Apfiltr_01009.Wdf
[2013.12.03 17:40:21 | 000,246,804 | ---- | M] () -- C:\Windows\SysNative\drivers\AtherosBt.bin
[2013.12.03 17:40:21 | 000,001,274 | ---- | M] () -- C:\Windows\SysNative\drivers\ramps_0x01020200_26.dfu
[2013.12.03 17:40:21 | 000,001,204 | ---- | M] () -- C:\Windows\SysNative\drivers\ramps_0x01020200_40_0x02.dfu
[2013.12.03 17:40:21 | 000,001,204 | ---- | M] () -- C:\Windows\SysNative\drivers\ramps_0x01020200_40.dfu
[2013.12.03 17:24:01 | 000,295,922 | ---- | M] () -- C:\Windows\SysNative\perfi007.dat
[2013.12.03 17:24:01 | 000,038,104 | ---- | M] () -- C:\Windows\SysNative\perfd007.dat
[2013.12.03 17:23:43 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\usbrpm.sys.mui
[2013.12.03 17:23:39 | 000,017,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\fvevol.sys.mui
[2013.12.03 17:23:35 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\UMDF\de-DE\WpdMtpDr.dll.mui
[2013.12.03 17:23:29 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\qwavedrv.sys.mui
[2013.12.03 17:23:28 | 000,017,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\nwifi.sys.mui
[2013.12.03 17:23:28 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\qwavedrv.sys.mui
[2013.12.03 17:23:25 | 000,028,672 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\volsnap.sys.mui
[2013.12.03 17:23:25 | 000,025,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\usbport.sys.mui
[2013.12.03 17:23:25 | 000,020,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\processr.sys.mui
[2013.12.03 17:23:25 | 000,020,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\intelppm.sys.mui
[2013.12.03 17:23:25 | 000,020,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\amdppm.sys.mui
[2013.12.03 17:23:25 | 000,020,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\amdk8.sys.mui
[2013.12.03 17:23:25 | 000,011,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\usbhub.sys.mui
[2013.12.03 17:23:25 | 000,011,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\serial.sys.mui
[2013.12.03 17:23:25 | 000,011,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ohci1394.sys.mui
[2013.12.03 17:23:25 | 000,011,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\1394ohci.sys.mui
[2013.12.03 17:23:25 | 000,011,776 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerId.sys.mui
[2013.12.03 17:23:25 | 000,011,776 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerIb.sys.mui
[2013.12.03 17:23:25 | 000,010,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\i8042prt.sys.mui
[2013.12.03 17:23:25 | 000,010,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\acpi.sys.mui
[2013.12.03 17:23:25 | 000,009,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\battc.sys.mui
[2013.12.03 17:23:25 | 000,008,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\pci.sys.mui
[2013.12.03 17:23:25 | 000,006,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\IPMIDrv.sys.mui
[2013.12.03 17:23:25 | 000,005,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\sermouse.sys.mui
[2013.12.03 17:23:25 | 000,005,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\kbdclass.sys.mui
[2013.12.03 17:23:25 | 000,004,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\vdrvroot.sys.mui
[2013.12.03 17:23:25 | 000,004,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\mouclass.sys.mui
[2013.12.03 17:23:25 | 000,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\wacompen.sys.mui
[2013.12.03 17:23:25 | 000,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\vhdmp.sys.mui
[2013.12.03 17:23:25 | 000,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\tpm.sys.mui
[2013.12.03 17:23:25 | 000,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\isapnp.sys.mui
[2013.12.03 17:23:25 | 000,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\hdaudbus.sys.mui
[2013.12.03 17:23:25 | 000,003,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\parport.sys.mui
[2013.12.03 17:23:25 | 000,003,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ataport.sys.mui
[2013.12.03 17:23:25 | 000,003,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\umbus.sys.mui
[2013.12.03 17:23:25 | 000,003,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\mssmbios.sys.mui
[2013.12.03 17:23:25 | 000,003,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\mouhid.sys.mui
[2013.12.03 17:23:25 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\vwifibus.sys.mui
[2013.12.03 17:23:25 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ULIAGPKX.SYS.mui
[2013.12.03 17:23:25 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\UAGP35.SYS.mui
[2013.12.03 17:23:25 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\NV_AGP.SYS.mui
[2013.12.03 17:23:25 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\MTConfig.sys.mui
[2013.12.03 17:23:25 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\kbdhid.sys.mui
[2013.12.03 17:23:25 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\GAGP30KX.SYS.mui
[2013.12.03 17:23:25 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\disk.sys.mui
[2013.12.03 17:23:25 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\AGP440.sys.mui
[2013.12.03 17:23:25 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\wd.sys.mui
[2013.12.03 17:23:25 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\cdrom.sys.mui
[2013.12.03 17:23:25 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\amdide.sys.mui
[2013.12.03 17:23:24 | 000,051,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\tcpip.sys.mui
[2013.12.03 17:23:24 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\mpio.sys.mui
[2013.12.03 17:23:24 | 000,008,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\bthport.sys.mui
[2013.12.03 17:23:24 | 000,007,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\msdsm.sys.mui
[2013.12.03 17:23:24 | 000,006,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\UMDF\de-DE\WUDFUsbccidDriver.dll.mui
[2013.12.03 17:23:24 | 000,004,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\pcmcia.sys.mui
[2013.12.03 17:23:24 | 000,004,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\bthpan.sys.mui
[2013.12.03 17:23:24 | 000,004,096 | ---- | M] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\de-DE\pscr.sys.mui
[2013.12.03 17:23:24 | 000,003,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\tsusbflt.sys.mui
[2013.12.03 17:23:24 | 000,003,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\portcls.sys.mui
[2013.12.03 17:23:24 | 000,003,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\HdAudio.sys.mui
[2013.12.03 17:23:24 | 000,003,584 | ---- | M] (ATI Technologies Inc.) -- C:\Windows\SysNative\drivers\de-DE\atikmdag.sys.mui
[2013.12.03 17:23:24 | 000,003,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\serscan.sys.mui
[2013.12.03 17:23:24 | 000,003,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\rndismpx.sys.mui
[2013.12.03 17:23:24 | 000,003,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\rndismp6.sys.mui
[2013.12.03 17:23:24 | 000,003,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\hidbth.sys.mui
[2013.12.03 17:23:24 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\pnpmem.sys.mui
[2013.12.03 17:23:24 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\Dot4usb.sys.mui
[2013.12.03 17:23:24 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\BTHUSB.SYS.mui
[2013.12.03 17:23:24 | 000,002,560 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrParwdm.sys.mui
[2013.12.03 17:23:24 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ws2ifsl.sys.mui
[2013.12.03 17:23:24 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\bthenum.sys.mui
[2013.12.03 17:23:20 | 000,016,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\pacer.sys.mui
[2013.12.03 17:23:19 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\rdpwd.sys.mui
[2013.12.03 17:23:18 | 000,029,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\bfe.dll.mui
[2013.12.03 17:23:18 | 000,003,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\modem.sys.mui
[2013.12.03 17:23:18 | 000,003,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ipnat.sys.mui
[2013.12.03 17:23:18 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\volmgrx.sys.mui
[2013.12.03 17:23:17 | 000,016,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\afd.sys.mui
[2013.12.03 17:23:16 | 000,072,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ntfs.sys.mui
[2013.12.03 17:23:16 | 000,009,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\tunnel.sys.mui
[2013.12.03 17:23:16 | 000,007,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\luafv.sys.mui
[2013.12.03 17:23:16 | 000,005,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\ndiscap.sys.mui
[2013.12.03 17:23:16 | 000,005,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\rdbss.sys.mui
[2013.12.03 17:23:16 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\srv.sys.mui
[2013.12.03 17:23:16 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\scfilter.sys.mui
[2013.12.03 17:23:15 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\partmgr.sys.mui
[2013.12.03 17:23:14 | 000,003,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ndisuio.sys.mui
[2013.12.03 17:23:14 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\mountmgr.sys.mui
[2013.12.03 17:23:13 | 000,005,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ndiscap.sys.mui
[2013.12.03 17:23:13 | 000,003,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\RNDISMP.sys.mui
[2013.12.03 17:23:13 | 000,002,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\scfilter.sys.mui
[2013.12.03 17:23:12 | 000,051,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\tcpip.sys.mui
[2013.12.03 17:23:10 | 000,041,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\ndis.sys.mui
[2013.12.03 17:23:10 | 000,005,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\fltmgr.sys.mui
[2013.12.03 17:23:09 | 000,044,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\http.sys.mui
[2013.12.03 17:23:09 | 000,029,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\bfe.dll.mui
[2013.12.03 17:23:09 | 000,016,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\drivers\de-DE\pacer.sys.mui
[2013.12.03 17:23:09 | 000,003,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\de-DE\scsiport.sys.mui
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.12.09 17:00:50 | 669,890,749 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2013.12.06 19:15:54 | 000,016,284 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.12.06 19:15:54 | 000,016,284 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2013.12.06 00:31:17 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2013.12.05 23:38:04 | 000,000,422 | ---- | C] () -- C:\Windows\tasks\Wise Care 365.job
[2013.12.05 23:28:28 | 000,000,546 | ---- | C] () -- C:\Users\Admin\Desktop\Emsisoft Emergency Kit.lnk
[2013.12.05 21:51:06 | 000,000,013 | ---- | C] () -- C:\fix.bat
[2013.12.04 18:52:23 | 000,000,512 | ---- | C] () -- C:\Users\Admin\Desktop\MBR.dat
[2013.12.04 18:15:31 | 004,101,441 | ---- | C] () -- C:\Users\Admin\Desktop\tdsskiller.zip
[2013.12.04 14:09:25 | 000,377,856 | ---- | C] () -- C:\Users\Admin\Desktop\gmer_2.1.19163.exe
[2013.12.04 13:43:56 | 000,001,145 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Update.lnk
[2013.12.04 13:28:32 | 000,001,754 | ---- | C] () -- C:\Users\Public\Desktop\Browserwahl.lnk
[2013.12.04 11:57:22 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2013.12.04 11:25:03 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2013.12.04 11:08:48 | 000,000,104 | ---- | C] () -- C:\Users\Admin\Desktop\Systemsteuerung.lnk
[2013.12.04 10:31:13 | 000,002,334 | ---- | C] () -- C:\Users\Admin\Desktop\Sicherer Zahlungsverkehr.lnk
[2013.12.04 10:30:44 | 000,001,124 | ---- | C] () -- C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
[2013.12.04 10:18:51 | 000,000,402 | ---- | C] () -- C:\Windows\tasks\Wise Turbo Checker.job
[2013.12.04 10:12:19 | 000,001,160 | ---- | C] () -- C:\Users\Public\Desktop\Wise Care 365.lnk
[2013.12.04 09:50:36 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2013.12.03 18:39:59 | 000,001,425 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2013.12.03 18:39:42 | 000,000,000 | RH-- | C] () -- C:\Windows\SysWow64\drivers\104D_Sony_VPCEH1S1E.mrk
[2013.12.03 18:39:42 | 000,000,000 | RH-- | C] () -- C:\Windows\SysNative\drivers\104D_Sony_VPCEH1S1E.mrk
[2013.12.03 18:39:34 | 000,001,965 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Music Unlimited powered by Qriocity.lnk
[2013.12.03 18:26:23 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_btath_hcrp_01009.Wdf
[2013.12.03 18:16:48 | 3206,959,104 | -HS- | C] () -- C:\hiberfil.sys
[2013.12.03 18:16:24 | 000,002,017 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Care.lnk
[2013.12.03 18:16:04 | 000,002,197 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Smart Network.lnk
[2013.12.03 18:15:35 | 000,262,144 | ---- | C] () -- C:\Windows\ocsetup_install_OEMHelpCustomization.etl
[2013.12.03 18:15:28 | 000,001,275 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Transfer.lnk
[2013.12.03 18:14:57 | 000,002,072 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Gate.lnk
[2013.12.03 18:14:45 | 000,002,679 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Easy Connect.lnk
[2013.12.03 18:14:28 | 000,002,269 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Data Restore Tool.lnk
[2013.12.03 18:12:17 | 000,001,189 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Remote Keyboard.lnk
[2013.12.03 18:06:08 | 000,001,139 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PMB.lnk
[2013.12.03 18:04:48 | 000,002,435 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2010.lnk
[2013.12.03 18:02:09 | 000,001,303 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Gallery.lnk
[2013.12.03 17:59:33 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2013.12.03 17:55:58 | 000,001,305 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk
[2013.12.03 17:55:52 | 000,001,374 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk
[2013.12.03 17:54:37 | 000,001,458 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
[2013.12.03 17:52:45 | 000,002,486 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
[2013.12.03 17:48:44 | 000,001,995 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Manual.lnk
[2013.12.03 17:48:19 | 000,001,531 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Control Center.lnk
[2013.12.03 17:43:23 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_Apfiltr_01009.Wdf
[2013.12.03 17:42:53 | 000,008,192 | ---- | C] () -- C:\Windows\SysNative\drivers\IntelMEFWVer.dll
[2013.12.03 17:41:29 | 000,007,621 | ---- | C] () -- C:\Windows\SysNative\nvinfo.pb
[2013.12.03 17:30:08 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2013.12.03 17:30:02 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2013.12.03 17:24:41 | 000,295,922 | ---- | C] () -- C:\Windows\SysNative\perfi007.dat
[2013.12.03 17:24:40 | 000,697,068 | ---- | C] () -- C:\Windows\SysNative\perfh007.dat
[2013.12.03 17:24:40 | 000,148,332 | ---- | C] () -- C:\Windows\SysNative\perfc007.dat
[2013.12.03 17:24:40 | 000,038,104 | ---- | C] () -- C:\Windows\SysNative\perfd007.dat
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.07.26 03:24:57 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.07.26 02:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2013.12.09 17:04:15 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Wise Care 365
[2013.12.04 10:12:02 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Wise Registry Cleaner
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:5C321E34

< End of report >

schrauber · 12.12.2013, 10:10

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

M4xNamara · 13.12.2013, 13:18

Combofix

Code:

ATTFilter

ComboFix 13-12-13.01 - Admin 13.12.2013  11:59:15.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4078.2729 [GMT 1:00]
ausgeführt von:: c:\users\******\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {179979E8-273D-D14E-0543-2861940E4886}
FW: Kaspersky Internet Security *Disabled* {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
SP: Kaspersky Internet Security *Disabled/Updated* {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-11-13 bis 2013-12-13  ))))))))))))))))))))))))))))))
.
.
2013-12-13 11:03 . 2013-12-13 11:03	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-12-11 16:57 . 2013-05-10 04:30	167424	----a-w-	c:\program files\Windows Media Player\wmplayer.exe
2013-12-11 16:57 . 2013-05-10 03:48	164864	----a-w-	c:\program files (x86)\Windows Media Player\wmplayer.exe
2013-12-11 16:57 . 2013-05-10 05:56	12625920	----a-w-	c:\windows\system32\wmploc.DLL
2013-12-11 16:57 . 2013-05-10 04:56	12625408	----a-w-	c:\windows\SysWow64\wmploc.DLL
2013-12-11 16:57 . 2013-05-10 05:56	14631424	----a-w-	c:\windows\system32\wmp.dll
2013-12-11 09:26 . 2013-10-30 02:32	335360	----a-w-	c:\windows\system32\msieftp.dll
2013-12-11 09:24 . 2013-09-04 12:12	343040	----a-w-	c:\windows\system32\drivers\usbhub.sys
2013-12-11 09:24 . 2013-09-04 12:11	325120	----a-w-	c:\windows\system32\drivers\usbport.sys
2013-12-11 09:24 . 2013-09-04 12:11	99840	----a-w-	c:\windows\system32\drivers\usbccgp.sys
2013-12-11 09:24 . 2013-09-04 12:11	52736	----a-w-	c:\windows\system32\drivers\usbehci.sys
2013-12-11 09:24 . 2013-09-04 12:11	30720	----a-w-	c:\windows\system32\drivers\usbuhci.sys
2013-12-11 09:24 . 2013-09-04 12:11	25600	----a-w-	c:\windows\system32\drivers\usbohci.sys
2013-12-11 09:24 . 2013-09-04 12:11	7808	----a-w-	c:\windows\system32\drivers\usbd.sys
2013-12-11 09:16 . 2013-12-11 09:16	--------	d-----w-	c:\program files (x86)\Safer Networking
2013-12-09 18:19 . 2013-12-09 18:19	--------	d-----w-	c:\programdata\Canneverbe Limited
2013-12-09 18:19 . 2013-12-09 18:19	--------	d-----w-	c:\program files (x86)\CDBurnerXP
2013-12-06 18:19 . 2013-10-14 17:00	28368	----a-w-	c:\windows\system32\IEUDINIT.EXE
2013-12-06 15:25 . 2013-04-17 07:02	1230336	----a-w-	c:\windows\SysWow64\WindowsCodecs.dll
2013-12-06 15:25 . 2013-04-17 06:24	1424384	----a-w-	c:\windows\system32\WindowsCodecs.dll
2013-12-06 15:25 . 2012-02-11 06:36	559104	----a-w-	c:\windows\system32\spoolsv.exe
2013-12-06 15:25 . 2012-02-11 06:36	67072	----a-w-	c:\windows\splwow64.exe
2013-12-06 00:32 . 2013-12-06 00:32	--------	d-----w-	c:\programdata\Licenses
2013-12-06 00:32 . 2011-11-04 04:13	1070352	----a-w-	c:\windows\SysWow64\MSCOMCTL.OCX
2013-12-06 00:32 . 2009-03-24 11:52	129872	----a-w-	c:\windows\SysWow64\MSSTDFMT.DLL
2013-12-05 23:17 . 2013-12-05 23:17	--------	d-----w-	C:\FRST
2013-12-05 22:28 . 2013-12-05 22:28	--------	d-----w-	C:\EEK
2013-12-05 21:08 . 2013-12-05 21:08	--------	d-----w-	c:\windows\ERUNT
2013-12-05 21:07 . 2013-12-05 21:07	--------	d-----w-	c:\programdata\AVAST Software
2013-12-05 21:02 . 2013-12-05 23:36	--------	d-----w-	c:\programdata\HitmanPro
2013-12-05 20:51 . 2013-12-05 20:51	13	----a-w-	C:\fix.bat
2013-12-05 17:44 . 2013-12-09 18:04	116440	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2013-12-05 17:43 . 2013-12-09 18:03	91352	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2013-12-05 17:43 . 2013-12-05 18:16	--------	d-----w-	C:\mbar
2013-12-05 14:28 . 2013-12-05 14:28	163504	----a-w-	c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10145.bin
2013-12-04 18:08 . 2013-12-09 18:02	--------	d-----w-	C:\TDSSKiller_Quarantine
2013-12-04 13:40 . 2013-12-04 13:40	--------	d-----w-	c:\programdata\Malwarebytes
2013-12-04 13:40 . 2013-12-09 18:17	--------	d-----w-	c:\programdata\Malwarebytes' Anti-Malware (portable)
2013-12-04 12:37 . 2013-12-04 12:37	--------	d-----w-	C:\Update
2013-12-04 11:15 . 2010-02-23 08:16	294912	----a-w-	c:\windows\system32\browserchoice.exe
2013-12-04 10:57 . 2012-07-26 03:08	84992	----a-w-	c:\windows\system32\WUDFSvc.dll
2013-12-04 10:57 . 2012-07-26 03:08	194048	----a-w-	c:\windows\system32\WUDFPlatform.dll
2013-12-04 10:57 . 2012-07-26 02:26	87040	----a-w-	c:\windows\system32\drivers\WUDFPf.sys
2013-12-04 10:57 . 2012-07-26 02:26	198656	----a-w-	c:\windows\system32\drivers\WUDFRd.sys
2013-12-04 10:57 . 2012-07-26 03:08	229888	----a-w-	c:\windows\system32\WUDFHost.exe
2013-12-04 10:57 . 2012-07-26 03:08	744448	----a-w-	c:\windows\system32\WUDFx.dll
2013-12-04 10:57 . 2012-07-26 03:08	45056	----a-w-	c:\windows\system32\WUDFCoinstaller.dll
2013-12-04 10:49 . 2013-12-04 10:51	--------	d-----w-	c:\windows\system32\MRT
2013-12-04 10:29 . 2012-11-30 05:45	362496	----a-w-	c:\windows\system32\wow64win.dll
2013-12-04 10:29 . 2012-11-30 05:45	13312	----a-w-	c:\windows\system32\wow64cpu.dll
2013-12-04 10:29 . 2012-11-30 05:43	16384	----a-w-	c:\windows\system32\ntvdm64.dll
2013-12-04 10:27 . 2013-10-05 20:25	1474048	----a-w-	c:\windows\system32\crypt32.dll
2013-12-04 10:26 . 2011-11-17 06:35	395776	----a-w-	c:\windows\system32\webio.dll
2013-12-04 10:25 . 2012-11-01 05:43	2002432	----a-w-	c:\windows\system32\msxml6.dll
2013-12-04 10:24 . 2012-10-03 17:44	70656	----a-w-	c:\windows\system32\nlaapi.dll
2013-12-04 10:23 . 2012-11-22 05:44	800768	----a-w-	c:\windows\system32\usp10.dll
2013-12-04 10:23 . 2012-11-22 04:45	626688	----a-w-	c:\windows\SysWow64\usp10.dll
2013-12-04 10:23 . 2012-08-21 21:01	245760	----a-w-	c:\windows\system32\OxpsConverter.exe
2013-12-04 10:23 . 2012-09-25 22:46	95744	----a-w-	c:\windows\system32\synceng.dll
2013-12-04 10:23 . 2013-06-04 06:00	624128	----a-w-	c:\windows\system32\qedit.dll
2013-12-04 10:23 . 2013-06-04 04:53	509440	----a-w-	c:\windows\SysWow64\qedit.dll
2013-12-04 10:23 . 2012-09-25 22:47	78336	----a-w-	c:\windows\SysWow64\synceng.dll
2013-12-04 10:23 . 2012-03-17 07:58	75120	----a-w-	c:\windows\system32\drivers\partmgr.sys
2013-12-04 10:23 . 2012-05-01 05:40	209920	----a-w-	c:\windows\system32\profsvc.dll
2013-12-04 10:23 . 2012-11-02 05:59	478208	----a-w-	c:\windows\system32\dpnet.dll
2013-12-04 10:23 . 2012-11-02 05:11	376832	----a-w-	c:\windows\SysWow64\dpnet.dll
2013-12-04 10:18 . 2013-04-26 05:51	751104	----a-w-	c:\windows\system32\win32spl.dll
2013-12-04 10:18 . 2013-04-26 04:55	492544	----a-w-	c:\windows\SysWow64\win32spl.dll
2013-12-04 10:17 . 2013-10-03 02:23	404480	----a-w-	c:\windows\system32\gdi32.dll
2013-12-04 10:17 . 2013-10-03 02:00	311808	----a-w-	c:\windows\SysWow64\gdi32.dll
2013-12-04 10:17 . 2012-11-23 03:13	68608	----a-w-	c:\windows\system32\taskhost.exe
2013-12-04 10:17 . 2012-07-04 22:16	73216	----a-w-	c:\windows\system32\netapi32.dll
2013-12-04 10:17 . 2012-07-04 22:13	59392	----a-w-	c:\windows\system32\browcli.dll
2013-12-04 10:17 . 2012-07-04 22:13	136704	----a-w-	c:\windows\system32\browser.dll
2013-12-04 10:17 . 2012-07-04 21:14	41984	----a-w-	c:\windows\SysWow64\browcli.dll
2013-12-04 10:15 . 2013-05-10 05:49	30720	----a-w-	c:\windows\system32\cryptdlg.dll
2013-12-04 10:15 . 2013-05-10 03:20	24576	----a-w-	c:\windows\SysWow64\cryptdlg.dll
2013-12-04 10:14 . 2013-04-10 05:48	1732608	----a-w-	c:\program files\Windows Journal\NBDoc.DLL
2013-12-04 10:14 . 2013-04-10 05:46	1402880	----a-w-	c:\program files\Windows Journal\JNWDRV.dll
2013-12-04 10:14 . 2013-04-10 05:46	1393152	----a-w-	c:\program files\Windows Journal\JNTFiltr.dll
2013-12-04 10:14 . 2013-04-10 05:46	1367040	----a-w-	c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2013-12-04 10:14 . 2013-04-10 05:03	936448	----a-w-	c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2013-12-04 10:14 . 2013-05-13 03:43	1192448	----a-w-	c:\windows\system32\certutil.exe
2013-12-04 10:14 . 2013-05-13 03:08	903168	----a-w-	c:\windows\SysWow64\certutil.exe
2013-12-04 10:14 . 2013-05-13 05:50	52224	----a-w-	c:\windows\system32\certenc.dll
2013-12-04 10:14 . 2013-05-13 03:08	43008	----a-w-	c:\windows\SysWow64\certenc.dll
2013-12-04 10:14 . 2011-10-15 06:31	723456	----a-w-	c:\windows\system32\EncDec.dll
2013-12-04 10:14 . 2011-10-15 05:38	534528	----a-w-	c:\windows\SysWow64\EncDec.dll
2013-12-04 10:12 . 2013-08-28 01:12	461312	----a-w-	c:\windows\system32\scavengeui.dll
2013-12-04 10:12 . 2011-11-19 14:58	77312	----a-w-	c:\windows\system32\packager.dll
2013-12-04 10:12 . 2011-11-19 14:01	67072	----a-w-	c:\windows\SysWow64\packager.dll
2013-12-04 10:02 . 2013-12-04 10:03	--------	d-----w-	c:\users\******
2013-12-04 09:52 . 2012-03-01 06:46	23408	----a-w-	c:\windows\system32\drivers\fs_rec.sys
2013-12-04 09:52 . 2012-03-01 06:28	5120	----a-w-	c:\windows\system32\wmi.dll
2013-12-04 09:52 . 2012-03-01 05:29	5120	----a-w-	c:\windows\SysWow64\wmi.dll
2013-12-04 09:45 . 2012-02-17 06:38	1031680	----a-w-	c:\windows\system32\rdpcore.dll
2013-12-04 09:45 . 2012-02-17 05:34	826880	----a-w-	c:\windows\SysWow64\rdpcore.dll
2013-12-04 09:45 . 2012-02-17 04:57	23552	----a-w-	c:\windows\system32\drivers\tdtcp.sys
2013-12-04 09:40 . 2012-06-02 22:19	2428952	----a-w-	c:\windows\system32\wuaueng.dll
2013-12-04 09:40 . 2012-06-02 22:19	57880	----a-w-	c:\windows\system32\wuauclt.exe
2013-12-04 09:40 . 2012-06-02 22:19	44056	----a-w-	c:\windows\system32\wups2.dll
2013-12-04 09:40 . 2012-06-02 22:15	2622464	----a-w-	c:\windows\system32\wucltux.dll
2013-12-04 09:40 . 2012-06-02 22:19	38424	----a-w-	c:\windows\system32\wups.dll
2013-12-04 09:40 . 2012-06-02 22:19	701976	----a-w-	c:\windows\system32\wuapi.dll
2013-12-04 09:40 . 2012-06-02 22:15	99840	----a-w-	c:\windows\system32\wudriver.dll
2013-12-04 09:40 . 2012-06-02 14:19	186752	----a-w-	c:\windows\system32\wuwebv.dll
2013-12-04 09:40 . 2012-06-02 14:15	36864	----a-w-	c:\windows\system32\wuapp.exe
2013-12-04 09:30 . 2013-05-06 08:13	110176	----a-w-	c:\windows\system32\klfphc.dll
2013-12-04 09:29 . 2013-12-04 09:29	--------	d-----w-	c:\windows\ELAMBKUP
2013-12-04 09:29 . 2013-12-13 10:51	--------	d-----w-	c:\programdata\Kaspersky Lab
2013-12-04 09:29 . 2013-12-04 09:29	--------	d-----w-	c:\program files (x86)\Kaspersky Lab
2013-12-04 09:29 . 2013-12-04 09:46	623200	----a-w-	c:\windows\system32\drivers\klif.sys
2013-12-04 09:29 . 2013-06-08 19:18	112224	----a-w-	c:\windows\system32\drivers\klflt.sys
2013-12-04 09:10 . 2013-12-04 09:12	--------	d-----w-	c:\program files (x86)\Wise
2013-12-03 17:39 . 2013-12-03 17:39	--------	d--h--w-	c:\windows\msdownld.tmp
2013-12-03 17:30 . 2013-12-03 17:30	--------	d-----w-	c:\windows\SysWow64\VAIO Startup Setting Tool
2013-12-03 17:26 . 2013-12-11 09:08	--------	d-----w-	c:\programdata\Atheros
2013-12-03 17:15 . 2013-12-03 17:15	--------	d-----w-	C:\VAIO Sample Contents
2013-12-03 17:14 . 2013-12-03 17:14	--------	d-----w-	c:\program files (x86)\Common Files\Skype
2013-12-03 17:14 . 2013-12-03 17:14	--------	d-----r-	c:\program files (x86)\Skype
2013-12-03 17:14 . 2013-12-03 17:14	--------	d-----w-	c:\programdata\Skype
2013-12-03 17:14 . 2013-12-03 17:14	--------	d-----w-	c:\program files (x86)\Nascom
2013-12-03 17:14 . 2013-12-03 17:14	97167020	----a-w-	c:\windows\system32\VAIO Hero Screensaver - Summer 2011.scr
2013-12-03 17:12 . 2009-09-04 16:29	1892184	----a-w-	c:\windows\SysWow64\D3DX9_42.dll
2013-12-03 17:12 . 2009-09-04 16:29	2475352	----a-w-	c:\windows\system32\D3DX9_42.dll
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-05 13:37 . 2010-06-24 10:33	22240	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-12-04 09:46 . 2013-06-10 11:27	29792	----a-w-	c:\windows\system32\drivers\klim6.sys
2013-12-04 09:46 . 2013-05-05 21:42	29280	----a-w-	c:\windows\system32\drivers\klkbdflt.sys
2013-12-04 09:46 . 2013-05-05 21:42	29280	----a-w-	c:\windows\system32\drivers\klmouflt.sys
2013-12-04 09:46 . 2013-05-06 08:22	458336	----a-w-	c:\windows\system32\drivers\kl1.sys
2013-12-03 16:23 . 2013-12-03 16:23	2560	----a-w-	c:\windows\SysWow64\drivers\de-DE\qwavedrv.sys.mui
2013-12-03 16:23 . 2013-12-03 16:23	5632	----a-w-	c:\windows\SysWow64\drivers\de-DE\ndiscap.sys.mui
2013-12-03 16:23 . 2013-12-03 16:23	2560	----a-w-	c:\windows\SysWow64\drivers\de-DE\scfilter.sys.mui
2013-12-03 16:23 . 2013-12-03 16:23	51712	----a-w-	c:\windows\SysWow64\drivers\de-DE\tcpip.sys.mui
2013-12-03 16:23 . 2013-12-03 16:23	29696	----a-w-	c:\windows\SysWow64\drivers\de-DE\bfe.dll.mui
2013-12-03 16:23 . 2013-12-03 16:23	16896	----a-w-	c:\windows\SysWow64\drivers\de-DE\pacer.sys.mui
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2010-11-26 648032]
"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2011-02-15 2757312]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-09-13 283160]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-15 35736]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-15 932288]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 WiseBootAssistant;Wise Boot Assistant;c:\program files (x86)\Wise\Wise Care 365\BootTime.exe;c:\program files (x86)\Wise\Wise Care 365\BootTime.exe [x]
R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]
R3 btath_avdt;Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys;c:\windows\SYSNATIVE\drivers\btath_avdt.sys [x]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_hcrp.sys [x]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_rcp.sys [x]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
R3 cleanhlp;cleanhlp;c:\eek\Run\cleanhlp64.sys;c:\eek\Run\cleanhlp64.sys [x]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y60x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1y60x64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 SOHCImp;VAIO Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [x]
R3 SOHDs;VAIO Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [x]
R3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [x]
R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [x]
R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [x]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [x]
R4 klflt;klflt;c:\windows\system32\DRIVERS\klflt.sys;c:\windows\SYSNATIVE\DRIVERS\klflt.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S1 A2DDA;A2 Direct Disk Access Support Driver;c:\eek\RUN\a2ddax64.sys;c:\eek\RUN\a2ddax64.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 klpd;klpd;c:\windows\system32\DRIVERS\klpd.sys;c:\windows\SYSNATIVE\DRIVERS\klpd.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [x]
S2 SampleCollector;VAIO Care Performance Service;c:\program files\Sony\VAIO Care\VCPerfService.exe;c:\program files\Sony\VAIO Care\VCPerfService.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe;c:\program files\Sony\VAIO Smart Network\VSNService.exe [x]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftKsUFilter.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys;c:\windows\SYSNATIVE\DRIVERS\btath_bus.sys [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys;c:\windows\SYSNATIVE\DRIVERS\SFEP.sys [x]
S3 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe;c:\program files\Sony\VAIO Care\VCService.exe [x]
S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update\VUAgent.exe;c:\program files\Sony\VAIO Update\VUAgent.exe [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-12-13 c:\windows\Tasks\Wise Care 365.job
- c:\program files (x86)\Wise\Wise Care 365\WiseTray.exe [2013-12-04 13:29]
.
2013-12-04 c:\windows\Tasks\Wise Turbo Checker.job
- c:\program files (x86)\Wise\Wise Care 365\WiseTurbo.exe [2013-12-04 11:46]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2011-03-29 518784]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-04-29 790688]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-04-29 657568]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"MSPCLOCK"="streamci" [X]
"MSPQM"="streamci" [X]
"MSKSSRV"="streamci" [X]
"MSTEE.CxTransform"="streamci" [X]
"MSTEE.Splitter"="streamci" [X]
"WDM_DRMKAUD"="streamci" [X]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
TCP: DhcpNameServer = 192.168.178.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-85797428.sys
SafeBoot-CleanHlp
SafeBoot-CleanHlp.sys
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-Apoint - c:\program files (x86)\Apoint\Apoint.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]
"ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=5000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\% C3 Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=c:\programdata\Sony Corporation\VAIO Care\inteldata\""
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2236987307-1683447080-3745446454-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*¯*î*i%\OpenWithList]
@Class="Shell"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-12-13  12:05:00
ComboFix-quarantined-files.txt  2013-12-13 11:05
.
Vor Suchlauf: 16 Verzeichnis(se), 574.719.152.128 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 574.928.949.248 Bytes frei
.
- - End Of File - - 67678947E2D224DB3C6252D32C4E059F

Wie kann ich Screenshots (mit den chinesischen Dateien im Wise365 Registry Scans) ohne URL hochladen?

schrauber · 13.12.2013, 20:33

Mach Screens und häng sie direkt hier an. Unten auf Erweitert, dann runter scrollen, anhänge verwalten.

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

M4xNamara · 19.12.2013, 16:48

Hallo Schrauber, habe mich entschlossen, werde das Windows neu aufsetzen. Vielen Dank für Deinen Einsatz und schöne Weihnachten!

schrauber · 20.12.2013, 10:01

ok

11.12.2013, 15:02	#2
schrauber /// the machine /// TB-Ausbilder	Dateien mit "kryptischen" u. chinesische Zeichen verfolgen Registry MRUListEx hi, ich warte dann mal auf die Logs __________________ __________________

20.12.2013, 10:01	#13
schrauber /// the machine /// TB-Ausbilder	Dateien mit "kryptischen" u. chinesische Zeichen verfolgen Registry MRUListEx ok __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Dateien mit "kryptischen" u. chinesische Zeichen verfolgen Registry MRUListEx

Log-Analyse und Auswertung: Dateien mit "kryptischen" u. chinesische Zeichen verfolgen Registry MRUListEx