Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Alt 11.01.2014, 13:48   #1
B3AM3R
 
Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool? - Standard

Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?



Hallo Freunde,

ich hatte gestern das Problem, das mein 4 Kern Prozessor nur mit 2 Kernen lief. Daraufhin habe ich einiges ausprobiert um den Fehler zu lokalisieren. Mein 1. Verdacht war, das ich ihn mir beim Übertakten zerschossen habe. Im abgesicherten Modus konnte ich alle 4 Kerne sehen, der Gerätemanager zeigt mir auch 4 reibungslos laufende Kerne an. Ich habe aber festgestellt, das in meiner Registry und an anderen stellen gravierende Änderungen vorgenommen worden sind. Ich habe mein ganzes Laihenwissen angewendet. Scans mit Rootkittools, Malwarebytes und allem anderen funktionieren nicht beziehungsweise zeigen keinerlei Resultate. FRST64 gibt mir auch kurz nach dem Start eine Fehlermeldung raus und wird beendet. Ich bin echt verzweifelt. Könnt ihr mir, mal wieder, helfen?

LG B3AM3R

Alt 11.01.2014, 15:11   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool? - Standard

Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?



Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.


So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________

__________________

Alt 11.01.2014, 17:23   #3
B3AM3R
 
Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool? - Standard

Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?



Hallo Schrauber, es ist natürlich nicht mein Ziel, Dir die Arbeit zu erschweren. Entschuldige. Hier nochmal richtig:

Code:
ATTFilter
OTL Extras logfile created on: 11.01.2014 01:23:57 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Raubtier\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.16428)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 6,26 Gb Available Physical Memory | 78,39% Memory free
15,96 Gb Paging File | 13,93 Gb Available in Paging File | 87,27% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 146,48 Gb Total Space | 91,49 Gb Free Space | 62,46% Space Free | Partition Type: NTFS
Drive D: | 488,28 Gb Total Space | 263,52 Gb Free Space | 53,97% Space Free | Partition Type: NTFS
Drive E: | 443,10 Gb Total Space | 289,63 Gb Free Space | 65,36% Space Free | Partition Type: NTFS
Drive G: | 341,80 Gb Total Space | 164,28 Gb Free Space | 48,06% Space Free | Partition Type: NTFS
Drive H: | 443,23 Gb Total Space | 43,33 Gb Free Space | 9,78% Space Free | Partition Type: NTFS
 
Computer Name: RAUBTIER-PC | User Name: Raubtier | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-199586521-2663480010-3892174971-1000\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{12F00C8C-082D-4996-BEDA-EE8D7C235D86}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{17C35AFD-586C-4BF2-8047-982E66C9852B}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{1980AF02-AD78-434F-BB65-34561D807A4D}" = rport=139 | protocol=6 | dir=out | app=system | 
"{2D7C8FDD-E4C4-4380-A4C1-B264035C8C92}" = lport=137 | protocol=17 | dir=in | app=system | 
"{351E2128-21F1-4AC1-975A-DA509E97B44D}" = rport=137 | protocol=17 | dir=out | app=system | 
"{369D9D66-5A6C-42ED-A871-375E52CB6727}" = rport=138 | protocol=17 | dir=out | app=system | 
"{4E7C99EE-EB83-4C56-9C7C-A36BA1AB1B0B}" = lport=445 | protocol=6 | dir=in | app=system | 
"{57A5D731-16EE-4114-AAEE-6B875BDA6CC8}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{8E436780-53D2-474E-854D-C8F87CAF46AB}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{9674B0AE-3E51-4372-A379-11235DFABF08}" = rport=445 | protocol=6 | dir=out | app=system | 
"{B3A69312-6355-4001-8A48-0B6F798A806D}" = lport=138 | protocol=17 | dir=in | app=system | 
"{E2601526-EC9E-4177-99C3-117165E314D8}" = lport=139 | protocol=6 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1D1DA6CB-9AD8-4749-9204-6BBB181DCEFB}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{2910EAA1-A18D-4B08-B79A-08ADAC3CE47D}" = protocol=6 | dir=in | app=e:\origin games\battlefield 4\bf4_x86.exe | 
"{46766C2C-DFCF-4E40-8A93-D59246795D1A}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{5986A102-4EED-4CFA-B986-B530686BA442}" = protocol=6 | dir=in | app=e:\steam games\steamapps\common\nmrih\sdk\bin\hammer.bat | 
"{60A16F41-BE72-40E4-A155-9B9C0A6AAF23}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{66D82D21-D66F-4EEA-8BB8-A02A588A675B}" = protocol=17 | dir=in | app=e:\origin games\battlefield 4\bf4.exe | 
"{6FCD2361-7279-4DC0-8B9D-707267CDDA5B}" = protocol=17 | dir=in | app=e:\steam games\steamapps\common\nmrih\sdk\hl2.exe | 
"{799111C2-644B-464A-A5C1-1CF838B15CA7}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{7C959157-89EA-4A6A-A2E8-EE4AD45A6608}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 
"{8CB75ECC-7D24-412A-8214-79965279A9E0}" = protocol=17 | dir=in | app=e:\steam games\steamapps\common\nmrih\sdk\bin\hammer.bat | 
"{8E0A014F-C432-454B-9224-49EDAA83262C}" = protocol=6 | dir=in | app=e:\steam games\steamapps\common\nmrih\sdk\hl2.exe | 
"{9742D0D5-7D07-44E9-B39E-168DB88FB1D3}" = protocol=6 | dir=in | app=c:\program files\messenger\yahoomessenger.exe | 
"{99CE370D-851C-40D1-836E-20D3DB2248AE}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | 
"{99E9532F-4674-4557-B153-D7504B2DE547}" = protocol=17 | dir=in | app=e:\gamesgecrackt\nba2k14\nba2k14.exe | 
"{A4485D88-0F2C-4675-9E21-734B59830199}" = protocol=17 | dir=in | app=c:\program files\messenger\yahoomessenger.exe | 
"{A45C5040-EDF4-4047-9061-512D1C2873E4}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{BB349E5C-FFE1-4839-AA6F-141248DE7E88}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{BFF589D3-BE8C-4682-BADF-237B0533C107}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{C485850E-2440-4845-B791-E3B9B55DD664}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | 
"{CAB5DF8D-A095-437F-984E-45FD1B9AE4C2}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 
"{CFE032A0-3609-4996-A2E0-E49027EB30C7}" = protocol=17 | dir=in | app=e:\origin games\battlefield 4\bf4_x86.exe | 
"{E08D2824-E712-4F3A-B3EB-1520A9790BFC}" = protocol=6 | dir=in | app=e:\origin games\battlefield 4\bf4.exe | 
"{E6F14EA7-7099-4C26-B588-489D23C93408}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{EAC9D300-5DC3-45CC-A2C4-2D7C792072FF}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{F621EB0A-488C-4E57-BCB9-49D779F4E784}" = protocol=6 | dir=in | app=e:\gamesgecrackt\nba2k14\nba2k14.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{14297226-E0A0-3781-8911-E9D529552663}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729
"{2EDC2FA3-1F34-34E5-9085-588C9EFD1CC6}" = Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610
"{308051DA-0048-7A07-FE8B-9B6EC119A9E8}" = AMD Catalyst Install Manager
"{44AAA767-F540-F091-4571-ADCBC10B0C92}" = AMD Fuel
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{678A75C7-5953-B109-57EE-46C7BA4C29C1}" = AMD Drag and Drop Transcoding
"{764384C5-BCA9-307C-9AAC-FD443662686A}" = Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610
"{7DEBE4EB-6B40-3766-BB35-5CBBC385DA37}" = Microsoft .NET Framework 4.5.1
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5.1
"{AEF57B06-B494-8180-AFC7-05EFB1DB2B64}" = ccc-utility64
"{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}" = Microsoft Xbox 360 Accessories 1.2
"{BD1BCEF8-5CD6-D8ED-7D36-31C2172076EA}" = AMD Media Foundation Decoders
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{E102B843-786A-4F58-AF75-6504570E207B}" = Microsoft Security Client
"{ED273D26-E354-1A5B-A0D0-CB5258D43BD2}" = AMD Wireless Display v3.0
"{FCC4426F-0296-D30D-729C-E76C8E7252C7}" = AMD Accelerated Video Transcoding
"Microsoft Security Client" = Microsoft Security Essentials
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WinRAR archiver" = WinRAR 5.00 (64-Bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{046B79EE-7ED3-37A4-621A-FE297EF484C2}" = CCC Help Greek
"{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}" = Razer Synapse 2.0
"{10CB5DDD-38E1-2EB2-F62C-C1948A99943E}" = AMD Catalyst Control Center
"{1194740D-0DB8-A508-31BA-E722597B4516}" = Catalyst Control Center Graphics Previews Common
"{1FB16E3B-3AFB-46CB-6E83-2F5A0CF4ED16}" = Catalyst Control Center Localization All
"{2E3A81FB-7952-F8CB-9AD5-50544E2F4838}" = CCC Help Czech
"{3D6AD258-61EA-35F5-812C-B7A02152996E}" = Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610
"{4172E797-CE12-AC47-05B7-0E48BDB33E75}" = CCC Help Russian
"{4428AEE6-FA5E-2913-8D12-B410E85E11AA}" = CCC Help Spanish
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.11
"{4FE0545A-1BF3-4B9B-A044-6E1EE719E197}" = NBA 2K14
"{4FF1533E-FF2C-A04A-25DD-A8AEC6FA106B}" = CCC Help Chinese Standard
"{519C4DB6-B53B-4F5C-8297-89B2BE949FA5}_is1" = Data Lifeguard Diagnostic for Windows 1.24
"{5449FB4F-1802-4D5B-A6D8-087DB1142147}" = Realtek HDMI Audio Driver for ATI
"{6071CB80-DABC-B10D-F244-7F410FB3B150}" = CCC Help Polish
"{6343B6BA-F97F-B336-9ED8-FFD43776E84D}" = CCC Help Finnish
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{8D3A11D0-D925-FA0F-43F3-242E49975CD2}" = CCC Help Danish
"{8EF39A9F-6A57-9706-86A5-9312D9ED8016}" = CCC Help Portuguese
"{92352C97-C657-DB89-5F3A-E8C3789D9C89}" = CCC Help Chinese Traditional
"{95545E55-3309-1929-FF41-2908A9706742}" = CCC Help Turkish
"{95716cce-fc71-413f-8ad5-56c2892d4b3a}" = Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610
"{9CA5F712-9CAA-B3CB-02D3-7134DFC8801E}" = CCC Help French
"{A128A816-FD3F-990E-DD80-E1735BD718AE}" = CCC Help Italian
"{a1909659-0a08-4554-8af1-2175904903a1}" = Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{ABADE36E-EC37-413B-8179-B432AD3FACE7}" = Battlefield 4™
"{AFC9ECA9-6A4E-1370-98F3-002B63B5AF8E}" = CCC Help Thai
"{B88F2045-CF9A-996C-1670-6F7D65F1D18A}" = CCC Help Norwegian
"{BED96D0C-7743-3CE3-F7DF-A0A4475FBF2F}" = CCC Help Hungarian
"{CB79256B-C0E0-40C6-8EB7-BDD796203581}" = Catalyst Control Center - Branding
"{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}" = Etron USB3.0 Host Controller
"{E297492A-E114-CAE0-502E-5F36C386DD30}" = CCC Help Dutch
"{E6533A85-ED92-F897-2B68-58AC3BD87F94}" = CCC Help English
"{E7D4E834-93EB-351F-B8FB-82CDAE623003}" = Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610
"{EBAC163A-588E-1E5A-3CE8-826E9A449244}" = CCC Help Korean
"{ED4108A9-60FD-4F18-AF42-122219977773}" = Razer Naga
"{ED65BD75-CEF3-C0C2-9E9C-FA567484FF60}" = CCC Help Japanese
"{EEB34D84-92A1-7BE3-6DB7-ABD1C4912D6B}" = Catalyst Control Center InstallProxy
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F1289D68-1C48-930F-51CF-577BDB371252}" = CCC Help Swedish
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F3F340A5-64EC-AEEC-4BDF-DC537D390BF5}" = CCC Help German
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Battlelog Web Plugins" = Battlelog Web Plugins
"DAEMON Tools Lite" = DAEMON Tools Lite
"ESN Sonar-0.70.4" = ESN Sonar
"Google Chrome" = Google Chrome
"InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}" = Etron USB3.0 Host Controller
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300
"Origin" = Origin
"PunkBusterSvc" = PunkBuster Services
"QmF0bWFuQXJraGFtT3JpZ2lucw==_is1" = Batman Arkham Origins
"Steam" = Steam
"Steam App 224260" = No More Room in Hell
"Usenet.nl_is1" = Usenet.nl
"VGhlQnVyZWF1WENPTURlY2xhc3NpZmllZA==_is1" = The Bureau: XCOM Declassified
"VirtualCloneDrive" = VirtualCloneDrive
"VLC media player" = VLC media player 2.1.2
"Yahoo! Messenger" = Yahoo! Messenger
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 10.01.2014 16:21:18 | Computer Name = Raubtier-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 10.01.2014 16:36:11 | Computer Name = Raubtier-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 10.01.2014 17:03:25 | Computer Name = Raubtier-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 10.01.2014 17:24:02 | Computer Name = Raubtier-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 10.01.2014 17:34:39 | Computer Name = Raubtier-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 10.01.2014 17:42:07 | Computer Name = Raubtier-PC | Source = Microsoft-Windows-CAPI2 | ID = 512
Description = Vom Kryptografiedienst konnte das VSS-Sicherungsobjekt "System Writer"
 nicht initialisiert werden.  Details: Could not query the status of the EventSystem
 service.  System Error: Der Computer wird heruntergefahren.  .
 
Error - 10.01.2014 17:46:54 | Computer Name = Raubtier-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 10.01.2014 17:52:32 | Computer Name = Raubtier-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 10.01.2014 19:51:06 | Computer Name = Raubtier-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 10.01.2014 20:03:53 | Computer Name = Raubtier-PC | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 10.01.2014 19:58:39 | Computer Name = Raubtier-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Heimnetzgruppen-Anbieter" wurde aufgrund folgenden Fehlers
 nicht gestartet:   %%1053
 
Error - 10.01.2014 19:58:52 | Computer Name = Raubtier-PC | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
 des Dienstes "RPC-Endpunktzuordnung" Korrekturmaßnahmen (Neustart des Diensts) 
durchzuführen, ist fehlgeschlagen. Fehler:   %%1056
 
Error - 10.01.2014 19:59:39 | Computer Name = Raubtier-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 DHCP-Client erreicht.
 
Error - 10.01.2014 19:59:39 | Computer Name = Raubtier-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "DHCP-Client" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%1053
 
Error - 10.01.2014 19:59:39 | Computer Name = Raubtier-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Remoteprozeduraufruf (RPC)" ist vom Dienst "RPC-Endpunktzuordnung"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1062
 
Error - 10.01.2014 19:59:39 | Computer Name = Raubtier-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Sicherheitscenter" ist vom Dienst "Windows-Verwaltungsinstrumentation"
 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 10.01.2014 20:02:11 | Computer Name = Raubtier-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?11.?01.?2014 um 00:57:29 unerwartet heruntergefahren.
 
Error - 10.01.2014 20:02:17 | Computer Name = Raubtier-PC | Source = Service Control Manager | ID = 7003
Description = Der Dienst "Net.Msmq Listener Adapter" ist von folgendem Dienst abhängig:
 msmq. Dieser Dienst ist eventuell nicht installiert.
 
Error - 10.01.2014 20:02:17 | Computer Name = Raubtier-PC | Source = Service Control Manager | ID = 7003
Description = Der Dienst "Net.Pipe Listener Adapter" ist von folgendem Dienst abhängig:
 was. Dieser Dienst ist eventuell nicht installiert.
 
Error - 10.01.2014 20:02:17 | Computer Name = Raubtier-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Net.Tcp Listener Adapter" ist vom Dienst "Net.Tcp Port
 Sharing Service" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
   %%1058
 
 
< End of report >
         
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-01-2014 02
Ran by Raubtier (administrator) on RAUBTIER-PC on 11-01-2014 13:24:15
Running from C:\Users\Raubtier\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Advanced Micro Devices, Inc.) C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Razer USA Ltd) C:\Programme\Razer\Naga\RazerNagaSysTray.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Elaborate Bytes AG) C:\ProgrammeVirtualCloneDrive\VCDDaemon.exe
(Advanced Micro Devices Inc.) C:\Programme\AMD\ATI.ACE\Core-Static\MOM.exe
(Yahoo! Inc.) C:\Program Files\Messenger\Ymsgr_tray.exe
(ATI Technologies Inc.) C:\Programme\AMD\ATI.ACE\Core-Static\CCC.exe
         


Code:
ATTFilter
OTL logfile created on: 11.01.2014 01:23:57 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Raubtier\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.16428)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 6,26 Gb Available Physical Memory | 78,39% Memory free
15,96 Gb Paging File | 13,93 Gb Available in Paging File | 87,27% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 146,48 Gb Total Space | 91,49 Gb Free Space | 62,46% Space Free | Partition Type: NTFS
Drive D: | 488,28 Gb Total Space | 263,52 Gb Free Space | 53,97% Space Free | Partition Type: NTFS
Drive E: | 443,10 Gb Total Space | 289,63 Gb Free Space | 65,36% Space Free | Partition Type: NTFS
Drive G: | 341,80 Gb Total Space | 164,28 Gb Free Space | 48,06% Space Free | Partition Type: NTFS
Drive H: | 443,23 Gb Total Space | 43,33 Gb Free Space | 9,78% Space Free | Partition Type: NTFS
 
Computer Name: RAUBTIER-PC | User Name: Raubtier | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Raubtier\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Users\Raubtier\Desktop\Process Explorer.exe (Sysinternals - www.sysinternals.com)
PRC - C:\Programme\Razer\Naga\RazerNagaSysTray.exe (Razer USA Ltd)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\libglesv2.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\libegl.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ffmpegsumo.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (IEEtwCollectorService) -- C:\Windows\SysNative\IEEtwCollector.exe (Microsoft Corporation)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AMD FUEL Service) -- C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)
SRV - (NisSrv) -- C:\Programme\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) -- C:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (Disc Soft Ltd)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (NisDrv) -- C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (VClone) -- C:\Windows\SysNative\drivers\VClone.sys (Elaborate Bytes AG)
DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG)
DRV:64bit: - (EtronXHCI) -- C:\Windows\SysNative\drivers\EtronXHCI.sys (Etron Technology Inc)
DRV:64bit: - (EtronHub3) -- C:\Windows\SysNative\drivers\EtronHub3.sys (Etron Technology Inc)
DRV:64bit: - (RTHDMIAzAudService) -- C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (usbfilter) -- C:\Windows\SysNative\drivers\usbfilter.sys (Advanced Micro Devices)
DRV:64bit: - (RzSynapse) -- C:\Windows\SysNative\drivers\RzSynapse.sys (Razer USA Ltd)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (tsusbhub) -- C:\Windows\SysNative\drivers\tsusbhub.sys (Microsoft Corporation)
DRV:64bit: - (Synth3dVsc) -- C:\Windows\SysNative\drivers\Synth3dVsc.sys (Microsoft Corporation)
DRV:64bit: - (dmvsc) -- C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (terminpt) -- C:\Windows\SysNative\drivers\terminpt.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (AODDriver4.2.0) -- C:\Programme\AMD\ATI.ACE\Fuel\amd64\aoddriver2.sys (Advanced Micro Devices)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
 
 
 
 
IE - HKU\S-1-5-21-199586521-2663480010-3892174971-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/
IE - HKU\S-1-5-21-199586521-2663480010-3892174971-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-199586521-2663480010-3892174971-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E0 57 29 FF 8B 04 CF 01  [binary data]
IE - HKU\S-1-5-21-199586521-2663480010-3892174971-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-199586521-2663480010-3892174971-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKU\S-1-5-21-199586521-2663480010-3892174971-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/npbattlelog,version=2.3.2: C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.2: C:\Programme\VLC\npvlc.dll (VideoLAN)
 
 
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: 
CHR - Extension: ProxTube = C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek\1.2.7_0\
CHR - Extension: Google Docs = C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Adblock Plus = C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.7.2_0\
CHR - Extension: Google-Suche = C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: AdBlock = C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.16_0\
CHR - Extension: Google Wallet = C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0\
CHR - Extension: Google Mail = C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Razer Naga Driver] C:\Programme\Razer\Naga\RazerNagaSysTray.exe (Razer USA Ltd)
O4 - HKLM..\Run: [StartCCC] C:\Programme\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6284728D-E2A5-4CC3-B834-D361ECA5AAF5}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6284728D-E2A5-4CC3-B834-D361ECA5AAF5}: NameServer = 8.8.8.8,8.8.4.4
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{6bc5735a-707c-11e3-bfca-b0487a86f527}\Shell - "" = AutoRun
O33 - MountPoints2\{6bc5735a-707c-11e3-bfca-b0487a86f527}\Shell\AutoRun\command - "" = K:\setup.exe
O33 - MountPoints2\{775807df-7076-11e3-83df-b0487a86f527}\Shell - "" = AutoRun
O33 - MountPoints2\{775807df-7076-11e3-83df-b0487a86f527}\Shell\AutoRun\command - "" = J:\setup.exe
O33 - MountPoints2\{a13df7ad-7075-11e3-bae0-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{a13df7ad-7075-11e3-bae0-806e6f6e6963}\Shell\AutoRun\command - "" = I:\setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2014.01.11 01:23:17 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Raubtier\Desktop\OTL.exe
[2014.01.10 22:04:58 | 000,791,552 | ---- | C] (AMD) -- C:\Users\Raubtier\Desktop\amddriverdownloader.exe
[2014.01.10 21:40:14 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\Desktop\cpu-z-168
[2014.01.07 20:43:47 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\Tracing
[2014.01.07 12:56:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
[2014.01.07 12:55:37 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2014.01.07 12:55:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live
[2014.01.07 12:51:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft SkyDrive
[2014.01.07 12:50:57 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Windows Live
[2014.01.07 12:50:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Windows Live
[2014.01.07 12:50:35 | 001,245,168 | ---- | C] (Microsoft Corporation) -- C:\Users\Raubtier\Desktop\wlsetup-web.exe
[2014.01.07 00:57:54 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\Documents\Usenet.nl
[2014.01.07 00:57:53 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\Usenet.nl
[2014.01.07 00:57:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Usenet.nl
[2014.01.07 00:57:49 | 000,000,000 | ---D | C] -- C:\Program Files\Usenet.nl
[2014.01.03 21:18:56 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\Malwarebytes
[2014.01.03 21:18:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2014.01.03 21:18:41 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2014.01.03 21:18:41 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2014.01.02 23:15:21 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\Documents\WB Games
[2014.01.02 23:11:14 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\2K Sports
[2014.01.02 00:30:30 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Microsoft Games
[2014.01.01 22:35:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Xbox 360 Accessories
[2014.01.01 22:35:47 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Xbox 360 Accessories
[2014.01.01 21:18:04 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\Skype
[2014.01.01 21:17:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2014.01.01 21:17:57 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2014.01.01 21:17:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2014.01.01 21:17:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2014.01.01 20:53:03 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\ESN Sonar
[2013.12.31 01:25:42 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\vlc
[2013.12.30 22:20:28 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2013.12.30 20:47:48 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\TS3Client
[2013.12.30 19:28:51 | 000,000,000 | ---D | C] -- C:\Program Files\HDDGURU LLF Tool
[2013.12.30 12:34:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Data Lifeguard Diagnostic for Windows
[2013.12.30 12:34:08 | 000,000,000 | ---D | C] -- C:\Program Files\Data Lifeguard Diagnostic for Windows
[2013.12.30 06:36:02 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll
[2013.12.30 06:36:01 | 000,574,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013.12.30 06:36:01 | 000,440,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013.12.30 06:36:01 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013.12.30 06:36:01 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2013.12.30 06:36:01 | 000,066,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013.12.30 06:36:01 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll
[2013.12.30 06:36:01 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013.12.30 06:36:00 | 000,817,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2013.12.30 06:36:00 | 000,708,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll
[2013.12.30 06:36:00 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2013.12.30 06:36:00 | 000,553,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll
[2013.12.30 06:36:00 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe
[2013.12.30 06:35:58 | 001,995,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2013.12.30 06:35:58 | 001,928,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2013.12.30 06:35:56 | 005,769,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013.12.30 06:28:12 | 000,088,832 | ---- | C] (Etron Technology Inc) -- C:\Windows\SysNative\drivers\EtronXHCI.sys
[2013.12.30 06:28:12 | 000,065,152 | ---- | C] (Etron Technology Inc) -- C:\Windows\SysNative\drivers\EtronHub3.sys
[2013.12.30 06:28:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Etron Technology
[2013.12.30 06:20:31 | 000,000,000 | ---D | C] -- C:\Windows\Migration
[2013.12.30 06:19:15 | 000,028,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\IEUDINIT.EXE
[2013.12.30 06:15:14 | 000,940,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2013.12.30 06:15:14 | 000,194,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\elshyph.dll
[2013.12.30 06:15:10 | 000,645,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jsIntl.dll
[2013.12.30 06:15:10 | 000,616,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dat
[2013.12.30 06:15:10 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2013.12.30 06:15:10 | 000,235,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\elshyph.dll
[2013.12.30 06:15:10 | 000,233,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2013.12.30 06:15:10 | 000,164,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2013.12.30 06:15:10 | 000,083,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll
[2013.12.30 06:15:10 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013.12.30 06:15:10 | 000,069,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\icardie.dll
[2013.12.30 06:15:10 | 000,062,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx
[2013.12.30 06:15:10 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013.12.30 06:15:10 | 000,034,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
[2013.12.30 06:15:10 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013.12.30 06:15:10 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2013.12.30 06:15:09 | 001,051,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll
[2013.12.30 06:15:09 | 000,942,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jsIntl.dll
[2013.12.30 06:15:09 | 000,610,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013.12.30 06:15:09 | 000,151,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iexpress.exe
[2013.12.30 06:15:09 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wextract.exe
[2013.12.30 06:15:09 | 000,127,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll
[2013.12.30 06:15:09 | 000,116,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2013.12.30 06:15:09 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2013.12.30 06:15:09 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\IEAdvpack.dll
[2013.12.30 06:15:09 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013.12.30 06:15:09 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\SetIEInstalledDate.exe
[2013.12.30 06:15:09 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2013.12.30 06:15:09 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll
[2013.12.30 06:15:09 | 000,056,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\pngfilt.dll
[2013.12.30 06:15:09 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll
[2013.12.30 06:15:09 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmler.dll
[2013.12.30 06:15:09 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2013.12.30 06:15:08 | 001,228,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll
[2013.12.30 06:15:08 | 000,616,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dat
[2013.12.30 06:15:08 | 000,453,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2013.12.30 06:15:08 | 000,413,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2013.12.30 06:15:08 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2013.12.30 06:15:08 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll
[2013.12.30 06:15:08 | 000,235,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2013.12.30 06:15:08 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2013.12.30 06:15:08 | 000,131,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll
[2013.12.30 06:15:08 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013.12.30 06:15:08 | 000,090,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SetIEInstalledDate.exe
[2013.12.30 06:15:08 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013.12.30 06:15:08 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll
[2013.12.30 06:15:08 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx
[2013.12.30 06:15:08 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll
[2013.12.30 06:15:08 | 000,040,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll
[2013.12.30 06:15:08 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2013.12.30 06:15:07 | 000,774,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013.12.30 06:15:07 | 000,626,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013.12.30 06:15:07 | 000,548,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2013.12.30 06:15:07 | 000,167,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iexpress.exe
[2013.12.30 06:15:07 | 000,147,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll
[2013.12.30 06:15:07 | 000,143,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wextract.exe
[2013.12.30 06:15:07 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2013.12.30 06:15:07 | 000,101,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll
[2013.12.30 06:15:07 | 000,084,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2013.12.30 06:15:07 | 000,083,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll
[2013.12.30 06:15:07 | 000,062,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll
[2013.12.30 06:15:07 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll
[2013.12.30 06:15:07 | 000,030,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2013.12.30 06:15:07 | 000,013,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshta.exe
[2013.12.30 06:13:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2013.12.30 06:02:35 | 000,294,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browserchoice.exe
[2013.12.30 05:56:43 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imagehlp.dll
[2013.12.30 05:56:38 | 001,474,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2013.12.30 05:56:29 | 000,230,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\portcls.sys
[2013.12.30 05:56:28 | 000,116,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\drmk.sys
[2013.12.30 05:56:26 | 001,447,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll
[2013.12.30 05:56:26 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2013.12.30 05:56:26 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll
[2013.12.30 05:56:26 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll
[2013.12.30 05:56:26 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll
[2013.12.30 05:56:11 | 000,142,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\poqexec.exe
[2013.12.30 05:56:11 | 000,123,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\poqexec.exe
[2013.12.30 05:56:10 | 000,404,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gdi32.dll
[2013.12.30 05:53:21 | 000,150,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wshom.ocx
[2013.12.30 05:53:21 | 000,121,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wshom.ocx
[2013.12.30 05:53:20 | 000,202,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\scrrun.dll
[2013.12.30 05:53:20 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\scrrun.dll
[2013.12.30 05:53:20 | 000,156,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cscript.exe
[2013.12.30 05:53:20 | 000,126,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cscript.exe
[2013.12.30 05:53:19 | 000,830,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\nshwfp.dll
[2013.12.30 05:53:19 | 000,656,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\nshwfp.dll
[2013.12.30 05:53:19 | 000,324,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\FWPUCLNT.DLL
[2013.12.30 05:53:19 | 000,216,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\FWPUCLNT.DLL
[2013.12.30 05:49:26 | 002,622,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll
[2013.12.30 05:49:26 | 000,057,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe
[2013.12.30 05:49:26 | 000,044,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll
[2013.12.30 05:49:16 | 000,701,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll
[2013.12.30 05:49:16 | 000,099,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll
[2013.12.30 05:49:16 | 000,038,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll
[2013.12.30 05:49:00 | 000,186,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll
[2013.12.30 05:49:00 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe
[2013.12.29 23:14:23 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Diagnostics
[2013.12.29 23:11:52 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\ElevatedDiagnostics
[2013.12.29 22:42:51 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\MigWiz
[2013.12.29 22:28:36 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2013.12.29 22:28:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight
[2013.12.29 22:25:11 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\MRT
[2013.12.29 22:05:42 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\WinRAR
[2013.12.29 21:28:00 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\PunkBuster
[2013.12.29 21:06:28 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\Documents\Battlefield 4
[2013.12.29 20:34:41 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Razer
[2013.12.29 20:26:33 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Abelssoft
[2013.12.29 20:26:30 | 000,000,000 | ---D | C] -- C:\Program Files\CheckDrive
[2013.12.29 20:15:18 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\ESN
[2013.12.29 16:14:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Steam
[2013.12.29 16:04:50 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Common Files\EAInstaller
[2013.12.29 16:04:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Battlelog Web Plugins
[2013.12.29 16:02:27 | 000,527,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_7.dll
[2013.12.29 16:02:27 | 000,518,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_7.dll
[2013.12.29 16:02:27 | 000,239,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_7.dll
[2013.12.29 16:02:27 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_7.dll
[2013.12.29 16:02:27 | 000,077,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_5.dll
[2013.12.29 16:02:27 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_5.dll
[2013.12.29 16:02:26 | 002,526,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_43.dll
[2013.12.29 16:02:26 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_43.dll
[2013.12.29 16:02:26 | 001,907,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dcsx_43.dll
[2013.12.29 16:02:26 | 001,868,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_43.dll
[2013.12.29 16:02:26 | 000,511,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_43.dll
[2013.12.29 16:02:26 | 000,470,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_43.dll
[2013.12.29 16:02:26 | 000,276,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx11_43.dll
[2013.12.29 16:02:26 | 000,248,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_43.dll
[2013.12.29 16:02:25 | 002,401,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_43.dll
[2013.12.29 16:02:25 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_43.dll
[2013.12.29 16:02:25 | 000,530,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_6.dll
[2013.12.29 16:02:25 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_6.dll
[2013.12.29 16:02:25 | 000,078,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_4.dll
[2013.12.29 16:02:25 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_4.dll
[2013.12.29 16:02:24 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_6.dll
[2013.12.29 16:02:24 | 000,176,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_6.dll
[2013.12.29 16:02:24 | 000,024,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_7.dll
[2013.12.29 16:02:24 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_7.dll
[2013.12.29 16:02:22 | 000,517,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_5.dll
[2013.12.29 16:02:22 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_5.dll
[2013.12.29 16:02:21 | 002,582,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_42.dll
[2013.12.29 16:02:21 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_42.dll
[2013.12.29 16:02:21 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_5.dll
[2013.12.29 16:02:21 | 000,176,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_5.dll
[2013.12.29 16:02:20 | 005,554,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dcsx_42.dll
[2013.12.29 16:02:20 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dcsx_42.dll
[2013.12.29 16:02:20 | 000,285,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx11_42.dll
[2013.12.29 16:02:20 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx11_42.dll
[2013.12.29 16:02:19 | 002,475,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_42.dll
[2013.12.29 16:02:19 | 002,430,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_41.dll
[2013.12.29 16:02:19 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_42.dll
[2013.12.29 16:02:19 | 001,846,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_41.dll
[2013.12.29 16:02:19 | 000,523,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_42.dll
[2013.12.29 16:02:19 | 000,520,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_41.dll
[2013.12.29 16:02:19 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_42.dll
[2013.12.29 16:02:19 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_41.dll
[2013.12.29 16:02:18 | 005,425,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_41.dll
[2013.12.29 16:02:18 | 004,178,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_41.dll
[2013.12.29 16:02:18 | 000,521,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_4.dll
[2013.12.29 16:02:18 | 000,517,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_4.dll
[2013.12.29 16:02:18 | 000,073,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_3.dll
[2013.12.29 16:02:18 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_3.dll
[2013.12.29 16:02:17 | 002,605,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_40.dll
[2013.12.29 16:02:17 | 002,036,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_40.dll
[2013.12.29 16:02:17 | 000,519,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_40.dll
[2013.12.29 16:02:17 | 000,452,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_40.dll
[2013.12.29 16:02:17 | 000,235,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_4.dll
[2013.12.29 16:02:17 | 000,174,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_4.dll
[2013.12.29 16:02:17 | 000,024,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_6.dll
[2013.12.29 16:02:17 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_6.dll
[2013.12.29 16:02:16 | 005,631,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_40.dll
[2013.12.29 16:02:16 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_40.dll
[2013.12.29 16:02:15 | 000,518,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_3.dll
[2013.12.29 16:02:15 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_3.dll
[2013.12.29 16:02:15 | 000,074,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_2.dll
[2013.12.29 16:02:15 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_2.dll
[2013.12.29 16:02:14 | 000,513,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_2.dll
[2013.12.29 16:02:14 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_2.dll
[2013.12.29 16:02:14 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_3.dll
[2013.12.29 16:02:14 | 000,175,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_3.dll
[2013.12.29 16:02:14 | 000,072,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_1.dll
[2013.12.29 16:02:14 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_1.dll
[2013.12.29 16:02:14 | 000,025,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_5.dll
[2013.12.29 16:02:14 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_5.dll
[2013.12.29 16:02:13 | 004,992,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_39.dll
[2013.12.29 16:02:13 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_39.dll
[2013.12.29 16:02:13 | 001,942,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_39.dll
[2013.12.29 16:02:13 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_39.dll
[2013.12.29 16:02:13 | 000,540,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_39.dll
[2013.12.29 16:02:13 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_39.dll
[2013.12.29 16:02:13 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_2.dll
[2013.12.29 16:02:13 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_2.dll
[2013.12.29 16:02:12 | 001,941,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_38.dll
[2013.12.29 16:02:12 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_38.dll
[2013.12.29 16:02:12 | 000,540,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_38.dll
[2013.12.29 16:02:12 | 000,511,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_1.dll
[2013.12.29 16:02:12 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_1.dll
[2013.12.29 16:02:12 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_38.dll
[2013.12.29 16:02:12 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_1.dll
[2013.12.29 16:02:12 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_1.dll
[2013.12.29 16:02:12 | 000,068,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAPOFX1_0.dll
[2013.12.29 16:02:12 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAPOFX1_0.dll
[2013.12.29 16:02:12 | 000,028,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_4.dll
[2013.12.29 16:02:12 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_4.dll
[2013.12.29 16:02:11 | 004,991,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_38.dll
[2013.12.29 16:02:11 | 003,850,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_38.dll
[2013.12.29 16:02:11 | 000,489,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XAudio2_0.dll
[2013.12.29 16:02:11 | 000,479,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XAudio2_0.dll
[2013.12.29 16:02:11 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine3_0.dll
[2013.12.29 16:02:11 | 000,177,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine3_0.dll
[2013.12.29 16:02:11 | 000,028,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_3.dll
[2013.12.29 16:02:11 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_3.dll
[2013.12.29 16:02:10 | 004,910,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DX9_37.dll
[2013.12.29 16:02:10 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_37.dll
[2013.12.29 16:02:10 | 001,860,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_37.dll
[2013.12.29 16:02:10 | 001,420,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_37.dll
[2013.12.29 16:02:10 | 000,529,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_37.dll
[2013.12.29 16:02:10 | 000,462,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_37.dll
[2013.12.29 16:02:10 | 000,411,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_10.dll
[2013.12.29 16:02:10 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_10.dll
[2013.12.29 16:02:09 | 005,081,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_36.dll
[2013.12.29 16:02:09 | 003,734,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_36.dll
[2013.12.29 16:02:09 | 002,006,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_36.dll
[2013.12.29 16:02:09 | 001,374,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_36.dll
[2013.12.29 16:02:09 | 000,508,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_36.dll
[2013.12.29 16:02:09 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_36.dll
[2013.12.29 16:02:08 | 000,411,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_9.dll
[2013.12.29 16:02:08 | 000,267,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_9.dll
[2013.12.29 16:02:07 | 005,073,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_35.dll
[2013.12.29 16:02:07 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_35.dll
[2013.12.29 16:02:07 | 001,985,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_35.dll
[2013.12.29 16:02:07 | 001,358,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_35.dll
[2013.12.29 16:02:07 | 000,508,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_35.dll
[2013.12.29 16:02:07 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_35.dll
[2013.12.29 16:02:07 | 000,409,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_8.dll
[2013.12.29 16:02:07 | 000,266,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_8.dll
[2013.12.29 16:02:07 | 000,021,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\X3DAudio1_2.dll
[2013.12.29 16:02:07 | 000,017,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\X3DAudio1_2.dll
[2013.12.29 16:02:06 | 004,496,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_34.dll
[2013.12.29 16:02:06 | 003,497,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_34.dll
[2013.12.29 16:02:06 | 001,401,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_34.dll
[2013.12.29 16:02:06 | 001,124,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_34.dll
[2013.12.29 16:02:06 | 000,506,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_34.dll
[2013.12.29 16:02:06 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_34.dll
[2013.12.29 16:02:06 | 000,107,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_3.dll
[2013.12.29 16:02:06 | 000,081,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_3.dll
[2013.12.29 16:02:04 | 004,494,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_33.dll
[2013.12.29 16:02:04 | 003,495,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_33.dll
[2013.12.29 16:02:04 | 001,400,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\D3DCompiler_33.dll
[2013.12.29 16:02:04 | 001,123,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_33.dll
[2013.12.29 16:02:04 | 000,506,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10_33.dll
[2013.12.29 16:02:04 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10_33.dll
[2013.12.29 16:02:04 | 000,403,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_7.dll
[2013.12.29 16:02:04 | 000,261,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_7.dll
[2013.12.29 16:02:02 | 000,393,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_6.dll
[2013.12.29 16:02:02 | 000,390,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_5.dll
[2013.12.29 16:02:02 | 000,255,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_6.dll
[2013.12.29 16:02:02 | 000,251,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_5.dll
[2013.12.29 16:02:01 | 004,398,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_32.dll
[2013.12.29 16:02:01 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_32.dll
[2013.12.29 16:02:01 | 000,469,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx10.dll
[2013.12.29 16:02:01 | 000,440,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx10.dll
[2013.12.29 16:02:00 | 003,977,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_31.dll
[2013.12.29 16:02:00 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_31.dll
[2013.12.29 16:02:00 | 000,364,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_4.dll
[2013.12.29 16:02:00 | 000,363,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_3.dll
[2013.12.29 16:02:00 | 000,237,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_4.dll
[2013.12.29 16:02:00 | 000,236,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_3.dll
[2013.12.29 16:02:00 | 000,083,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_2.dll
[2013.12.29 16:02:00 | 000,062,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_2.dll
[2013.12.29 16:02:00 | 000,017,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\x3daudio1_1.dll
[2013.12.29 16:02:00 | 000,015,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\x3daudio1_1.dll
[2013.12.29 16:01:59 | 000,354,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_2.dll
[2013.12.29 16:01:59 | 000,230,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_2.dll
[2013.12.29 16:01:59 | 000,083,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xinput1_1.dll
[2013.12.29 16:01:59 | 000,062,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xinput1_1.dll
[2013.12.29 16:01:58 | 000,352,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_1.dll
[2013.12.29 16:01:58 | 000,229,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_1.dll
[2013.12.29 16:01:56 | 003,927,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_30.dll
[2013.12.29 16:01:56 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_30.dll
[2013.12.29 16:01:55 | 003,830,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_29.dll
[2013.12.29 16:01:55 | 003,815,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_28.dll
[2013.12.29 16:01:55 | 002,332,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_29.dll
[2013.12.29 16:01:55 | 002,323,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_28.dll
[2013.12.29 16:01:55 | 000,355,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\xactengine2_0.dll
[2013.12.29 16:01:55 | 000,230,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\xactengine2_0.dll
[2013.12.29 16:01:55 | 000,016,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\x3daudio1_0.dll
[2013.12.29 16:01:55 | 000,014,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\x3daudio1_0.dll
[2013.12.29 16:01:54 | 003,823,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_25.dll
[2013.12.29 16:01:54 | 003,807,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_27.dll
[2013.12.29 16:01:54 | 003,767,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_26.dll
[2013.12.29 16:01:54 | 002,337,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_25.dll
[2013.12.29 16:01:54 | 002,319,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_27.dll
[2013.12.29 16:01:54 | 002,297,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_26.dll
[2013.12.29 16:01:53 | 003,544,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3dx9_24.dll
[2013.12.29 16:01:53 | 002,222,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_24.dll
[2013.12.29 15:30:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
[2013.12.29 15:29:58 | 000,283,064 | ---- | C] (Disc Soft Ltd) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys
[2013.12.29 15:29:56 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\DAEMON Tools Lite
[2013.12.29 15:29:53 | 000,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Lite
[2013.12.29 15:28:39 | 000,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Lite
[2013.12.29 14:23:19 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Programs
[2013.12.29 13:11:02 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\Yahoo!
[2013.12.29 13:10:40 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\Macromedia
[2013.12.29 13:09:49 | 000,419,488 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.12.29 13:09:49 | 000,070,304 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.12.29 13:09:49 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
[2013.12.29 13:09:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yahoo! Messenger
[2013.12.29 13:09:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Yahoo!
[2013.12.29 13:09:32 | 000,000,000 | ---D | C] -- C:\Program Files\Messenger
[2013.12.29 13:07:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Yahoo!
[2013.12.29 13:05:58 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013.12.29 13:05:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Razer
[2013.12.29 13:02:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
[2013.12.29 13:02:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Razer
[2013.12.29 13:02:50 | 000,000,000 | ---D | C] -- C:\Program Files\Razer
[2013.12.29 12:57:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
[2013.12.29 12:57:30 | 000,000,000 | ---D | C] -- C:\Program Files\TeamSpeak 3 Client
[2013.12.29 12:51:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2013.12.29 12:49:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2013.12.29 12:49:47 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Google
[2013.12.29 12:49:33 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Deployment
[2013.12.29 12:49:33 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Apps
[2013.12.29 12:32:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
[2013.12.29 12:30:42 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\AMD
[2013.12.29 12:30:18 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\ATI
[2013.12.29 12:30:18 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\ATI
[2013.12.29 12:30:18 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2013.12.29 12:23:32 | 002,738,264 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\Users\Raubtier\Desktop\Process Explorer.exe
[2013.12.29 12:22:44 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\Origin
[2013.12.29 12:22:43 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Origin
[2013.12.29 12:21:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Steam
[2013.12.29 12:21:54 | 000,000,000 | ---D | C] -- C:\Program Files\Steam
[2013.12.29 12:21:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Origin
[2013.12.29 12:21:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
[2013.12.29 12:21:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts
[2013.12.29 12:20:50 | 000,000,000 | ---D | C] -- C:\Program Files\Origin
[2013.12.29 12:19:38 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2013.12.29 12:19:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2013.12.29 12:18:52 | 000,000,000 | ---D | C] -- C:\ProgrammeVirtualCloneDrive
[2013.12.29 12:18:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elaborate Bytes
[2013.12.29 12:18:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2013.12.29 12:18:22 | 000,000,000 | ---D | C] -- C:\Program Files\VLC
[2013.12.29 12:17:51 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2013.12.29 12:13:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2013.12.29 12:13:41 | 000,056,448 | ---- | C] (Advanced Micro Devices) -- C:\Windows\SysNative\drivers\usbfilter.sys
[2013.12.29 12:13:40 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE
[2013.12.29 12:12:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Security Client
[2013.12.29 12:12:46 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Client
[2013.12.29 12:08:20 | 000,646,248 | ---- | C] (Realtek                                            ) -- C:\Windows\SysNative\drivers\Rt64win7.sys
[2013.12.29 12:08:20 | 000,107,552 | ---- | C] (Realtek Semiconductor Corporation) -- C:\Windows\SysNative\RTNUninst64.dll
[2013.12.29 12:07:38 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM
[2013.12.29 12:07:38 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2013.12.29 12:07:30 | 007,163,744 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEP64H.dll
[2013.12.29 12:07:30 | 003,746,408 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkHDM64.dll
[2013.12.29 12:07:30 | 002,526,824 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RHDMEx64.dll
[2013.12.29 12:07:30 | 000,433,504 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EED64H.dll
[2013.12.29 12:07:30 | 000,372,056 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64H.dll
[2013.12.29 12:07:30 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RH3DHT64.dll
[2013.12.29 12:07:30 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RH3DAA64.dll
[2013.12.29 12:07:30 | 000,237,968 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\drivers\RtHDMIVX.sys
[2013.12.29 12:07:30 | 000,204,120 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64H.dll
[2013.12.29 12:07:30 | 000,141,152 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEL64H.dll
[2013.12.29 12:07:30 | 000,123,744 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEA64H.dll
[2013.12.29 12:07:30 | 000,097,624 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64H.dll
[2013.12.29 12:07:30 | 000,092,264 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RHCoInst64.dll
[2013.12.29 12:07:30 | 000,078,680 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64H.dll
[2013.12.29 12:07:30 | 000,074,592 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEG64H.dll
[2013.12.29 12:07:29 | 003,615,888 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkAPO64.dll
[2013.12.29 12:07:29 | 002,674,320 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtPgEx64.dll
[2013.12.29 12:07:29 | 002,605,400 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\WavesGUILib.dll
[2013.12.29 12:07:29 | 001,560,168 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RTSnMg64.cpl
[2013.12.29 12:07:29 | 000,869,520 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkApi64.dll
[2013.12.29 12:07:29 | 000,518,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll
[2013.12.29 12:07:29 | 000,375,128 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll
[2013.12.29 12:07:29 | 000,331,880 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtlCPAPI64.dll
[2013.12.29 12:07:29 | 000,211,184 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll
[2013.12.29 12:07:29 | 000,198,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll
[2013.12.29 12:07:29 | 000,155,888 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll
[2013.12.29 12:07:29 | 000,149,608 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkCfg64.dll
[2013.12.29 12:07:29 | 000,014,952 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkCoLDR64.dll
[2013.12.29 12:07:28 | 002,533,952 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll
[2013.12.29 12:07:28 | 002,131,288 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioEQ.dll
[2013.12.29 12:07:28 | 001,262,696 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RTCOM64.dll
[2013.12.29 12:07:28 | 001,015,640 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPOShell64.dll
[2013.12.29 12:07:28 | 000,897,152 | ---- | C] (Creative Technology Ltd.) -- C:\Windows\SysNative\MBAPO64.dll
[2013.12.29 12:07:28 | 000,753,280 | ---- | C] (Creative Technology Ltd.) -- C:\Windows\SysWow64\MBAPO32.dll
[2013.12.29 12:07:28 | 000,318,808 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll
[2013.12.29 12:07:28 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll
[2013.12.29 12:07:28 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll
[2013.12.29 12:07:28 | 000,204,120 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll
[2013.12.29 12:07:28 | 000,105,616 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RCoInstII64.dll
[2013.12.29 12:07:28 | 000,101,208 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll
[2013.12.29 12:07:28 | 000,083,072 | ---- | C] (Creative Technology Ltd.) -- C:\Windows\SysNative\MBWrp64.dll
[2013.12.29 12:07:28 | 000,078,680 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll
[2013.12.29 12:07:28 | 000,065,112 | ---- | C] (Creative Technology Ltd.) -- C:\Windows\SysNative\MBppld64.dll
[2013.12.29 12:07:28 | 000,060,504 | ---- | C] (Creative Technology Ltd.) -- C:\Windows\SysNative\MBPPCn64.dll
[2013.12.29 12:07:27 | 000,202,336 | ---- | C] (Andrea Electronics Corporation) -- C:\Windows\SysNative\AERTAC64.dll
[2013.12.29 12:07:27 | 000,108,640 | ---- | C] (Andrea Electronics Corporation) -- C:\Windows\SysNative\AERTAR64.dll
[2013.12.29 12:07:27 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information
[2013.12.29 12:07:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek
[2013.12.29 12:07:24 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Temp
[2013.12.29 12:07:23 | 001,706,640 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\RtlExUpd.dll
[2013.12.29 12:07:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield
[2013.12.29 12:07:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT
[2013.12.29 12:07:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies
[2013.12.29 12:06:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
[2013.12.29 12:06:07 | 000,000,000 | ---D | C] -- C:\ProgramData\AMD
[2013.12.29 12:05:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies
[2013.12.29 12:03:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Package Cache
[2013.12.29 12:03:20 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2013.12.29 12:02:34 | 000,000,000 | ---D | C] -- C:\Program Files\AMD
[2013.12.29 11:58:57 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\Adobe
[2013.12.29 11:58:56 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2013.12.29 11:58:56 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Searches
[2013.12.29 11:58:56 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2013.12.29 11:58:45 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\Identities
[2013.12.29 11:58:43 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Contacts
[2013.12.29 11:58:41 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\VirtualStore
[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Vorlagen
[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\AppData\Local\Verlauf
[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\AppData\Local\Temporary Internet Files
[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Startmenü
[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\SendTo
[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Recent
[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Netzwerkumgebung
[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Lokale Einstellungen
[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Documents\Eigene Videos
[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Documents\Eigene Musik
[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Eigene Dateien
[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Documents\Eigene Bilder
[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Druckumgebung
[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Cookies
[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\AppData\Local\Anwendungsdaten
[2013.12.29 11:58:32 | 000,000,000 | -HSD | C] -- C:\Users\Raubtier\Anwendungsdaten
[2013.12.29 11:58:31 | 000,000,000 | --SD | C] -- C:\Users\Raubtier\AppData\Roaming\Microsoft
[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Videos
[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Saved Games
[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Pictures
[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Music
[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Links
[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Favorites
[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Downloads
[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Documents
[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\Desktop
[2013.12.29 11:58:31 | 000,000,000 | R--D | C] -- C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2013.12.29 11:58:31 | 000,000,000 | -H-D | C] -- C:\Users\Raubtier\AppData
[2013.12.29 11:58:31 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Temp
[2013.12.29 11:58:31 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Local\Microsoft
[2013.12.29 11:58:31 | 000,000,000 | ---D | C] -- C:\Users\Raubtier\AppData\Roaming\Media Center Programs
[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\Recovery
[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\Programme
[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2013.12.29 11:58:25 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2013.12.29 11:48:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2013.12.29 11:47:30 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2013.12.29 11:43:36 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2013.12.29 11:41:25 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2013.12.29 11:40:41 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2013.12.29 11:39:47 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2013.12.29 11:39:32 | 000,000,000 | -HSD | C] -- C:\Boot
[2013.12.29 11:17:37 | 008,287,008 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiumdva.dll
[2013.12.29 11:17:37 | 000,143,304 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiuxp64.dll
[2013.12.29 11:17:37 | 000,129,536 | ---- | C] (AMD) -- C:\Windows\SysNative\coinst_13.251.dll
[2013.12.29 11:17:37 | 000,126,336 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiuxpag.dll
[2013.12.29 11:17:37 | 000,110,080 | ---- | C] (TODO: <Company name>) -- C:\Windows\SysNative\DelayAPO.dll
[2013.12.29 11:17:37 | 000,099,840 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\OpenVideo64.dll
[2013.12.29 11:17:37 | 000,094,208 | ---- | C] (Advanced Micro Devices) -- C:\Windows\SysNative\drivers\AtihdW76.sys
[2013.12.29 11:17:37 | 000,086,528 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\OVDecode64.dll
[2013.12.29 11:17:37 | 000,083,968 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\OpenVideo.dll
[2013.12.29 11:17:37 | 000,073,728 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\OVDecode.dll
[2013.12.29 11:17:36 | 022,157,824 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysWow64\atioglxx.dll
[2013.12.29 11:17:36 | 008,927,704 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiumd6a.dll
[2013.12.29 11:17:36 | 007,751,920 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiumd64.dll
[2013.12.29 11:17:36 | 006,630,232 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiumdag.dll
[2013.12.29 11:17:36 | 000,190,976 | ---- | C] (AMD) -- C:\Windows\SysNative\atitmm64.dll
[2013.12.29 11:17:36 | 000,115,512 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiu9p64.dll
[2013.12.29 11:17:36 | 000,098,496 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiu9pag.dll
[2013.12.29 11:17:35 | 026,352,128 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atio6axx.dll
[2013.12.29 11:17:35 | 013,207,552 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\drivers\atikmdag.sys
[2013.12.29 11:17:35 | 009,753,752 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atidxx64.dll
[2013.12.29 11:17:35 | 008,406,024 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atidxx32.dll
[2013.12.29 11:17:35 | 001,318,552 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\aticfx64.dll
[2013.12.29 11:17:35 | 001,100,216 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\aticfx32.dll
[2013.12.29 11:17:35 | 000,626,176 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\drivers\atikmpag.sys
[2013.12.29 11:17:35 | 000,588,288 | ---- | C] (AMD) -- C:\Windows\SysNative\atieclxx.exe
[2013.12.29 11:17:35 | 000,442,368 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atidemgy.dll
[2013.12.29 11:17:35 | 000,332,800 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\ATIODE.exe
[2013.12.29 11:17:35 | 000,239,616 | ---- | C] (AMD) -- C:\Windows\SysNative\atiesrxx.exe
[2013.12.29 11:17:35 | 000,100,352 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atig6txx.dll
[2013.12.29 11:17:35 | 000,096,768 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atigktxx.dll
[2013.12.29 11:17:35 | 000,078,432 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atimpc64.dll
[2013.12.29 11:17:35 | 000,078,432 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\amdpcom64.dll
[2013.12.29 11:17:35 | 000,074,752 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atig6pxx.dll
[2013.12.29 11:17:35 | 000,071,704 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atimpc32.dll
[2013.12.29 11:17:35 | 000,071,704 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\amdpcom32.dll
[2013.12.29 11:17:35 | 000,069,632 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysWow64\atiglpxx.dll
[2013.12.29 11:17:35 | 000,069,632 | ---- | C] (Advanced Micro Devices, Inc. ) -- C:\Windows\SysNative\atiglpxx.dll
[2013.12.29 11:17:35 | 000,062,464 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\aticalrt64.dll
[2013.12.29 11:17:35 | 000,052,224 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\aticalrt.dll
[2013.12.29 11:17:35 | 000,051,200 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\ATIODCLI.exe
[2013.12.29 11:17:35 | 000,031,232 | ---- | C] (AMD) -- C:\Windows\SysNative\atimuixx.dll
[2013.12.29 11:17:34 | 015,716,352 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\aticaldd64.dll
[2013.12.29 11:17:34 | 014,302,208 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\aticaldd.dll
[2013.12.29 11:17:34 | 001,144,320 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atiadlxx.dll
[2013.12.29 11:17:34 | 000,825,344 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysWow64\atiadlxy.dll
[2013.12.29 11:17:34 | 000,368,640 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atiapfxx.exe
[2013.12.29 11:17:34 | 000,118,784 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\atibtmon.exe
[2013.12.29 11:17:34 | 000,063,488 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll
[2013.12.29 11:17:34 | 000,057,344 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll
[2013.12.29 11:17:34 | 000,055,808 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\aticalcl64.dll
[2013.12.29 11:17:34 | 000,049,152 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\aticalcl.dll
[2013.12.29 11:17:34 | 000,043,520 | ---- | C] (Advanced Micro Devices, Inc.) -- C:\Windows\SysNative\drivers\ati2erec.dll
[2013.12.29 11:17:32 | 029,382,144 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysNative\amdocl64.dll
[2013.12.29 11:17:31 | 024,860,160 | ---- | C] (Advanced Micro Devices Inc.) -- C:\Windows\SysWow64\amdocl.dll
 
========== Files - Modified Within 30 Days ==========
 
[2014.01.11 01:23:18 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Raubtier\Desktop\OTL.exe
[2014.01.11 01:21:20 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2014.01.11 01:09:26 | 000,026,352 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014.01.11 01:09:26 | 000,026,352 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2014.01.11 01:06:29 | 001,618,320 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2014.01.11 01:06:29 | 000,698,688 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2014.01.11 01:06:29 | 000,653,526 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2014.01.11 01:06:29 | 000,148,828 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2014.01.11 01:06:29 | 000,121,398 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2014.01.11 01:02:27 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2014.01.11 01:02:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014.01.11 01:02:05 | 2132,877,311 | -HS- | M] () -- C:\hiberfil.sys
[2014.01.11 00:58:39 | 000,007,603 | ---- | M] () -- C:\Users\Raubtier\AppData\Local\Resmon.ResmonCfg
[2014.01.11 00:52:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014.01.10 22:04:59 | 000,791,552 | ---- | M] (AMD) -- C:\Users\Raubtier\Desktop\amddriverdownloader.exe
[2014.01.10 21:38:42 | 001,994,222 | ---- | M] () -- C:\Users\Raubtier\Desktop\cpu-z-168.zip
[2014.01.07 12:50:35 | 001,245,168 | ---- | M] (Microsoft Corporation) -- C:\Users\Raubtier\Desktop\wlsetup-web.exe
[2014.01.07 00:57:49 | 000,001,682 | ---- | M] () -- C:\Users\Raubtier\Desktop\Usenet.nl.lnk
[2014.01.07 00:57:16 | 007,457,256 | ---- | M] (                                                            ) -- C:\Users\Raubtier\Desktop\UsenetNLSetup.exe
[2014.01.03 21:18:44 | 000,000,914 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2014.01.02 23:11:00 | 000,001,520 | ---- | M] () -- C:\Users\Raubtier\Desktop\TheBureau.lnk
[2014.01.02 23:10:26 | 000,001,045 | ---- | M] () -- C:\Users\Raubtier\Desktop\nba2k14.lnk
[2014.01.02 23:09:35 | 000,001,669 | ---- | M] () -- C:\Users\Raubtier\Desktop\BatmanOrigins.lnk
[2014.01.01 22:35:01 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_xusb21_01009.Wdf
[2014.01.01 22:17:52 | 000,214,392 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2014.01.01 22:02:14 | 000,214,392 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2014.01.01 21:17:58 | 000,002,699 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2014.01.01 03:02:41 | 000,000,857 | ---- | M] () -- C:\Users\Raubtier\Desktop\Yahoo! Messenger.lnk
[2013.12.30 19:29:01 | 000,000,001 | ---- | M] () -- C:\Users\Raubtier\AppData\Local\llftool.4.30.agreement
[2013.12.30 06:21:50 | 001,591,896 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013.12.30 06:15:14 | 000,940,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2013.12.30 06:15:14 | 000,194,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\elshyph.dll
[2013.12.30 06:15:10 | 001,051,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll
[2013.12.30 06:15:10 | 000,645,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jsIntl.dll
[2013.12.30 06:15:10 | 000,616,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dat
[2013.12.30 06:15:10 | 000,337,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2013.12.30 06:15:10 | 000,235,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\elshyph.dll
[2013.12.30 06:15:10 | 000,233,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2013.12.30 06:15:10 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2013.12.30 06:15:10 | 000,083,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll
[2013.12.30 06:15:10 | 000,071,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013.12.30 06:15:10 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\icardie.dll
[2013.12.30 06:15:10 | 000,062,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx
[2013.12.30 06:15:10 | 000,061,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013.12.30 06:15:10 | 000,034,816 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
[2013.12.30 06:15:10 | 000,032,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013.12.30 06:15:10 | 000,024,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2013.12.30 06:15:10 | 000,016,284 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.12.30 06:15:09 | 000,942,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jsIntl.dll
[2013.12.30 06:15:09 | 000,610,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013.12.30 06:15:09 | 000,151,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iexpress.exe
[2013.12.30 06:15:09 | 000,139,264 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\wextract.exe
[2013.12.30 06:15:09 | 000,127,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll
[2013.12.30 06:15:09 | 000,116,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2013.12.30 06:15:09 | 000,112,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2013.12.30 06:15:09 | 000,111,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\IEAdvpack.dll
[2013.12.30 06:15:09 | 000,086,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013.12.30 06:15:09 | 000,074,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\SetIEInstalledDate.exe
[2013.12.30 06:15:09 | 000,069,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2013.12.30 06:15:09 | 000,061,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll
[2013.12.30 06:15:09 | 000,056,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\pngfilt.dll
[2013.12.30 06:15:09 | 000,051,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll
[2013.12.30 06:15:09 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmler.dll
[2013.12.30 06:15:09 | 000,012,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2013.12.30 06:15:08 | 001,228,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll
[2013.12.30 06:15:08 | 000,616,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dat
[2013.12.30 06:15:08 | 000,453,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2013.12.30 06:15:08 | 000,413,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2013.12.30 06:15:08 | 000,296,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2013.12.30 06:15:08 | 000,247,808 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll
[2013.12.30 06:15:08 | 000,235,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2013.12.30 06:15:08 | 000,195,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2013.12.30 06:15:08 | 000,131,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll
[2013.12.30 06:15:08 | 000,105,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013.12.30 06:15:08 | 000,090,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\SetIEInstalledDate.exe
[2013.12.30 06:15:08 | 000,086,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013.12.30 06:15:08 | 000,081,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll
[2013.12.30 06:15:08 | 000,077,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx
[2013.12.30 06:15:08 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll
[2013.12.30 06:15:08 | 000,040,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll
[2013.12.30 06:15:08 | 000,016,284 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2013.12.30 06:15:08 | 000,013,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2013.12.30 06:15:07 | 000,774,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013.12.30 06:15:07 | 000,626,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013.12.30 06:15:07 | 000,548,352 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2013.12.30 06:15:07 | 000,167,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iexpress.exe
[2013.12.30 06:15:07 | 000,147,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll
[2013.12.30 06:15:07 | 000,143,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wextract.exe
[2013.12.30 06:15:07 | 000,135,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2013.12.30 06:15:07 | 000,101,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll
[2013.12.30 06:15:07 | 000,084,992 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2013.12.30 06:15:07 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll
[2013.12.30 06:15:07 | 000,062,464 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll
[2013.12.30 06:15:07 | 000,048,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll
[2013.12.30 06:15:07 | 000,030,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2013.12.30 06:15:07 | 000,013,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshta.exe
[2013.12.30 06:08:27 | 000,294,344 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.12.29 16:04:04 | 000,076,888 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2013.12.29 15:29:58 | 000,283,064 | ---- | M] (Disc Soft Ltd) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys
[2013.12.29 13:09:49 | 000,419,488 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.12.29 13:09:49 | 000,070,304 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.12.29 13:03:06 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_RzSynapse_01007.Wdf
[2013.12.29 12:57:34 | 000,000,909 | ---- | M] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2013.12.29 12:29:22 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2013.12.29 12:13:05 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif
[2013.12.29 12:01:35 | 000,372,091 | RHS- | M] () -- C:\WOYBL
[2013.12.29 11:45:44 | 000,161,548 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2013.12.29 11:45:44 | 000,161,548 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2013.12.29 11:39:34 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
 
========== Files Created - No Company Name ==========
 
[2014.01.10 21:38:39 | 001,994,222 | ---- | C] () -- C:\Users\Raubtier\Desktop\cpu-z-168.zip
[2014.01.07 00:57:49 | 000,001,682 | ---- | C] () -- C:\Users\Raubtier\Desktop\Usenet.nl.lnk
[2014.01.07 00:57:10 | 007,457,256 | ---- | C] (                                                            ) -- C:\Users\Raubtier\Desktop\UsenetNLSetup.exe
[2014.01.03 21:18:44 | 000,000,914 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2014.01.02 23:11:00 | 000,001,520 | ---- | C] () -- C:\Users\Raubtier\Desktop\TheBureau.lnk
[2014.01.02 23:10:26 | 000,001,045 | ---- | C] () -- C:\Users\Raubtier\Desktop\nba2k14.lnk
[2014.01.02 23:09:35 | 000,001,669 | ---- | C] () -- C:\Users\Raubtier\Desktop\BatmanOrigins.lnk
[2014.01.01 22:35:01 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_xusb21_01009.Wdf
[2014.01.01 21:17:58 | 000,002,699 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2014.01.01 03:02:41 | 000,000,857 | ---- | C] () -- C:\Users\Raubtier\Desktop\Yahoo! Messenger.lnk
[2013.12.30 23:09:13 | 000,007,603 | ---- | C] () -- C:\Users\Raubtier\AppData\Local\Resmon.ResmonCfg
[2013.12.30 19:29:01 | 000,000,001 | ---- | C] () -- C:\Users\Raubtier\AppData\Local\llftool.4.30.agreement
[2013.12.30 06:15:10 | 000,016,284 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.12.30 06:15:08 | 000,016,284 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2013.12.29 16:04:07 | 000,214,392 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2013.12.29 16:04:07 | 000,214,392 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2013.12.29 16:04:04 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2013.12.29 13:09:50 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.12.29 13:03:06 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_RzSynapse_01007.Wdf
[2013.12.29 12:57:34 | 000,000,909 | ---- | C] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2013.12.29 12:49:54 | 000,001,114 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.12.29 12:49:53 | 000,001,110 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.12.29 12:29:22 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2013.12.29 12:13:05 | 000,001,912 | ---- | C] () -- C:\Windows\epplauncher.mif
[2013.12.29 12:13:01 | 000,002,117 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2013.12.29 12:08:20 | 000,074,272 | ---- | C] () -- C:\Windows\SysNative\RtNicProp64.dll
[2013.12.29 12:07:28 | 000,293,889 | ---- | C] () -- C:\Windows\SysNative\drivers\RTAIODAT.DAT
[2013.12.29 12:01:34 | 000,372,091 | RHS- | C] () -- C:\WOYBL
[2013.12.29 11:58:57 | 000,001,421 | ---- | C] () -- C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2013.12.29 11:50:47 | 001,591,896 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013.12.29 11:45:03 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2013.12.29 11:44:49 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2013.12.29 11:40:42 | 2132,877,311 | -HS- | C] () -- C:\hiberfil.sys
[2013.12.29 11:39:34 | 000,008,192 | RHS- | C] () -- C:\BOOTSECT.BAK
[2013.12.29 11:39:32 | 000,383,786 | RHS- | C] () -- C:\bootmgr
[2013.12.29 11:17:37 | 003,461,040 | ---- | C] () -- C:\Windows\SysWow64\atiumdva.cap
[2013.12.29 11:17:37 | 000,234,036 | ---- | C] () -- C:\Windows\SysNative\ativvaxy_cik.dat
[2013.12.29 11:17:37 | 000,233,776 | ---- | C] () -- C:\Windows\SysNative\ativvaxy_cik_nd.dat
[2013.12.29 11:17:37 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2013.12.29 11:17:37 | 000,204,952 | ---- | C] () -- C:\Windows\SysNative\ativvsvl.dat
[2013.12.29 11:17:37 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2013.12.29 11:17:37 | 000,157,144 | ---- | C] () -- C:\Windows\SysNative\ativvsva.dat
[2013.12.29 11:17:37 | 000,083,552 | ---- | C] () -- C:\Windows\SysNative\ativce02.dat
[2013.12.29 11:17:36 | 003,426,688 | ---- | C] () -- C:\Windows\SysNative\atiumd6a.cap
[2013.12.29 11:17:36 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2013.12.29 11:17:36 | 000,003,917 | ---- | C] () -- C:\Windows\SysNative\atipblag.dat
[2013.12.29 11:17:35 | 000,721,296 | ---- | C] () -- C:\Windows\SysNative\atiicdxx.dat
[2013.12.29 11:17:35 | 000,047,887 | ---- | C] () -- C:\Windows\atiogl.xml
[2013.12.29 11:17:34 | 001,061,902 | ---- | C] () -- C:\Windows\SysNative\amdocl_ld64.exe
[2013.12.29 11:17:34 | 000,798,734 | ---- | C] () -- C:\Windows\SysWow64\amdocl_ld32.exe
[2013.12.29 11:17:34 | 000,550,456 | ---- | C] () -- C:\Windows\SysWow64\atiapfxx.blb
[2013.12.29 11:17:34 | 000,550,456 | ---- | C] () -- C:\Windows\SysNative\atiapfxx.blb
[2013.12.29 11:17:33 | 001,187,342 | ---- | C] () -- C:\Windows\SysNative\amdocl_as64.exe
[2013.12.29 11:17:33 | 000,995,342 | ---- | C] () -- C:\Windows\SysWow64\amdocl_as32.exe
[2013.12.06 16:44:26 | 000,038,912 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.10.10 02:11:05 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.10.10 02:11:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2014.01.02 23:11:14 | 000,000,000 | ---D | M] -- C:\Users\Raubtier\AppData\Roaming\2K Sports
[2013.12.29 15:54:54 | 000,000,000 | ---D | M] -- C:\Users\Raubtier\AppData\Roaming\DAEMON Tools Lite
[2013.12.29 12:36:19 | 000,000,000 | ---D | M] -- C:\Users\Raubtier\AppData\Roaming\Origin
[2014.01.01 22:31:00 | 000,000,000 | ---D | M] -- C:\Users\Raubtier\AppData\Roaming\TS3Client
[2014.01.10 01:01:08 | 000,000,000 | ---D | M] -- C:\Users\Raubtier\AppData\Roaming\Usenet.nl
 
========== Purity Check ==========
 
 

< End of report >
         
__________________

Alt 11.01.2014, 17:26   #4
B3AM3R
 
Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool? - Standard

Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?



Code:
ATTFilter
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2014-01-11 13:32:17
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD10EARS-67Y5B1 rev.80.00A80 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Raubtier\AppData\Local\Temp\fxddikog.sys


---- User code sections - GMER 2.1 ----

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                      0000000076da1360 5 bytes JMP 000000014a540460
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                               0000000076da13b0 5 bytes JMP 000000014a540450
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                               0000000076da1510 5 bytes JMP 000000014a540370
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                    0000000076da1560 5 bytes JMP 000000014a540470
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                          0000000076da1570 5 bytes JMP 000000014a5403e0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                               0000000076da1620 5 bytes JMP 000000014a540320
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                        0000000076da1650 5 bytes JMP 000000014a5403b0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                           0000000076da1670 5 bytes JMP 000000014a540390
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                 0000000076da16b0 5 bytes JMP 000000014a5402e0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                               0000000076da1730 5 bytes JMP 000000014a5402d0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                             0000000076da1750 5 bytes JMP 000000014a540310
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                              0000000076da1790 5 bytes JMP 000000014a5403c0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                           0000000076da17e0 5 bytes JMP 000000014a5403f0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                              0000000076da1940 5 bytes JMP 000000014a540230
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                   0000000076da1b00 5 bytes JMP 000000014a540480
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                  0000000076da1b30 5 bytes JMP 000000014a5403a0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                           0000000076da1c10 5 bytes JMP 000000014a5402f0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                        0000000076da1c20 5 bytes JMP 000000014a540350
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                              0000000076da1c80 5 bytes JMP 000000014a540290
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                           0000000076da1d10 5 bytes JMP 000000014a5402b0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                            0000000076da1d30 5 bytes JMP 000000014a5403d0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                               0000000076da1d40 5 bytes JMP 000000014a540330
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                        0000000076da1db0 5 bytes JMP 000000014a540410
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                           0000000076da1de0 5 bytes JMP 000000014a540240
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                0000000076da20a0 5 bytes JMP 000000014a5401e0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                           0000000076da2160 5 bytes JMP 000000014a540250
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                           0000000076da2190 5 bytes JMP 000000014a540490
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                  0000000076da21a0 5 bytes JMP 000000014a5404a0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                             0000000076da21d0 5 bytes JMP 000000014a540300
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                          0000000076da21e0 5 bytes JMP 000000014a540360
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                0000000076da2240 5 bytes JMP 000000014a5402a0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                             0000000076da2290 5 bytes JMP 000000014a5402c0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                0000000076da22c0 5 bytes JMP 000000014a540380
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                 0000000076da22d0 5 bytes JMP 000000014a540340
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                          0000000076da25c0 5 bytes JMP 000000014a540440
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                         0000000076da27c0 5 bytes JMP 000000014a540260
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                            0000000076da27d0 5 bytes JMP 000000014a540270
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                          0000000076da27e0 5 bytes JMP 000000014a540400
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                      0000000076da29a0 5 bytes JMP 000000014a5401f0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                       0000000076da29b0 5 bytes JMP 000000014a540210
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                            0000000076da2a20 5 bytes JMP 000000014a540200
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                            0000000076da2a80 5 bytes JMP 000000014a540420
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                             0000000076da2a90 5 bytes JMP 000000014a540430
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                        0000000076da2aa0 5 bytes JMP 000000014a540220
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                0000000076da2b80 5 bytes JMP 000000014a540280
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                    0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                             0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                             0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                  0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                        0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                             0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                      0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                         0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                               0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                             0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                           0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                            0000000076da1790 5 bytes JMP 0000000076f003c0
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                         0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                            0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                 0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                         0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                      0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                            0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                         0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                          0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                             0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                      0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                         0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                              0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                         0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                         0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                           0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                        0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                              0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                           0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                              0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                               0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                        0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                       0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                          0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                        0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                    0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                     0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                          0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                          0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                           0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                      0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                              0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Windows\system32\wininit.exe[628] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                   0000000076b8eecd 1 byte [62]
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                      0000000076da1360 5 bytes JMP 000000014a540460
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                               0000000076da13b0 5 bytes JMP 000000014a540450
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                               0000000076da1510 5 bytes JMP 000000014a540370
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                    0000000076da1560 5 bytes JMP 000000014a540470
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                          0000000076da1570 5 bytes JMP 000000014a5403e0
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                               0000000076da1620 5 bytes JMP 000000014a540320
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                        0000000076da1650 5 bytes JMP 000000014a5403b0
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                           0000000076da1670 5 bytes JMP 000000014a540390
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                 0000000076da16b0 5 bytes JMP 000000014a5402e0
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                               0000000076da1730 5 bytes JMP 000000014a5402d0
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                             0000000076da1750 5 bytes JMP 000000014a540310
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                              0000000076da1790 5 bytes JMP 000000014a5403c0
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                           0000000076da17e0 5 bytes JMP 000000014a5403f0
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                              0000000076da1940 5 bytes JMP 000000014a540230
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                   0000000076da1b00 5 bytes JMP 000000014a540480
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                  0000000076da1b30 5 bytes JMP 000000014a5403a0
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                           0000000076da1c10 5 bytes JMP 000000014a5402f0
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                        0000000076da1c20 5 bytes JMP 000000014a540350
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                              0000000076da1c80 5 bytes JMP 000000014a540290
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                           0000000076da1d10 5 bytes JMP 000000014a5402b0
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                            0000000076da1d30 5 bytes JMP 000000014a5403d0
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                               0000000076da1d40 5 bytes JMP 000000014a540330
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                        0000000076da1db0 5 bytes JMP 000000014a540410
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                           0000000076da1de0 5 bytes JMP 000000014a540240
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                0000000076da20a0 5 bytes JMP 000000014a5401e0
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                           0000000076da2160 5 bytes JMP 000000014a540250
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                           0000000076da2190 5 bytes JMP 000000014a540490
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                  0000000076da21a0 5 bytes JMP 000000014a5404a0
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                             0000000076da21d0 5 bytes JMP 000000014a540300
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                          0000000076da21e0 5 bytes JMP 000000014a540360
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                0000000076da2240 5 bytes JMP 000000014a5402a0
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                             0000000076da2290 5 bytes JMP 000000014a5402c0
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                0000000076da22c0 5 bytes JMP 000000014a540380
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                 0000000076da22d0 5 bytes JMP 000000014a540340
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                          0000000076da25c0 5 bytes JMP 000000014a540440
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                         0000000076da27c0 5 bytes JMP 000000014a540260
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                            0000000076da27d0 5 bytes JMP 000000014a540270
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                          0000000076da27e0 5 bytes JMP 000000014a540400
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                      0000000076da29a0 5 bytes JMP 000000014a5401f0
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                       0000000076da29b0 5 bytes JMP 000000014a540210
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                            0000000076da2a20 5 bytes JMP 000000014a540200
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                            0000000076da2a80 5 bytes JMP 000000014a540420
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                             0000000076da2a90 5 bytes JMP 000000014a540430
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                        0000000076da2aa0 5 bytes JMP 000000014a540220
.text  C:\Windows\system32\csrss.exe[648] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                0000000076da2b80 5 bytes JMP 000000014a540280
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000076da1790 5 bytes JMP 0000000076f003c0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Windows\system32\services.exe[684] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Windows\system32\services.exe[684] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                  0000000076b8eecd 1 byte [62]
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                      0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                               0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                               0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                    0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                          0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                               0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                        0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                           0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                 0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                               0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                             0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                              0000000076da1790 5 bytes JMP 0000000076f003c0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                           0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                              0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                   0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                  0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                           0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                        0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                              0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                           0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                            0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                               0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                        0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                           0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                           0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                           0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                  0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                             0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                          0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                             0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                 0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                          0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                         0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                            0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                          0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                      0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                       0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                            0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                            0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                             0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                        0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                        0000000076da1360 5 bytes JMP 0000000100070460
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                 0000000076da13b0 5 bytes JMP 0000000100070450
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                 0000000076da1510 5 bytes JMP 0000000100070370
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                      0000000076da1560 5 bytes JMP 0000000100070470
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                            0000000076da1570 5 bytes JMP 00000001000703e0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                 0000000076da1620 5 bytes JMP 0000000100070320
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                          0000000076da1650 5 bytes JMP 00000001000703b0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                             0000000076da1670 5 bytes JMP 0000000100070390
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                   0000000076da16b0 5 bytes JMP 00000001000702e0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                 0000000076da1730 5 bytes JMP 00000001000702d0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                               0000000076da1750 5 bytes JMP 0000000100070310
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                0000000076da1790 5 bytes JMP 00000001000703c0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                             0000000076da17e0 5 bytes JMP 00000001000703f0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                0000000076da1940 5 bytes JMP 0000000100070230
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                     0000000076da1b00 5 bytes JMP 0000000100070480
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                    0000000076da1b30 5 bytes JMP 00000001000703a0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                             0000000076da1c10 5 bytes JMP 00000001000702f0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                          0000000076da1c20 5 bytes JMP 0000000100070350
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                0000000076da1c80 5 bytes JMP 0000000100070290
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                             0000000076da1d10 5 bytes JMP 00000001000702b0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                              0000000076da1d30 5 bytes JMP 00000001000703d0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                 0000000076da1d40 5 bytes JMP 0000000100070330
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                          0000000076da1db0 5 bytes JMP 0000000100070410
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                             0000000076da1de0 5 bytes JMP 0000000100070240
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                  0000000076da20a0 5 bytes JMP 00000001000701e0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                             0000000076da2160 5 bytes JMP 0000000100070250
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                             0000000076da2190 5 bytes JMP 0000000100070490
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                    0000000076da21a0 5 bytes JMP 00000001000704a0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                               0000000076da21d0 5 bytes JMP 0000000100070300
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                            0000000076da21e0 5 bytes JMP 0000000100070360
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                  0000000076da2240 5 bytes JMP 00000001000702a0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                               0000000076da2290 5 bytes JMP 00000001000702c0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                  0000000076da22c0 5 bytes JMP 0000000100070380
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                   0000000076da22d0 5 bytes JMP 0000000100070340
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                            0000000076da25c0 5 bytes JMP 0000000100070440
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                           0000000076da27c0 5 bytes JMP 0000000100070260
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                              0000000076da27d0 5 bytes JMP 0000000100070270
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                            0000000076da27e0 5 bytes JMP 0000000100070400
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                        0000000076da29a0 5 bytes JMP 00000001000701f0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                         0000000076da29b0 5 bytes JMP 0000000100070210
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                              0000000076da2a20 5 bytes JMP 0000000100070200
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                              0000000076da2a80 5 bytes JMP 0000000100070420
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                               0000000076da2a90 5 bytes JMP 0000000100070430
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                          0000000076da2aa0 5 bytes JMP 0000000100070220
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                  0000000076da2b80 5 bytes JMP 0000000100070280
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000076da1790 5 bytes JMP 0000000076f003c0
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Windows\system32\winlogon.exe[772] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                  0000000076b8eecd 1 byte [62]
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                    0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                             0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                             0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                  0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                        0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                             0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                      0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                         0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                               0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                             0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                           0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                            0000000076da1790 5 bytes JMP 0000000076f003c0
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                         0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                            0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                 0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                         0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                      0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                            0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                         0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                          0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                             0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                      0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                         0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                              0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                         0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                         0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                           0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                        0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                              0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                           0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                              0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                               0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                        0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                       0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                          0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                        0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                    0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                     0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                          0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                          0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                           0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                      0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                              0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Windows\system32\svchost.exe[868] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                   0000000076b8eecd 1 byte [62]
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                    0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                             0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                             0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                  0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                        0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                             0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                      0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                         0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                               0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                             0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                           0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                            0000000076da1790 5 bytes JMP 0000000076f003c0
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                         0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                            0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                 0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                         0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                      0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                            0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                         0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                          0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                             0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                      0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                         0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                              0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                         0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                         0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                           0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                        0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                              0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                           0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                              0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                               0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                        0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                       0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                          0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                        0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                    0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                     0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                          0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                          0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                           0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                      0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Windows\system32\svchost.exe[968] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                              0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort             0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                      0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                      0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx           0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                 0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                      0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory               0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                  0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                        0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                      0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                    0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                     0000000076da1790 5 bytes JMP 0000000076f003c0
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                  0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                     0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort          0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject         0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                  0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion               0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                     0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                  0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                   0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                      0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess               0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                  0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                       0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                  0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                  0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys         0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                    0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                 0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                       0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                    0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                       0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                        0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                 0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                   0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                 0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation             0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState              0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                   0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                   0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                    0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl               0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                       0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Program Files\Microsoft Security Client\MsMpEng.exe[124] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189            0000000076b8eecd 1 byte [62]
.text  C:\Windows\system32\atiesrxx.exe[388] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                  0000000076b8eecd 1 byte [62]
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                    0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                             0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                             0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                  0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                        0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                             0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                      0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                         0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                               0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                             0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                           0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                            0000000076da1790 5 bytes JMP 0000000076f003c0
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                         0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                            0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                 0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                         0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                      0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                            0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                         0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                          0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                             0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                      0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                         0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                              0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                         0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                         0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                           0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                        0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                              0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                           0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                              0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                               0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                        0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                       0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                          0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                        0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                    0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                     0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                          0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                          0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                           0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                      0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                              0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Windows\System32\svchost.exe[376] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                   0000000076b8eecd 1 byte [62]
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   0000000076da1360 5 bytes JMP 0000000100070460
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            0000000076da13b0 5 bytes JMP 0000000100070450
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000076da1510 5 bytes JMP 0000000100070370
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000076da1560 5 bytes JMP 0000000100070470
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000076da1570 5 bytes JMP 00000001000703e0
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000076da1620 5 bytes JMP 0000000100070320
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000076da1650 5 bytes JMP 00000001000703b0
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000076da1670 5 bytes JMP 0000000100070390
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              0000000076da16b0 5 bytes JMP 00000001000702e0
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000076da1730 5 bytes JMP 00000001000702d0
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000076da1750 5 bytes JMP 0000000100070310
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000076da1790 5 bytes JMP 00000001000703c0
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        0000000076da17e0 5 bytes JMP 00000001000703f0
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000076da1940 5 bytes JMP 0000000100070230
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000076da1b00 5 bytes JMP 0000000100070480
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000076da1b30 5 bytes JMP 00000001000703a0
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000076da1c10 5 bytes JMP 00000001000702f0
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000076da1c20 5 bytes JMP 0000000100070350
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000076da1c80 5 bytes JMP 0000000100070290
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000076da1d10 5 bytes JMP 00000001000702b0
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000076da1d30 5 bytes JMP 00000001000703d0
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000076da1d40 5 bytes JMP 0000000100070330
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     0000000076da1db0 5 bytes JMP 0000000100070410
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        0000000076da1de0 5 bytes JMP 0000000100070240
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000076da20a0 5 bytes JMP 00000001000701e0
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000076da2160 5 bytes JMP 0000000100070250
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000076da2190 5 bytes JMP 0000000100070490
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000076da21a0 5 bytes JMP 00000001000704a0
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000076da21d0 5 bytes JMP 0000000100070300
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000076da21e0 5 bytes JMP 0000000100070360
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000076da2240 5 bytes JMP 00000001000702a0
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000076da2290 5 bytes JMP 00000001000702c0
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000076da22c0 5 bytes JMP 0000000100070380
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000076da22d0 5 bytes JMP 0000000100070340
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       0000000076da25c0 5 bytes JMP 0000000100070440
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      0000000076da27c0 5 bytes JMP 0000000100070260
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         0000000076da27d0 5 bytes JMP 0000000100070270
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       0000000076da27e0 5 bytes JMP 0000000100070400
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   0000000076da29a0 5 bytes JMP 00000001000701f0
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    0000000076da29b0 5 bytes JMP 0000000100070210
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000076da2a20 5 bytes JMP 0000000100070200
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000076da2a80 5 bytes JMP 0000000100070420
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000076da2a90 5 bytes JMP 0000000100070430
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     0000000076da2aa0 5 bytes JMP 0000000100070220
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000076da2b80 5 bytes JMP 0000000100070280
.text  C:\Windows\System32\svchost.exe[1072] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                  0000000076b8eecd 1 byte [62]
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000076da1790 5 bytes JMP 0000000076f003c0
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Windows\system32\svchost.exe[1116] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                  0000000076b8eecd 1 byte [62]
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000076da1790 5 bytes JMP 0000000076f003c0
.text
         

Alt 11.01.2014, 17:29   #5
B3AM3R
 
Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool? - Standard

Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?



Code:
ATTFilter
C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Windows\system32\svchost.exe[1148] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                  0000000076b8eecd 1 byte [62]
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   0000000076da1360 5 bytes JMP 0000000100040460
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            0000000076da13b0 5 bytes JMP 0000000100040450
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000076da1510 5 bytes JMP 0000000100040370
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000076da1560 5 bytes JMP 0000000100040470
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000076da1570 5 bytes JMP 00000001000403e0
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000076da1620 5 bytes JMP 0000000100040320
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000076da1650 5 bytes JMP 00000001000403b0
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000076da1670 5 bytes JMP 0000000100040390
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              0000000076da16b0 5 bytes JMP 00000001000402e0
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000076da1730 5 bytes JMP 00000001000402d0
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000076da1750 5 bytes JMP 0000000100040310
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000076da1790 5 bytes JMP 00000001000403c0
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        0000000076da17e0 5 bytes JMP 00000001000403f0
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000076da1940 5 bytes JMP 0000000100040230
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000076da1b00 5 bytes JMP 0000000100040480
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000076da1b30 5 bytes JMP 00000001000403a0
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000076da1c10 5 bytes JMP 00000001000402f0
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000076da1c20 5 bytes JMP 0000000100040350
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000076da1c80 5 bytes JMP 0000000100040290
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000076da1d10 5 bytes JMP 00000001000402b0
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000076da1d30 5 bytes JMP 00000001000403d0
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000076da1d40 5 bytes JMP 0000000100040330
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     0000000076da1db0 5 bytes JMP 0000000100040410
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        0000000076da1de0 5 bytes JMP 0000000100040240
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000076da20a0 5 bytes JMP 00000001000401e0
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000076da2160 5 bytes JMP 0000000100040250
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000076da2190 5 bytes JMP 0000000100040490
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000076da21a0 5 bytes JMP 00000001000404a0
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000076da21d0 5 bytes JMP 0000000100040300
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000076da21e0 5 bytes JMP 0000000100040360
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000076da2240 5 bytes JMP 00000001000402a0
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000076da2290 5 bytes JMP 00000001000402c0
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000076da22c0 5 bytes JMP 0000000100040380
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000076da22d0 5 bytes JMP 0000000100040340
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       0000000076da25c0 5 bytes JMP 0000000100040440
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      0000000076da27c0 5 bytes JMP 0000000100040260
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         0000000076da27d0 5 bytes JMP 0000000100040270
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       0000000076da27e0 5 bytes JMP 0000000100040400
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   0000000076da29a0 5 bytes JMP 00000001000401f0
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    0000000076da29b0 5 bytes JMP 0000000100040210
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000076da2a20 5 bytes JMP 0000000100040200
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000076da2a80 5 bytes JMP 0000000100040420
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000076da2a90 5 bytes JMP 0000000100040430
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     0000000076da2aa0 5 bytes JMP 0000000100040220
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000076da2b80 5 bytes JMP 0000000100040280
.text  C:\Windows\system32\AUDIODG.EXE[1208] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189                                  0000000076b8eecd 1 byte [62]
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                  0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                           0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                           0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                      0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                           0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                    0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                       0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                             0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                           0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                         0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                          0000000076da1790 5 bytes JMP 0000000076f003c0
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                       0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                          0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                               0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                              0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                       0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                    0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                          0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                       0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                        0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                           0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                    0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                       0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                            0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                       0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                       0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                              0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                         0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                      0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                            0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                         0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                            0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                             0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                      0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                     0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                        0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                      0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                  0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                   0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                        0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                        0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                         0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                    0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Windows\system32\atieclxx.exe[1332] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                            0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000076da1790 5 bytes JMP 0000000076f003c0
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Windows\system32\svchost.exe[1388] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                  0000000076b8eecd 1 byte [62]
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000076da1790 5 bytes JMP 0000000076f003c0
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Windows\System32\spoolsv.exe[1744] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                  0000000076b8eecd 1 byte [62]
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000076da1790 5 bytes JMP 0000000076f003c0
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Windows\system32\svchost.exe[1776] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                  0000000076b8eecd 1 byte [62]
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                    0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                             0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                             0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                  0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                        0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                             0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                      0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                         0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                               0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                             0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                           0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                            0000000076da1790 5 bytes JMP 0000000076f003c0
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                         0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                            0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                 0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                         0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                      0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                            0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                         0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                          0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                             0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                      0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                         0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                              0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                         0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                         0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                           0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                        0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                              0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                           0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                              0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                               0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                        0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                       0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                          0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                        0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                    0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                     0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                          0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                          0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                           0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                      0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                              0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe[1872] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                   0000000076b8eecd 1 byte [62]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                 0000000075dca2ba 1 byte [62]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                      00000000747d1a22 2 bytes [7D, 74]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                      00000000747d1ad0 2 bytes [7D, 74]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                      00000000747d1b08 2 bytes [7D, 74]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                      00000000747d1bba 2 bytes [7D, 74]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                      00000000747d1bda 2 bytes [7D, 74]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 18                               0000000074aa1402 1 byte [74]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 18                                 0000000074aa141a 1 byte [74]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 18                               0000000074aa1432 1 byte [74]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 43                               0000000074aa144b 1 byte [74]
.text  ...                                                                                                                          * 9
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 18                                  0000000074aa14de 1 byte [74]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 18                           0000000074aa14f6 1 byte [74]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 18                                  0000000074aa150e 1 byte [74]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 18                           0000000074aa1526 1 byte [74]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 18                                 0000000074aa153e 1 byte [74]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 18                                      0000000074aa1556 1 byte [74]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 18                               0000000074aa156e 1 byte [74]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 18                                 0000000074aa1586 1 byte [74]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 18                                    0000000074aa159e 1 byte [74]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 18                                 0000000074aa15b6 1 byte [74]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 18                               0000000074aa15ce 1 byte [74]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 21                           0000000074aa16b3 1 byte [74]
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1932] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 32                           0000000074aa16be 1 byte [74]
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                  0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                           0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                           0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                      0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                           0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                    0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                       0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                             0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                           0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                         0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                          0000000076da1790 5 bytes JMP 0000000076f003c0
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                       0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                          0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                               0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                              0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                       0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                    0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                          0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                       0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                        0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                           0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                    0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                       0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                            0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                       0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                       0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                              0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                         0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                      0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                            0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                         0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                            0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                             0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                      0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                     0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                        0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                      0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                  0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                   0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                        0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                        0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                         0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                    0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Windows\system32\taskhost.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                            0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                       0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                     0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                           0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                         0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                            0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                  0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                              0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                               0000000076da1790 5 bytes JMP 0000000076f003c0
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                            0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                               0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                    0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                   0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                            0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                         0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                               0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                            0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                             0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                         0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                            0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                 0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                            0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                            0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                   0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                              0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                           0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                 0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                              0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                 0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                  0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                           0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                          0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                             0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                           0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                       0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                        0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                             0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                             0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                              0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                         0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Windows\system32\Dwm.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                 0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                           0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                    0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                    0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                         0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                               0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                    0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                             0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                      0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                    0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                  0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                   0000000076da1790 5 bytes JMP 0000000076f003c0
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                   0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                        0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                       0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                             0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                   0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                 0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                    0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                             0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                     0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                       0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                  0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                               0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                     0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                  0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                     0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                      0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                               0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                              0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                 0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                               0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                           0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                            0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                 0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                 0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                  0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                             0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                     0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Windows\Explorer.EXE[2476] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                          0000000076b8eecd 1 byte [62]
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                   0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                            0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                            0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                 0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                       0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                            0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                     0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                        0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                              0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                            0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                          0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                           0000000076da1790 5 bytes JMP 0000000076f003c0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                        0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                           0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject               0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                        0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                     0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                           0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                        0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                         0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                            0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                     0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                        0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                             0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                        0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                        0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys               0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                          0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                       0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                             0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                          0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                             0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                              0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                       0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                      0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                         0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                       0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                   0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                    0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                         0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                         0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                          0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                     0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                             0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2748] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                  0000000076b8eecd 1 byte [62]
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort            0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                     0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                     0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx          0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                     0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory              0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                 0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                       0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                     0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                   0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                    0000000076da1790 5 bytes JMP 0000000076f003c0
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                 0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                    0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort         0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject        0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                 0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion              0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                    0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                 0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                  0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                     0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess              0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                 0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                      0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                 0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                 0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys        0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                   0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                      0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                   0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                      0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                       0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder               0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                  0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation            0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState             0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                  0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                  0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                   0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl              0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                      0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Program Files\Microsoft Security Client\msseces.exe[3032] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189           0000000076b8eecd 1 byte [62]
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort      0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject               0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess               0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx    0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess          0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection               0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory        0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject           0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                 0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent               0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection             0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread              0000000076da1790 5 bytes JMP 0000000076f003c0
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread           0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry              0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort   0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject  0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair           0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion        0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant              0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore           0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx            0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer               0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess        0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry           0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry           0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey           0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys  0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair             0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion          0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore             0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                 0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx          0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder         0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions            0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread          0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation      0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState       0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem            0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess            0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread             0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl        0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2988] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189     0000000076b8eecd 1 byte [62]
.text  C:\Programme\Razer\Naga\RazerNagaSysTray.exe[3116] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                     0000000075dca2ba 1 byte [62]
.text  C:\Program Files\AVAST Software\Avast\AvastUI.exe[3124] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                0000000075dca2ba 1 byte [62]
.text  C:\ProgrammeVirtualCloneDrive\VCDDaemon.exe[3144] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                      0000000075dca2ba 1 byte [62]
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                             0000000076da1360 5 bytes JMP 0000000076f00460
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                      0000000076da13b0 5 bytes JMP 0000000076f00450
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                      0000000076da1510 5 bytes JMP 0000000076f00370
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                           0000000076da1560 5 bytes JMP 0000000076f00470
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                 0000000076da1570 5 bytes JMP 0000000076f003e0
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                      0000000076da1620 5 bytes JMP 0000000076f00320
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                               0000000076da1650 5 bytes JMP 0000000076f003b0
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                  0000000076da1670 5 bytes JMP 0000000076f00390
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                        0000000076da16b0 5 bytes JMP 0000000076f002e0
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                      0000000076da1730 5 bytes JMP 0000000076f002d0
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                    0000000076da1750 5 bytes JMP 0000000076f00310
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                     0000000076da1790 5 bytes JMP 0000000076f003c0
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                  0000000076da17e0 5 bytes JMP 0000000076f003f0
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                     0000000076da1940 5 bytes JMP 0000000076f00230
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                          0000000076da1b00 5 bytes JMP 0000000076f00480
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                         0000000076da1b30 5 bytes JMP 0000000076f003a0
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                  0000000076da1c10 5 bytes JMP 0000000076f002f0
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                               0000000076da1c20 5 bytes JMP 0000000076f00350
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                     0000000076da1c80 5 bytes JMP 0000000076f00290
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                  0000000076da1d10 5 bytes JMP 0000000076f002b0
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                   0000000076da1d30 5 bytes JMP 0000000076f003d0
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                      0000000076da1d40 5 bytes JMP 0000000076f00330
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                               0000000076da1db0 5 bytes JMP 0000000076f00410
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                  0000000076da1de0 5 bytes JMP 0000000076f00240
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                       0000000076da20a0 5 bytes JMP 0000000076f001e0
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                  0000000076da2160 5 bytes JMP 0000000076f00250
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                  0000000076da2190 5 bytes JMP 0000000076f00490
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                         0000000076da21a0 5 bytes JMP 0000000076f004a0
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                    0000000076da21d0 5 bytes JMP 0000000076f00300
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                 0000000076da21e0 5 bytes JMP 0000000076f00360
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                       0000000076da2240 5 bytes JMP 0000000076f002a0
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                    0000000076da2290 5 bytes JMP 0000000076f002c0
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                       0000000076da22c0 5 bytes JMP 0000000076f00380
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                        0000000076da22d0 5 bytes JMP 0000000076f00340
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                 0000000076da25c0 5 bytes JMP 0000000076f00440
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                0000000076da27c0 5 bytes JMP 0000000076f00260
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                   0000000076da27d0 5 bytes JMP 0000000076f00270
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                 0000000076da27e0 5 bytes JMP 0000000076f00400
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                             0000000076da29a0 5 bytes JMP 0000000076f001f0
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                              0000000076da29b0 5 bytes JMP 0000000076f00210
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                   0000000076da2a20 5 bytes JMP 0000000076f00200
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                   0000000076da2a80 5 bytes JMP 0000000076f00420
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                    0000000076da2a90 5 bytes JMP 0000000076f00430
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                               0000000076da2aa0 5 bytes JMP 0000000076f00220
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                       0000000076da2b80 5 bytes JMP 0000000076f00280
.text  C:\Windows\system32\SearchIndexer.exe[3244] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                            0000000076b8eecd 1 byte [62]
.text  C:\Users\Raubtier\Desktop\gmer_2.1.19163.exe[2536] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                     0000000075dca2ba 1 byte [62]

---- EOF - GMER 2.1 ----
         
Die GMER text musste ich aufteilen in 2 posts. Hier noch die defogger log:

Code:
ATTFilter
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:21 on 11/01/2014 (Raubtier)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed

Checking for services/drivers...


-=E.O.F=-
         
Hoffentlich hab ich nichts vergessen. Vielen Dank.

LG


Alt 12.01.2014, 08:39   #6
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool? - Standard

Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?



Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!
Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.
__________________
--> Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?

Alt 12.01.2014, 13:58   #7
B3AM3R
 
Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool? - Standard

Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?



Hallo Schrauber,

erstmal Danke für Deine Antwort. Ich konnte es mir ja nicht nehmen lassen, die halbe Nacht an meinem Rechner rumzuspielen. Habe Scans probiert, habe die Registry und auch mein System mal durchforstet. Ich habe mein System, also c: Ende Dezember mit win 7 neu aufgesetzt, also können dort ja auch nur Dateien mit einem Datum von frühestens 29.12.`13 glaube ich sein. Da sind aber auch ältere und merkwürdige Einträge. Als ob ich auf einem emulierten System arbeite und parrallel versteckt noch ein zweites läuft. Ich bin da nicht so versiert und das sind nur wage Vermutungen, aber ich bin doch nicht doof, irgendwas ist da doch.
Hier jetzt die combofix für Dich:

Code:
ATTFilter
ComboFix 14-01-08.03 - Raubtier 12.01.2014  13:36:19.1.4 - x64
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1031.18.8173.6028 [GMT 1:00]
ausgeführt von:: c:\users\Raubtier\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-12-12 bis 2014-01-12  ))))))))))))))))))))))))))))))
.
.
2014-01-12 12:40 . 2014-01-12 12:40	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-01-11 23:13 . 2014-01-11 23:13	82744	----a-w-	c:\windows\system32\drivers\aswStm.sys
2014-01-11 23:13 . 2014-01-11 23:13	207904	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2014-01-11 23:13 . 2014-01-11 23:13	65776	----a-w-	c:\windows\system32\drivers\aswRvrt.sys
2014-01-11 23:13 . 2014-01-11 23:13	1034464	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2014-01-11 23:13 . 2014-01-11 23:13	78648	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2014-01-11 23:13 . 2014-01-11 23:13	422216	----a-w-	c:\windows\system32\drivers\aswSP.sys
2014-01-11 23:13 . 2014-01-11 23:13	92544	----a-w-	c:\windows\system32\drivers\aswRdr2.sys
2014-01-11 23:13 . 2014-01-11 23:13	334136	----a-w-	c:\windows\system32\aswBoot.exe
2014-01-11 23:13 . 2014-01-11 23:13	43152	----a-w-	c:\windows\avastSS.scr
2014-01-11 22:44 . 2014-01-11 22:44	--------	d-----w-	C:\Temp
2014-01-11 17:01 . 2009-06-18 11:54	6144	------w-	c:\windows\system32\535E.tmp
2014-01-11 12:22 . 2014-01-11 12:22	--------	d-----w-	C:\FRST
2014-01-11 11:47 . 2014-01-11 11:47	--------	d-----w-	c:\program files (x86)\Sophos
2014-01-11 01:07 . 2014-01-11 01:07	--------	d-----w-	c:\program files\AVAST Software
2014-01-11 01:07 . 2014-01-11 01:07	--------	d-----w-	c:\programdata\AVAST Software
2014-01-10 21:13 . 2013-12-03 18:28	10315576	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A33A6787-DD79-4F95-875E-3F3EBB942972}\mpengine.dll
2014-01-10 21:01 . 2013-12-03 18:28	10315576	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-01-07 11:56 . 2014-01-07 11:56	--------	d-----w-	c:\program files (x86)\Microsoft SQL Server Compact Edition
2014-01-07 11:55 . 2014-01-07 11:55	--------	d-----w-	c:\windows\PCHEALTH
2014-01-07 11:55 . 2014-01-10 21:00	--------	d-----w-	c:\program files (x86)\Windows Live
2014-01-07 11:51 . 2014-01-07 11:51	--------	d-----w-	c:\programdata\Microsoft SkyDrive
2014-01-07 11:50 . 2014-01-07 11:50	--------	d-----w-	c:\program files (x86)\Common Files\Windows Live
2014-01-06 23:57 . 2014-01-06 23:57	--------	d-----w-	c:\program files\Usenet.nl
2014-01-03 20:18 . 2014-01-03 20:18	--------	d-----w-	c:\programdata\Malwarebytes
2014-01-03 20:18 . 2014-01-11 20:27	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2014-01-03 20:18 . 2013-04-04 13:50	25928	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-01-01 21:35 . 2014-01-01 21:35	--------	d-----w-	c:\program files\Microsoft Xbox 360 Accessories
2014-01-01 20:17 . 2014-01-01 20:17	--------	d-----r-	c:\program files (x86)\Skype
2014-01-01 20:17 . 2014-01-01 20:17	--------	d-----w-	c:\program files (x86)\Common Files\Skype
2014-01-01 20:17 . 2014-01-01 20:18	--------	d-----w-	c:\programdata\Skype
2013-12-30 18:28 . 2014-01-07 11:49	--------	d-----w-	c:\program files\HDDGURU LLF Tool
2013-12-30 11:34 . 2013-12-30 11:35	--------	d-----w-	c:\program files\Data Lifeguard Diagnostic for Windows
2013-12-30 05:35 . 2013-11-26 09:41	2764288	----a-w-	c:\windows\system32\iertutil.dll
2013-12-30 05:28 . 2012-08-07 07:09	88832	----a-w-	c:\windows\system32\drivers\EtronXHCI.sys
2013-12-30 05:28 . 2012-08-07 07:09	65152	----a-w-	c:\windows\system32\drivers\EtronHub3.sys
2013-12-30 05:28 . 2013-12-30 05:28	--------	d-----w-	c:\program files (x86)\Etron Technology
2013-12-30 05:20 . 2013-12-30 05:20	--------	d-----w-	c:\windows\Migration
2013-12-30 05:19 . 2013-10-14 17:00	28368	----a-w-	c:\windows\system32\IEUDINIT.EXE
2013-12-30 05:02 . 2010-02-23 08:16	294912	----a-w-	c:\windows\system32\browserchoice.exe
2013-12-30 04:53 . 2013-10-12 02:32	150016	----a-w-	c:\windows\system32\wshom.ocx
2013-12-30 04:53 . 2013-10-12 02:04	121856	----a-w-	c:\windows\SysWow64\wshom.ocx
2013-12-30 04:53 . 2013-10-12 02:31	202752	----a-w-	c:\windows\system32\scrrun.dll
2013-12-30 04:53 . 2013-10-12 02:03	163840	----a-w-	c:\windows\SysWow64\scrrun.dll
2013-12-30 04:53 . 2013-10-12 01:33	156160	----a-w-	c:\windows\system32\cscript.exe
2013-12-30 04:53 . 2013-10-12 01:33	168960	----a-w-	c:\windows\system32\wscript.exe
2013-12-30 04:53 . 2013-10-12 01:15	141824	----a-w-	c:\windows\SysWow64\wscript.exe
2013-12-30 04:53 . 2013-10-12 01:15	126976	----a-w-	c:\windows\SysWow64\cscript.exe
2013-12-30 04:53 . 2013-10-12 02:30	830464	----a-w-	c:\windows\system32\nshwfp.dll
2013-12-30 04:53 . 2013-10-12 02:29	859648	----a-w-	c:\windows\system32\IKEEXT.DLL
2013-12-30 04:53 . 2013-10-12 02:29	324096	----a-w-	c:\windows\system32\FWPUCLNT.DLL
2013-12-30 04:53 . 2013-10-12 02:03	656896	----a-w-	c:\windows\SysWow64\nshwfp.dll
2013-12-30 04:53 . 2013-10-12 02:01	216576	----a-w-	c:\windows\SysWow64\FWPUCLNT.DLL
2013-12-30 04:49 . 2012-06-02 22:19	2428952	----a-w-	c:\windows\system32\wuaueng.dll
2013-12-30 04:49 . 2012-06-02 22:19	57880	----a-w-	c:\windows\system32\wuauclt.exe
2013-12-30 04:49 . 2012-06-02 22:19	44056	----a-w-	c:\windows\system32\wups2.dll
2013-12-30 04:49 . 2012-06-02 22:15	2622464	----a-w-	c:\windows\system32\wucltux.dll
2013-12-30 04:49 . 2012-06-02 22:19	38424	----a-w-	c:\windows\system32\wups.dll
2013-12-30 04:49 . 2012-06-02 22:19	701976	----a-w-	c:\windows\system32\wuapi.dll
2013-12-30 04:49 . 2012-06-02 22:15	99840	----a-w-	c:\windows\system32\wudriver.dll
2013-12-30 04:49 . 2012-06-02 14:19	186752	----a-w-	c:\windows\system32\wuwebv.dll
2013-12-30 04:49 . 2012-06-02 14:15	36864	----a-w-	c:\windows\system32\wuapp.exe
2013-12-29 21:28 . 2013-12-30 05:40	--------	d-----w-	c:\program files\Microsoft Silverlight
2013-12-29 21:28 . 2013-12-30 05:40	--------	d-----w-	c:\program files (x86)\Microsoft Silverlight
2013-12-29 21:25 . 2013-12-30 04:56	--------	d-----w-	c:\windows\system32\MRT
2013-12-29 19:26 . 2014-01-07 11:48	--------	d-----w-	c:\program files\CheckDrive
2013-12-29 15:14 . 2013-12-29 15:14	--------	d-----w-	c:\programdata\Steam
2013-12-29 15:04 . 2013-12-29 15:04	--------	d--h--w-	c:\program files (x86)\Common Files\EAInstaller
2013-12-29 15:04 . 2014-01-01 11:27	--------	d-----w-	c:\program files (x86)\Battlelog Web Plugins
2013-12-29 15:04 . 2014-01-01 21:17	214392	----a-w-	c:\windows\SysWow64\PnkBstrB.exe
2013-12-29 15:04 . 2014-01-01 21:02	214392	----a-w-	c:\windows\SysWow64\PnkBstrB.ex0
2013-12-29 15:04 . 2013-12-29 15:04	76888	----a-w-	c:\windows\SysWow64\PnkBstrA.exe
2013-12-29 14:29 . 2013-12-29 14:29	283064	----a-w-	c:\windows\system32\drivers\dtsoftbus01.sys
2013-12-29 14:29 . 2013-12-29 14:29	--------	d-----w-	c:\program files\DAEMON Tools Lite
2013-12-29 14:28 . 2013-12-29 14:54	--------	d-----w-	c:\programdata\DAEMON Tools Lite
2013-12-29 12:09 . 2013-12-29 12:09	70304	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-12-29 12:09 . 2013-12-29 12:09	419488	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-12-29 12:09 . 2013-12-29 12:09	--------	d-----w-	c:\windows\SysWow64\Macromed
2013-12-29 12:09 . 2013-12-29 12:09	--------	d-----w-	c:\programdata\Yahoo!
2013-12-29 12:09 . 2013-12-29 12:09	--------	d-----w-	c:\program files\Messenger
2013-12-29 12:07 . 2013-12-29 12:09	--------	d-----w-	c:\program files (x86)\Yahoo!
2013-12-29 12:05 . 2013-12-30 04:35	--------	d-----w-	c:\programdata\Razer
2013-12-29 12:02 . 2013-12-29 12:05	--------	d-----w-	c:\program files (x86)\Razer
2013-12-29 12:02 . 2013-12-29 12:02	--------	d-----w-	c:\program files\Razer
2013-12-29 11:57 . 2013-12-29 11:57	--------	d-----w-	c:\program files\TeamSpeak 3 Client
2013-12-29 11:49 . 2013-12-29 11:51	--------	d-----w-	c:\program files (x86)\Google
2013-12-29 11:30 . 2013-12-29 11:30	--------	d-----w-	c:\programdata\ATI
2013-12-29 11:29 . 2013-12-29 11:29	0	----a-w-	c:\windows\ativpsrm.bin
2013-12-29 11:21 . 2014-01-10 21:00	--------	d-----w-	c:\program files (x86)\Common Files\Steam
2013-12-29 11:21 . 2014-01-10 21:00	--------	d-----w-	c:\program files\Steam
2013-12-29 11:21 . 2013-12-30 20:30	--------	d-----w-	c:\programdata\Origin
2013-12-29 11:21 . 2013-12-29 20:06	--------	d-----w-	c:\programdata\Electronic Arts
2013-12-29 11:20 . 2014-01-06 17:59	--------	d-----w-	c:\program files\Origin
2013-12-29 11:18 . 2013-12-29 11:18	--------	d-----w-	c:\program files\VLC
2013-12-29 11:17 . 2013-12-29 11:19	--------	d-----w-	c:\program files\WinRAR
2013-12-29 11:14 . 2013-12-29 11:14	965000	------w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{DA292B97-484F-4413-933C-B43DD988705D}\gapaengine.dll
2013-12-29 11:13 . 2013-12-29 11:13	--------	d-----w-	c:\program files (x86)\AMD APP
2013-12-29 11:13 . 2012-03-30 14:49	56448	----a-w-	c:\windows\system32\drivers\usbfilter.sys
2013-12-29 11:13 . 2013-12-29 11:13	--------	dc----w-	c:\windows\system32\DRVSTORE
2013-12-29 11:12 . 2013-12-29 11:12	--------	d-----w-	c:\program files (x86)\Microsoft Security Client
2013-12-29 11:12 . 2013-12-29 11:13	--------	d-----w-	c:\program files\Microsoft Security Client
2013-12-29 11:08 . 2011-09-29 09:30	74272	----a-w-	c:\windows\system32\RtNicProp64.dll
2013-12-29 11:08 . 2011-09-29 09:30	646248	----a-w-	c:\windows\system32\drivers\Rt64win7.sys
2013-12-29 11:08 . 2011-09-29 09:30	107552	----a-w-	c:\windows\system32\RTNUninst64.dll
2013-12-29 11:05 . 2013-12-29 11:05	--------	d-----w-	c:\program files\Common Files\ATI Technologies
2013-12-29 11:03 . 2013-12-29 15:04	--------	d-----w-	c:\programdata\Package Cache
2013-12-29 11:03 . 2013-12-29 11:03	--------	d-----w-	c:\program files\ATI
2013-12-29 11:02 . 2013-12-29 11:06	--------	d-----w-	c:\program files\AMD
2013-12-29 10:48 . 2013-12-29 10:48	--------	d-----w-	c:\program files (x86)\Microsoft.NET
2013-12-29 10:47 . 2014-01-10 21:00	--------	d-sh--w-	c:\windows\Installer
2013-12-29 10:39 . 2014-01-11 18:25	--------	d-----w-	c:\windows\Panther
2013-12-29 10:39 . 2014-01-11 22:44	--------	d-----w-	C:\Boot
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-06 15:49 . 2013-12-06 15:49	51200	----a-w-	c:\windows\system32\kdbsdk64.dll
2013-12-06 15:44 . 2013-12-06 15:44	38912	----a-w-	c:\windows\SysWow64\kdbsdk32.dll
2013-11-19 10:21 . 2010-11-21 03:27	267936	------w-	c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\programme\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2013-12-06 766208]
"Razer Naga Driver"="c:\programme\Razer\Naga\RazerNagaSysTray.exe" [2011-11-16 953232]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-01-11 3764024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe;c:\programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AODDriver4.2.0;AODDriver4.2.0;c:\programme\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\programme\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys;c:\windows\SYSNATIVE\Drivers\EtronHub3.sys [x]
S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys;c:\windows\SYSNATIVE\Drivers\EtronXHCI.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 RzSynapse;Razer Driver;c:\windows\system32\DRIVERS\RzSynapse.sys;c:\windows\SYSNATIVE\DRIVERS\RzSynapse.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-12-29 11:51	1210320	----a-w-	c:\program files (x86)\Google\Chrome\Application\31.0.1650.63\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-01-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-29 12:09]
.
2014-01-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-12-29 11:49]
.
2014-01-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-12-29 11:49]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-01-11 23:13	287280	----a-w-	c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-06-11 12503184]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 1266912]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.2.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-Battlelog Web Plugins - c:\program files (x86)\Battlelog Web Plugins\uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-01-12  13:43:12
ComboFix-quarantined-files.txt  2014-01-12 12:43
.
Vor Suchlauf: 9 Verzeichnis(se), 99.185.618.944 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 99.062.714.368 Bytes frei
.
- - End Of File - - 742D59DC396B8A00B23587C0FEAD0AB6
A36C5E4F47E84449FF07ED3517B43A31
         
Gruß,

B3AM3R

Alt 13.01.2014, 10:13   #8
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool? - Standard

Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?



Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 14.01.2014, 06:07   #9
B3AM3R
 
Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool? - Standard

Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?



Moin, moin, Schrauber,

hier mal die logs:

Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.01.12.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Raubtier :: RAUBTIER-PC [Administrator]

Schutz: Aktiviert

13.01.2014 17:44:44
mbam-log-2014-01-13 (17-44-44).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|G:\|H:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM | P2P
Deaktivierte Suchlaufeinstellungen: 
Durchsuchte Objekte: 374013
Laufzeit: 36 Minute(n), 2 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         
Code:
ATTFilter
# AdwCleaner v3.017 - Bericht erstellt am 14/01/2014 um 05:18:36
# Aktualisiert 12/01/2014 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)
# Benutzername : Raubtier - RAUBTIER-PC
# Gestartet von : C:\Users\Raubtier\Desktop\adwcleaner.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Google Chrome v31.0.1650.63

[ Datei : C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [665 octets] - [14/01/2014 05:18:36]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [724 octets] ##########
         
Code:
ATTFilter
# AdwCleaner v3.017 - Bericht erstellt am 14/01/2014 um 05:22:18
# Aktualisiert 12/01/2014 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)
# Benutzername : Raubtier - RAUBTIER-PC
# Gestartet von : C:\Users\Raubtier\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Google Chrome v31.0.1650.63

[ Datei : C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [803 octets] - [14/01/2014 05:18:36]
AdwCleaner[S0].txt - [725 octets] - [14/01/2014 05:22:18]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [784 octets] ##########
         
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Ultimate x64
Ran by Raubtier on 14.01.2014 at  5:28:04,12
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 14.01.2014 at  5:33:46,76
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         
Sag mal, bin ich nur paranoid und meine 2 Kerne sind tatsächlich kaputt oder ist da irgendwas? Process Explorer hat mir immer 4 Kerne angezeigt, jetzt nur noch zwei. Im System sagt er mir 2 logische, 2 virtuelle Kerne oder ähnlich. Ressourcenmonitor sagte 2 sind geparkt, habe aber 2 Microsoft updates installiert, die dies jetzt verhindern. Trotzdem nur 2 Kerne. Jedoch arbeiten laut Taskmanager, Leistung, alle 4 Kerne. Ich habe ein paar Bilder von fragwürdigen Windows Updates gemacht. Die kann ich dir aber erst heut Abend posten. Sonst komm ich zu spät zur Arbeit.

Vielen Dank an Dich und einen schönen Tach jewünscht.

LG B3AM3R

Alt 14.01.2014, 15:24   #10
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool? - Standard

Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?



dann warte ich mal auf die Bilder
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 14.01.2014, 17:16   #11
B3AM3R
 
Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool? - Standard

Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?



Hallo Schrauber,

hier die Bilder von denen ich geschrieben habe. Warum steht bei manchen Microsoft Corporation und bei manchen nicht? Und wie geht das, das ich am 29.12.´13 mein System neu gemacht habe und ich n Update von 2010 habe. Ich hatte auch viele ältere Registry-Einträge von 2010 und 2011, sogar 2006 gefunden gehabt. CCleaner hat aber ziemlich viele davon entfernt gehabt. Auch komisch: Das Update vom 21.11.2010 erscheint nicht in meinem Updateverlauf, jedoch in der Liste der installierten Updates.

Ich hoffe ich habe das mit den Bildern richtig gemacht.

Lieben Gruß

B3AM3R

Name:  Unbenannt.PNG
Hits: 301
Größe:  13,8 KB

Name:  Unbenannt1.PNG
Hits: 268
Größe:  6,8 KB

Name:  Unbenannt2.PNG
Hits: 299
Größe:  11,2 KB

Name:  Unbenannt3.PNG
Hits: 287
Größe:  6,2 KB

Geändert von B3AM3R (14.01.2014 um 17:24 Uhr)

Alt 14.01.2014, 21:31   #12
B3AM3R
 
Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool? - Standard

Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?



Die frst Log hab ich total vergessen. Hier noch nachträglich. Sry.


FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-01-2014 02
Ran by Raubtier (administrator) on RAUBTIER-PC on 14-01-2014 21:25:55
Running from C:\Users\Raubtier\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official downoad link fo FRST:
Farbar Recovery Scan Tool Download Link Download Now 32-Bit Version 
Farbar Recovery Scan Tool Download Link Download Now 32-Bit Version 
Any other download link is unpermitted or outdated.
The tutorial for FRST can be find here: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Razer USA Ltd) C:\Programme\Razer\Naga\RazerNagaSysTray.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Advanced Micro Devices Inc.) C:\Programme\AMD\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Programme\AMD\ATI.ACE\Core-Static\CCC.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [StartCCC] - C:\Programme\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Razer Naga Driver] - C:\Programme\Razer\Naga\RazerNagaSysTray.exe [953232 2011-11-16] (Razer USA Ltd)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3764024 2014-01-12] (AVAST Software)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE05729FF8B04CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome: 
=======
CHR HomePage: 
CHR RestoreOnStartup: "hxxp://www.google.de/"
CHR Extension: (ProxTube) - C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek\1.2.7_0 [2014-01-03]
CHR Extension: (Google Drive) - C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0 [2013-12-29]
CHR Extension: (YouTube) - C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0 [2013-12-29]
CHR Extension: (Adblock Plus) - C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.7.2_0 [2013-12-29]
CHR Extension: (Google Search) - C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0 [2013-12-29]
CHR Extension: (AdBlock) - C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.16_0 [2013-12-29]
CHR Extension: () - C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\9.0.2011.70_0 [2014-01-11]
CHR Extension: (Google Wallet) - C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0 [2013-12-29]
CHR Extension: (Gmail) - C:\Users\Raubtier\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1 [2013-12-29]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-01-11]

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-01-12] (AVAST Software)
S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-12-29] ()

==================== Drivers (Whitelisted) ====================

R2 AODDriver4.2.0; C:\Programme\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2014-01-12] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2014-01-12] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-01-12] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1034464 2014-01-12] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422216 2014-01-12] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [79672 2014-01-12] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-01-12] ()
S1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-29] (Disc Soft Ltd)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 RzSynapse; C:\Windows\System32\DRIVERS\RzSynapse.sys [126464 2011-11-15] (Razer USA Ltd)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-14 21:21 - 2014-01-14 21:21 - 02076160 _____ (Farbar) C:\Users\Raubtier\Desktop\FRST64.exe
2014-01-14 05:33 - 2014-01-14 05:33 - 00000624 _____ C:\Users\Raubtier\Desktop\JRT.txt
2014-01-14 05:28 - 2014-01-14 05:28 - 00000000 ____D C:\Windows\ERUNT
2014-01-14 05:27 - 2014-01-14 05:27 - 01037068 _____ (Thisisu) C:\Users\Raubtier\Desktop\JRT (1).exe
2014-01-14 05:17 - 2014-01-14 05:22 - 00000000 ____D C:\AdwCleaner
2014-01-14 05:15 - 2014-01-14 05:15 - 01037068 _____ (Thisisu) C:\Users\Raubtier\Desktop\JRT.exe
2014-01-14 05:14 - 2014-01-14 05:14 - 01236282 _____ C:\Users\Raubtier\Desktop\adwcleaner.exe
2014-01-13 17:38 - 2014-01-14 17:56 - 00000000 ____D C:\Users\Raubtier\Desktop\Updates
2014-01-12 20:26 - 2011-11-24 08:17 - 00166912 _____ (Microsoft Corporation) C:\Windows\system32\powrprof.dll
2014-01-12 20:26 - 2011-11-24 07:22 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\powrprof.dll
2014-01-12 20:25 - 2014-01-12 20:25 - 00000000 ____D C:\Patch2
2014-01-12 20:25 - 2014-01-12 20:25 - 00000000 ____D C:\patch1
2014-01-12 20:24 - 2014-01-12 20:24 - 04693832 _____ C:\Users\Raubtier\Desktop\441065_intl_x64_zip.exe
2014-01-12 20:23 - 2014-01-12 20:24 - 00316912 _____ C:\Users\Raubtier\Desktop\441280_intl_x64_zip.exe
2014-01-12 17:03 - 2014-01-12 17:04 - 00000000 ____D C:\Users\Raubtier\Desktop\Prime95
2014-01-12 17:03 - 2014-01-12 17:03 - 04277073 _____ C:\Users\Raubtier\Desktop\p95v279.win32.zip
2014-01-12 14:25 - 2014-01-12 14:31 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-01-12 14:25 - 2014-01-12 14:25 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-01-12 14:24 - 2014-01-12 14:25 - 00000000 ____D C:\Users\Raubtier\Desktop\mbar
2014-01-12 14:24 - 2014-01-12 14:24 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Raubtier\Desktop\mbar-1.07.0.1008.exe
2014-01-12 14:17 - 2014-01-12 14:17 - 00000914 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-12 14:17 - 2014-01-12 14:17 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2014-01-12 14:17 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-12 14:13 - 2014-01-12 14:13 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Raubtier\Desktop\mbam-setup-1.75.0.1300.exe
2014-01-12 13:43 - 2014-01-12 13:43 - 00021244 _____ C:\ComboFix.txt
2014-01-12 13:35 - 2014-01-12 13:43 - 00000000 ____D C:\Qoobox
2014-01-12 13:35 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-12 13:35 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-12 13:35 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-12 13:35 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-12 13:35 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-12 13:35 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-12 13:35 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-12 13:35 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-12 13:34 - 2014-01-12 13:41 - 00000000 ____D C:\Windows\erdnt
2014-01-12 13:32 - 2014-01-12 13:32 - 05162489 ____R (Swearware) C:\Users\Raubtier\Desktop\ComboFix.exe
2014-01-12 00:13 - 2014-01-14 00:36 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2014-01-12 00:13 - 2014-01-12 14:16 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-01-12 00:13 - 2014-01-12 00:13 - 01034464 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-01-12 00:13 - 2014-01-12 00:13 - 00422216 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-01-12 00:13 - 2014-01-12 00:13 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-01-12 00:13 - 2014-01-12 00:13 - 00207904 _____ C:\Windows\system32\Drivers\aswVmm.sys
2014-01-12 00:13 - 2014-01-12 00:13 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-01-12 00:13 - 2014-01-12 00:13 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-01-12 00:13 - 2014-01-12 00:13 - 00065776 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2014-01-12 00:13 - 2014-01-12 00:13 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-01-12 00:13 - 2014-01-12 00:13 - 00001966 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-01-11 21:28 - 2014-01-11 21:28 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2014-01-11 18:34 - 2014-01-11 21:27 - 00000000 ____D C:\Users\Raubtier\Desktop\rootkit detektiv
2014-01-11 18:34 - 2014-01-11 17:56 - 01720705 _____ C:\Users\Raubtier\Desktop\McafeeRootkitDetective11.zip
2014-01-11 18:01 - 2009-06-18 12:54 - 00006144 ____N (Sophos Plc) C:\Windows\system32\535E.tmp
2014-01-11 17:59 - 2014-01-11 17:59 - 00000000 ____D C:\Users\Raubtier\Desktop\RootkitRevealer171
2014-01-11 14:00 - 2014-01-11 19:25 - 00000000 ____D C:\Windows\Minidump
2014-01-11 13:32 - 2014-01-11 13:32 - 00225630 _____ C:\Users\Raubtier\Desktop\Gmer.txt
2014-01-11 13:24 - 2014-01-14 21:26 - 00006989 _____ C:\Users\Raubtier\Desktop\FRST.txt
2014-01-11 13:22 - 2014-01-11 13:22 - 00000000 ____D C:\FRST
2014-01-11 13:21 - 2014-01-11 13:21 - 00000148 _____ C:\Users\Raubtier\defogger_reenable
2014-01-11 12:47 - 2014-01-11 12:47 - 00000000 ____D C:\Program Files (x86)\Sophos
2014-01-11 02:08 - 2014-01-11 02:08 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\AVAST Software
2014-01-11 02:07 - 2014-01-11 02:07 - 00000000 ____D C:\ProgramData\AVAST Software
2014-01-11 02:07 - 2014-01-11 02:07 - 00000000 ____D C:\Program Files\AVAST Software
2014-01-11 02:05 - 2014-01-11 02:06 - 91412976 _____ (AVAST Software) C:\Users\Raubtier\Desktop\avast_free_antivirus_setup.exe
2014-01-11 01:41 - 2014-01-11 01:41 - 04745728 _____ (AVAST Software) C:\Users\Raubtier\Desktop\aswMBR.exe
2014-01-11 01:28 - 2014-01-11 19:37 - 00050568 _____ C:\Users\Raubtier\Desktop\Extras.Txt
2014-01-11 01:27 - 2014-01-11 19:37 - 00217022 _____ C:\Users\Raubtier\Desktop\OTL.Txt
2014-01-11 01:23 - 2014-01-11 01:23 - 00602112 _____ (OldTimer Tools) C:\Users\Raubtier\Desktop\OTL.exe
2014-01-10 22:04 - 2014-01-10 22:04 - 00791552 _____ (AMD) C:\Users\Raubtier\Desktop\amddriverdownloader.exe
2014-01-10 21:40 - 2014-01-10 22:00 - 00000000 ____D C:\Users\Raubtier\Desktop\cpu-z-168
2014-01-10 21:38 - 2014-01-10 21:38 - 01994222 _____ C:\Users\Raubtier\Desktop\cpu-z-168.zip
2014-01-10 21:16 - 2014-01-10 21:16 - 00000010 _____ C:\csb.log
2014-01-07 20:43 - 2014-01-08 20:14 - 00000000 ____D C:\Users\Raubtier\Tracing
2014-01-07 12:56 - 2014-01-07 12:56 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2014-01-07 12:55 - 2014-01-10 22:00 - 00000000 ____D C:\Program Files (x86)\Windows Live
2014-01-07 12:55 - 2014-01-07 12:55 - 00000000 ____D C:\Windows\PCHEALTH
2014-01-07 12:51 - 2014-01-07 12:51 - 00000000 ____D C:\ProgramData\Microsoft SkyDrive
2014-01-07 12:50 - 2014-01-08 00:21 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Windows Live
2014-01-07 12:50 - 2014-01-07 12:50 - 01245168 _____ (Microsoft Corporation) C:\Users\Raubtier\Desktop\wlsetup-web.exe
2014-01-07 00:57 - 2014-01-10 01:01 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Usenet.nl
2014-01-07 00:57 - 2014-01-10 00:55 - 00000000 ____D C:\Users\Raubtier\Documents\Usenet.nl
2014-01-07 00:57 - 2014-01-07 00:57 - 07457256 _____ (                                                            ) C:\Users\Raubtier\Desktop\UsenetNLSetup.exe
2014-01-07 00:57 - 2014-01-07 00:57 - 00001682 _____ C:\Users\Raubtier\Desktop\Usenet.nl.lnk
2014-01-07 00:57 - 2014-01-07 00:57 - 00000000 ____D C:\Program Files\Usenet.nl
2014-01-03 21:18 - 2014-01-03 21:18 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Malwarebytes
2014-01-03 21:18 - 2014-01-03 21:18 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-02 23:15 - 2014-01-02 23:15 - 00000000 ____D C:\Users\Raubtier\Documents\WB Games
2014-01-02 23:11 - 2014-01-02 23:11 - 00001520 _____ C:\Users\Raubtier\Desktop\TheBureau.lnk
2014-01-02 23:11 - 2014-01-02 23:11 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\2K Sports
2014-01-02 23:10 - 2014-01-02 23:10 - 00001045 _____ C:\Users\Raubtier\Desktop\nba2k14.lnk
2014-01-02 23:09 - 2014-01-02 23:09 - 00001669 _____ C:\Users\Raubtier\Desktop\BatmanOrigins.lnk
2014-01-02 00:30 - 2014-01-07 00:39 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Microsoft Games
2014-01-01 22:35 - 2014-01-01 22:35 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_xusb21_01009.Wdf
2014-01-01 22:35 - 2014-01-01 22:35 - 00000000 ____D C:\Program Files\Microsoft Xbox 360 Accessories
2014-01-01 21:18 - 2014-01-10 22:00 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Skype
2014-01-01 21:17 - 2014-01-01 21:18 - 00000000 ____D C:\ProgramData\Skype
2014-01-01 21:17 - 2014-01-01 21:17 - 00002699 _____ C:\Users\Public\Desktop\Skype.lnk
2014-01-01 21:17 - 2014-01-01 21:17 - 00000000 ___RD C:\Program Files (x86)\Skype
2014-01-01 20:53 - 2014-01-01 22:52 - 00000000 ____D C:\Users\Raubtier\AppData\Local\ESN Sonar
2014-01-01 03:02 - 2014-01-01 03:02 - 00000857 _____ C:\Users\Raubtier\Desktop\Yahoo! Messenger.lnk
2013-12-31 01:25 - 2014-01-07 01:48 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\vlc
2013-12-31 01:07 - 2013-12-31 01:07 - 00000000 ____D C:\Windows\System32\Tasks\Games
2013-12-30 23:09 - 2014-01-14 21:19 - 00007607 _____ C:\Users\Raubtier\AppData\Local\Resmon.ResmonCfg
2013-12-30 22:20 - 2014-01-11 21:27 - 00000000 ____D C:\Windows\pss
2013-12-30 20:47 - 2014-01-14 21:19 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\TS3Client
2013-12-30 19:29 - 2013-12-30 19:29 - 00000001 _____ C:\Users\Raubtier\AppData\Local\llftool.4.30.agreement
2013-12-30 19:28 - 2014-01-07 12:49 - 00000000 ____D C:\Program Files\HDDGURU LLF Tool
2013-12-30 12:34 - 2013-12-30 12:35 - 00000000 ____D C:\Program Files\Data Lifeguard Diagnostic for Windows
2013-12-30 11:02 - 2014-01-07 12:48 - 00000000 ____D C:\Windows\System32\Tasks\Abelssoft
2013-12-30 06:36 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-30 06:36 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-30 06:36 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-30 06:36 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-30 06:36 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-30 06:36 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-30 06:36 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-30 06:36 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-30 06:36 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-30 06:36 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-30 06:36 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-30 06:36 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-30 06:36 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-30 06:36 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-30 06:36 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-30 06:36 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-30 06:36 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-30 06:36 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-30 06:35 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-30 06:35 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-30 06:35 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-30 06:35 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-30 06:35 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-30 06:35 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-30 06:35 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-30 06:35 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-30 06:35 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-30 06:35 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-30 06:35 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-30 06:35 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-30 06:35 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-30 06:28 - 2013-12-30 06:28 - 00000000 ____D C:\Program Files (x86)\Etron Technology
2013-12-30 06:28 - 2012-08-07 08:09 - 00088832 _____ (Etron Technology Inc) C:\Windows\system32\Drivers\EtronXHCI.sys
2013-12-30 06:28 - 2012-08-07 08:09 - 00065152 _____ (Etron Technology Inc) C:\Windows\system32\Drivers\EtronHub3.sys
2013-12-30 06:19 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2013-12-30 06:15 - 2013-12-30 06:15 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-12-30 06:15 - 2013-12-30 06:15 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-30 06:15 - 2013-12-30 06:15 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-30 06:15 - 2013-12-30 06:15 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-12-30 06:15 - 2013-12-30 06:15 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-30 06:15 - 2013-12-30 06:15 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-12-30 06:15 - 2013-12-30 06:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-12-30 06:02 - 2010-02-23 09:16 - 00294912 _____ (Microsoft Corporation) C:\Windows\system32\browserchoice.exe
2013-12-30 05:57 - 2013-12-30 06:19 - 00015952 _____ C:\Windows\IE11_main.log
2013-12-30 05:56 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-30 05:56 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-30 05:56 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-30 05:56 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-30 05:56 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-30 05:56 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-12-30 05:56 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-12-30 05:56 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-30 05:56 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-30 05:56 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-12-30 05:56 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-12-30 05:56 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-12-30 05:56 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-12-30 05:56 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-12-30 05:56 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-12-30 05:56 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-12-30 05:56 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-12-30 05:56 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-12-30 05:56 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-12-30 05:56 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-12-30 05:56 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-12-30 05:56 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-12-30 05:56 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-12-30 05:56 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-12-30 05:56 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-12-30 05:56 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-12-30 05:56 - 2011-04-09 07:58 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2013-12-30 05:56 - 2011-04-09 06:56 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2013-12-30 05:54 - 2013-12-01 14:42 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-30 05:53 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-30 05:53 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-30 05:53 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-12-30 05:53 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-12-30 05:53 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-12-30 05:53 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-30 05:53 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-12-30 05:53 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-30 05:53 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-12-30 05:53 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-30 05:53 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-30 05:53 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-30 05:53 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-30 05:49 - 2012-06-02 23:19 - 02428952 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2013-12-30 05:49 - 2012-06-02 23:19 - 00701976 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2013-12-30 05:49 - 2012-06-02 23:19 - 00057880 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2013-12-30 05:49 - 2012-06-02 23:19 - 00044056 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2013-12-30 05:49 - 2012-06-02 23:19 - 00038424 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2013-12-30 05:49 - 2012-06-02 23:15 - 02622464 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2013-12-30 05:49 - 2012-06-02 23:15 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2013-12-30 05:49 - 2012-06-02 15:19 - 00186752 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2013-12-30 05:49 - 2012-06-02 15:15 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2013-12-29 23:36 - 2013-12-29 23:37 - 00000000 ____D C:\Windows\System32\Tasks\Aufgaben der Ereignisanzeige
2013-12-29 22:42 - 2014-01-11 19:25 - 00000000 ___DC C:\Users\Raubtier\AppData\Local\MigWiz
2013-12-29 22:28 - 2013-12-30 06:40 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-12-29 22:28 - 2013-12-30 06:40 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-12-29 22:25 - 2013-12-30 05:56 - 00000000 ____D C:\Windows\system32\MRT
2013-12-29 22:05 - 2013-12-29 22:05 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\WinRAR
2013-12-29 21:28 - 2013-12-29 21:28 - 00000000 ____D C:\Users\Raubtier\AppData\Local\PunkBuster
2013-12-29 21:06 - 2013-12-29 21:06 - 00000000 ____D C:\Users\Raubtier\Documents\Battlefield 4
2013-12-29 20:34 - 2013-12-29 20:34 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Razer
2013-12-29 20:26 - 2014-01-07 12:48 - 00000000 ____D C:\Program Files\CheckDrive
2013-12-29 20:26 - 2013-12-30 11:02 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Abelssoft
2013-12-29 20:15 - 2013-12-29 20:15 - 00000000 ____D C:\Users\Raubtier\AppData\Local\ESN
2013-12-29 16:14 - 2013-12-29 16:14 - 00000000 ____D C:\ProgramData\Steam
2013-12-29 16:04 - 2014-01-01 22:17 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2013-12-29 16:04 - 2014-01-01 22:02 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2013-12-29 16:04 - 2014-01-01 12:27 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins
2013-12-29 16:04 - 2013-12-29 16:04 - 00076888 _____ C:\Windows\SysWOW64\PnkBstrA.exe
2013-12-29 16:02 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2013-12-29 16:02 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2013-12-29 16:02 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2013-12-29 16:02 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2013-12-29 16:02 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2013-12-29 16:02 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2013-12-29 16:02 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2013-12-29 16:02 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2013-12-29 16:02 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2013-12-29 16:02 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2013-12-29 16:02 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2013-12-29 16:02 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2013-12-29 16:02 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2013-12-29 16:02 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2013-12-29 16:02 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2013-12-29 16:02 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2013-12-29 16:02 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2013-12-29 16:02 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2013-12-29 16:02 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2013-12-29 16:02 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2013-12-29 16:02 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2013-12-29 16:02 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2013-12-29 16:02 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2013-12-29 16:02 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2013-12-29 16:02 - 2009-09-04 17:44 - 00517960 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2013-12-29 16:02 - 2009-09-04 17:44 - 00515416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_5.dll
2013-12-29 16:02 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_5.dll
2013-12-29 16:02 - 2009-09-04 17:44 - 00176968 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2013-12-29 16:02 - 2009-09-04 17:44 - 00073544 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2013-12-29 16:02 - 2009-09-04 17:44 - 00069464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2013-12-29 16:02 - 2009-09-04 17:29 - 05554512 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2013-12-29 16:02 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_42.dll
2013-12-29 16:02 - 2009-09-04 17:29 - 02582888 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_42.dll
2013-12-29 16:02 - 2009-09-04 17:29 - 02475352 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_42.dll
2013-12-29 16:02 - 2009-09-04 17:29 - 01974616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_42.dll
2013-12-29 16:02 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_42.dll
2013-12-29 16:02 - 2009-09-04 17:29 - 00523088 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2013-12-29 16:02 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_42.dll
2013-12-29 16:02 - 2009-09-04 17:29 - 00285024 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2013-12-29 16:02 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_42.dll
2013-12-29 16:02 - 2009-03-16 14:18 - 00521560 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2013-12-29 16:02 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2013-12-29 16:02 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2013-12-29 16:02 - 2009-03-16 14:18 - 00174936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2013-12-29 16:02 - 2009-03-16 14:18 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2013-12-29 16:02 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2013-12-29 16:02 - 2009-03-09 15:27 - 05425496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2013-12-29 16:02 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_41.dll
2013-12-29 16:02 - 2009-03-09 15:27 - 02430312 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll
2013-12-29 16:02 - 2009-03-09 15:27 - 01846632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_41.dll
2013-12-29 16:02 - 2009-03-09 15:27 - 00520544 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2013-12-29 16:02 - 2009-03-09 15:27 - 00453456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_41.dll
2013-12-29 16:02 - 2008-10-27 10:04 - 00518480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2013-12-29 16:02 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_3.dll
2013-12-29 16:02 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_3.dll
2013-12-29 16:02 - 2008-10-27 10:04 - 00175440 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2013-12-29 16:02 - 2008-10-27 10:04 - 00074576 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2013-12-29 16:02 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_2.dll
2013-12-29 16:02 - 2008-10-27 10:04 - 00025936 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2013-12-29 16:02 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_5.dll
2013-12-29 16:02 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2013-12-29 16:02 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2013-12-29 16:02 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2013-12-29 16:02 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2013-12-29 16:02 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2013-12-29 16:02 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2013-12-29 16:02 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_2.dll
2013-12-29 16:02 - 2008-07-31 10:41 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2013-12-29 16:02 - 2008-07-31 10:41 - 00072200 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2013-12-29 16:02 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_1.dll
2013-12-29 16:02 - 2008-07-31 10:40 - 00513544 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2013-12-29 16:02 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_2.dll
2013-12-29 16:02 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2013-12-29 16:02 - 2008-07-10 11:00 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2013-12-29 16:02 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2013-12-29 16:02 - 2008-07-10 11:00 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2013-12-29 16:02 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2013-12-29 16:02 - 2008-07-10 11:00 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2013-12-29 16:02 - 2008-05-30 14:19 - 00511496 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2013-12-29 16:02 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_1.dll
2013-12-29 16:02 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_1.dll
2013-12-29 16:02 - 2008-05-30 14:18 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2013-12-29 16:02 - 2008-05-30 14:17 - 00068104 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2013-12-29 16:02 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_0.dll
2013-12-29 16:02 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_4.dll
2013-12-29 16:02 - 2008-05-30 14:16 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2013-12-29 16:02 - 2008-05-30 14:11 - 04991496 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2013-12-29 16:02 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_38.dll
2013-12-29 16:02 - 2008-05-30 14:11 - 01941528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2013-12-29 16:02 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_38.dll
2013-12-29 16:02 - 2008-05-30 14:11 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2013-12-29 16:02 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_38.dll
2013-12-29 16:02 - 2008-03-05 16:04 - 00489480 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2013-12-29 16:02 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_0.dll
2013-12-29 16:02 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_0.dll
2013-12-29 16:02 - 2008-03-05 16:03 - 00177672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2013-12-29 16:02 - 2008-03-05 16:00 - 00028168 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2013-12-29 16:02 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_3.dll
2013-12-29 16:02 - 2008-03-05 15:56 - 04910088 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2013-12-29 16:02 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_37.dll
2013-12-29 16:02 - 2008-03-05 15:56 - 01860120 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2013-12-29 16:02 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_37.dll
2013-12-29 16:02 - 2008-02-05 23:07 - 00529424 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2013-12-29 16:02 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_37.dll
2013-12-29 16:02 - 2007-10-22 03:40 - 00411656 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2013-12-29 16:02 - 2007-10-22 03:39 - 00267272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_10.dll
2013-12-29 16:02 - 2007-10-22 03:37 - 00021000 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2013-12-29 16:02 - 2007-10-22 03:37 - 00017928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_2.dll
2013-12-29 16:02 - 2007-10-12 15:14 - 05081608 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll
2013-12-29 16:02 - 2007-10-12 15:14 - 03734536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_36.dll
2013-12-29 16:02 - 2007-10-12 15:14 - 02006552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2013-12-29 16:02 - 2007-10-12 15:14 - 01374232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_36.dll
2013-12-29 16:02 - 2007-10-02 09:56 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2013-12-29 16:02 - 2007-10-02 09:56 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_36.dll
2013-12-29 16:02 - 2007-07-20 00:57 - 00411496 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll
2013-12-29 16:02 - 2007-07-20 00:57 - 00267112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_9.dll
2013-12-29 16:02 - 2007-07-19 18:14 - 05073256 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2013-12-29 16:02 - 2007-07-19 18:14 - 03727720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_35.dll
2013-12-29 16:02 - 2007-07-19 18:14 - 01985904 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll
2013-12-29 16:02 - 2007-07-19 18:14 - 01358192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_35.dll
2013-12-29 16:02 - 2007-07-19 18:14 - 00508264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll
2013-12-29 16:02 - 2007-07-19 18:14 - 00444776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_35.dll
2013-12-29 16:02 - 2007-06-20 20:49 - 00409960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2013-12-29 16:02 - 2007-06-20 20:46 - 00266088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_8.dll
2013-12-29 16:02 - 2007-05-16 16:45 - 04496232 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2013-12-29 16:02 - 2007-05-16 16:45 - 03497832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_34.dll
2013-12-29 16:02 - 2007-05-16 16:45 - 01401200 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2013-12-29 16:02 - 2007-05-16 16:45 - 01124720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_34.dll
2013-12-29 16:02 - 2007-05-16 16:45 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2013-12-29 16:02 - 2007-05-16 16:45 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_34.dll
2013-12-29 16:02 - 2007-04-04 18:55 - 00403304 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2013-12-29 16:02 - 2007-04-04 18:55 - 00261480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_7.dll
2013-12-29 16:02 - 2007-04-04 18:54 - 00107368 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2013-12-29 16:02 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2013-12-29 16:02 - 2007-03-15 16:57 - 00506728 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2013-12-29 16:02 - 2007-03-15 16:57 - 00443752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_33.dll
2013-12-29 16:02 - 2007-03-12 16:42 - 04494184 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2013-12-29 16:02 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2013-12-29 16:02 - 2007-03-12 16:42 - 01400176 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2013-12-29 16:02 - 2007-03-12 16:42 - 01123696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_33.dll
2013-12-29 16:02 - 2007-03-05 12:42 - 00017688 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2013-12-29 16:02 - 2007-03-05 12:42 - 00015128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_1.dll
2013-12-29 16:02 - 2007-01-24 15:27 - 00393576 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2013-12-29 16:02 - 2007-01-24 15:27 - 00255848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_6.dll
2013-12-29 16:02 - 2006-12-08 12:02 - 00251672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_5.dll
2013-12-29 16:02 - 2006-12-08 12:00 - 00390424 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2013-12-29 16:02 - 2006-11-29 13:06 - 04398360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2013-12-29 16:02 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_32.dll
2013-12-29 16:02 - 2006-11-29 13:06 - 00469264 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2013-12-29 16:02 - 2006-11-29 13:06 - 00440080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10.dll
2013-12-29 16:02 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2013-12-29 16:02 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2013-12-29 16:02 - 2006-09-28 16:05 - 00237848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_4.dll
2013-12-29 16:02 - 2006-09-28 16:04 - 00364824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2013-12-29 16:02 - 2006-07-28 09:31 - 00083736 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2013-12-29 16:02 - 2006-07-28 09:30 - 00363288 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2013-12-29 16:02 - 2006-07-28 09:30 - 00236824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_3.dll
2013-12-29 16:02 - 2006-07-28 09:30 - 00062744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_2.dll
2013-12-29 16:01 - 2014-01-02 23:02 - 00074987 _____ C:\Windows\DirectX.log
2013-12-29 16:01 - 2006-05-31 07:24 - 00230168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_2.dll
2013-12-29 16:01 - 2006-05-31 07:22 - 00354072 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2013-12-29 16:01 - 2006-03-31 12:41 - 03927248 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2013-12-29 16:01 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_30.dll
2013-12-29 16:01 - 2006-03-31 12:40 - 00352464 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2013-12-29 16:01 - 2006-03-31 12:39 - 00229584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_1.dll
2013-12-29 16:01 - 2006-03-31 12:39 - 00083664 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2013-12-29 16:01 - 2006-03-31 12:39 - 00062672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_1.dll
2013-12-29 16:01 - 2006-02-03 08:43 - 03830992 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2013-12-29 16:01 - 2006-02-03 08:43 - 02332368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_29.dll
2013-12-29 16:01 - 2006-02-03 08:42 - 00355536 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2013-12-29 16:01 - 2006-02-03 08:42 - 00230096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine2_0.dll
2013-12-29 16:01 - 2006-02-03 08:41 - 00016592 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2013-12-29 16:01 - 2006-02-03 08:41 - 00014032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\x3daudio1_0.dll
2013-12-29 16:01 - 2005-12-05 18:09 - 03815120 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2013-12-29 16:01 - 2005-12-05 18:09 - 02323664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_28.dll
2013-12-29 16:01 - 2005-07-22 19:59 - 03807440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2013-12-29 16:01 - 2005-07-22 19:59 - 02319568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_27.dll
2013-12-29 16:01 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2013-12-29 16:01 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll
2013-12-29 16:01 - 2005-03-18 17:19 - 03823312 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2013-12-29 16:01 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_25.dll
2013-12-29 16:01 - 2005-02-05 19:45 - 03544272 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2013-12-29 16:01 - 2005-02-05 19:45 - 02222800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_24.dll
2013-12-29 15:29 - 2014-01-11 21:27 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\DAEMON Tools Lite
2013-12-29 15:29 - 2013-12-29 15:29 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2013-12-29 15:29 - 2013-12-29 15:29 - 00000000 ____D C:\Program Files\DAEMON Tools Lite
2013-12-29 15:28 - 2013-12-29 15:54 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2013-12-29 13:11 - 2013-12-29 13:11 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Yahoo!
2013-12-29 13:10 - 2013-12-29 13:10 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Macromedia
2013-12-29 13:09 - 2014-01-14 20:52 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-29 13:09 - 2013-12-29 13:09 - 00419488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-29 13:09 - 2013-12-29 13:09 - 00070304 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-29 13:09 - 2013-12-29 13:09 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-29 13:09 - 2013-12-29 13:09 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2013-12-29 13:09 - 2013-12-29 13:09 - 00000000 ____D C:\ProgramData\Yahoo!
2013-12-29 13:09 - 2013-12-29 13:09 - 00000000 ____D C:\Program Files\Messenger
2013-12-29 13:07 - 2013-12-29 13:09 - 00000000 ____D C:\Program Files (x86)\Yahoo!
2013-12-29 13:07 - 2013-12-29 13:07 - 00444024 _____ (Yahoo! Inc.) C:\Users\Raubtier\Downloads\msgr11de.exe
2013-12-29 13:05 - 2013-12-30 05:35 - 00000000 ____D C:\ProgramData\Razer
2013-12-29 13:04 - 2013-12-29 13:05 - 13163200 _____ (Razer Inc.) C:\Users\Raubtier\Downloads\Razer_Synapse_Framework_V1.16.06.exe
2013-12-29 13:03 - 2013-12-29 13:03 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_RzSynapse_01007.Wdf
2013-12-29 13:02 - 2013-12-29 13:05 - 00000000 ____D C:\Program Files (x86)\Razer
2013-12-29 13:02 - 2013-12-29 13:03 - 00007312 _____ C:\Windows\DPINST.LOG
2013-12-29 13:02 - 2013-12-29 13:02 - 00000000 ____D C:\Program Files\Razer
2013-12-29 12:59 - 2013-12-29 13:00 - 40394840 _____ (Razer USA Ltd.                                               ) C:\Users\Raubtier\Downloads\Razer_NagaEpic_Driver_v3.03.exe
2013-12-29 12:57 - 2013-12-29 12:57 - 00000909 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2013-12-29 12:57 - 2013-12-29 12:57 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-12-29 12:55 - 2013-12-29 12:56 - 32520760 _____ (TeamSpeak Systems GmbH) C:\Users\Raubtier\Downloads\TeamSpeak3-Client-win64-3.0.13.1.exe
2013-12-29 12:49 - 2014-01-14 21:21 - 00001114 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-29 12:49 - 2014-01-14 20:42 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-29 12:49 - 2013-12-29 13:16 - 00004110 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-12-29 12:49 - 2013-12-29 13:16 - 00003858 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-12-29 12:49 - 2013-12-29 12:51 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Google
2013-12-29 12:49 - 2013-12-29 12:51 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-29 12:49 - 2013-12-29 12:49 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Deployment
2013-12-29 12:49 - 2013-12-29 12:49 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Apps\2.0
2013-12-29 12:30 - 2013-12-29 12:30 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\ATI
2013-12-29 12:30 - 2013-12-29 12:30 - 00000000 ____D C:\Users\Raubtier\AppData\Local\ATI
2013-12-29 12:30 - 2013-12-29 12:30 - 00000000 ____D C:\Users\Raubtier\AppData\Local\AMD
2013-12-29 12:30 - 2013-12-29 12:30 - 00000000 ____D C:\ProgramData\ATI
2013-12-29 12:29 - 2013-12-29 12:29 - 00000000 _____ C:\Windows\ativpsrm.bin
2013-12-29 12:23 - 2013-02-04 22:46 - 02738264 _____ (Sysinternals - www.sysinternals.com) C:\Users\Raubtier\Desktop\Process Explorer.exe
2013-12-29 12:22 - 2013-12-29 21:06 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Origin
2013-12-29 12:22 - 2013-12-29 12:36 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Origin
2013-12-29 12:21 - 2014-01-12 17:03 - 00000000 ____D C:\ProgramData\Origin
2013-12-29 12:21 - 2014-01-10 22:00 - 00000000 ____D C:\Program Files\Steam
2013-12-29 12:21 - 2013-12-29 21:06 - 00000000 ____D C:\ProgramData\Electronic Arts
2013-12-29 12:20 - 2014-01-14 20:46 - 00000000 ____D C:\Program Files\Origin
2013-12-29 12:19 - 2013-12-30 05:43 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-12-29 12:18 - 2014-01-11 23:12 - 00000000 ____D C:\ProgrammeVirtualCloneDrive
2013-12-29 12:18 - 2013-12-29 12:18 - 00000000 ____D C:\Program Files\VLC
2013-12-29 12:17 - 2013-12-29 12:19 - 00000000 ____D C:\Program Files\WinRAR
2013-12-29 12:13 - 2014-01-13 17:27 - 00001912 _____ C:\Windows\epplauncher.mif
2013-12-29 12:13 - 2013-12-30 05:46 - 00059296 _____ C:\Users\Raubtier\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-29 12:13 - 2013-12-29 12:13 - 00000000 ____D C:\Program Files (x86)\AMD APP
2013-12-29 12:13 - 2012-03-30 15:49 - 00056448 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\usbfilter.sys
2013-12-29 12:08 - 2011-09-29 10:30 - 00646248 _____ (Realtek                                            ) C:\Windows\system32\Drivers\Rt64win7.sys
2013-12-29 12:08 - 2011-09-29 10:30 - 00107552 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll
2013-12-29 12:08 - 2011-09-29 10:30 - 00074272 _____ C:\Windows\system32\RtNicProp64.dll
2013-12-29 12:07 - 2014-01-10 22:00 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-29 12:07 - 2013-12-29 12:08 - 00000000 ____D C:\Program Files (x86)\Realtek
2013-12-29 12:07 - 2013-12-29 12:07 - 00000000 ____D C:\Windows\SysWOW64\RTCOM
2013-12-29 12:07 - 2013-12-29 12:07 - 00000000 ____D C:\Program Files\Realtek
2013-12-29 12:07 - 2013-12-29 12:07 - 00000000 ____D C:\Program Files (x86)\AMD AVT
2013-12-29 12:07 - 2012-06-19 09:54 - 04065296 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys
2013-12-29 12:07 - 2012-06-19 06:31 - 00293889 _____ C:\Windows\system32\Drivers\RTAIODAT.DAT
2013-12-29 12:07 - 2012-06-08 09:23 - 00083072 _____ (Creative Technology Ltd.) C:\Windows\system32\MBWrp64.dll
2013-12-29 12:07 - 2012-06-08 09:21 - 00897152 _____ (Creative Technology Ltd.) C:\Windows\system32\MBAPO64.dll
2013-12-29 12:07 - 2012-06-08 09:21 - 00753280 _____ (Creative Technology Ltd.) C:\Windows\SysWOW64\MBAPO32.dll
2013-12-29 12:07 - 2012-06-08 09:18 - 03615888 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkAPO64.dll
2013-12-29 12:07 - 2012-06-06 03:44 - 00869520 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
2013-12-29 12:07 - 2012-06-05 06:45 - 00237968 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RtHDMIVX.sys
2013-12-29 12:07 - 2012-06-01 02:37 - 02674320 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
2013-12-29 12:07 - 2012-05-31 11:08 - 00105616 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll
2013-12-29 12:07 - 2012-05-25 11:06 - 01706640 _____ (Realtek Semiconductor Corp.) C:\Windows\RtlExUpd.dll
2013-12-29 12:07 - 2012-05-17 04:29 - 07163744 _____ (Dolby Laboratories) C:\Windows\system32\R4EEP64H.dll
2013-12-29 12:07 - 2012-05-17 04:29 - 00433504 _____ (Dolby Laboratories) C:\Windows\system32\R4EED64H.dll
2013-12-29 12:07 - 2012-05-17 04:29 - 00141152 _____ (Dolby Laboratories) C:\Windows\system32\R4EEL64H.dll
2013-12-29 12:07 - 2012-05-17 04:29 - 00123744 _____ (Dolby Laboratories) C:\Windows\system32\R4EEA64H.dll
2013-12-29 12:07 - 2012-05-17 04:29 - 00074592 _____ (Dolby Laboratories) C:\Windows\system32\R4EEG64H.dll
2013-12-29 12:07 - 2012-05-10 08:22 - 01262696 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
2013-12-29 12:07 - 2012-04-10 07:40 - 02533952 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll
2013-12-29 12:07 - 2012-04-03 11:42 - 01015640 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPOShell64.dll
2013-12-29 12:07 - 2012-03-08 04:47 - 00202336 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
2013-12-29 12:07 - 2012-03-08 04:47 - 00108640 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
2013-12-29 12:07 - 2012-02-21 12:45 - 02605400 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesGUILib.dll
2013-12-29 12:07 - 2011-12-20 08:32 - 00331880 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
2013-12-29 12:07 - 2011-12-18 10:58 - 02131288 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ.dll
2013-12-29 12:07 - 2011-12-16 07:57 - 00065112 _____ (Creative Technology Ltd.) C:\Windows\system32\MBppld64.dll
2013-12-29 12:07 - 2011-12-13 09:58 - 01560168 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
2013-12-29 12:07 - 2011-12-02 07:20 - 03746408 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkHDM64.dll
2013-12-29 12:07 - 2011-11-22 09:28 - 00014952 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoLDR64.dll
2013-12-29 12:07 - 2011-09-27 07:04 - 02526824 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RHDMEx64.dll
2013-12-29 12:07 - 2011-07-06 06:27 - 00092264 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RHCoInst64.dll
2013-12-29 12:07 - 2010-11-08 00:31 - 00375128 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
2013-12-29 12:07 - 2010-11-08 00:31 - 00372056 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64H.dll
2013-12-29 12:07 - 2010-11-08 00:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
2013-12-29 12:07 - 2010-11-08 00:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
2013-12-29 12:07 - 2010-11-08 00:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RH3DHT64.dll
2013-12-29 12:07 - 2010-11-08 00:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RH3DAA64.dll
2013-12-29 12:07 - 2010-11-08 00:31 - 00204120 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64H.dll
2013-12-29 12:07 - 2010-11-08 00:31 - 00204120 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
2013-12-29 12:07 - 2010-11-08 00:31 - 00101208 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
2013-12-29 12:07 - 2010-11-08 00:31 - 00097624 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64H.dll
2013-12-29 12:07 - 2010-11-08 00:31 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64H.dll
2013-12-29 12:07 - 2010-11-08 00:31 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
2013-12-29 12:07 - 2010-11-03 11:30 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2013-12-29 12:07 - 2010-09-27 02:34 - 00318808 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll
2013-12-29 12:07 - 2009-11-24 02:55 - 00518896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll
2013-12-29 12:07 - 2009-11-24 02:55 - 00211184 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSH64.dll
2013-12-29 12:07 - 2009-11-24 02:55 - 00198896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP64.dll
2013-12-29 12:07 - 2009-11-24 02:55 - 00155888 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll
2013-12-29 12:07 - 2009-11-18 00:13 - 00060504 _____ (Creative Technology Ltd.) C:\Windows\system32\MBPPCn64.dll
2013-12-29 12:06 - 2013-12-29 12:07 - 00000000 ____D C:\ProgramData\AMD
2013-12-29 12:06 - 2013-12-29 12:06 - 00060197 _____ C:\Windows\SysWOW64\CCCInstall_201312291206544121.log
2013-12-29 12:05 - 2013-12-29 12:05 - 00000000 ____D C:\Program Files\Common Files\ATI Technologies
2013-12-29 12:03 - 2013-12-29 16:04 - 00000000 ____D C:\ProgramData\Package Cache
2013-12-29 12:03 - 2013-12-29 12:03 - 00000000 ____D C:\Program Files\ATI
2013-12-29 12:02 - 2013-12-29 12:06 - 00000000 ____D C:\Program Files\AMD
2013-12-29 12:01 - 2013-12-29 12:01 - 00372091 __RSH C:\WOYBL
2013-12-29 11:58 - 2014-01-11 21:28 - 00000000 ____D C:\Users\Raubtier
2013-12-29 11:58 - 2014-01-11 21:27 - 00000000 ____D C:\Users\Raubtier\AppData\Local\VirtualStore
2013-12-29 11:58 - 2013-12-30 06:31 - 00001421 _____ C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-12-29 11:58 - 2013-12-30 05:43 - 00000000 ___RD C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-29 11:58 - 2013-12-30 05:43 - 00000000 ___RD C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-29 11:58 - 2013-12-29 11:59 - 00000000 ___RD C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-29 11:58 - 2013-12-29 11:59 - 00000000 ___RD C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-12-29 11:58 - 2013-12-29 11:58 - 00000020 ___SH C:\Users\Raubtier\ntuser.ini
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Vorlagen
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Startmenü
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Netzwerkumgebung
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Lokale Einstellungen
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Eigene Dateien
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Druckumgebung
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Documents\Eigene Musik
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Documents\Eigene Bilder
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\AppData\Local\Verlauf
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\AppData\Local\Anwendungsdaten
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Anwendungsdaten
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Vorlagen
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Startmenü
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Netzwerkumgebung
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Lokale Einstellungen
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Eigene Dateien
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Druckumgebung
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Musik
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Bilder
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\AppData\Local\Verlauf
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\AppData\Local\Anwendungsdaten
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Anwendungsdaten
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Musik
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Bilder
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Verlauf
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Anwendungsdaten
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Programme
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\ProgramData\Vorlagen
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\ProgramData\Startmenü
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\ProgramData\Favoriten
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\ProgramData\Dokumente
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\ProgramData\Anwendungsdaten
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Program Files\Gemeinsame Dateien
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Dokumente und Einstellungen
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Adobe
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 ____D C:\Recovery
2013-12-29 11:50 - 2013-12-30 06:21 - 01591896 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-12-29 11:44 - 2013-12-29 11:44 - 00001355 _____ C:\Windows\TSSysprep.log
2013-12-29 11:43 - 2014-01-14 20:58 - 01752098 _____ C:\Windows\WindowsUpdate.log
2013-12-29 11:39 - 2014-01-11 19:25 - 00000000 ____D C:\Windows\Panther
2013-12-29 11:39 - 2013-12-29 11:39 - 00008192 __RSH C:\BOOTSECT.BAK
2013-12-29 11:39 - 2010-11-21 04:23 - 00383786 __RSH C:\bootmgr
2013-12-29 11:17 - 2013-12-06 23:07 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atimpc64.dll
2013-12-29 11:17 - 2013-12-06 23:07 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\amdpcom64.dll
2013-12-29 11:17 - 2013-12-06 23:07 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atimpc32.dll
2013-12-29 11:17 - 2013-12-06 23:07 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\amdpcom32.dll
2013-12-29 11:17 - 2013-12-06 23:04 - 00143304 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiuxp64.dll
2013-12-29 11:17 - 2013-12-06 23:03 - 00126336 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiuxpag.dll
2013-12-29 11:17 - 2013-12-06 23:03 - 00115512 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiu9p64.dll
2013-12-29 11:17 - 2013-12-06 23:02 - 00098496 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiu9pag.dll
2013-12-29 11:17 - 2013-12-06 23:01 - 01318552 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\aticfx64.dll
2013-12-29 11:17 - 2013-12-06 23:01 - 01100216 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\aticfx32.dll
2013-12-29 11:17 - 2013-12-06 23:00 - 09753752 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atidxx64.dll
2013-12-29 11:17 - 2013-12-06 22:59 - 08406024 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atidxx32.dll
2013-12-29 11:17 - 2013-12-06 22:59 - 08287008 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdva.dll
2013-12-29 11:17 - 2013-12-06 22:58 - 06630232 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiumdag.dll
2013-12-29 11:17 - 2013-12-06 22:57 - 08927704 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumd6a.dll
2013-12-29 11:17 - 2013-12-06 22:56 - 07751920 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiumd64.dll
2013-12-29 11:17 - 2013-12-06 22:52 - 13207552 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmdag.sys
2013-12-29 11:17 - 2013-12-06 22:38 - 01187342 _____ C:\Windows\system32\amdocl_as64.exe
2013-12-29 11:17 - 2013-12-06 22:38 - 01061902 _____ C:\Windows\system32\amdocl_ld64.exe
2013-12-29 11:17 - 2013-12-06 22:38 - 00995342 _____ C:\Windows\SysWOW64\amdocl_as32.exe
2013-12-29 11:17 - 2013-12-06 22:38 - 00798734 _____ C:\Windows\SysWOW64\amdocl_ld32.exe
2013-12-29 11:17 - 2013-12-06 22:38 - 00099840 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\OpenVideo64.dll
2013-12-29 11:17 - 2013-12-06 22:38 - 00086528 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\OVDecode64.dll
2013-12-29 11:17 - 2013-12-06 22:38 - 00083968 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\OpenVideo.dll
2013-12-29 11:17 - 2013-12-06 22:38 - 00073728 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\OVDecode.dll
2013-12-29 11:17 - 2013-12-06 22:37 - 29382144 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\amdocl64.dll
2013-12-29 11:17 - 2013-12-06 22:35 - 24860160 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\amdocl.dll
2013-12-29 11:17 - 2013-12-06 22:33 - 00063488 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2013-12-29 11:17 - 2013-12-06 22:33 - 00057344 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2013-12-29 11:17 - 2013-12-06 22:26 - 00129536 _____ (AMD) C:\Windows\system32\coinst_13.251.dll
2013-12-29 11:17 - 2013-12-06 22:16 - 26352128 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atio6axx.dll
2013-12-29 11:17 - 2013-12-06 22:13 - 00550456 _____ C:\Windows\SysWOW64\atiapfxx.blb
2013-12-29 11:17 - 2013-12-06 22:13 - 00550456 _____ C:\Windows\system32\atiapfxx.blb
2013-12-29 11:17 - 2013-12-06 22:13 - 00368640 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiapfxx.exe
2013-12-29 11:17 - 2013-12-06 22:12 - 15716352 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticaldd64.dll
2013-12-29 11:17 - 2013-12-06 22:12 - 00062464 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalrt64.dll
2013-12-29 11:17 - 2013-12-06 22:12 - 00055808 _____ (Advanced Micro Devices Inc.) C:\Windows\system32\aticalcl64.dll
2013-12-29 11:17 - 2013-12-06 22:12 - 00052224 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalrt.dll
2013-12-29 11:17 - 2013-12-06 22:12 - 00049152 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticalcl.dll
2013-12-29 11:17 - 2013-12-06 22:09 - 14302208 _____ (Advanced Micro Devices Inc.) C:\Windows\SysWOW64\aticaldd.dll
2013-12-29 11:17 - 2013-12-06 21:58 - 22157824 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atioglxx.dll
2013-12-29 11:17 - 2013-12-06 21:53 - 00588288 _____ (AMD) C:\Windows\system32\atieclxx.exe
2013-12-29 11:17 - 2013-12-06 21:53 - 00442368 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atidemgy.dll
2013-12-29 11:17 - 2013-12-06 21:53 - 00031232 _____ (AMD) C:\Windows\system32\atimuixx.dll
2013-12-29 11:17 - 2013-12-06 21:52 - 00239616 _____ (AMD) C:\Windows\system32\atiesrxx.exe
2013-12-29 11:17 - 2013-12-06 21:50 - 00190976 _____ (AMD) C:\Windows\system32\atitmm64.dll
2013-12-29 11:17 - 2013-12-06 21:42 - 03426688 _____ C:\Windows\system32\atiumd6a.cap
2013-12-29 11:17 - 2013-12-06 21:39 - 00204952 _____ C:\Windows\SysWOW64\ativvsvl.dat
2013-12-29 11:17 - 2013-12-06 21:39 - 00204952 _____ C:\Windows\system32\ativvsvl.dat
2013-12-29 11:17 - 2013-12-06 21:39 - 00157144 _____ C:\Windows\SysWOW64\ativvsva.dat
2013-12-29 11:17 - 2013-12-06 21:39 - 00157144 _____ C:\Windows\system32\ativvsva.dat
2013-12-29 11:17 - 2013-12-06 21:31 - 03461040 _____ C:\Windows\SysWOW64\atiumdva.cap
2013-12-29 11:17 - 2013-12-06 21:22 - 01144320 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiadlxx.dll
2013-12-29 11:17 - 2013-12-06 21:22 - 00825344 _____ (Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\atiadlxy.dll
2013-12-29 11:17 - 2013-12-06 21:22 - 00100352 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atig6txx.dll
2013-12-29 11:17 - 2013-12-06 21:22 - 00074752 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atig6pxx.dll
2013-12-29 11:17 - 2013-12-06 21:22 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atiglpxx.dll
2013-12-29 11:17 - 2013-12-06 21:22 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiglpxx.dll
2013-12-29 11:17 - 2013-12-06 21:21 - 00626176 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\atikmpag.sys
2013-12-29 11:17 - 2013-12-06 21:21 - 00096768 _____ (Advanced Micro Devices, Inc. ) C:\Windows\SysWOW64\atigktxx.dll
2013-12-29 11:17 - 2013-12-06 21:18 - 00043520 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\Drivers\ati2erec.dll
2013-12-29 11:17 - 2013-11-01 09:08 - 00721296 _____ C:\Windows\system32\atiicdxx.dat
2013-12-29 11:17 - 2013-09-30 21:48 - 00047887 _____ C:\Windows\atiogl.xml
2013-12-29 11:17 - 2013-09-26 22:14 - 00083552 _____ C:\Windows\system32\ativce02.dat
2013-12-29 11:17 - 2013-09-24 15:53 - 00094208 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\AtihdW76.sys
2013-12-29 11:17 - 2013-09-24 15:51 - 00110080 _____ (TODO: <Company name>) C:\Windows\system32\DelayAPO.dll
2013-12-29 11:17 - 2013-09-12 17:31 - 00233776 _____ C:\Windows\system32\ativvaxy_cik_nd.dat
2013-12-29 11:17 - 2013-09-12 17:30 - 00234036 _____ C:\Windows\system32\ativvaxy_cik.dat
2013-12-29 11:17 - 2013-04-10 16:34 - 00332800 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\ATIODE.exe
2013-12-29 11:17 - 2013-04-10 16:34 - 00118784 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atibtmon.exe
2013-12-29 11:17 - 2013-04-10 16:34 - 00051200 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\ATIODCLI.exe
2013-12-29 11:17 - 2011-09-12 23:06 - 00003917 _____ C:\Windows\SysWOW64\atipblag.dat
2013-12-29 11:17 - 2011-09-12 23:06 - 00003917 _____ C:\Windows\system32\atipblag.dat

==================== One Month Modified Files and Folders =======

2014-01-14 21:26 - 2014-01-11 13:24 - 00006989 _____ C:\Users\Raubtier\Desktop\FRST.txt
2014-01-14 21:21 - 2014-01-14 21:21 - 02076160 _____ (Farbar) C:\Users\Raubtier\Desktop\FRST64.exe
2014-01-14 21:21 - 2013-12-29 12:49 - 00001114 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-14 21:20 - 2011-04-12 08:43 - 00698688 _____ C:\Windows\system32\perfh007.dat
2014-01-14 21:20 - 2011-04-12 08:43 - 00148828 _____ C:\Windows\system32\perfc007.dat
2014-01-14 21:20 - 2009-07-14 06:13 - 01618320 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-14 21:19 - 2013-12-30 23:09 - 00007607 _____ C:\Users\Raubtier\AppData\Local\Resmon.ResmonCfg
2014-01-14 21:19 - 2013-12-30 20:47 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\TS3Client
2014-01-14 20:58 - 2013-12-29 11:43 - 01752098 _____ C:\Windows\WindowsUpdate.log
2014-01-14 20:58 - 2009-07-14 05:51 - 00030576 _____ C:\Windows\setupact.log
2014-01-14 20:52 - 2013-12-29 13:09 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-14 20:49 - 2009-07-14 05:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-14 20:49 - 2009-07-14 05:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-14 20:46 - 2013-12-29 12:20 - 00000000 ____D C:\Program Files\Origin
2014-01-14 20:42 - 2013-12-29 12:49 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-14 20:42 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-14 17:56 - 2014-01-13 17:38 - 00000000 ____D C:\Users\Raubtier\Desktop\Updates
2014-01-14 05:33 - 2014-01-14 05:33 - 00000624 _____ C:\Users\Raubtier\Desktop\JRT.txt
2014-01-14 05:28 - 2014-01-14 05:28 - 00000000 ____D C:\Windows\ERUNT
2014-01-14 05:27 - 2014-01-14 05:27 - 01037068 _____ (Thisisu) C:\Users\Raubtier\Desktop\JRT (1).exe
2014-01-14 05:22 - 2014-01-14 05:17 - 00000000 ____D C:\AdwCleaner
2014-01-14 05:15 - 2014-01-14 05:15 - 01037068 _____ (Thisisu) C:\Users\Raubtier\Desktop\JRT.exe
2014-01-14 05:14 - 2014-01-14 05:14 - 01236282 _____ C:\Users\Raubtier\Desktop\adwcleaner.exe
2014-01-14 00:36 - 2014-01-12 00:13 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2014-01-13 17:27 - 2013-12-29 12:13 - 00001912 _____ C:\Windows\epplauncher.mif
2014-01-12 20:25 - 2014-01-12 20:25 - 00000000 ____D C:\Patch2
2014-01-12 20:25 - 2014-01-12 20:25 - 00000000 ____D C:\patch1
2014-01-12 20:24 - 2014-01-12 20:24 - 04693832 _____ C:\Users\Raubtier\Desktop\441065_intl_x64_zip.exe
2014-01-12 20:24 - 2014-01-12 20:23 - 00316912 _____ C:\Users\Raubtier\Desktop\441280_intl_x64_zip.exe
2014-01-12 20:10 - 2010-11-21 04:47 - 00008452 _____ C:\Windows\PFRO.log
2014-01-12 17:04 - 2014-01-12 17:03 - 00000000 ____D C:\Users\Raubtier\Desktop\Prime95
2014-01-12 17:03 - 2014-01-12 17:03 - 04277073 _____ C:\Users\Raubtier\Desktop\p95v279.win32.zip
2014-01-12 17:03 - 2013-12-29 12:21 - 00000000 ____D C:\ProgramData\Origin
2014-01-12 14:31 - 2014-01-12 14:25 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-01-12 14:25 - 2014-01-12 14:25 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-01-12 14:25 - 2014-01-12 14:24 - 00000000 ____D C:\Users\Raubtier\Desktop\mbar
2014-01-12 14:24 - 2014-01-12 14:24 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Raubtier\Desktop\mbar-1.07.0.1008.exe
2014-01-12 14:17 - 2014-01-12 14:17 - 00000914 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-12 14:17 - 2014-01-12 14:17 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2014-01-12 14:16 - 2014-01-12 00:13 - 00079672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-01-12 14:13 - 2014-01-12 14:13 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Raubtier\Desktop\mbam-setup-1.75.0.1300.exe
2014-01-12 13:43 - 2014-01-12 13:43 - 00021244 _____ C:\ComboFix.txt
2014-01-12 13:43 - 2014-01-12 13:35 - 00000000 ____D C:\Qoobox
2014-01-12 13:41 - 2014-01-12 13:34 - 00000000 ____D C:\Windows\erdnt
2014-01-12 13:40 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2014-01-12 13:32 - 2014-01-12 13:32 - 05162489 ____R (Swearware) C:\Users\Raubtier\Desktop\ComboFix.exe
2014-01-12 00:13 - 2014-01-12 00:13 - 01034464 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-01-12 00:13 - 2014-01-12 00:13 - 00422216 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-01-12 00:13 - 2014-01-12 00:13 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-01-12 00:13 - 2014-01-12 00:13 - 00207904 _____ C:\Windows\system32\Drivers\aswVmm.sys
2014-01-12 00:13 - 2014-01-12 00:13 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-01-12 00:13 - 2014-01-12 00:13 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-01-12 00:13 - 2014-01-12 00:13 - 00065776 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2014-01-12 00:13 - 2014-01-12 00:13 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-01-12 00:13 - 2014-01-12 00:13 - 00001966 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-01-11 23:12 - 2013-12-29 12:18 - 00000000 ____D C:\ProgrammeVirtualCloneDrive
2014-01-11 22:36 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2014-01-11 21:28 - 2014-01-11 21:28 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2014-01-11 21:28 - 2013-12-29 11:58 - 00000000 ____D C:\Users\Raubtier
2014-01-11 21:27 - 2014-01-11 18:34 - 00000000 ____D C:\Users\Raubtier\Desktop\rootkit detektiv
2014-01-11 21:27 - 2013-12-30 22:20 - 00000000 ____D C:\Windows\pss
2014-01-11 21:27 - 2013-12-29 15:29 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\DAEMON Tools Lite
2014-01-11 21:27 - 2013-12-29 11:58 - 00000000 ____D C:\Users\Raubtier\AppData\Local\VirtualStore
2014-01-11 21:27 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2014-01-11 19:37 - 2014-01-11 01:28 - 00050568 _____ C:\Users\Raubtier\Desktop\Extras.Txt
2014-01-11 19:37 - 2014-01-11 01:27 - 00217022 _____ C:\Users\Raubtier\Desktop\OTL.Txt
2014-01-11 19:25 - 2014-01-11 14:00 - 00000000 ____D C:\Windows\Minidump
2014-01-11 19:25 - 2013-12-29 22:42 - 00000000 ___DC C:\Users\Raubtier\AppData\Local\MigWiz
2014-01-11 19:25 - 2013-12-29 11:39 - 00000000 ____D C:\Windows\Panther
2014-01-11 17:59 - 2014-01-11 17:59 - 00000000 ____D C:\Users\Raubtier\Desktop\RootkitRevealer171
2014-01-11 17:56 - 2014-01-11 18:34 - 01720705 _____ C:\Users\Raubtier\Desktop\McafeeRootkitDetective11.zip
2014-01-11 13:32 - 2014-01-11 13:32 - 00225630 _____ C:\Users\Raubtier\Desktop\Gmer.txt
2014-01-11 13:22 - 2014-01-11 13:22 - 00000000 ____D C:\FRST
2014-01-11 13:21 - 2014-01-11 13:21 - 00000148 _____ C:\Users\Raubtier\defogger_reenable
2014-01-11 12:47 - 2014-01-11 12:47 - 00000000 ____D C:\Program Files (x86)\Sophos
2014-01-11 02:08 - 2014-01-11 02:08 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\AVAST Software
2014-01-11 02:07 - 2014-01-11 02:07 - 00000000 ____D C:\ProgramData\AVAST Software
2014-01-11 02:07 - 2014-01-11 02:07 - 00000000 ____D C:\Program Files\AVAST Software
2014-01-11 02:06 - 2014-01-11 02:05 - 91412976 _____ (AVAST Software) C:\Users\Raubtier\Desktop\avast_free_antivirus_setup.exe
2014-01-11 01:41 - 2014-01-11 01:41 - 04745728 _____ (AVAST Software) C:\Users\Raubtier\Desktop\aswMBR.exe
2014-01-11 01:23 - 2014-01-11 01:23 - 00602112 _____ (OldTimer Tools) C:\Users\Raubtier\Desktop\OTL.exe
2014-01-11 00:53 - 2009-07-14 06:08 - 00015246 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-10 22:04 - 2014-01-10 22:04 - 00791552 _____ (AMD) C:\Users\Raubtier\Desktop\amddriverdownloader.exe
2014-01-10 22:00 - 2014-01-10 21:40 - 00000000 ____D C:\Users\Raubtier\Desktop\cpu-z-168
2014-01-10 22:00 - 2014-01-07 12:55 - 00000000 ____D C:\Program Files (x86)\Windows Live
2014-01-10 22:00 - 2014-01-01 21:18 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Skype
2014-01-10 22:00 - 2013-12-29 12:21 - 00000000 ____D C:\Program Files\Steam
2014-01-10 22:00 - 2013-12-29 12:07 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2014-01-10 22:00 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2014-01-10 22:00 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\AppCompat
2014-01-10 21:38 - 2014-01-10 21:38 - 01994222 _____ C:\Users\Raubtier\Desktop\cpu-z-168.zip
2014-01-10 21:16 - 2014-01-10 21:16 - 00000010 _____ C:\csb.log
2014-01-10 01:01 - 2014-01-07 00:57 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Usenet.nl
2014-01-10 00:55 - 2014-01-07 00:57 - 00000000 ____D C:\Users\Raubtier\Documents\Usenet.nl
2014-01-08 20:14 - 2014-01-07 20:43 - 00000000 ____D C:\Users\Raubtier\Tracing
2014-01-08 00:21 - 2014-01-07 12:50 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Windows Live
2014-01-07 12:56 - 2014-01-07 12:56 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2014-01-07 12:55 - 2014-01-07 12:55 - 00000000 ____D C:\Windows\PCHEALTH
2014-01-07 12:51 - 2014-01-07 12:51 - 00000000 ____D C:\ProgramData\Microsoft SkyDrive
2014-01-07 12:50 - 2014-01-07 12:50 - 01245168 _____ (Microsoft Corporation) C:\Users\Raubtier\Desktop\wlsetup-web.exe
2014-01-07 12:49 - 2013-12-30 19:28 - 00000000 ____D C:\Program Files\HDDGURU LLF Tool
2014-01-07 12:48 - 2013-12-30 11:02 - 00000000 ____D C:\Windows\System32\Tasks\Abelssoft
2014-01-07 12:48 - 2013-12-29 20:26 - 00000000 ____D C:\Program Files\CheckDrive
2014-01-07 01:48 - 2013-12-31 01:25 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\vlc
2014-01-07 00:57 - 2014-01-07 00:57 - 07457256 _____ (                                                            ) C:\Users\Raubtier\Desktop\UsenetNLSetup.exe
2014-01-07 00:57 - 2014-01-07 00:57 - 00001682 _____ C:\Users\Raubtier\Desktop\Usenet.nl.lnk
2014-01-07 00:57 - 2014-01-07 00:57 - 00000000 ____D C:\Program Files\Usenet.nl
2014-01-07 00:39 - 2014-01-02 00:30 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Microsoft Games
2014-01-03 21:18 - 2014-01-03 21:18 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Malwarebytes
2014-01-03 21:18 - 2014-01-03 21:18 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-02 23:15 - 2014-01-02 23:15 - 00000000 ____D C:\Users\Raubtier\Documents\WB Games
2014-01-02 23:11 - 2014-01-02 23:11 - 00001520 _____ C:\Users\Raubtier\Desktop\TheBureau.lnk
2014-01-02 23:11 - 2014-01-02 23:11 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\2K Sports
2014-01-02 23:10 - 2014-01-02 23:10 - 00001045 _____ C:\Users\Raubtier\Desktop\nba2k14.lnk
2014-01-02 23:09 - 2014-01-02 23:09 - 00001669 _____ C:\Users\Raubtier\Desktop\BatmanOrigins.lnk
2014-01-02 23:02 - 2013-12-29 16:01 - 00074987 _____ C:\Windows\DirectX.log
2014-01-01 22:52 - 2014-01-01 20:53 - 00000000 ____D C:\Users\Raubtier\AppData\Local\ESN Sonar
2014-01-01 22:35 - 2014-01-01 22:35 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_xusb21_01009.Wdf
2014-01-01 22:35 - 2014-01-01 22:35 - 00000000 ____D C:\Program Files\Microsoft Xbox 360 Accessories
2014-01-01 22:17 - 2013-12-29 16:04 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2014-01-01 22:02 - 2013-12-29 16:04 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2014-01-01 21:18 - 2014-01-01 21:17 - 00000000 ____D C:\ProgramData\Skype
2014-01-01 21:17 - 2014-01-01 21:17 - 00002699 _____ C:\Users\Public\Desktop\Skype.lnk
2014-01-01 21:17 - 2014-01-01 21:17 - 00000000 ___RD C:\Program Files (x86)\Skype
2014-01-01 12:27 - 2013-12-29 16:04 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins
2014-01-01 03:02 - 2014-01-01 03:02 - 00000857 _____ C:\Users\Raubtier\Desktop\Yahoo! Messenger.lnk
2013-12-31 01:07 - 2013-12-31 01:07 - 00000000 ____D C:\Windows\System32\Tasks\Games
2013-12-30 19:29 - 2013-12-30 19:29 - 00000001 _____ C:\Users\Raubtier\AppData\Local\llftool.4.30.agreement
2013-12-30 12:35 - 2013-12-30 12:34 - 00000000 ____D C:\Program Files\Data Lifeguard Diagnostic for Windows
2013-12-30 11:02 - 2013-12-29 20:26 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Abelssoft
2013-12-30 07:15 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-30 06:40 - 2013-12-29 22:28 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-12-30 06:40 - 2013-12-29 22:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-12-30 06:31 - 2013-12-29 11:58 - 00001421 _____ C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-12-30 06:28 - 2013-12-30 06:28 - 00000000 ____D C:\Program Files (x86)\Etron Technology
2013-12-30 06:28 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-12-30 06:21 - 2013-12-29 11:50 - 01591896 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-12-30 06:19 - 2013-12-30 05:57 - 00015952 _____ C:\Windows\IE11_main.log
2013-12-30 06:15 - 2013-12-30 06:15 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-12-30 06:15 - 2013-12-30 06:15 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-30 06:15 - 2013-12-30 06:15 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-30 06:15 - 2013-12-30 06:15 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-12-30 06:15 - 2013-12-30 06:15 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-30 06:15 - 2013-12-30 06:15 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-12-30 06:15 - 2013-12-30 06:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-12-30 06:15 - 2013-12-30 06:15 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-30 06:15 - 2013-12-30 06:15 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-12-30 06:08 - 2009-07-14 05:45 - 00294344 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-30 05:56 - 2013-12-29 22:25 - 00000000 ____D C:\Windows\system32\MRT
2013-12-30 05:46 - 2013-12-29 12:13 - 00059296 _____ C:\Users\Raubtier\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-30 05:44 - 2009-07-14 04:20 - 00000000 __RSD C:\Windows\Media
2013-12-30 05:43 - 2013-12-29 12:19 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2013-12-30 05:43 - 2013-12-29 11:58 - 00000000 ___RD C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-30 05:43 - 2013-12-29 11:58 - 00000000 ___RD C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-30 05:43 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-12-30 05:35 - 2013-12-29 13:05 - 00000000 ____D C:\ProgramData\Razer
2013-12-29 23:37 - 2013-12-29 23:36 - 00000000 ____D C:\Windows\System32\Tasks\Aufgaben der Ereignisanzeige
2013-12-29 22:05 - 2013-12-29 22:05 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\WinRAR
2013-12-29 21:28 - 2013-12-29 21:28 - 00000000 ____D C:\Users\Raubtier\AppData\Local\PunkBuster
2013-12-29 21:06 - 2013-12-29 21:06 - 00000000 ____D C:\Users\Raubtier\Documents\Battlefield 4
2013-12-29 21:06 - 2013-12-29 12:22 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Origin
2013-12-29 21:06 - 2013-12-29 12:21 - 00000000 ____D C:\ProgramData\Electronic Arts
2013-12-29 20:34 - 2013-12-29 20:34 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Razer
2013-12-29 20:15 - 2013-12-29 20:15 - 00000000 ____D C:\Users\Raubtier\AppData\Local\ESN
2013-12-29 16:14 - 2013-12-29 16:14 - 00000000 ____D C:\ProgramData\Steam
2013-12-29 16:04 - 2013-12-29 16:04 - 00076888 _____ C:\Windows\SysWOW64\PnkBstrA.exe
2013-12-29 16:04 - 2013-12-29 12:03 - 00000000 ____D C:\ProgramData\Package Cache
2013-12-29 15:54 - 2013-12-29 15:28 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2013-12-29 15:29 - 2013-12-29 15:29 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys
2013-12-29 15:29 - 2013-12-29 15:29 - 00000000 ____D C:\Program Files\DAEMON Tools Lite
2013-12-29 13:16 - 2013-12-29 12:49 - 00004110 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-12-29 13:16 - 2013-12-29 12:49 - 00003858 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-12-29 13:11 - 2013-12-29 13:11 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Yahoo!
2013-12-29 13:10 - 2013-12-29 13:10 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Macromedia
2013-12-29 13:09 - 2013-12-29 13:09 - 00419488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-29 13:09 - 2013-12-29 13:09 - 00070304 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-29 13:09 - 2013-12-29 13:09 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-29 13:09 - 2013-12-29 13:09 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2013-12-29 13:09 - 2013-12-29 13:09 - 00000000 ____D C:\ProgramData\Yahoo!
2013-12-29 13:09 - 2013-12-29 13:09 - 00000000 ____D C:\Program Files\Messenger
2013-12-29 13:09 - 2013-12-29 13:07 - 00000000 ____D C:\Program Files (x86)\Yahoo!
2013-12-29 13:07 - 2013-12-29 13:07 - 00444024 _____ (Yahoo! Inc.) C:\Users\Raubtier\Downloads\msgr11de.exe
2013-12-29 13:05 - 2013-12-29 13:04 - 13163200 _____ (Razer Inc.) C:\Users\Raubtier\Downloads\Razer_Synapse_Framework_V1.16.06.exe
2013-12-29 13:05 - 2013-12-29 13:02 - 00000000 ____D C:\Program Files (x86)\Razer
2013-12-29 13:03 - 2013-12-29 13:03 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_RzSynapse_01007.Wdf
2013-12-29 13:03 - 2013-12-29 13:02 - 00007312 _____ C:\Windows\DPINST.LOG
2013-12-29 13:02 - 2013-12-29 13:02 - 00000000 ____D C:\Program Files\Razer
2013-12-29 13:00 - 2013-12-29 12:59 - 40394840 _____ (Razer USA Ltd.                                               ) C:\Users\Raubtier\Downloads\Razer_NagaEpic_Driver_v3.03.exe
2013-12-29 12:57 - 2013-12-29 12:57 - 00000909 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2013-12-29 12:57 - 2013-12-29 12:57 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-12-29 12:56 - 2013-12-29 12:55 - 32520760 _____ (TeamSpeak Systems GmbH) C:\Users\Raubtier\Downloads\TeamSpeak3-Client-win64-3.0.13.1.exe
2013-12-29 12:51 - 2013-12-29 12:49 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Google
2013-12-29 12:51 - 2013-12-29 12:49 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-29 12:49 - 2013-12-29 12:49 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Deployment
2013-12-29 12:49 - 2013-12-29 12:49 - 00000000 ____D C:\Users\Raubtier\AppData\Local\Apps\2.0
2013-12-29 12:36 - 2013-12-29 12:22 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Origin
2013-12-29 12:30 - 2013-12-29 12:30 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\ATI
2013-12-29 12:30 - 2013-12-29 12:30 - 00000000 ____D C:\Users\Raubtier\AppData\Local\ATI
2013-12-29 12:30 - 2013-12-29 12:30 - 00000000 ____D C:\Users\Raubtier\AppData\Local\AMD
2013-12-29 12:30 - 2013-12-29 12:30 - 00000000 ____D C:\ProgramData\ATI
2013-12-29 12:29 - 2013-12-29 12:29 - 00000000 _____ C:\Windows\ativpsrm.bin
2013-12-29 12:19 - 2013-12-29 12:17 - 00000000 ____D C:\Program Files\WinRAR
2013-12-29 12:18 - 2013-12-29 12:18 - 00000000 ____D C:\Program Files\VLC
2013-12-29 12:13 - 2013-12-29 12:13 - 00000000 ____D C:\Program Files (x86)\AMD APP
2013-12-29 12:08 - 2013-12-29 12:07 - 00000000 ____D C:\Program Files (x86)\Realtek
2013-12-29 12:07 - 2013-12-29 12:07 - 00000000 ____D C:\Windows\SysWOW64\RTCOM
2013-12-29 12:07 - 2013-12-29 12:07 - 00000000 ____D C:\Program Files\Realtek
2013-12-29 12:07 - 2013-12-29 12:07 - 00000000 ____D C:\Program Files (x86)\AMD AVT
2013-12-29 12:07 - 2013-12-29 12:06 - 00000000 ____D C:\ProgramData\AMD
2013-12-29 12:06 - 2013-12-29 12:06 - 00060197 _____ C:\Windows\SysWOW64\CCCInstall_201312291206544121.log
2013-12-29 12:06 - 2013-12-29 12:02 - 00000000 ____D C:\Program Files\AMD
2013-12-29 12:05 - 2013-12-29 12:05 - 00000000 ____D C:\Program Files\Common Files\ATI Technologies
2013-12-29 12:03 - 2013-12-29 12:03 - 00000000 ____D C:\Program Files\ATI
2013-12-29 12:03 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\restore
2013-12-29 12:01 - 2013-12-29 12:01 - 00372091 __RSH C:\WOYBL
2013-12-29 11:59 - 2013-12-29 11:58 - 00000000 ___RD C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-29 11:59 - 2013-12-29 11:58 - 00000000 ___RD C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-12-29 11:58 - 2013-12-29 11:58 - 00000020 ___SH C:\Users\Raubtier\ntuser.ini
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Vorlagen
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Startmenü
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Netzwerkumgebung
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Lokale Einstellungen
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Eigene Dateien
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Druckumgebung
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Documents\Eigene Musik
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Documents\Eigene Bilder
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\AppData\Local\Verlauf
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\AppData\Local\Anwendungsdaten
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Raubtier\Anwendungsdaten
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Musik
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Public\Documents\Eigene Bilder
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Vorlagen
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Startmenü
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Netzwerkumgebung
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Lokale Einstellungen
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Eigene Dateien
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Druckumgebung
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Musik
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Bilder
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\AppData\Local\Verlauf
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\AppData\Local\Anwendungsdaten
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default\Anwendungsdaten
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Musik
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Bilder
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Verlauf
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Anwendungsdaten
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Programme
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\ProgramData\Vorlagen
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\ProgramData\Startmenü
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\ProgramData\Favoriten
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\ProgramData\Dokumente
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\ProgramData\Anwendungsdaten
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Program Files\Gemeinsame Dateien
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 _SHDL C:\Dokumente und Einstellungen
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 ____D C:\Users\Raubtier\AppData\Roaming\Adobe
2013-12-29 11:58 - 2013-12-29 11:58 - 00000000 ____D C:\Recovery
2013-12-29 11:58 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default
2013-12-29 11:58 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\Recovery
2013-12-29 11:58 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Windows NT
2013-12-29 11:44 - 2013-12-29 11:44 - 00001355 _____ C:\Windows\TSSysprep.log
2013-12-29 11:44 - 2009-07-14 05:46 - 00002790 _____ C:\Windows\DtcInstall.log
2013-12-29 11:44 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\sysprep
2013-12-29 11:41 - 2011-04-12 08:54 - 00000000 ____D C:\Windows\CSC
2013-12-29 11:39 - 2013-12-29 11:39 - 00008192 __RSH C:\BOOTSECT.BAK
2013-12-29 11:39 - 2009-07-14 06:38 - 00025600 ___SH C:\Windows\system32\config\BCD-Template.LOG
2013-12-29 11:39 - 2009-07-14 06:32 - 00028672 _____ C:\Windows\system32\config\BCD-Template
2013-12-29 11:39 - 2009-07-14 05:45 - 00000000 ____D C:\Windows\Setup

Some content of TEMP:
====================
C:\Users\Raubtier\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-09 22:50

==================== End Of Log ============================
         
--- --- ---

--- --- ---

Alt 14.01.2014, 21:32   #13
B3AM3R
 
Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool? - Standard

Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?



Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-01-2014 02
Ran by Raubtier at 2014-01-14 21:26:30
Running from C:\Users\Raubtier\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

Adobe Flash Player 11 ActiveX (x32 Version: 11.2.202.235 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (Version: 13.20.100.31206 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.938.2 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Control Center (x32 Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden
AMD Catalyst Install Manager (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Fuel (Version: 2013.1206.1603.28764 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.81206.1620 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.14 - Advanced Micro Devices, Inc.) Hidden
avast! Free Antivirus (x32 Version: 9.0.2011 - Avast Software)
Batman Arkham Origins (x32 Version: 1 - )
Battlefield 4™ (x32 Version: 1.0.0.1 - Electronic Arts)
Battlelog Web Plugins (x32 Version: 2.3.2 - EA Digital Illusions CE AB)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.1206.1602.28764 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden
DAEMON Tools Lite (x32 Version: 4.48.1.0347 - Disc Soft Ltd)
Data Lifeguard Diagnostic for Windows 1.24 (x32 Version:  - Western Digital Corporation)
ESN Sonar (x32 Version: 0.70.4 - ESN Social Software AB)
Etron USB3.0 Host Controller (x32 Version: 0.115 - Etron Technology)
Etron USB3.0 Host Controller (x32 Version: 0.115 - Etron Technology) Hidden
Google Chrome (x32 Version: 31.0.1650.63 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Xbox 360 Accessories 1.2 (Version: 1.20.146.0 - Microsoft)
NBA 2K14 (x32 Version: 1.0.0 - 2K Sports)
No More Room in Hell (x32 Version:  - No More Room in Hell Team)
Origin (x32 Version: 9.3.11.2762 - Electronic Arts, Inc.)
PunkBuster Services (x32 Version: 0.993 - Even Balance, Inc.)
Razer Naga (x32 Version: 3.03.01 - Razer USA Ltd.)
Razer Synapse 2.0 (x32 Version: 1.16.6 - Razer Inc.)
Realtek Ethernet Controller Driver (x32 Version: 7.49.927.2011 - Realtek)
Realtek HDMI Audio Driver for ATI (x32 Version: 6.0.1.6650 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
Steam (x32 Version:  - Valve Corporation)
TeamSpeak 3 Client (Version: 3.0.13 - TeamSpeak Systems GmbH)
The Bureau: XCOM Declassified (x32 Version: 1 - )
Usenet.nl (x32 Version:  - )
VLC media player 2.1.2 (x32 Version: 2.1.2 - VideoLAN)
WinRAR 5.00 (64-Bit) (Version: 5.00.0 - win.rar GmbH)
Yahoo! Messenger (x32 Version:  - Yahoo! Inc.)

==================== Restore Points  =========================

10-01-2014 13:40:18 Windows Update
10-01-2014 20:56:45 Configured Etron USB3.0 Host Controller
10-01-2014 20:59:11 Wiederherstellungsvorgang
10-01-2014 21:13:05 Windows Update
11-01-2014 01:07:25 avast! antivirus system restore point
11-01-2014 23:12:49 avast! antivirus system restore point
12-01-2014 19:26:02 Windows Update
12-01-2014 19:27:31 Windows Update
12-01-2014 19:31:32 Windows Update

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {08D4B8B1-9185-4CA9-A9EC-2EE7CA338D17} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-01-12] (AVAST Software)
Task: {49271653-5C6F-4686-9810-335BAF8B9F80} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\MpCmdRun.exe
Task: {6E7B4529-29ED-4013-93A9-C50CDC123A42} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-29] (Adobe Systems Incorporated)
Task: {7B97527C-D3F3-414E-9B0D-7E3D8F2330E6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-29] (Google Inc.)
Task: {968D6584-599F-4831-902B-E2F584557820} - System32\Tasks\Games\UpdateCheck_S-1-5-21-199586521-2663480010-3892174971-1000
Task: {F04774E6-327B-4C2A-AB20-43DF7D1744F1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-29] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-12-06 16:06 - 2013-12-06 16:06 - 00102400 _____ () C:\Programme\AMD\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2014-01-14 17:03 - 2014-01-14 08:32 - 02153984 _____ () C:\Program Files\AVAST Software\Avast\defs\14011400\algo.dll
2014-01-14 20:43 - 2014-01-14 18:11 - 02153984 _____ () C:\Program Files\AVAST Software\Avast\defs\14011401\algo.dll
2014-01-12 00:13 - 2014-01-12 00:13 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: DAEMON Tools Virtual Bus
Description: DAEMON Tools Virtual Bus
Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}
Manufacturer: DT Soft Ltd
Service: dtsoftbus01
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Enumerator-Treiber für Microsoft Virtual Drive
Description: Enumerator-Treiber für Microsoft Virtual Drive
Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardsystemgeräte)
Service: vdrvroot
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/14/2014 09:25:40 PM) (Source: Application Hang) (User: )
Description: Programm FRST64.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: f24

Startzeit: 01cf116650aecaa5

Endzeit: 32

Anwendungspfad: C:\Users\Raubtier\Desktop\FRST64.exe

Berichts-ID:

Error: (01/14/2014 08:44:13 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/14/2014 05:04:42 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (01/14/2014 08:42:53 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
dtsoftbus01
vdrvroot

Error: (01/14/2014 08:42:41 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Net.Tcp Listener Adapter" ist vom Dienst "Net.Tcp Port Sharing Service" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1058

Error: (01/14/2014 08:42:41 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Net.Pipe Listener Adapter" ist von folgendem Dienst abhängig: was. Dieser Dienst ist eventuell nicht installiert.

Error: (01/14/2014 08:42:41 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Net.Msmq Listener Adapter" ist von folgendem Dienst abhängig: msmq. Dieser Dienst ist eventuell nicht installiert.

Error: (01/14/2014 05:03:36 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
dtsoftbus01
vdrvroot

Error: (01/14/2014 05:03:13 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Net.Tcp Listener Adapter" ist vom Dienst "Net.Tcp Port Sharing Service" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1058

Error: (01/14/2014 05:03:13 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Net.Pipe Listener Adapter" ist von folgendem Dienst abhängig: was. Dieser Dienst ist eventuell nicht installiert.

Error: (01/14/2014 05:03:13 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Net.Msmq Listener Adapter" ist von folgendem Dienst abhängig: msmq. Dieser Dienst ist eventuell nicht installiert.


Microsoft Office Sessions:
=========================
Error: (01/14/2014 09:25:40 PM) (Source: Application Hang)(User: )
Description: FRST64.exe0.0.0.0f2401cf116650aecaa532C:\Users\Raubtier\Desktop\FRST64.exe

Error: (01/14/2014 08:44:13 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/14/2014 05:04:42 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2014-01-11 18:24:07.182
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\535E.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-01-11 18:24:07.135
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\535E.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-01-11 18:24:07.088
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\535E.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-01-11 18:24:07.041
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\535E.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-01-11 18:24:06.901
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\535E.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-01-11 18:24:06.854
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\535E.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-01-11 18:19:01.125
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\535E.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-01-11 18:19:01.078
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\535E.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-01-11 18:17:02.642
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\535E.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-01-11 18:17:02.596
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\535E.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 17%
Total physical RAM: 8173.43 MB
Available physical RAM: 6723.8 MB
Total Pagefile: 16345.04 MB
Available Pagefile: 14776.59 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:146.48 GB) (Free:93.56 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (frei) (Fixed) (Total:488.28 GB) (Free:262.91 GB) NTFS
Drive e: (Daten_BACKUP) (Fixed) (Total:443.1 GB) (Free:290.16 GB) NTFS
Drive f: (INTENSO) (Removable) (Total:14.44 GB) (Free:14.44 GB) FAT32
Drive g: (Volume) (Fixed) (Total:341.8 GB) (Free:163.85 GB) NTFS
Drive h: (Musik) (Fixed) (Total:443.23 GB) (Free:42.78 GB) NTFS
Drive i: (W7AiO_Okt13) (CDROM) (Total:6.99 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: D51718CD)
Partition 1: (Active) - (Size=146 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=342 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=443 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 932 GB) (Disk ID: 0891393C)

Partition: GPT Partition Type
========================================================
Disk: 2 (Size: 14 GB) (Disk ID: 01CE7825)
Partition 1: (Active) - (Size=14 GB) - (Type=0C)

==================== End Of Log ============================
         
Gruß,

B3AM3R

Alt 15.01.2014, 12:57   #14
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool? - Standard

Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?



Deine Windows Version, inklusiver der vorab installierten Updates sind schon älter, du bekommst das Dateum der Erstellung angezeigt, nicht wann es installiert wurde

Was bestehen denn noch für Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 17.01.2014, 05:44   #15
B3AM3R
 
Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool? - Standard

Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?



Moin Schrauber,

entschuldige meine späte Antwort.

Also, ich fang denn mal an: Rechner läuft nur auf 2 Kernen, laut Process Explorer. Zeigt zwar 4 Kerne, jedoch 2 Kerne und 2 logische. Task Manager zeigt 4. Irgendwelche Prozesse und Hostprozesse die zu komischen Pfaden führen und Berechtigungen für irgendwelche Benutzer im Vollzugriff zulassen. Like this: Name:  Process Rpcs.PNG
Hits: 371
Größe:  59,6 KBName:  Process Rpcssecurity.PNG
Hits: 469
Größe:  61,6 KB Das immer viele "SVCHost"-Prozesse laufen war mir klar. Mir erscheint das nur sehr viel.
Auf meiner C: Platte sind mehrere Ordner mit Namen "boot" aufgetaucht, mit Anwendungen oder Anwendungserweiterungen. Mein Browser speichert keine Passwörter mehr und ich hab den Eindruck das mein Google Konto und mein Yahoo von jemand anderem benutzt wurden. Passwörter geändert. Mein browser leitet mich neuerdings gerne auf englische Seiten weiter. Auch bei Yahoo, wenn ich meine mails abfragen möchte.

Name:  Systemübers..jpg
Hits: 433
Größe:  56,3 KBName:  Umgebungsvariablen systemübersicht.jpg
Hits: 363
Größe:  40,4 KB

Die Umgebungsvariablen, auch wenn ich davon nicht wirklich Ahnung habe, erscheinen mir die Pfade extrem lang und unnatürlich, genau wie das OS Win NT?

Ich danke Dir vielmals für Deine Mühe.

Lieben Gruß

B3AM3R

Antwort

Themen zu Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?
abgesicherten, anderen, bootmanager, fehler, fehlermeldung, festgestellt, freunde, funktionieren, gen, malwarebytes, manager, modus, problem, prozessor, registry, rootkit, start, stelle, tools, verdacht, verändert, windows, windows 7, wissen, Änderungen




Ähnliche Themen: Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?


  1. virus im bootmanager
    Plagegeister aller Art und deren Bekämpfung - 26.08.2014 (2)
  2. Windows 7: Chrome Browser verändert und Suchen werden weitergeleitet
    Log-Analyse und Auswertung - 20.01.2014 (7)
  3. Windows 7: Datein auf USB-Stick werden ungewollt zu Verknüpfungen verändert
    Log-Analyse und Auswertung - 03.11.2013 (33)
  4. Bundestrojaner überschreibt Windows BootManager
    Plagegeister aller Art und deren Bekämpfung - 20.07.2013 (11)
  5. Virus/Rootkit ruft Webseiten auf, steuert Maus und verändert Systemstart
    Log-Analyse und Auswertung - 07.06.2013 (3)
  6. Rootkit Infektion, danach Windows-Neuinstallation, GMER zeigt erneut Rootkit Aktivitäten an (Avast! false positive?)
    Log-Analyse und Auswertung - 05.03.2013 (2)
  7. Windows 7 , nach Boot endlosschleife des Startup Repairs Diagnose: Bootmanager fehlt / ist defekt / Was tun?
    Plagegeister aller Art und deren Bekämpfung - 04.12.2012 (7)
  8. Prozessorkerne dektivieren
    Netzwerk und Hardware - 26.09.2011 (1)
  9. Tr/rootkit.gen windows/system32/Drivers.lnuuf.sys (rootkit Agent)
    Plagegeister aller Art und deren Bekämpfung - 29.05.2010 (1)
  10. Windows 7 Bootmanager entfernen
    Alles rund um Windows - 24.01.2010 (7)
  11. Kleines problem mit dem bootmanager!
    Alles rund um Windows - 01.09.2008 (3)
  12. Hilfe Windows-darstellung Verändert
    Plagegeister aller Art und deren Bekämpfung - 15.04.2007 (2)
  13. windows kennwort verändert...
    Plagegeister aller Art und deren Bekämpfung - 12.09.2005 (1)
  14. Wie klappt es mit dem Bootmanager?
    Alles rund um Mac OSX & Linux - 29.03.2005 (13)
  15. Bootmanager
    Alles rund um Windows - 04.08.2004 (10)
  16. Bootmanager
    Alles rund um Mac OSX & Linux - 14.05.2003 (5)
  17. Lilo Bootmanager
    Alles rund um Mac OSX & Linux - 07.11.2002 (12)

Zum Thema Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool? - Hallo Freunde, ich hatte gestern das Problem, das mein 4 Kern Prozessor nur mit 2 Kernen lief. Daraufhin habe ich einiges ausprobiert um den Fehler zu lokalisieren. Mein 1. Verdacht - Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool?...
Archiv
Du betrachtest: Windows 7 Bootmanager verändert, Prozessorkerne werden abgezweigt, Rootkit, Bootmanagertool? auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.