Windows 7: Troj/ZbotMem-B Befall?

Mira_11 · 28.12.2014, 23:20

Hallo,

ich habe mir am 26.12. online den Troj/ZbotMem-B eingefangen, welchen Sophos in Quarantäne schob und eine manuelle Reinigung forderte. Ich habe dann Malwarebytes laufen lassen und die betroffenen Dateien dadurch ermittelt und manuell entfernt (zusätzlich habe ich mit AdwCleaner "aufgeräumt"). Folgescans waren dann soweit ich erkennen konnte weitestgehend (außer etwas Adware) sauber. Ich habe dann interessehalber über den Trojaner nachgelesen und bin so auf eurer Seite gelandet und hatte den Eindruck, dass meine Art des Entfernens vielleicht doch etwas simpel war und traue dem Frieden nicht. Desweiteren konnte ich merkwürdigerweise die logfiles von Malwarbytes nicht als txt speichern (sondern nur als völlig unübersichtliches xml - Entschuldigung dafür!) und habe gelesen (Quelle weiß ich leider nicht mehr :-(), dass das ein "Symptom" des Virus sein kann... Aktuell läuft der Rechner auch sehr langsam... Ich bin total verunsichert.
Könntet ihr nochmal einen Experten-Blick werfen?

Vielen Dank!

Mira

cosinus · 29.12.2014, 00:55

Hi und

Logs bitte nicht anhängen, notfalls splitten und über mehrere Postings verteilt posten

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Mira_11 · 29.12.2014, 01:53

Hallo und danke für die schnelle Antwort! Muss das leider ziemlich aufteilen... aber hier kommen die logs:

Oder hab ich irgendwas falsch gemacht? Die sind so riesig, in anderen Posts passten da immer viel mehr rein o_O

defogger:

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:17 on 28/12/2014 (Mirjana)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

FRST, Teil 1:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-12-2014
Ran by Mirjana (administrator) on MIRJANA_VAIO on 28-12-2014 21:18:38
Running from C:\Users\Mirjana\Desktop
Loaded Profile: Mirjana (Available profiles: Mirjana)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
(Safer Networking Limited) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
() C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
(Sony Corporation) C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Dropbox, Inc.) C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe
(Intel Corporation) C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSystemTray.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2057000 2010-05-31] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10775584 2010-05-31] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2040352 2010-05-31] (Realtek Semiconductor)
HKLM\...\Run: [EPSON Stylus DX3800 Series] => C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIACE.EXE /F "C:\Windows\TEMP\E_SF71A.tmp" /EF "HKLM"
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [102400 2010-09-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [PMBVolumeWatcher] => C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [600928 2010-06-01] (Sony Corporation)
HKLM-x32\...\Run: [ISBMgr.exe] => C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [673136 2010-05-31] (Sony Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-04] (Intel Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [703888 2013-07-19] (Cisco Systems, Inc.)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH)
HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] => C:\Program Files (x86)\Sophos\AutoUpdate\almon.exe [1617704 2014-10-14] (Sophos Limited)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [emsisoft anti-malware] => C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe [4954576 2014-12-01] (Emsisoft GmbH)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2462366986-3853951462-1244750843-1001\...\Run: [espaces] => C:\premiumsoft\PhotoFun\photofun.exe
HKU\S-1-5-21-2462366986-3853951462-1244750843-1001\...\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)
HKU\S-1-5-21-2462366986-3853951462-1244750843-1001\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
HKU\S-1-5-21-2462366986-3853951462-1244750843-1001\...\Run: [Veoh383477.exe] => "C:\Users\Mirjana\AppData\Local\Temp\Veoh383477.exe" /XML="C:\Users\Mirjana\AppData\Local\Temp\CC55.tmp" /ROS /STP=0:2 <===== ATTENTION
HKU\S-1-5-21-2462366986-3853951462-1244750843-1001\...\Run: [Amazon Music] => C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe [6277952 2014-11-19] ()
HKU\S-1-5-21-2462366986-3853951462-1244750843-1001\...\Run: [CrossRiderPlugin] => C:\Program Files (x86)\CrossriderWebApps\Crossrider.exe
HKU\S-1-5-21-2462366986-3853951462-1244750843-1001\...\MountPoints2: {73e0654b-28bb-11e0-8a20-544249f72881} - E:\setup_vmb_lite.exe /checkApplicationPresence
AppInit_DLLs: C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~2.DLL => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured_x64.dll [217160 2014-05-25] (Sophos Limited)
AppInit_DLLs-x32: C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~1.DLL => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured.dll [275352 2014-05-25] (Sophos Limited)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\Mirjana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2462366986-3853951462-1244750843-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://dub112.mail.live.com/default.aspx?id=64855
HKU\S-1-5-21-2462366986-3853951462-1244750843-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SVEE&bmod=SVEE
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2462366986-3853951462-1244750843-1001 -> {E26FC2B6-6293-4F5A-9F67-7EA1B2BC031E} URL = hxxp://ecosia.org/search.php?q={searchTerms}&addon=opensearch
BHO: Deaktivierungs-Add-on für Browser von Google Analytics -> {75EF13CE-B59E-41ba-8A5A-A944031BD8B4} -> C:\Program Files\Google\Google Analytics Opt-Out\gaoptout_x64.dll (Google, Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: WOT Helper -> {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} -> C:\Program Files\WOT\WOT.dll ()
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: DAPIELoader Class -> {FF6C3CF0-4B15-11D1-ABED-709549C10000} -> C:\Program Files (x86)\DAP\DAPIELoader64.dll No File
BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: Deaktivierungs-Add-on für Browser von Google Analytics -> {75EF13CE-B59E-41ba-8A5A-A944031BD8B4} -> C:\Program Files (x86)\Google\Google Analytics Opt-Out\gaoptout.dll (Google, Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: WOT Helper -> {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} -> C:\Program Files (x86)\WOT\WOT.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: CodecC Class -> {EF06946E-DF9F-42FA-A012-AF242B2F0072} -> C:\ProgramData\CodecC\bhoclass.dll No File
Toolbar: HKLM - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
Toolbar: HKLM-x32 - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files (x86)\WOT\WOT.dll ()
Toolbar: HKU\S-1-5-21-2462366986-3853951462-1244750843-1001 -> WOT - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
DPF: HKLM-x32 {55963676-2F5E-4BAF-AC28-CF26AA587566} https://vpn.gwdg.de/CACHE/stc/1/binaries/vpnweb.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
Handler-x32: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files (x86)\WOT\WOT.dll ()
Winsock: Catalog9 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760] (Sophos Limited)
Winsock: Catalog9 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760] (Sophos Limited)
Winsock: Catalog9 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760] (Sophos Limited)
Winsock: Catalog9 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760] (Sophos Limited)
Winsock: Catalog9 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760] (Sophos Limited)
Winsock: Catalog9 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760] (Sophos Limited)
Winsock: Catalog9 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760] (Sophos Limited)
Winsock: Catalog9 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760] (Sophos Limited)
Winsock: Catalog9 20 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [126760] (Sophos Limited)
Winsock: Catalog9-x64 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864] (Sophos Limited)
Winsock: Catalog9-x64 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864] (Sophos Limited)
Winsock: Catalog9-x64 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864] (Sophos Limited)
Winsock: Catalog9-x64 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864] (Sophos Limited)
Winsock: Catalog9-x64 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864] (Sophos Limited)
Winsock: Catalog9-x64 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864] (Sophos Limited)
Winsock: Catalog9-x64 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864] (Sophos Limited)
Winsock: Catalog9-x64 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864] (Sophos Limited)
Winsock: Catalog9-x64 20 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [173864] (Sophos Limited)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Mirjana\AppData\Roaming\Mozilla\Firefox\Profiles\n9w74nir.default
FF DefaultSearchEngine: Ecosia
FF SelectedSearchEngine: Ecosia
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin -> C:\Program Files (x86)\Sony\MSS\3.8.130\npMcAfeeMss.dll No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2462366986-3853951462-1244750843-1001: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101714.dll (Amazon.com, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFFICE.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Extension: DoNotTrackMe: Online Privacy Protection - C:\Users\Mirjana\AppData\Roaming\Mozilla\Firefox\Profiles\n9w74nir.default\Extensions\donottrackplus@abine.com [2014-10-18]
FF Extension: GoogleSharing - C:\Users\Mirjana\AppData\Roaming\Mozilla\Firefox\Profiles\n9w74nir.default\Extensions\googlesharing@extension.thoughtcrime.org [2012-05-12]
FF Extension: WOT - C:\Users\Mirjana\AppData\Roaming\Mozilla\Firefox\Profiles\n9w74nir.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-12-25]
FF Extension: Download videos and MP3s from YouTube - C:\Users\Mirjana\AppData\Roaming\Mozilla\Firefox\Profiles\n9w74nir.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-11-24]
FF Extension: Ghostery - C:\Users\Mirjana\AppData\Roaming\Mozilla\Firefox\Profiles\n9w74nir.default\Extensions\firefox@ghostery.com.xpi [2014-09-03]
FF Extension: Advertising Cookie Opt-out - C:\Users\Mirjana\AppData\Roaming\Mozilla\Firefox\Profiles\n9w74nir.default\Extensions\optout@google.com.xpi [2012-01-27]
FF Extension: Facebook Phishing Protector - C:\Users\Mirjana\AppData\Roaming\Mozilla\Firefox\Profiles\n9w74nir.default\Extensions\{023e9ca0-63f3-47b1-bcb2-9badf9d9ef28}.xpi [2012-01-17]
FF Extension: NoScript - C:\Users\Mirjana\AppData\Roaming\Mozilla\Firefox\Profiles\n9w74nir.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-03-26]
FF Extension: Ecosia — The search engine that plants trees! - C:\Users\Mirjana\AppData\Roaming\Mozilla\Firefox\Profiles\n9w74nir.default\Extensions\{d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}.xpi [2012-05-15]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi [2014-12-03]
FF HKU\S-1-5-21-2462366986-3853951462-1244750843-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-11-24]

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [ekdjfcdinekpfcedakhpngcnaamhiihn] - C:\ProgramData\CodecC\ekdjfcdinekpfcedakhpngcnaamhiihn.crx [Not Found]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [4907232 2014-12-01] (Emsisoft GmbH)
S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
S2 ESRV_SVC; C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe [377768 2013-11-01] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S3 McComponentHostServiceSony; C:\Program Files (x86)\Sony\MSS\3.8.130\McCHSvc.exe [235216 2013-10-16] (McAfee, Inc.)
R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [288552 2014-05-25] (Sophos Limited)
R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [208168 2014-10-14] (Sophos Limited)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [341800 2014-10-14] (Sophos Limited)
R2 Sophos Web Control Service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe [341800 2014-10-14] (Sophos Limited)
R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [3262248 2014-10-14] (Sophos Limited)
S2 swi_update_64; C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe [2065704 2014-10-14] (Sophos Limited)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
R3 USER_ESRV_SVC; C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe [377768 2013-11-01] (Intel Corporation)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [887000 2011-01-20] (Sony Corporation)
R2 VSNService; C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [845312 2010-08-11] (Sony Corporation) [File not signed]
R3 VUAgent; C:\Program Files\Sony\VAIO Update\vuagent.exe [1642544 2014-02-28] (Sony Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [71472 2014-05-12] (Emsisoft GmbH)
R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH)
R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [45208 2013-09-30] (Emsisoft GmbH)
R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [23088 2014-05-12] (Emsisoft GmbH)
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57024 2013-12-04] (Emsisoft GmbH)
S3 igfx; C:\Windows\System32\DRIVERS\igdkmd64.sys [10326784 2010-06-24] (Intel Corporation) [File not signed]
S3 IntcDAud; C:\Windows\System32\DRIVERS\IntcDAud.sys [271872 2010-06-24] (Intel(R) Corporation) [File not signed]
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-28] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [158976 2014-05-25] (Sophos Limited)
S3 sdcfilter; C:\Windows\System32\DRIVERS\sdcfilter.sys [38144 2014-05-25] (Sophos Limited)
S3 semav6thermal64ro; C:\Windows\system32\drivers\semav6thermal64ro.sys [13792 2014-12-28] ()
S4 SophosBootDriver; C:\Windows\System32\DRIVERS\SophosBootDriver.sys [27904 2014-05-25] (Sophos Limited)
S3 ssudobex; C:\Windows\System32\DRIVERS\ssudobex.sys [204568 2013-08-20] (DEVGURU Co., LTD.(www.devguru.co.kr))
R3 vodafone_K380x-z_dc_enum; C:\Windows\System32\DRIVERS\vodafone_K380x-z_dc_enum.sys [75776 2010-05-20] (Vodafone)
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-07-19] (Cisco Systems, Inc.)
S3 massfilter; system32\DRIVERS\massfilter.sys [X]
S3 massfilter_hs; system32\drivers\massfilter_hs.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]
S3 ZTEusbvoice; system32\DRIVERS\ZTEusbvoice.sys [X]
S3 ZTEusbwwan; system32\DRIVERS\ZTEusbwwan.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-28 21:18 - 2014-12-28 21:19 - 00026179 _____ () C:\Users\Mirjana\Desktop\FRST.txt
2014-12-28 21:18 - 2014-12-28 21:18 - 00000000 ____D () C:\FRST
2014-12-28 21:17 - 2014-12-28 21:17 - 00000476 _____ () C:\Users\Mirjana\Desktop\defogger_disable.log
2014-12-28 21:17 - 2014-12-28 21:17 - 00000000 _____ () C:\Users\Mirjana\defogger_reenable
2014-12-28 21:04 - 2014-12-28 21:04 - 02123264 _____ (Farbar) C:\Users\Mirjana\Desktop\FRST64.exe
2014-12-28 21:04 - 2014-12-28 21:04 - 00380416 _____ () C:\Users\Mirjana\Desktop\Gmer-19357.exe
2014-12-28 21:02 - 2014-12-28 21:02 - 00050477 _____ () C:\Users\Mirjana\Desktop\Defogger.exe
2014-12-28 20:21 - 2014-12-28 20:21 - 00003142 _____ () C:\Windows\System32\Tasks\USER_ESRV_SVC
2014-12-28 20:21 - 2014-12-28 20:21 - 00002027 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Care.lnk
2014-12-28 20:21 - 2014-12-28 20:21 - 00000000 __RHD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Care
2014-12-27 22:19 - 2014-12-27 22:19 - 00000670 _____ () C:\EamClean.log
2014-12-27 22:18 - 2014-12-27 22:18 - 00000000 _____ () C:\Windows\SysWOW64\shoF26E.tmp
2014-12-27 22:09 - 2014-12-27 22:09 - 00000000 ____D () C:\ProgramData\Emsisoft
2014-12-27 20:05 - 2014-12-27 20:05 - 00068110 _____ () C:\Users\Mirjana\Desktop\Sophos_1.txt
2014-12-27 18:19 - 2014-12-27 18:19 - 00000000 ____D () C:\Users\Mirjana\Desktop\EEK
2014-12-27 18:09 - 2014-12-27 18:09 - 00602112 _____ (OldTimer Tools) C:\Users\Mirjana\Desktop\OTL.exe
2014-12-27 17:53 - 2014-12-27 17:53 - 00001095 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2014-12-27 17:53 - 2014-12-27 17:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2014-12-27 17:52 - 2014-12-28 20:02 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-12-27 13:10 - 2014-12-27 13:10 - 00003740 _____ () C:\Users\Mirjana\Desktop\Malware_log_3.xml
2014-12-27 12:18 - 2014-06-27 03:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-12-27 12:18 - 2014-06-27 02:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-12-27 12:14 - 2014-12-27 12:14 - 00001132 _____ () C:\Users\Mirjana\Desktop\AdwCleaner_02.txt
2014-12-27 11:42 - 2014-12-27 11:42 - 00000000 _____ () C:\Windows\SysWOW64\sho26B9.tmp
2014-12-27 11:33 - 2013-10-02 03:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-12-27 11:33 - 2013-10-02 03:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-12-27 11:33 - 2013-10-02 03:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-12-27 11:33 - 2013-10-02 02:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-12-27 11:33 - 2013-10-02 02:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-12-27 11:33 - 2013-10-02 02:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-12-27 11:33 - 2013-10-02 02:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-12-27 11:33 - 2013-10-02 01:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-12-27 11:33 - 2013-10-02 01:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2014-12-27 11:33 - 2013-10-02 01:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2014-12-27 11:33 - 2013-10-02 01:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-12-27 11:33 - 2013-10-02 01:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-12-27 11:33 - 2013-10-02 00:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-12-27 11:33 - 2013-10-02 00:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-12-27 11:33 - 2013-10-02 00:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-12-27 11:33 - 2013-10-01 23:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-12-27 11:33 - 2013-10-01 21:57 - 06578176 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-12-27 11:33 - 2013-10-01 21:55 - 05698048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-12-27 11:32 - 2012-08-23 15:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2014-12-27 11:32 - 2012-08-23 14:24 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-12-27 11:31 - 2012-08-23 15:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2014-12-27 11:31 - 2012-08-23 12:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2014-12-27 11:31 - 2012-08-23 11:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2014-12-27 11:31 - 2012-08-23 10:51 - 03174912 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-12-27 11:26 - 2014-12-27 11:26 - 00007796 _____ () C:\Users\Mirjana\Desktop\Malware_log_2.xml
2014-12-27 11:11 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-27 11:11 - 2014-06-24 04:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-12-27 11:11 - 2014-06-24 03:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-12-27 11:11 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-12-27 11:11 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2014-12-27 11:11 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2014-12-27 11:11 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-12-27 10:07 - 2014-12-27 10:07 - 00000000 __SHD () C:\Users\Mirjana\AppData\Local\EmieUserList
2014-12-27 10:07 - 2014-12-27 10:07 - 00000000 __SHD () C:\Users\Mirjana\AppData\Local\EmieSiteList
2014-12-27 10:07 - 2014-12-27 10:07 - 00000000 __SHD () C:\Users\Mirjana\AppData\Local\EmieBrowserModeList
2014-12-27 10:05 - 2014-12-27 10:05 - 00001425 _____ () C:\Users\Mirjana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-12-27 05:36 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-27 05:36 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-12-27 05:08 - 2014-12-27 05:08 - 00000000 _____ () C:\Windows\SysWOW64\sho9C62.tmp
2014-12-27 04:38 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2014-12-27 04:38 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2014-12-27 04:38 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2014-12-27 04:38 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2014-12-27 04:07 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2014-12-27 03:44 - 2014-12-27 03:44 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-12-27 03:44 - 2014-12-27 03:44 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2014-12-27 03:44 - 2014-12-27 03:44 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2014-12-27 03:44 - 2014-12-27 03:44 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2014-12-27 03:44 - 2014-12-27 03:44 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2014-12-27 03:44 - 2014-12-27 03:44 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-12-27 03:44 - 2014-12-27 03:44 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2014-12-27 03:44 - 2014-12-27 03:44 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-12-27 03:44 - 2014-12-27 03:44 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-12-27 03:43 - 2014-12-27 03:43 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-27 03:43 - 2014-12-27 03:43 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-27 03:43 - 2014-12-27 03:43 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-27 03:43 - 2014-12-27 03:43 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2014-12-27 03:43 - 2014-12-27 03:43 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-12-27 03:43 - 2014-12-27 03:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2014-12-27 03:43 - 2014-12-27 03:43 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-27 03:43 - 2014-12-27 03:43 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2014-12-27 03:43 - 2014-12-27 03:43 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-27 03:43 - 2014-12-27 03:43 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-27 03:43 - 2014-12-27 03:43 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2014-12-27 03:43 - 2014-12-27 03:43 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-12-27 03:43 - 2014-12-27 03:43 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2014-12-27 03:43 - 2014-12-27 03:43 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2014-12-27 03:43 - 2014-12-27 03:43 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-12-27 03:43 - 2014-12-27 03:43 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-12-27 03:43 - 2014-12-27 03:43 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-12-27 03:43 - 2014-12-27 03:43 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-12-27 03:43 - 2014-12-27 03:43 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-12-27 03:43 - 2014-12-27 03:43 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 01175552 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00604160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00010752 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00010752 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00009728 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00009728 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00002560 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2014-12-27 03:38 - 2014-12-27 03:38 - 00002560 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2014-12-27 00:50 - 2014-12-27 00:50 - 00039771 _____ () C:\Users\Mirjana\Desktop\AdwCleaner_01.txt
2014-12-27 00:32 - 2014-12-27 00:25 - 00146834 _____ () C:\Users\Mirjana\Desktop\Malwarebytes Anti-Malware_log_1.xml
2014-12-27 00:17 - 2014-12-27 12:08 - 00000000 ____D () C:\AdwCleaner
2014-12-27 00:16 - 2014-12-27 00:16 - 02173952 _____ () C:\Users\Mirjana\Desktop\AdwCleaner_4.106.exe
2014-12-26 23:22 - 2014-12-28 20:54 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-26 23:21 - 2014-12-26 23:21 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-26 23:21 - 2014-12-26 23:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-26 23:21 - 2014-12-26 23:21 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-26 23:21 - 2014-12-26 23:21 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-12-26 23:21 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-26 23:21 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-26 23:21 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-26 18:49 - 2014-12-26 23:17 - 00000000 ____D () C:\Users\Mirjana\AppData\Roaming\Zyfiwe
2014-12-26 16:45 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-12-26 16:45 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-12-26 16:45 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-12-26 16:45 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-12-26 16:45 - 2014-07-09 03:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-12-26 16:45 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-12-26 16:45 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-12-26 16:45 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-12-26 16:45 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-12-26 16:45 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-12-26 16:45 - 2014-07-08 23:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-12-26 16:45 - 2014-07-08 23:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-12-23 22:17 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-23 22:17 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-12-23 22:17 - 2014-07-07 03:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2014-12-23 22:17 - 2014-07-07 03:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2014-12-23 22:17 - 2014-07-07 03:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2014-12-23 22:17 - 2014-07-07 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2014-12-23 22:17 - 2014-07-07 02:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2014-12-23 22:17 - 2014-07-07 02:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2014-12-23 22:17 - 2014-07-07 02:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2014-12-23 22:17 - 2014-07-07 02:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2014-12-23 22:04 - 2014-01-28 03:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-12-23 22:04 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2014-12-23 22:04 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2014-12-23 22:04 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2014-12-23 22:04 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2014-12-23 22:04 - 2013-03-19 06:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll
2014-12-23 22:03 - 2013-07-09 06:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2014-12-23 22:03 - 2013-07-09 05:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2014-12-23 22:03 - 2012-10-09 19:17 - 00226816 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore6.dll
2014-12-23 22:03 - 2012-10-09 19:17 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc6.dll
2014-12-23 22:03 - 2012-10-09 18:40 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcore6.dll
2014-12-23 22:03 - 2012-10-09 18:40 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcsvc6.dll
2014-12-23 22:01 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-23 22:01 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-23 22:01 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-23 22:01 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-23 22:01 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-23 22:01 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-23 22:01 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-23 22:01 - 2014-03-04 10:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-12-23 22:01 - 2014-03-04 10:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-12-23 22:01 - 2014-03-04 10:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-12-23 22:01 - 2014-03-04 10:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-12-23 22:01 - 2014-03-04 10:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-12-23 22:01 - 2014-03-04 10:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-12-23 22:01 - 2014-03-04 10:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-12-23 22:01 - 2014-03-04 10:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-12-23 22:01 - 2014-03-04 10:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-12-23 22:01 - 2014-03-04 09:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-12-23 22:01 - 2014-03-04 09:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-12-23 22:01 - 2013-08-02 03:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 02:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2014-12-23 22:01 - 2013-08-02 01:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 01:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 01:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2014-12-23 22:01 - 2013-08-02 01:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2014-12-23 22:00 - 2014-08-01 12:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-12-23 22:00 - 2014-08-01 12:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-12-23 22:00 - 2014-04-25 03:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-12-23 22:00 - 2014-04-25 03:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-12-23 21:58 - 2014-06-18 23:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-12-23 21:58 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-12-23 21:58 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-12-23 21:58 - 2014-06-18 23:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-12-23 21:58 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-12-23 21:58 - 2014-06-18 23:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-12-23 21:58 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2014-12-23 21:58 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2014-12-23 21:58 - 2013-07-09 06:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2014-12-23 21:58 - 2013-07-09 06:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2014-12-23 21:58 - 2013-07-09 05:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2014-12-23 21:58 - 2013-07-09 05:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2014-12-23 21:57 - 2014-07-14 03:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-12-23 21:57 - 2014-07-14 02:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-12-23 21:57 - 2014-04-05 03:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-12-23 21:57 - 2014-04-05 03:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-12-23 21:57 - 2014-01-29 03:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-12-23 21:57 - 2014-01-29 03:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-12-23 21:57 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-12-23 21:57 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2014-12-23 21:57 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2014-12-23 21:57 - 2013-08-05 03:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2014-12-23 21:56 - 2014-10-14 03:13 - 00683520 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-12-23 21:56 - 2014-10-14 03:09 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2014-12-23 21:56 - 2014-10-14 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2014-12-23 21:56 - 2014-10-14 02:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2014-12-23 21:56 - 2014-10-14 02:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2014-12-23 21:56 - 2014-03-26 15:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-12-23 21:56 - 2014-03-26 15:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-12-23 21:56 - 2014-03-26 15:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-12-23 21:56 - 2014-03-26 15:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-12-23 21:56 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2014-12-23 21:56 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2014-12-23 21:55 - 2014-06-18 03:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-12-23 21:55 - 2014-06-18 02:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-12-23 21:55 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-12-23 21:55 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-12-23 21:55 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-12-23 21:55 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-12-23 21:55 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-12-23 21:55 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-12-23 21:55 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-12-23 21:55 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-12-23 21:55 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-12-23 21:55 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-12-23 21:55 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-12-23 21:55 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-12-23 21:55 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-12-23 21:55 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-12-23 21:55 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-12-23 21:55 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-12-23 21:55 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-12-23 21:55 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-12-23 21:55 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2014-12-23 21:55 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2014-12-23 21:55 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2014-12-23 21:55 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2014-12-23 21:55 - 2013-07-25 10:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2014-12-23 21:55 - 2013-07-25 09:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2014-12-23 21:55 - 2013-07-03 05:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2014-12-23 21:55 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2014-12-23 21:55 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2014-12-23 21:55 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2014-12-23 21:55 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2014-12-23 21:55 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2014-12-23 21:55 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2014-12-23 21:55 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2014-12-23 21:55 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2014-12-23 21:55 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2014-12-23 21:55 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2014-12-23 21:55 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2014-12-23 21:55 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2014-12-23 21:54 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-23 21:54 - 2014-08-21 07:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-12-23 21:54 - 2014-08-21 07:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-12-23 21:54 - 2014-08-21 07:26 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-12-23 21:54 - 2014-08-21 07:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-12-23 21:54 - 2014-06-06 11:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-12-23 21:54 - 2014-06-06 10:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-12-23 21:54 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-12-23 21:54 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-12-23 21:54 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-12-23 21:54 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-12-23 21:54 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-12-23 21:54 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-12-23 21:54 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-12-23 21:54 - 2013-04-26 00:30 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2014-12-23 21:54 - 2013-03-31 23:52 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2014-12-23 21:54 - 2012-10-03 18:44 - 00303104 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2014-12-23 21:54 - 2012-10-03 18:44 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\netcorehc.dll
2014-12-23 21:54 - 2012-10-03 18:44 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2014-12-23 21:54 - 2012-10-03 18:44 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2014-12-23 21:54 - 2012-10-03 18:44 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\netevent.dll
2014-12-23 21:54 - 2012-10-03 18:42 - 00569344 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll
2014-12-23 21:54 - 2012-10-03 17:42 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcorehc.dll
2014-12-23 21:54 - 2012-10-03 17:42 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2014-12-23 21:54 - 2012-10-03 17:42 - 00018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netevent.dll
2014-12-23 21:54 - 2012-10-03 17:07 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2014-12-23 21:54 - 2012-08-22 19:12 - 00950128 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2014-12-23 21:54 - 2012-07-04 21:26 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\RNDISMP.sys
2014-12-23 21:54 - 2012-01-13 08:12 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2014-12-23 21:53 - 2014-05-30 07:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-12-23 21:53 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2014-12-23 21:53 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2014-12-23 21:53 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2014-12-23 21:52 - 2013-07-04 13:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2014-12-23 21:52 - 2013-07-04 13:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2014-12-23 21:52 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2014-12-23 21:52 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2014-12-23 21:52 - 2013-07-04 11:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2014-12-23 21:52 - 2012-08-21 22:01 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\OxpsConverter.exe
2014-12-23 21:50 - 2014-03-04 10:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-12-23 21:50 - 2014-03-04 10:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-12-23 21:50 - 2014-03-04 10:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-12-23 21:50 - 2014-03-04 10:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-12-23 21:50 - 2014-03-04 10:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-12-23 21:50 - 2014-03-04 10:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-12-23 21:50 - 2014-03-04 10:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-12-23 21:50 - 2014-03-04 10:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-12-23 21:50 - 2014-03-04 10:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-12-23 21:50 - 2014-03-04 10:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-12-23 21:50 - 2014-03-04 10:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-12-23 21:50 - 2014-03-04 10:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-12-23 21:50 - 2014-03-04 10:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-12-23 21:50 - 2014-03-04 10:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-12-23 21:50 - 2014-03-04 10:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-12-23 21:50 - 2014-03-04 10:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-12-23 21:50 - 2014-03-04 10:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-12-23 21:50 - 2014-03-04 10:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-12-23 21:50 - 2014-03-04 10:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-12-23 21:50 - 2013-08-02 03:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2014-12-23 21:50 - 2013-08-02 03:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2014-12-23 21:50 - 2013-08-02 02:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2014-12-23 21:50 - 2013-08-02 01:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2014-12-23 21:49 - 2014-08-12 03:02 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL
2014-12-23 21:49 - 2014-08-12 02:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL
2014-12-23 21:49 - 2014-06-16 03:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-12-23 21:49 - 2013-04-10 07:01 - 00265064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2014-12-23 21:49 - 2011-02-03 12:25 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-12-23 21:48 - 2014-10-03 03:12 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2014-12-23 21:48 - 2014-10-03 03:11 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2014-12-23 21:48 - 2014-10-03 03:11 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2014-12-23 21:48 - 2014-10-03 03:11 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2014-12-23 21:48 - 2014-10-03 03:11 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2014-12-23 21:48 - 2014-10-03 02:44 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2014-12-23 21:48 - 2014-10-03 02:44 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2014-12-23 21:48 - 2014-10-03 02:44 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2014-12-23 21:48 - 2014-09-25 03:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-12-23 21:48 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-12-23 21:48 - 2013-09-08 03:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2014-12-23 21:48 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2014-12-23 21:48 - 2013-07-26 03:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2014-12-23 21:48 - 2013-07-26 02:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2014-12-23 21:46 - 2014-02-04 03:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-12-23 21:46 - 2014-02-04 03:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-12-23 21:46 - 2014-02-04 03:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-12-23 21:46 - 2014-02-04 03:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-12-23 21:46 - 2014-02-04 03:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-12-23 21:46 - 2013-08-29 03:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2014-12-23 21:46 - 2013-08-29 03:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2014-12-23 21:46 - 2013-08-29 03:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2014-12-23 21:46 - 2013-08-29 02:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2014-12-23 21:46 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2014-12-23 21:46 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2014-12-23 21:45 - 2014-11-11 04:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-12-23 21:45 - 2014-11-11 04:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll
2014-12-23 21:45 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-12-23 21:45 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll
2014-12-23 21:45 - 2014-10-14 03:16 - 00155064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-12-23 21:45 - 2014-10-14 03:12 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-12-23 21:45 - 2014-10-14 02:50 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-12-23 21:45 - 2014-10-14 02:49 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-12-23 21:45 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-12-23 21:45 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-23 21:45 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-12-23 21:45 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-12-23 21:45 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-12-23 21:45 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-12-23 21:45 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2014-12-23 21:45 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2014-12-23 21:45 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2014-12-23 21:45 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2014-12-23 21:45 - 2014-09-04 06:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-12-23 21:45 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-12-23 21:45 - 2014-04-12 03:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-12-23 21:45 - 2014-04-12 03:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-12-23 21:45 - 2014-04-12 03:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-12-23 21:45 - 2014-04-12 03:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-12-23 21:45 - 2014-04-12 03:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-12-23 21:45 - 2013-05-10 06:49 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2014-12-23 21:45 - 2013-05-10 04:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2014-12-23 21:43 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-23 21:43 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2014-12-23 21:43 - 2014-06-25 03:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-12-23 21:43 - 2014-06-25 02:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-12-23 21:43 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2014-12-23 21:43 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2014-12-23 21:43 - 2013-04-26 06:51 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2014-12-23 21:43 - 2013-04-26 05:55 - 00492544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2014-12-23 21:43 - 2012-11-23 04:13 - 00068608 _____ (Microsoft Corporation) C:\Windows\system32\taskhost.exe
2014-12-23 21:42 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-23 21:42 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-12-23 21:42 - 2014-09-19 10:42 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-12-23 21:42 - 2014-09-19 10:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-12-23 21:42 - 2014-09-19 10:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-12-23 21:42 - 2014-09-19 10:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-12-23 21:42 - 2014-09-19 10:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-12-23 21:42 - 2014-09-19 10:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-12-23 21:42 - 2014-09-19 10:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-12-23 21:42 - 2014-09-19 10:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-12-23 21:42 - 2014-09-19 10:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-12-23 21:42 - 2014-09-19 10:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-12-23 21:42 - 2014-09-19 10:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-12-23 21:42 - 2014-09-19 10:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-12-23 21:41 - 2014-07-17 03:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-12-23 21:41 - 2014-07-17 03:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-12-23 21:41 - 2014-07-17 03:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-12-23 21:41 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-12-23 21:41 - 2014-07-17 02:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-12-23 21:41 - 2014-07-17 02:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-12-23 21:40 - 2014-10-25 02:57 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-12-23 21:40 - 2014-10-25 02:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-12-23 21:39 - 2014-10-10 01:57 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-12-23 21:32 - 2014-06-30 23:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-12-23 21:32 - 2014-06-30 23:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-12-23 21:32 - 2014-03-09 22:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-12-23 21:32 - 2014-03-09 22:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-12-23 21:32 - 2014-03-09 22:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-12-23 21:32 - 2014-03-09 22:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-12-23 21:31 - 2014-06-06 07:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-12-23 21:31 - 2014-06-06 07:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-12-23 21:22 - 2014-10-14 03:13 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-12-23 21:22 - 2014-10-14 02:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-12-23 21:22 - 2014-06-03 11:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-12-23 21:22 - 2014-06-03 11:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-12-23 21:22 - 2014-06-03 11:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-12-23 21:22 - 2014-06-03 10:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-12-23 21:22 - 2014-06-03 10:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-12-23 21:22 - 2014-01-24 03:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-12-23 21:22 - 2013-02-27 06:47 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2014-12-23 21:20 - 2013-05-13 06:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2014-12-23 21:20 - 2013-05-13 04:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2014-12-23 21:20 - 2013-05-13 04:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2014-12-23 21:20 - 2013-05-13 04:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2014-12-23 21:19 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2014-12-23 21:19 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2014-12-23 21:19 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2014-12-23 21:19 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2014-12-23 21:19 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2014-12-23 21:19 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2014-12-23 21:19 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2014-12-23 21:19 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2014-12-23 21:19 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2014-12-23 21:18 - 2014-10-18 03:05 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-12-23 21:18 - 2014-10-18 02:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2014-12-23 21:18 - 2014-08-23 03:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-12-23 21:18 - 2014-08-23 02:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-12-23 21:17 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2014-12-23 21:17 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2014-12-23 21:17 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2014-12-23 21:17 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2014-12-23 21:17 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2014-12-23 21:17 - 2013-08-28 02:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2014-12-23 15:38 - 2014-05-14 17:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-12-23 15:38 - 2014-05-14 17:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-12-23 15:38 - 2014-05-14 17:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-12-23 15:38 - 2014-05-14 17:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-12-23 15:37 - 2014-05-14 17:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-12-23 15:37 - 2014-05-14 17:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-12-23 15:37 - 2014-05-14 17:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-12-23 15:37 - 2014-05-14 17:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-12-23 15:37 - 2014-05-14 17:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-12-23 15:37 - 2014-05-14 17:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-12-23 15:37 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-12-23 15:37 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-12-23 15:37 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-12-23 15:37 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-12-23 15:25 - 2014-12-23 15:25 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-21 15:29 - 2014-12-21 15:29 - 00000000 ____D () C:\Windows\system32\SPReview
2014-12-21 15:27 - 2014-12-21 15:27 - 00000000 ____D () C:\Windows\system32\EventProviders
2014-12-21 15:06 - 2010-11-05 02:57 - 00048976 _____ (Microsoft Corporation) C:\Windows\system32\netfxperf.dll
2014-12-21 15:05 - 2010-11-20 14:39 - 05066752 _____ (Microsoft Corporation) C:\Windows\system32\AuthFWSnapin.dll
2014-12-21 15:05 - 2010-11-20 14:34 - 00215936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vhdmp.sys
2014-12-21 15:05 - 2010-11-20 14:33 - 00299392 _____ (Microsoft Corporation) C:\Windows\system32\mcupdate_GenuineIntel.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 03860992 _____ (Microsoft Corporation) C:\Windows\system32\UIRibbon.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 03650560 _____ (Microsoft Corporation) C:\Windows\system32\MSVidCtl.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 03027968 _____ (Microsoft Corporation) C:\Windows\system32\WMVCORE.DLL
2014-12-21 15:05 - 2010-11-20 14:27 - 03008000 _____ (Microsoft Corporation) C:\Windows\system32\xpsservices.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 02652160 _____ (Microsoft Corporation) C:\Windows\system32\netshell.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 02543616 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 02086912 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 02055680 _____ (Microsoft Corporation) C:\Windows\system32\Query.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 01900544 _____ (Microsoft Corporation) C:\Windows\system32\setupapi.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 01808384 _____ (Microsoft Corporation) C:\Windows\system32\pnidui.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 01753088 _____ (Microsoft Corporation) C:\Windows\system32\vssapi.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 01743360 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 01646080 _____ (Microsoft Corporation) C:\Windows\system32\wevtsvc.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 01556992 _____ (Microsoft Corporation) C:\Windows\system32\RacEngn.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 01509888 _____ (Microsoft Corporation) C:\Windows\system32\msdtctm.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 01326080 _____ (Microsoft Corporation) C:\Windows\system32\NaturalLanguage6.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 01281024 _____ (Microsoft Corporation) C:\Windows\system32\werconcpl.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 01212416 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 01197056 _____ (Microsoft Corporation) C:\Windows\system32\taskschd.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 01158656 _____ (Microsoft Corporation) C:\Windows\system32\webservices.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 01110016 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 01098240 _____ (Microsoft Corporation) C:\Windows\system32\Vault.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 01008128 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 00867840 _____ (Microsoft Corporation) C:\Windows\system32\SearchFolder.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 00849920 _____ (Microsoft Corporation) C:\Windows\system32\qmgr.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 00758784 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceApi.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 00720896 _____ (Microsoft Corporation) C:\Windows\system32\odbc32.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 00695808 _____ (Microsoft Corporation) C:\Windows\system32\netlogon.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 00582656 _____ (Microsoft Corporation) C:\Windows\system32\sxs.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 00577536 _____ (Microsoft Corporation) C:\Windows\system32\WSDApi.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\netcfgx.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 00512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 00481280 _____ (Microsoft Corporation) C:\Windows\system32\wmpps.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 00476160 _____ (Microsoft Corporation) C:\Windows\system32\QAGENTRT.DLL
2014-12-21 15:05 - 2010-11-20 14:27 - 00473600 _____ (Microsoft Corporation) C:\Windows\system32\taskcomp.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\shlwapi.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 00444416 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 00312832 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 00299520 _____ (Microsoft Corporation) C:\Windows\system32\tsmf.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\ws2_32.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\QAGENT.DLL
2014-12-21 15:05 - 2010-11-20 14:27 - 00263168 _____ (Microsoft Corporation) C:\Windows\system32\spwizui.dll
2014-12-21 15:05 - 2010-11-20 14:27 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\sqmapi.dll
2014-12-21 15:05 - 2010-11-20 14:26 - 03391488 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll
2014-12-21 15:05 - 2010-11-20 14:26 - 03205120 _____ (Microsoft Corporation) C:\Windows\system32\mmcndmgr.dll
2014-12-21 15:05 - 2010-11-20 14:26 - 02067456 _____ (Microsoft Corporation) C:\Windows\system32\d3d9.dll
2014-12-21 15:05 - 2010-11-20 14:26 - 01866240 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2014-12-21 15:05 - 2010-11-20 14:26 - 01632256 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2014-12-21 15:05 - 2010-11-20 14:26 - 01340416 _____ (Microsoft Corporation) C:\Windows\system32\diagperf.dll
2014-12-21 15:05 - 2010-11-20 14:26 - 01244160 _____ (Microsoft Corporation) C:\Windows\system32\imapi2fs.dll
2014-12-21 15:05 - 2010-11-20 14:26 - 00828416 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll
2014-12-21 15:05 - 2010-11-20 14:26 - 00777728 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2014-12-21 15:05 - 2010-11-20 14:26 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\ipsmsnap.dll
2014-12-21 15:05 - 2010-11-20 14:26 - 00381440 _____ (Microsoft Corporation) C:\Windows\system32\mfds.dll
2014-12-21 15:05 - 2010-11-20 14:26 - 00317952 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore.dll
2014-12-21 15:05 - 2010-11-20 14:26 - 00295936 _____ (Microsoft Corporation) C:\Windows\system32\framedynos.dll
2014-12-21 15:05 - 2010-11-20 14:26 - 00281600 _____ (Microsoft) C:\Windows\system32\DShowRdpFilter.dll
2014-12-21 15:05 - 2010-11-20 14:26 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\hgprint.dll
2014-12-21 15:05 - 2010-11-20 14:25 - 03957760 _____ (Microsoft Corporation) C:\Windows\system32\WinSAT.exe
2014-12-21 15:05 - 2010-11-20 14:25 - 01975296 _____ (Microsoft Corporation) C:\Windows\system32\CertEnroll.dll
2014-12-21 15:05 - 2010-11-20 14:25 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\certmgr.dll
2014-12-21 15:05 - 2010-11-20 14:25 - 01600512 _____ (Microsoft Corporation) C:\Windows\system32\VSSVC.exe
2014-12-21 15:05 - 2010-11-20 14:25 - 01504256 _____ (Microsoft Corporation) C:\Windows\system32\wbengine.exe
2014-12-21 15:05 - 2010-11-20 14:25 - 00958464 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2014-12-21 15:05 - 2010-11-20 14:25 - 00897536 _____ (Microsoft Corporation) C:\Windows\system32\azroles.dll
2014-12-21 15:05 - 2010-11-20 14:25 - 00705024 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2014-12-21 15:05 - 2010-11-20 14:25 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\spinstall.exe
2014-12-21 15:05 - 2010-11-20 14:25 - 00594432 _____ (Microsoft Corporation) C:\Windows\system32\comdlg32.dll
2014-12-21 15:05 - 2010-11-20 14:25 - 00464384 _____ (Microsoft Corporation) C:\Windows\system32\taskeng.exe
2014-12-21 15:05 - 2010-11-20 14:25 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2014-12-21 15:05 - 2010-11-20 14:25 - 00301568 _____ (Microsoft Corporation) C:\Windows\system32\spreview.exe
2014-12-21 15:05 - 2010-11-20 14:24 - 00653312 _____ (Microsoft Corporation) C:\Windows\system32\lpksetup.exe
2014-12-21 15:05 - 2010-11-20 14:24 - 00345088 _____ (Microsoft Corporation) C:\Windows\system32\cmd.exe
2014-12-21 15:05 - 2010-11-20 14:24 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\lsm.exe
2014-12-21 15:05 - 2010-11-20 14:24 - 00272896 _____ (Microsoft Corporation) C:\Windows\system32\mcbuilder.exe
2014-12-21 15:05 - 2010-11-20 13:32 - 05066752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AuthFWSnapin.dll
2014-12-21 15:05 - 2010-11-20 13:21 - 01667584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setupapi.dll
2014-12-21 15:05 - 2010-11-20 13:21 - 01363456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Query.dll
2014-12-21 15:05 - 2010-11-20 13:21 - 01128448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vssapi.dll
2014-12-21 15:05 - 2010-11-20 13:21 - 01115136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RacEngn.dll
2014-12-21 15:05 - 2010-11-20 13:21 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFolder.dll
2014-12-21 15:05 - 2010-11-20 13:21 - 00505856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskschd.dll
2014-12-21 15:05 - 2010-11-20 13:21 - 00351232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2014-12-21 15:05 - 2010-11-20 13:21 - 00270848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsmf.dll
2014-12-21 15:05 - 2010-11-20 13:21 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\upnp.dll
2014-12-21 15:05 - 2010-11-20 13:20 - 01414144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2014-12-21 15:05 - 2010-11-20 13:20 - 00573440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbc32.dll
2014-12-21 15:05 - 2010-11-20 13:20 - 00563712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netlogon.dll
2014-12-21 15:05 - 2010-11-20 13:20 - 00406528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcfgx.dll
2014-12-21 15:05 - 2010-11-20 13:19 - 02291712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSVidCtl.dll
2014-12-21 15:05 - 2010-11-20 13:19 - 02151936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmcndmgr.dll
2014-12-21 15:05 - 2010-11-20 13:19 - 01493504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2014-12-21 15:05 - 2010-11-20 13:19 - 00954752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc40.dll
2014-12-21 15:05 - 2010-11-20 13:19 - 00954288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc40u.dll
2014-12-21 15:05 - 2010-11-20 13:18 - 02522624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll
2014-12-21 15:05 - 2010-11-20 13:18 - 01828352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d9.dll
2014-12-21 15:05 - 2010-11-20 13:18 - 01371136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2014-12-21 15:05 - 2010-11-20 13:18 - 01334272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CertEnroll.dll
2014-12-21 15:05 - 2010-11-20 13:18 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2014-12-21 15:05 - 2010-11-20 13:18 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2014-12-21 15:05 - 2010-11-20 13:18 - 00252928 _____ (Microsoft) C:\Windows\SysWOW64\DShowRdpFilter.dll
2014-12-21 15:05 - 2010-11-20 13:18 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dot3api.dll
2014-12-21 15:05 - 2010-11-20 12:05 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\rdpdd.dll
2014-12-21 15:05 - 2010-11-20 10:25 - 00753664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2014-12-21 15:05 - 2010-11-20 10:23 - 00261632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2014-12-21 15:05 - 2010-11-05 03:20 - 00347904 _____ () C:\Windows\system32\systemsf.ebd
2014-12-21 15:05 - 2010-11-05 02:58 - 00297808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscoree.dll
2014-12-21 15:05 - 2010-11-05 02:58 - 00049488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netfxperf.dll
2014-12-21 15:05 - 2010-11-05 02:57 - 00444752 _____ (Microsoft Corporation) C:\Windows\system32\mscoree.dll
2014-12-21 15:05 - 2010-11-05 02:53 - 00320352 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHost.exe
2014-12-21 15:05 - 2010-11-05 02:53 - 00295264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationHost.exe
2014-12-21 15:05 - 2010-11-05 02:53 - 00109928 _____ (Microsoft Corporation) C:\Windows\system32\PresentationHostProxy.dll
2014-12-21 15:05 - 2010-11-05 02:53 - 00099176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationHostProxy.dll
2014-12-21 15:05 - 2009-07-14 02:16 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tcpmonui.dll
2014-12-21 15:04 - 2010-11-20 14:44 - 01077248 _____ (Microsoft Corporation) C:\Windows\system32\Narrator.exe
2014-12-21 15:04 - 2010-11-20 14:34 - 00363392 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volmgrx.sys
2014-12-21 15:04 - 2010-11-20 14:34 - 00295808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2014-12-21 15:04 - 2010-11-20 14:34 - 00071552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volmgr.sys
2014-12-21 15:04 - 2010-11-20 14:33 - 00366976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msrpc.sys
2014-12-21 15:04 - 2010-11-20 14:33 - 00289664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fltMgr.sys
2014-12-21 15:04 - 2010-11-20 14:33 - 00263040 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
2014-12-21 15:04 - 2010-11-20 14:33 - 00213888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdyboost.sys
2014-12-21 15:04 - 2010-11-20 14:33 - 00184704 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
2014-12-21 15:04 - 2010-11-20 14:33 - 00171392 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\scsiport.sys
2014-12-21 15:04 - 2010-11-20 14:33 - 00155008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpio.sys
2014-12-21 15:04 - 2010-11-20 14:33 - 00140672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msdsm.sys
2014-12-21 15:04 - 2010-11-20 14:33 - 00103808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sbp2port.sys
2014-12-21 15:04 - 2010-11-20 14:33 - 00094592 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2014-12-21 15:04 - 2010-11-20 14:33 - 00078720 _____ (Hewlett-Packard Company) C:\Windows\system32\Drivers\HpSAMD.sys
2014-12-21 15:04 - 2010-11-20 14:33 - 00063360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\termdd.sys
2014-12-21 15:04 - 2010-11-20 14:33 - 00031104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msahci.sys
2014-12-21 15:04 - 2010-11-20 14:33 - 00014720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hwpolicy.sys
2014-12-21 15:04 - 2010-11-20 14:32 - 02217856 _____ (Microsoft Corporation) C:\Windows\system32\bootres.dll
2014-12-21 15:04 - 2010-11-20 14:32 - 00334208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\acpi.sys
2014-12-21 15:04 - 2010-11-20 14:32 - 00179072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys
2014-12-21 15:04 - 2010-11-20 14:29 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll
2014-12-21 15:04 - 2010-11-20 14:28 - 00780008 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2014-12-21 15:04 - 2010-11-20 14:28 - 00298104 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll
2014-12-21 15:04 - 2010-11-20 14:28 - 00166784 _____ (Microsoft Corporation) C:\Windows\system32\basecsp.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 02851840 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll

Mira_11 · 29.12.2014, 01:55

FRST, Teil 2:

Code:

ATTFilter

2014-12-21 15:04 - 2010-11-20 14:27 - 02262528 _____ (Microsoft Corporation) C:\Windows\system32\SyncCenter.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 02250752 _____ (Microsoft Corporation) C:\Windows\system32\SensorsCpl.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 02193920 _____ (Microsoft Corporation) C:\Windows\system32\themecpl.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 02146816 _____ (Microsoft Corporation) C:\Windows\system32\networkmap.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 02072576 _____ (Microsoft Corporation) C:\Windows\system32\WMPEncEn.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 01689600 _____ (Microsoft Corporation) C:\Windows\system32\netcenter.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 01441280 _____ (Microsoft Corporation) C:\Windows\system32\wlanpref.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\system32\pla.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 01363968 _____ (Microsoft Corporation) C:\Windows\system32\wdc.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 01243136 _____ (Microsoft Corporation) C:\Windows\system32\WMNetMgr.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 01160192 _____ (Microsoft Corporation) C:\Windows\system32\MSMPEG2ENC.DLL
2014-12-21 15:04 - 2010-11-20 14:27 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\sdengin2.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 01082880 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 01050624 _____ (Microsoft Corporation) C:\Windows\system32\printui.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 01024512 _____ (Microsoft Corporation) C:\Windows\system32\wmpmde.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00933888 _____ (Microsoft Corporation) C:\Windows\system32\sqlsrv32.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00898560 _____ (Microsoft Corporation) C:\Windows\system32\OobeFldr.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00812032 _____ (Microsoft Corporation) C:\Windows\system32\wpccpl.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00799744 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00769536 _____ (Microsoft Corporation) C:\Windows\system32\sud.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\sdcpl.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00691200 _____ (Microsoft Corporation) C:\Windows\system32\VAN.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\PerfCenterCPL.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00633344 _____ (Microsoft Corporation) C:\Windows\system32\riched20.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00625664 _____ (Microsoft Corporation) C:\Windows\system32\usercpl.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00625664 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00611840 _____ (Microsoft Corporation) C:\Windows\system32\wpd_ci.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00605696 _____ (Microsoft Corporation) C:\Windows\system32\wmpeffects.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\wiaservc.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\mspbda.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\msdri.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\WinSATAPI.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\powercpl.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00483840 _____ (Microsoft Corporation) C:\Windows\system32\StructuredQuery.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00475136 _____ (Microsoft Corporation) C:\Windows\system32\wlangpui.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00462336 _____ (Microsoft Corporation) C:\Windows\system32\wiadefui.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\nshipsec.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\puiobj.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\systemcpl.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00418816 _____ (Microsoft Corporation) C:\Windows\system32\sppwinob.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\prnfldr.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\wlanui.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00409600 _____ (Microsoft Corporation) C:\Windows\system32\photowiz.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00406016 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00403968 _____ (Microsoft Corporation) C:\Windows\system32\untfs.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\mtxclu.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00370688 _____ (Microsoft Corporation) C:\Windows\system32\shsvcs.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\wcncsvc.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00366080 _____ (Microsoft Corporation) C:\Windows\system32\zipfldr.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00357888 _____ (Microsoft Corporation) C:\Windows\system32\sharemediacpl.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\rasmans.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\srchadmin.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\netdiagfx.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\tapisrv.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\scansetting.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00300032 _____ (Microsoft Corporation) C:\Windows\system32\pdh.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00268288 _____ (Microsoft Corporation) C:\Windows\system32\MSAC3ENC.DLL
2014-12-21 15:04 - 2010-11-20 14:27 - 00264192 _____ (Microsoft Corporation) C:\Windows\system32\upnp.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00263168 _____ (Microsoft Corporation) C:\Windows\system32\vpnike.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00257024 _____ (Microsoft Corporation) C:\Windows\system32\stobject.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00253440 _____ (Microsoft Corporation) C:\Windows\system32\tcpipcfg.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00244224 _____ (Microsoft Corporation) C:\Windows\system32\spp.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\taskbarcpl.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00236032 _____ (Microsoft Corporation) C:\Windows\system32\srvsvc.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\onex.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00232960 _____ (Microsoft Corporation) C:\Windows\system32\scecli.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00232448 _____ (Microsoft Corporation) C:\Windows\system32\sppcomapi.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\XpsRasterService.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\SndVolSSO.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\wmpsrcwp.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\QSHVHOST.DLL
2014-12-21 15:04 - 2010-11-20 14:27 - 00222720 _____ (Microsoft Corporation) C:\Windows\system32\wwanconn.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00221696 _____ (Microsoft Corporation) C:\Windows\system32\OnLineIDCpl.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\netiohlp.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00211456 _____ (Microsoft Corporation) C:\Windows\system32\rasppp.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00200192 _____ (Microsoft Corporation) C:\Windows\system32\syncui.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00193024 _____ (Microsoft Corporation) C:\Windows\system32\netplwiz.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00188928 _____ (Microsoft Corporation) C:\Windows\system32\netjoin.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\provsvc.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00183808 _____ (Microsoft Corporation) C:\Windows\system32\prncache.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\twext.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00165376 _____ (Microsoft Corporation) C:\Windows\system32\netid.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00161792 _____ (Microsoft Corporation) C:\Windows\system32\ocsetapi.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\prntvpt.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00154624 _____ (Microsoft Corporation) C:\Windows\system32\uxlib.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00148992 _____ (Microsoft Corporation) C:\Windows\system32\t2embed.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\recovery.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\shsetup.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00121856 _____ (Microsoft Corporation) C:\Windows\system32\SessEnv.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00118784 _____ (Microsoft Corporation) C:\Windows\system32\wkssvc.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00117248 _____ (Microsoft Corporation) C:\Windows\system32\wpdbusenum.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00115200 _____ (Microsoft Corporation) C:\Windows\system32\WPDShServiceObj.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\thumbcache.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\userenv.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\QUTIL.DLL
2014-12-21 15:04 - 2010-11-20 14:27 - 00095232 _____ (Microsoft Corporation) C:\Windows\system32\regapi.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\TabSvc.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\nci.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\samcli.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\RpcRtRemote.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\wscapi.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\rtutils.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\msasn1.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\vpnikeapi.dll
2014-12-21 15:04 - 2010-11-20 14:27 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\sisbkup.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 01457664 _____ (Microsoft Corporation) C:\Windows\system32\DxpTaskSync.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\DiagCpl.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 01066496 _____ (Microsoft Corporation) C:\Windows\system32\Display.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 01009152 _____ (Microsoft Corporation) C:\Windows\system32\mcmde.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00934912 _____ (Microsoft Corporation) C:\Windows\system32\FirewallControlPanel.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00861184 _____ (Microsoft Corporation) C:\Windows\system32\fontext.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00701440 _____ (Microsoft Corporation) C:\Windows\system32\dsuiext.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00675328 _____ (Microsoft Corporation) C:\Windows\system32\DXPTaskRingtone.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00551936 _____ (Microsoft Corporation) C:\Windows\system32\localsec.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00508928 _____ (Microsoft Corporation) C:\Windows\system32\DeviceCenter.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\imapi2.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\IPSECSVC.DLL
2014-12-21 15:04 - 2010-11-20 14:26 - 00459776 _____ (Microsoft Corporation) C:\Windows\system32\DXP.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00355328 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00348160 _____ (Microsoft Corporation) C:\Windows\system32\eapp3hst.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\MediaMetadataHandler.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00332288 _____ (Microsoft Corporation) C:\Windows\system32\hgcpl.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\efscore.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\eapphost.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00279552 _____ (Microsoft Corporation) C:\Windows\system32\dxdiagn.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\framedyn.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00257024 _____ (Microsoft Corporation) C:\Windows\system32\mfreadwrite.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00252416 _____ (Microsoft Corporation) C:\Windows\system32\dot3svc.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dskquoui.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00233984 _____ (Microsoft Corporation) C:\Windows\system32\defaultlocationcpl.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00232448 _____ (Microsoft Corporation) C:\Windows\system32\ListSvc.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\mprapi.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00217088 _____ (Microsoft Corporation) C:\Windows\system32\iasrad.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00211456 _____ (Microsoft Corporation) C:\Windows\system32\mprddm.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00186880 _____ (Microsoft Corporation) C:\Windows\system32\logoncli.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00171520 _____ (Microsoft Corporation) C:\Windows\system32\fde.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00166912 _____ (Microsoft Corporation) C:\Windows\system32\inetpp.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00162816 _____ (Microsoft Corporation) C:\Windows\system32\dps.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\IPHLPAPI.DLL
2014-12-21 15:04 - 2010-11-20 14:26 - 00128512 _____ (Microsoft Corporation) C:\Windows\system32\dwmredir.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\dnscmmc.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00116224 _____ (Windows (R) Codename Longhorn DDK provider) C:\Windows\system32\fms.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\iasacct.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\dot3api.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\hbaapi.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\fdeploy.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\dot3cfg.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\lsmproxy.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\httpapi.dll
2014-12-21 15:04 - 2010-11-20 14:26 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\mimefilt.dll
2014-12-21 15:04 - 2010-11-20 14:25 - 03745792 _____ (Microsoft Corporation) C:\Windows\system32\accessibilitycpl.dll
2014-12-21 15:04 - 2010-11-20 14:25 - 03524608 _____ (Microsoft Corporation) C:\Windows\system32\sppsvc.exe
2014-12-21 15:04 - 2010-11-20 14:25 - 01264640 _____ (Microsoft Corporation) C:\Windows\system32\sdclt.exe
2014-12-21 15:04 - 2010-11-20 14:25 - 01065984 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2014-12-21 15:04 - 2010-11-20 14:25 - 00780800 _____ (Microsoft Corporation) C:\Windows\system32\ActionCenter.dll
2014-12-21 15:04 - 2010-11-20 14:25 - 00749568 _____ (Microsoft Corporation) C:\Windows\system32\batmeter.dll
2014-12-21 15:04 - 2010-11-20 14:25 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\AuxiliaryDisplayCpl.dll
2014-12-21 15:04 - 2010-11-20 14:25 - 00533504 _____ (Microsoft Corporation) C:\Windows\system32\vds.exe
2014-12-21 15:04 - 2010-11-20 14:25 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\biocpl.dll
2014-12-21 15:04 - 2010-11-20 14:25 - 00472064 _____ (Microsoft Corporation) C:\Windows\system32\azroleui.dll
2014-12-21 15:04 - 2010-11-20 14:25 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\wisptis.exe
2014-12-21 15:04 - 2010-11-20 14:25 - 00349696 _____ (Microsoft Corporation) C:\Windows\system32\slui.exe
2014-12-21 15:04 - 2010-11-20 14:25 - 00314368 _____ (Microsoft Corporation) C:\Windows\system32\clusapi.dll
2014-12-21 15:04 - 2010-11-20 14:25 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\wusa.exe
2014-12-21 15:04 - 2010-11-20 14:25 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\schtasks.exe
2014-12-21 15:04 - 2010-11-20 14:25 - 00273920 _____ (Microsoft Corporation) C:\Windows\system32\SndVol.exe
2014-12-21 15:04 - 2010-11-20 14:25 - 00257024 _____ (Microsoft Corporation) C:\Windows\system32\taskmgr.exe
2014-12-21 15:04 - 2010-11-20 14:25 - 00238080 _____ (Microsoft Corporation) C:\Windows\system32\recdisc.exe
2014-12-21 15:04 - 2010-11-20 14:25 - 00186368 _____ (Microsoft Corporation) C:\Windows\system32\ocsetup.exe
2014-12-21 15:04 - 2010-11-20 14:25 - 00168448 _____ (Microsoft Corporation) C:\Windows\system32\bcdsrv.dll
2014-12-21 15:04 - 2010-11-20 14:25 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\autoplay.dll
2014-12-21 15:04 - 2010-11-20 14:25 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\cabview.dll
2014-12-21 15:04 - 2010-11-20 14:25 - 00128000 _____ (Microsoft) C:\Windows\system32\Robocopy.exe
2014-12-21 15:04 - 2010-11-20 14:25 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\AxInstSv.dll
2014-12-21 15:04 - 2010-11-20 14:25 - 00095232 _____ (Microsoft Corporation) C:\Windows\system32\cca.dll
2014-12-21 15:04 - 2010-11-20 14:25 - 00088576 _____ (Microsoft Corporation) C:\Windows\system32\setupcl.exe
2014-12-21 15:04 - 2010-11-20 14:25 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2014-12-21 15:04 - 2010-11-20 14:25 - 00058368 _____ (Microsoft Corporation) C:\Windows\system32\tzutil.exe
2014-12-21 15:04 - 2010-11-20 14:25 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\proquota.exe
2014-12-21 15:04 - 2010-11-20 14:25 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\userinit.exe
2014-12-21 15:04 - 2010-11-20 14:24 - 00957440 _____ (Microsoft Corporation) C:\Windows\system32\mblctr.exe
2014-12-21 15:04 - 2010-11-20 14:24 - 00850944 _____ (Microsoft Corporation) C:\Windows\system32\mmsys.cpl
2014-12-21 15:04 - 2010-11-20 14:24 - 00793088 _____ (Microsoft Corporation) C:\Windows\system32\autoconv.exe
2014-12-21 15:04 - 2010-11-20 14:24 - 00777728 _____ (Microsoft Corporation) C:\Windows\system32\autochk.exe
2014-12-21 15:04 - 2010-11-20 14:24 - 00763904 _____ (Microsoft Corporation) C:\Windows\system32\autofmt.exe
2014-12-21 15:04 - 2010-11-20 14:24 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\appwiz.cpl
2014-12-21 15:04 - 2010-11-20 14:24 - 00721408 _____ (Microsoft Corporation) C:\Windows\system32\bthprops.cpl
2014-12-21 15:04 - 2010-11-20 14:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\system32\FXSSVC.exe
2014-12-21 15:04 - 2010-11-20 14:24 - 00684032 _____ (Microsoft Corporation) C:\Windows\system32\TabletPC.cpl
2014-12-21 15:04 - 2010-11-20 14:24 - 00477696 _____ (Microsoft Corporation) C:\Windows\system32\PhotoScreensaver.scr
2014-12-21 15:04 - 2010-11-20 14:24 - 00442368 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv
2014-12-21 15:04 - 2010-11-20 14:24 - 00378880 _____ (Microsoft Corporation) C:\Windows\system32\msinfo32.exe
2014-12-21 15:04 - 2010-11-20 14:24 - 00373248 _____ (Microsoft Corporation) C:\Windows\system32\intl.cpl
2014-12-21 15:04 - 2010-11-20 14:24 - 00359936 _____ (Microsoft Corporation) C:\Windows\system32\eudcedit.exe
2014-12-21 15:04 - 2010-11-20 14:24 - 00352768 _____ (Microsoft Corporation) C:\Windows\system32\sysdm.cpl
2014-12-21 15:04 - 2010-11-20 14:24 - 00346112 _____ (Microsoft Corporation) C:\Windows\system32\bcdedit.exe
2014-12-21 15:04 - 2010-11-20 14:24 - 00300032 _____ (Microsoft Corporation) C:\Windows\system32\msconfig.exe
2014-12-21 15:04 - 2010-11-20 14:24 - 00250880 _____ (Microsoft Corporation) C:\Windows\system32\ksproxy.ax
2014-12-21 15:04 - 2010-11-20 14:24 - 00217088 _____ (Microsoft Corporation) C:\Windows\system32\wdmaud.drv
2014-12-21 15:04 - 2010-11-20 14:24 - 00196096 _____ (Microsoft Corporation) C:\Windows\system32\VBICodec.ax
2014-12-21 15:04 - 2010-11-20 14:24 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2014-12-21 15:04 - 2010-11-20 14:24 - 00122880 _____ (Microsoft Corporation) C:\Windows\system32\aitagent.exe
2014-12-21 15:04 - 2010-11-20 14:24 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\WSTPager.ax
2014-12-21 15:04 - 2010-11-20 14:24 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\isoburn.exe
2014-12-21 15:04 - 2010-11-20 13:23 - 00144768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\basecsp.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 02983424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIRibbon.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 02755072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\themeui.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 02202624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SensorsCpl.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 02157568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\themecpl.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 02146304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SyncCenter.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 01712640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xpsservices.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 01624064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPEncEn.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 01326592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanpref.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 01227776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdc.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 01003008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMNetMgr.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00933376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Vault.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00782336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webservices.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00778240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sqlsrv32.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00638976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VAN.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00600064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usercpl.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00458752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSDApi.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00416768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wiadefui.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00411648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlangpui.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00410112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanui.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00380416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sxs.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00363520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StructuredQuery.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00352768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\termmgr.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00352768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwizeng.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00352256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpeffects.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00350208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shlwapi.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00346624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\untfs.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00335872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSATAPI.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00328192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shsvcs.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00327680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\zipfldr.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00307712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00305152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskcomp.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srchadmin.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00276992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wcncsvc.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00269824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00246272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scansetting.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00242176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tapisrv.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00228352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\stobject.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SndVolSSO.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ws2_32.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winmm.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sppcomapi.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00181760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tcpipcfg.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasppp.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00175616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scecli.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00172544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spp.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00135168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsRasterService.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00134656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00113664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SessEnv.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00111104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shsetup.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\thumbcache.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\userenv.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00072192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\regapi.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00051712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscapi.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samcli.dll
2014-12-21 15:04 - 2010-11-20 13:21 - 00046080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RpcRtRemote.dll
2014-12-21 15:04 - 2010-11-20 13:20 - 02504192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVCORE.DLL
2014-12-21 15:04 - 2010-11-20 13:20 - 02494464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netshell.dll
2014-12-21 15:04 - 2010-11-20 13:20 - 01750528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pnidui.dll
2014-12-21 15:04 - 2010-11-20 13:20 - 01644032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcenter.dll
2014-12-21 15:04 - 2010-11-20 13:20 - 01508864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pla.dll
2014-12-21 15:04 - 2010-11-20 13:20 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\propsys.dll
2014-12-21 15:04 - 2010-11-20 13:20 - 00932352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\printui.dll
2014-12-21 15:04 - 2010-11-20 13:20 - 00801280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NaturalLanguage6.dll
2014-12-21 15:04 - 2010-11-20 13:20 - 00600576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PerfCenterCPL.dll
2014-12-21 15:04 - 2010-11-20 13:20 - 00547840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PortableDeviceApi.dll
2014-12-21 15:04 - 2010-11-20 13:20 - 00441856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\powercpl.dll
2014-12-21 15:04 - 2010-11-20 13:20 - 00324608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\puiobj.dll
2014-12-21 15:04 - 2010-11-20 13:20 - 00225792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netdiagfx.dll
2014-12-21 15:04 - 2010-11-20 13:20 - 00199168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\onex.dll
2014-12-21 15:04 - 2010-11-20 13:20 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QAGENT.DLL
2014-12-21 15:04 - 2010-11-20 13:20 - 00167936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QSHVHOST.DLL
2014-12-21 15:04 - 2010-11-20 13:20 - 00166400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netiohlp.dll
2014-12-21 15:04 - 2010-11-20 13:20 - 00120320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\prntvpt.dll
2014-12-21 15:04 - 2010-11-20 13:20 - 00117248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netid.dll
2014-12-21 15:04 - 2010-11-20 13:20 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\prncache.dll
2014-12-21 15:04 - 2010-11-20 13:20 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nci.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00856576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FirewallControlPanel.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00830464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSMPEG2ENC.DLL
2014-12-21 15:04 - 2010-11-20 13:19 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontext.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00732160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imapi2fs.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00488448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00481792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00429056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\localsec.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00400896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ipsmsnap.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00392192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imapi2.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00320512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mtxclu.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00312832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hgcpl.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00296448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfds.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00268800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mprddm.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00226304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSAC3ENC.DLL
2014-12-21 15:04 - 2010-11-20 13:19 - 00213504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MMDevAPI.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00206336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\framedynos.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00202752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\framedyn.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00196608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfreadwrite.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00167936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msutb.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logoncli.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00124416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fde.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IPHLPAPI.DLL
2014-12-21 15:04 - 2010-11-20 13:19 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iasacct.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00066560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hbaapi.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdeploy.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00042496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mimefilt.dll
2014-12-21 15:04 - 2010-11-20 13:19 - 00034304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msasn1.dll
2014-12-21 15:04 - 2010-11-20 13:18 - 03727872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\accessibilitycpl.dll
2014-12-21 15:04 - 2010-11-20 13:18 - 01555456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certmgr.dll
2014-12-21 15:04 - 2010-11-20 13:18 - 01400320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DxpTaskSync.dll
2014-12-21 15:04 - 2010-11-20 13:18 - 01040384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Display.dll
2014-12-21 15:04 - 2010-11-20 13:18 - 00854016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbghelp.dll
2014-12-21 15:04 - 2010-11-20 13:18 - 00762880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\azroles.dll
2014-12-21 15:04 - 2010-11-20 13:18 - 00740864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\batmeter.dll
2014-12-21 15:04 - 2010-11-20 13:18 - 00665600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AuxiliaryDisplayCpl.dll
2014-12-21 15:04 - 2010-11-20 13:18 - 00630784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DXPTaskRingtone.dll
2014-12-21 15:04 - 2010-11-20 13:18 - 00485888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comdlg32.dll
2014-12-21 15:04 - 2010-11-20 13:18 - 00314368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\azroleui.dll
2014-12-21 15:04 - 2010-11-20 13:18 - 00309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2014-12-21 15:04 - 2010-11-20 13:18 - 00254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcore.dll
2014-12-21 15:04 - 2010-11-20 13:18 - 00222208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eapphost.dll
2014-12-21 15:04 - 2010-11-20 13:18 - 00132608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cabview.dll
2014-12-21 15:04 - 2010-11-20 13:18 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnscmmc.dll
2014-12-21 15:04 - 2010-11-20 13:17 - 00314368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SndVol.exe
2014-12-21 15:04 - 2010-11-20 13:17 - 00303104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msinfo32.exe
2014-12-21 15:04 - 2010-11-20 13:17 - 00302592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
2014-12-21 15:04 - 2010-11-20 13:17 - 00288256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eudcedit.exe
2014-12-21 15:04 - 2010-11-20 13:17 - 00227328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskmgr.exe
2014-12-21 15:04 - 2010-11-20 13:17 - 00220672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mcbuilder.exe
2014-12-21 15:04 - 2010-11-20 13:17 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskeng.exe
2014-12-21 15:04 - 2010-11-20 13:17 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schtasks.exe
2014-12-21 15:04 - 2010-11-20 13:17 - 00142336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\net1.exe
2014-12-21 15:04 - 2010-11-20 13:17 - 00098816 _____ (Microsoft) C:\Windows\SysWOW64\Robocopy.exe
2014-12-21 15:04 - 2010-11-20 13:17 - 00066048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\w32tm.exe
2014-12-21 15:04 - 2010-11-20 13:17 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\proquota.exe
2014-12-21 15:04 - 2010-11-20 13:17 - 00026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\userinit.exe
2014-12-21 15:04 - 2010-11-20 13:16 - 00905216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mmsys.cpl
2014-12-21 15:04 - 2010-11-20 13:16 - 00776192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\calc.exe
2014-12-21 15:04 - 2010-11-20 13:16 - 00679424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autoconv.exe
2014-12-21 15:04 - 2010-11-20 13:16 - 00668160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autochk.exe
2014-12-21 15:04 - 2010-11-20 13:16 - 00658944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autofmt.exe
2014-12-21 15:04 - 2010-11-20 13:16 - 00649216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appwiz.cpl
2014-12-21 15:04 - 2010-11-20 13:16 - 00516096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\main.cpl
2014-12-21 15:04 - 2010-11-20 13:16 - 00413696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PhotoScreensaver.scr
2014-12-21 15:04 - 2010-11-20 13:16 - 00326656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sysdm.cpl
2014-12-21 15:04 - 2010-11-20 13:16 - 00320000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winspool.drv
2014-12-21 15:04 - 2010-11-20 13:08 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2014-12-21 15:04 - 2010-11-20 11:52 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndiswan.sys
2014-12-21 15:04 - 2010-11-20 11:52 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rasl2tp.sys
2014-12-21 15:04 - 2010-11-20 11:52 - 00111104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\raspptp.sys
2014-12-21 15:04 - 2010-11-20 11:52 - 00088576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys
2014-12-21 15:04 - 2010-11-20 11:52 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ipfltdrv.sys
2014-12-21 15:04 - 2010-11-20 11:44 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\1394ohci.sys
2014-12-21 15:04 - 2010-11-20 11:43 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\winusb.sys
2014-12-21 15:04 - 2010-11-20 11:33 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ks.sys
2014-12-21 15:04 - 2010-11-20 10:37 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2014-12-21 15:04 - 2010-11-20 10:27 - 00309248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdbss.sys
2014-12-21 15:04 - 2010-11-20 10:26 - 00328192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
2014-12-21 15:04 - 2010-11-05 03:11 - 00433512 _____ (Microsoft Corporation) C:\Windows\system32\MCEWMDRMNDBootstrap.dll
2014-12-21 15:03 - 2010-11-20 14:44 - 00133632 _____ (Microsoft Corporation) C:\Windows\system32\NAPHLPR.DLL
2014-12-21 15:03 - 2010-11-20 14:44 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\NAPCRYPT.DLL
2014-12-21 15:03 - 2010-11-20 14:27 - 01911808 _____ (Microsoft Corporation) C:\Windows\system32\OpcServices.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 01672704 _____ (Microsoft Corporation) C:\Windows\system32\networkexplorer.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 01232896 _____ (Microsoft Corporation) C:\Windows\system32\WMADMOD.DLL
2014-12-21 15:03 - 2010-11-20 14:27 - 01080320 _____ (Microsoft Corporation) C:\Windows\system32\onexui.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00978944 _____ (Microsoft Corporation) C:\Windows\system32\WMSPDMOD.DLL
2014-12-21 15:03 - 2010-11-20 14:27 - 00781312 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00666112 _____ (Microsoft Corporation) C:\Windows\system32\WMVSDECD.DLL
2014-12-21 15:03 - 2010-11-20 14:27 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00636416 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmdev.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00594432 _____ (Microsoft Corporation) C:\Windows\system32\wvc.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00527872 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmnet.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00451072 _____ (Microsoft Corporation) C:\Windows\system32\shwebsvc.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00446976 _____ (Microsoft Corporation) C:\Windows\system32\sqlcese30.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00445952 _____ (Microsoft Corporation) C:\Windows\system32\spwizeng.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00435712 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceStatus.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00431104 _____ (Microsoft Corporation) C:\Windows\system32\WPDSp.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00421888 _____ (Microsoft Corporation) C:\Windows\system32\termmgr.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\wlanmsm.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00358400 _____ (Microsoft Corporation) C:\Windows\system32\wmpdxm.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00344576 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00337920 _____ (Microsoft Corporation) C:\Windows\system32\raschap.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00313856 _____ (Microsoft Corporation) C:\Windows\system32\ReAgent.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00270848 _____ (Microsoft Corporation) C:\Windows\system32\srrstr.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\wavemsp.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00254464 _____ (Microsoft Corporation) C:\Windows\system32\qasf.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00250880 _____ (Microsoft Corporation) C:\Windows\system32\qdv.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00238080 _____ (Microsoft Corporation) C:\Windows\system32\mstask.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\PortableDeviceSyncProvider.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00222208 _____ (Microsoft Corporation) C:\Windows\system32\rdpencom.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00217600 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\wpdwcn.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00207360 _____ (Microsoft Corporation) C:\Windows\system32\sysclass.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\vdsbas.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00185856 _____ (Microsoft Corporation) C:\Windows\system32\vdsutil.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\qcap.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00170496 _____ (Microsoft Corporation) C:\Windows\system32\sdrsvc.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00153088 _____ (Microsoft Corporation) C:\Windows\system32\remotepg.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00145920 _____ (Microsoft Corporation) C:\Windows\system32\sppc.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00143360 _____ (Microsoft Corporation) C:\Windows\system32\mydocs.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\shacct.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00132608 _____ (Microsoft Corporation) C:\Windows\system32\wmpshell.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\ntlanman.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\srvcli.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00124928 _____ (Microsoft Corporation) C:\Windows\system32\wiavideo.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\QSVRMGMT.DLL
2014-12-21 15:03 - 2010-11-20 14:27 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\sppnp.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\UserAccountControlSettings.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\QCLIPROV.DLL
2014-12-21 15:03 - 2010-11-20 14:27 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\spbcd.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\tlscsp.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\unimdmat.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\napdsnap.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\wkscli.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\vfwwdm32.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\rdpd3d.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\wsnmp32.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\ncryptui.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\WavDest.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\vss_ps.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\umb.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\odbcconf.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\PrintIsolationProxy.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\wshbth.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\msvidc32.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\shimgvw.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\wdiasqmmodule.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\msdmo.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\seclogon.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\netutils.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\shgina.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\wsdchngr.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\msyuv.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\schedcli.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\rdprefdrvapi.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00021504 _____ (Microsoft Corporation) C:\Windows\system32\TRAPI.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\spopk.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\syssetup.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\muifontsetup.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\msrle32.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\slwga.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\nrpsrv.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\tsbyuv.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\wshirda.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\sscore.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\shunimpl.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\riched32.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\rdpcfgex.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2014-12-21 15:03 - 2010-11-20 14:27 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2014-12-21 15:03 - 2010-11-20 14:27 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 01087488 _____ (Microsoft Corporation) C:\Windows\system32\dbghelp.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00623104 _____ (Microsoft Corporation) C:\Windows\system32\FXSAPI.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00495104 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\FXSTIFF.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00313344 _____ (Microsoft Corporation) C:\Windows\system32\dot3ui.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00282624 _____ (Microsoft Corporation) C:\Windows\system32\iTVData.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00281088 _____ (Microsoft Corporation) C:\Windows\system32\iprtrmgr.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00240640 _____ (Microsoft Corporation) C:\Windows\system32\MFPlay.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\DevicePairingFolder.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\iasrecst.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\itircl.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00180736 _____ (Microsoft Corporation) C:\Windows\system32\ifsutil.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00144896 _____ (Microsoft Corporation) C:\Windows\system32\EhStorAPI.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00121344 _____ (Microsoft Corporation) C:\Windows\system32\fphc.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\eappgnui.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\dot3msm.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\mapistub.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\mapi32.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00090624 _____ (Microsoft Corporation) C:\Windows\system32\KMSVC.DLL
2014-12-21 15:03 - 2010-11-20 14:26 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\Mcx2Svc.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\fdProxy.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\inetmib1.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\iyuv_32.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\luainstall.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\FXSMON.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\mciqtz32.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\iscsium.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\dsauth.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00027136 _____ (Microsoft Corporation) C:\Windows\system32\HotStartUserAgent.dll
2014-12-21 15:03 - 2010-11-20 14:26 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\elsTrans.dll
2014-12-21 15:03 - 2010-11-20 14:25 - 00840192 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2014-12-21 15:03 - 2010-11-20 14:25 - 00549888 _____ (Microsoft Corporation) C:\Windows\system32\ActionCenterCPL.dll
2014-12-21 15:03 - 2010-11-20 14:25 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2014-12-21 15:03 - 2010-11-20 14:25 - 00395776 _____ (Microsoft Corporation) C:\Windows\system32\nltest.exe
2014-12-21 15:03 - 2010-11-20 14:25 - 00294912 _____ (Microsoft Corporation) C:\Windows\system32\WindowsAnytimeUpgradeResults.exe
2014-12-21 15:03 - 2010-11-20 14:25 - 00293888 _____ (Microsoft Corporation) C:\Windows\system32\wsqmcons.exe
2014-12-21 15:03 - 2010-11-20 14:25 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\sethc.exe
2014-12-21 15:03 - 2010-11-20 14:25 - 00213504 _____ (Microsoft Corporation) C:\Windows\system32\ActionQueue.dll
2014-12-21 15:03 - 2010-11-20 14:25 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\perfmon.exe
2014-12-21 15:03 - 2010-11-20 14:25 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\net1.exe
2014-12-21 15:03 - 2010-11-20 14:25 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\AuxiliaryDisplayServices.dll
2014-12-21 15:03 - 2010-11-20 14:25 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\nslookup.exe
2014-12-21 15:03 - 2010-11-20 14:25 - 00094720 _____ (Microsoft Corporation) C:\Windows\system32\cabinet.dll
2014-12-21 15:03 - 2010-11-20 14:25 - 00089088 _____ (Microsoft Corporation) C:\Windows\system32\amstream.dll
2014-12-21 15:03 - 2010-11-20 14:25 - 00080384 _____ (Microsoft Corporation) C:\Windows\system32\certprop.dll
2014-12-21 15:03 - 2010-11-20 14:25 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\tabcal.exe
2014-12-21 15:03 - 2010-11-20 14:25 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\CertPolEng.dll
2014-12-21 15:03 - 2010-11-20 14:25 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\takeown.exe
2014-12-21 15:03 - 2010-11-20 14:25 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\PnPUnattend.exe
2014-12-21 15:03 - 2010-11-20 14:25 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\runonce.exe
2014-12-21 15:03 - 2010-11-20 14:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\acppage.dll
2014-12-21 15:03 - 2010-11-20 14:25 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\repair-bde.exe
2014-12-21 15:03 - 2010-11-20 14:25 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\MultiDigiMon.exe
2014-12-21 15:03 - 2010-11-20 14:25 - 00046080 _____ (Microsoft Corporation) C:\Windows\system32\cscapi.dll
2014-12-21 15:03 - 2010-11-20 14:25 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2014-12-21 15:03 - 2010-11-20 14:25 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\AzSqlExt.dll
2014-12-21 15:03 - 2010-11-20 14:25 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\cscdll.dll
2014-12-21 15:03 - 2010-11-20 14:25 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
2014-12-21 15:03 - 2010-11-20 14:25 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\bitsperf.dll
2014-12-21 15:03 - 2010-11-20 14:25 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\BWUnpairElevated.dll
2014-12-21 15:03 - 2010-11-20 14:25 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\browseui.dll
2014-12-21 15:03 - 2010-11-20 14:25 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\C_ISCII.DLL
2014-12-21 15:03 - 2010-11-20 14:24 - 00899584 _____ (Microsoft Corporation) C:\Windows\system32\Bubbles.scr
2014-12-21 15:03 - 2010-11-20 14:24 - 00606208 _____ (Microsoft Corporation) C:\Windows\system32\dfrgui.exe
2014-12-21 15:03 - 2010-11-20 14:24 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\main.cpl
2014-12-21 15:03 - 2010-11-20 14:24 - 00474112 _____ (Microsoft Corporation) C:\Windows\system32\sysmon.ocx
2014-12-21 15:03 - 2010-11-20 14:24 - 00363520 _____ (Microsoft Corporation) C:\Windows\system32\diskraid.exe
2014-12-21 15:03 - 2010-11-20 14:24 - 00333824 _____ (Microsoft Corporation) C:\Windows\system32\ssText3d.scr
2014-12-21 15:03 - 2010-11-20 14:24 - 00321536 _____ (Microsoft Corporation) C:\Windows\system32\unimdm.tsp
2014-12-21 15:03 - 2010-11-20 14:24 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\Mystify.scr
2014-12-21 15:03 - 2010-11-20 14:24 - 00241664 _____ (Microsoft Corporation) C:\Windows\system32\Ribbons.scr
2014-12-21 15:03 - 2010-11-20 14:24 - 00232448 _____ (Microsoft Corporation) C:\Windows\system32\bitsadmin.exe
2014-12-21 15:03 - 2010-11-20 14:24 - 00175616 _____ (Microsoft Corporation) C:\Windows\system32\bcdboot.exe
2014-12-21 15:03 - 2010-11-20 14:24 - 00173568 _____ (Microsoft Corporation) C:\Windows\system32\powercfg.cpl
2014-12-21 15:03 - 2010-11-20 14:24 - 00166400 _____ (Microsoft Corporation) C:\Windows\system32\diskpart.exe
2014-12-21 15:03 - 2010-11-20 14:24 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\iscsicli.exe
2014-12-21 15:03 - 2010-11-20 14:24 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\MdSched.exe
2014-12-21 15:03 - 2010-11-20 14:24 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\Kswdmcap.ax
2014-12-21 15:03 - 2010-11-20 14:24 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\desk.cpl
2014-12-21 15:03 - 2010-11-20 14:24 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2014-12-21 15:03 - 2010-11-20 14:24 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2014-12-21 15:03 - 2010-11-20 14:24 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\kstvtune.ax
2014-12-21 15:03 - 2010-11-20 14:24 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\mobsync.exe
2014-12-21 15:03 - 2010-11-20 14:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\cmstp.exe
2014-12-21 15:03 - 2010-11-20 14:24 - 00079872 _____ (Microsoft Corporation) C:\Windows\system32\manage-bde.exe
2014-12-21 15:03 - 2010-11-20 14:24 - 00071168 _____ (Microsoft Corporation) C:\Windows\system32\findstr.exe
2014-12-21 15:03 - 2010-11-20 14:24 - 00071168 _____ (Microsoft Corporation) C:\Windows\bfsvc.exe
2014-12-21 15:03 - 2010-11-20 14:24 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\ksxbar.ax
2014-12-21 15:03 - 2010-11-20 14:24 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\djoin.exe
2014-12-21 15:03 - 2010-11-20 14:24 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\g711codc.ax
2014-12-21 15:03 - 2010-11-20 14:24 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\ftp.exe
2014-12-21 15:03 - 2010-11-20 14:24 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\vbisurf.ax
2014-12-21 15:03 - 2010-11-20 14:24 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\choice.exe
2014-12-21 15:03 - 2010-11-20 14:24 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\LogonUI.exe
2014-12-21 15:03 - 2010-11-20 14:24 - 00018432 _____ (Microsoft Corporation) C:\Windows\system32\FXSUNATD.exe
2014-12-21 15:03 - 2010-11-20 14:24 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\fixmapi.exe
2014-12-21 15:03 - 2010-11-20 14:15 - 01164800 _____ (Microsoft Corporation) C:\Windows\system32\UIRibbonRes.dll
2014-12-21 15:03 - 2010-11-20 14:14 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\spwizres.dll
2014-12-21 15:03 - 2010-11-20 14:13 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\RDPENCDD.dll
2014-12-21 15:03 - 2010-11-20 14:13 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\nlsbres.dll
2014-12-21 15:03 - 2010-11-20 14:12 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\pifmgr.dll
2014-12-21 15:03 - 2010-11-20 14:02 - 01148416 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10.IME
2014-12-21 15:03 - 2010-11-20 14:02 - 00457216 _____ (Microsoft Corporation) C:\Windows\system32\imkr80.ime
2014-12-21 15:03 - 2010-11-20 14:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDTUQ.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDTUF.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDSG.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\kbdlk41a.dll
2014-12-21 15:03 - 2010-11-20 14:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDGKL.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\KBDCZ1.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDSF.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDPO.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDNEPR.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDINTAM.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDINBEN.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\KBDGR1.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDUS.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDUGHR1.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTURME.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAJIK.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDMON.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDMAORI.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDLT1.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDINTEL.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDINORI.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDINMAR.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDINKAN.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDINHIN.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBULG.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBLR.DLL
2014-12-21 15:03 - 2010-11-20 14:02 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDGEO.DLL
2014-12-21 15:03 - 2010-11-20 13:54 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\BlbEvents.dll
2014-12-21 15:03 - 2010-11-20 13:51 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-ums-l1-1-0.dll
2014-12-21 15:03 - 2010-11-20 13:36 - 00107008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NAPHLPR.DLL
2014-12-21 15:03 - 2010-11-20 13:36 - 00046080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NAPCRYPT.DLL
2014-12-21 15:03 - 2010-11-20 13:21 - 00902656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMADMOD.DLL
2014-12-21 15:03 - 2010-11-20 13:21 - 00755200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sud.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00739328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMSPDMOD.DLL
2014-12-21 15:03 - 2010-11-20 13:21 - 00738816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpmde.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00616960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00541184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVSDECD.DLL
2014-12-21 15:03 - 2010-11-20 13:21 - 00507392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmdev.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00473600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\riched20.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00444928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wvc.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00436736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmnet.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00428544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shwebsvc.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanmsm.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00410624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\systemcpl.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00406528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wimgapi.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00350720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WPDSp.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00318976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\raschap.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sqlcese30.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00299520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpdxm.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ReAgent.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00222208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wavemsp.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00198144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdwcn.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sqmapi.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00186368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpencom.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpsrcwp.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00160256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vdsbas.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\syncui.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00146944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\remotepg.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twext.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00144384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpps.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00118784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxlib.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setupcln.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00109568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wiavideo.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00108032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shacct.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00105984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WPDShServiceObj.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00105472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmpshell.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00100864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sppinst.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00090112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srvcli.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QUTIL.DLL
2014-12-21 15:03 - 2010-11-20 13:21 - 00078848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UserAccountControlSettings.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00071168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\resutils.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tlscsp.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastapi.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spbcd.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\unimdmat.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vfwwdm32.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpd3d.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00051712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsnmp32.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00051200 _____ (Twain Working Group) C:\Windows\twain_32.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wkscli.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wtsapi32.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rtutils.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshbth.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00035840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimgvw.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00031744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\utildll.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vpnikeapi.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wsdchngr.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TRAPI.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdprefdrvapi.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shgina.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00019968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spopk.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00019456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sisbkup.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schedcli.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00014848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\syssetup.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\slwga.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00012288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsbyuv.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00011264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshirda.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shunimpl.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sscore.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00008704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\riched32.dll
2014-12-21 15:03 - 2010-11-20 13:21 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2014-12-21 15:03 - 2010-11-20 13:21 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 02130944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\networkmap.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 01661440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\networkexplorer.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 01160192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OpcServices.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 01111552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\onexui.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00859648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OobeFldr.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PortableDeviceStatus.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00395264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\prnfldr.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00346112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshipsec.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00297472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00295424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\photowiz.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00283136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdv.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00236544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pdh.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00218112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OnLineIDCpl.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qasf.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00190976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qcap.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00183296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PortableDeviceSyncProvider.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00175616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netplwiz.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00174592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ocsetapi.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00165376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\provsvc.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netjoin.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00136192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mydocs.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00121344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sppc.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00099328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QSVRMGMT.DLL
2014-12-21 15:03 - 2010-11-20 13:20 - 00090112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\olepro32.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00077824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\olethk32.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\QCLIPROV.DLL
2014-12-21 15:03 - 2010-11-20 13:20 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntlanman.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00068096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\napdsnap.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00060928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncryptui.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pdhui.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00040960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbcconf.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netutils.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\perfts.dll
2014-12-21 15:03 - 2010-11-20 13:20 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00592384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00320512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00271360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iprtrmgr.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00266752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MediaMetadataHandler.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00219648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iTVData.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00209920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstask.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00202240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\input.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00176128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msorcl32.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00176128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MFPlay.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iasrad.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mprapi.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itircl.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00148992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ifsutil.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00122880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iasrecst.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00120320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvfw32.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00101888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\migisol.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00098304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fphc.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00093696 _____ (Windows (R) Codename Longhorn DDK provider) C:\Windows\SysWOW64\fms.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mciavi32.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00082944 _____ (Radius Inc.) C:\Windows\SysWOW64\iccvid.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mapistub.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mapi32.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00052736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetmib1.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iyuv_32.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\luainstall.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mciqtz32.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\httpapi.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00031744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvidc32.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdmo.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iscsium.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msyuv.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lsmproxy.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\muifontsetup.dll
2014-12-21 15:03 - 2010-11-20 13:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrle32.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 01003520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00744448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ActionCenter.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00743424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00685056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dsuiext.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00537600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ActionCenterCPL.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00484864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DeviceCenter.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00402944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00333824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dot3ui.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00243712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\audiodev.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00242176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eapp3hst.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00230912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clusapi.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00220672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\defaultlocationcpl.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00211456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DevicePairingFolder.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00210432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxdiagn.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00205312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\efscore.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00202752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\activeds.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00196608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dskquoui.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adsldp.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00146944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\autoplay.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00128512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EhStorAPI.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00115200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dot3msm.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00094208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\eappgnui.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00091648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\avifil32.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dot3cfg.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cabinet.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\amstream.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\asycfilt.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00066560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cca.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CertPolEng.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00045568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\acppage.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscapi.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dsauth.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00028160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AzSqlExt.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscdll.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elsTrans.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bitsperf.dll
2014-12-21 15:03 - 2010-11-20 13:18 - 00011264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\C_ISCII.DLL
2014-12-21 15:03 - 2010-11-20 13:18 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\browseui.dll
2014-12-21 15:03 - 2010-11-20 13:17 - 00586752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfrgui.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00327680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wimserv.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00314880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wusa.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00276480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskraid.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00270336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sethc.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00197632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ocsetup.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00157184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\perfmon.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00144896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iscsicli.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00133632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskpart.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00113152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setupugc.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00101376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mobsync.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00098304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nslookup.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00095232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logagent.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\isoburn.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cmstp.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MuiUnattend.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00062976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\findstr.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\takeown.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\runonce.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzutil.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00042496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ftp.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00034304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\unlodctr.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netiougc.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00024064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netbtugc.exe
2014-12-21 15:03 - 2010-11-20 13:17 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ReAgentc.exe
2014-12-21 15:03 - 2010-11-20 13:16 - 00878592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Bubbles.scr
2014-12-21 15:03 - 2010-11-20 13:16 - 00692736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bthprops.cpl
2014-12-21 15:03 - 2010-11-20 13:16 - 00389632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sysmon.ocx
2014-12-21 15:03 - 2010-11-20 13:16 - 00345088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\intl.cpl
2014-12-21 15:03 - 2010-11-20 13:16 - 00293888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ssText3d.scr
2014-12-21 15:03 - 2010-11-20 13:16 - 00281088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\unimdm.tsp
2014-12-21 15:03 - 2010-11-20 13:16 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Mystify.scr
2014-12-21 15:03 - 2010-11-20 13:16 - 00220672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Ribbons.scr
2014-12-21 15:03 - 2010-11-20 13:16 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ksproxy.ax
2014-12-21 15:03 - 2010-11-20 13:16 - 00186368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bitsadmin.exe
2014-12-21 15:03 - 2010-11-20 13:16 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdmaud.drv
2014-12-21 15:03 - 2010-11-20 13:16 - 00153600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VBICodec.ax
2014-12-21 15:03 - 2010-11-20 13:16 - 00142336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\powercfg.cpl
2014-12-21 15:03 - 2010-11-20 13:16 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\desk.cpl
2014-12-21 15:03 - 2010-11-20 13:16 - 00107008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Kswdmcap.ax
2014-12-21 15:03 - 2010-11-20 13:16 - 00084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kstvtune.ax
2014-12-21 15:03 - 2010-11-20 13:16 - 00068608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSTPager.ax
2014-12-21 15:03 - 2010-11-20 13:16 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ksxbar.ax
2014-12-21 15:03 - 2010-11-20 13:16 - 00045568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\g711codc.ax
2014-12-21 15:03 - 2010-11-20 13:16 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbisurf.ax
2014-12-21 15:03 - 2010-11-20 13:08 - 00119808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imm32.dll
2014-12-21 15:03 - 2010-11-20 13:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTUQ.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTUF.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDSG.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kbdlk41a.dll
2014-12-21 15:03 - 2010-11-20 13:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDGR1.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDGKL.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDCZ1.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDSF.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDPO.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDNEPR.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINTAM.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINORI.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINMAR.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINKAN.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINHIN.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINBEN.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDUS.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDUGHR1.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTURME.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAJIK.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDMON.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDMAORI.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDLT1.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDINTEL.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDGEO.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBULG.DLL
2014-12-21 15:03 - 2010-11-20 13:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBLR.DLL
2014-12-21 15:03 - 2010-11-20 13:07 - 01164800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIRibbonRes.dll
2014-12-21 15:03 - 2010-11-20 13:07 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwizres.dll
2014-12-21 15:03 - 2010-11-20 13:06 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlsbres.dll
2014-12-21 15:03 - 2010-11-20 13:05 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pifmgr.dll
2014-12-21 15:03 - 2010-11-20 13:00 - 01027584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10.IME
2014-12-21 15:03 - 2010-11-20 13:00 - 00430080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imkr80.ime
2014-12-21 15:03 - 2010-11-20 12:37 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbrpm.sys
2014-12-21 15:03 - 2010-11-20 11:52 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pacer.sys
2014-12-21 15:03 - 2010-11-20 11:52 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys
2014-12-21 15:03 - 2010-11-20 11:51 - 00125440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tunnel.sys
2014-12-21 15:03 - 2010-11-20 11:50 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndisuio.sys
2014-12-21 15:03 - 2010-11-20 11:49 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rmcast.sys
2014-12-21 15:03 - 2010-11-20 11:44 - 00350208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\HdAudio.sys
2014-12-21 15:03 - 2010-11-20 11:44 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\umbus.sys
2014-12-21 15:03 - 2010-11-20 11:44 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBCAMD2.sys
2014-12-21 15:03 - 2010-11-20 11:43 - 00122368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hdaudbus.sys
2014-12-21 15:03 - 2010-11-20 11:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidusb.sys
2014-12-21 15:03 - 2010-11-20 11:34 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sffp_sd.sys
2014-12-21 15:03 - 2010-11-20 11:33 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\CompositeBus.sys
2014-12-21 15:03 - 2010-11-20 11:33 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\kbdhid.sys
2014-12-21 15:03 - 2010-11-20 11:14 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2014-12-21 15:03 - 2010-11-20 11:09 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\scfilter.sys
2014-12-21 15:03 - 2010-11-20 11:04 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\IPMIDrv.sys
2014-12-21 15:03 - 2010-11-20 10:30 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\acpipmi.sys
2014-12-21 15:03 - 2010-11-20 10:26 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2014-12-21 15:03 - 2010-11-20 10:22 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdi.sys
2014-12-21 15:03 - 2010-11-20 10:19 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cdrom.sys
2014-12-21 15:03 - 2010-11-10 02:48 - 00010429 _____ () C:\Windows\system32\ScavengeSpace.xml
2014-12-21 15:03 - 2010-11-05 03:20 - 00105559 _____ () C:\Windows\SysWOW64\RacRules.xml
2014-12-21 15:03 - 2010-11-05 03:20 - 00105559 _____ () C:\Windows\system32\RacRules.xml
2014-12-21 15:03 - 2010-11-05 03:11 - 00312168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MCEWMDRMNDBootstrap.dll
2014-12-21 15:02 - 2010-11-20 13:21 - 00363008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wbemcomn.dll
2014-12-21 15:02 - 2010-11-20 13:21 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdscore.dll
2014-12-21 15:02 - 2010-11-20 13:18 - 00323072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drvstore.dll
2014-12-21 15:02 - 2010-11-20 13:18 - 00257024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpx.dll
2014-12-21 15:02 - 2010-11-20 13:17 - 00209920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PkgMgr.exe
2014-12-21 15:02 - 2009-06-10 22:39 - 00001041 _____ () C:\Windows\SysWOW64\tcpbidi.xml
2014-12-21 14:57 - 2010-11-20 14:27 - 00933376 _____ (Microsoft Corporation) C:\Windows\system32\SmiEngine.dll
2014-12-21 14:57 - 2010-11-20 14:27 - 00529408 _____ (Microsoft Corporation) C:\Windows\system32\wbemcomn.dll
2014-12-21 14:57 - 2010-11-20 14:27 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\wmicmiplugin.dll
2014-12-21 14:57 - 2010-11-20 14:25 - 00199168 _____ (Microsoft Corporation) C:\Windows\system32\PkgMgr.exe
2014-12-21 14:56 - 2010-11-20 14:26 - 00422912 _____ (Microsoft Corporation) C:\Windows\system32\drvstore.dll
2014-12-21 14:56 - 2010-11-20 14:26 - 00399872 _____ (Microsoft Corporation) C:\Windows\system32\dpx.dll
2014-12-21 14:12 - 2014-12-02 00:21 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-01 10:43 - 2014-12-01 10:43 - 00000000 ____D () C:\Users\Mirjana\AppData\Local\{E1D329AE-8C25-476F-B025-FB435F5E2A04}
2014-11-29 14:46 - 2014-11-29 14:46 - 00000000 ____D () C:\Users\Mirjana\AppData\Local\Microsoft Games

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-28 21:21 - 2012-01-27 16:22 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-28 21:17 - 2011-01-01 17:28 - 00000000 ____D () C:\Users\Mirjana
2014-12-28 21:08 - 2009-07-14 05:45 - 00019760 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-28 21:08 - 2009-07-14 05:45 - 00019760 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-28 21:03 - 2011-01-01 16:24 - 02052170 _____ () C:\Windows\WindowsUpdate.log
2014-12-28 20:24 - 2011-01-01 17:42 - 00003954 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{99877528-B8C3-46A5-9AA0-D6BA4F0A96B8}
2014-12-28 20:22 - 2011-01-01 18:00 - 00000000 ____D () C:\Update
2014-12-28 20:21 - 2011-04-22 10:03 - 00000000 ____D () C:\Windows\System32\Tasks\Sony Corporation
2014-12-28 20:21 - 2010-10-21 07:47 - 00000000 ____D () C:\Program Files (x86)\Sony
2014-12-28 20:20 - 2010-10-21 07:48 - 00000000 ____D () C:\Program Files\Sony
2014-12-28 20:15 - 2014-04-23 09:27 - 00013792 _____ () C:\Windows\system32\Drivers\semav6thermal64ro.sys
2014-12-28 20:06 - 2010-10-21 17:34 - 04871038 _____ () C:\Windows\system32\perfh007.dat
2014-12-28 20:06 - 2010-10-21 17:34 - 01507228 _____ () C:\Windows\system32\perfc007.dat
2014-12-28 20:06 - 2009-07-14 06:13 - 00006560 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-28 20:00 - 2012-02-16 11:47 - 00000000 ____D () C:\Users\Mirjana\AppData\Roaming\Dropbox
2014-12-28 19:59 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-28 19:58 - 2009-07-14 05:51 - 00230539 _____ () C:\Windows\setupact.log
2014-12-27 12:09 - 2010-10-21 07:38 - 00284748 _____ () C:\Windows\PFRO.log
2014-12-27 11:48 - 2013-08-12 10:27 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-12-27 11:44 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-12-27 11:42 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\schemas
2014-12-27 11:41 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-27 06:15 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-12-27 05:18 - 2009-07-14 05:45 - 00334912 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-27 05:03 - 2014-07-09 20:06 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-27 05:03 - 2010-10-12 23:58 - 00000000 ____D () C:\Program Files\Windows Journal
2014-12-27 05:03 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\zh-HK
2014-12-27 05:03 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\tr-TR
2014-12-27 05:03 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\zh-HK
2014-12-27 05:03 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\tr-TR
2014-12-27 05:02 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Defender
2014-12-27 05:02 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-12-27 05:02 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-12-27 05:02 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-12-27 04:08 - 2014-05-04 19:19 - 00015539 _____ () C:\Windows\IE11_main.log
2014-12-27 00:44 - 2013-10-09 01:19 - 00000000 _____ () C:\Windows\system32\vireng.log
2014-12-27 00:39 - 2010-10-21 07:47 - 00000000 ____D () C:\Windows\Sonysys
2014-12-27 00:25 - 2011-08-02 02:19 - 00000000 ____D () C:\ProgramData\InstallMate
2014-12-26 22:39 - 2013-11-29 02:24 - 00000000 ____D () C:\Users\Mirjana\AppData\Roaming\vlc
2014-12-26 13:19 - 2012-05-12 15:34 - 00000000 ____D () C:\Users\Mirjana\AppData\Local\DoNotTrackPlus
2014-12-23 16:42 - 2014-05-03 10:29 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-12-23 16:42 - 2014-05-03 10:29 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-12-23 16:40 - 2011-01-02 13:30 - 00000000 ____D () C:\Users\Mirjana\AppData\Local\Adobe
2014-12-23 15:25 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-12-21 16:54 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-12-21 16:54 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Portable Devices
2014-12-21 16:54 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Photo Viewer
2014-12-21 16:54 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\DVD Maker
2014-12-21 16:54 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\Windows Sidebar
2014-12-21 16:54 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\Windows Portable Devices
2014-12-21 16:54 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\Windows Photo Viewer
2014-12-21 16:54 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\servicing
2014-12-21 16:54 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\System
2014-12-21 16:53 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\sppui
2014-12-21 16:53 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Setup
2014-12-21 16:53 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\oobe
2014-12-21 16:53 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\migwiz
2014-12-21 16:53 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\manifeststore
2014-12-21 16:53 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\AdvancedInstallers
2014-12-21 16:52 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\sppui
2014-12-21 16:52 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Setup
2014-12-21 16:52 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\oobe
2014-12-21 16:52 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\migwiz
2014-12-21 16:52 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\manifeststore
2014-12-21 16:52 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2014-12-21 15:52 - 2013-08-15 04:41 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-21 15:48 - 2011-01-04 15:29 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-21 15:43 - 2009-07-14 03:36 - 00175616 _____ (Microsoft Corporation) C:\Windows\system32\msclmd.dll
2014-12-21 15:43 - 2009-07-14 03:36 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msclmd.dll
2014-12-21 14:01 - 2012-02-16 11:55 - 00001027 _____ () C:\Users\Mirjana\Desktop\Dropbox.lnk
2014-12-21 14:01 - 2012-02-16 11:48 - 00000000 ____D () C:\Users\Mirjana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-12-05 21:25 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-12-03 18:50 - 2011-04-02 23:20 - 00000000 ____D () C:\Users\Mirjana\Desktop\Player, Reader, Messenger
2014-12-03 18:41 - 2011-07-30 23:28 - 00000000 ____D () C:\Users\Mirjana\AppData\Roaming\DVDVideoSoft
2014-12-03 18:40 - 2014-11-24 01:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-12-03 18:40 - 2014-11-24 01:49 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft

Some content of TEMP:
====================
C:\Users\Mirjana\AppData\Local\Temp\DivXSetup.exe
C:\Users\Mirjana\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp7zssvz.dll
C:\Users\Mirjana\AppData\Local\Temp\FreeDailymotionDownload.exe
C:\Users\Mirjana\AppData\Local\Temp\jre-7u11-windows-i586-iftw.exe
C:\Users\Mirjana\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe
C:\Users\Mirjana\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\Mirjana\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Mirjana\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Mirjana\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Mirjana\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Mirjana\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Mirjana\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Mirjana\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\Mirjana\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Mirjana\AppData\Local\Temp\jre-7u7-windows-i586-iftw.exe
C:\Users\Mirjana\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\Mirjana\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe
C:\Users\Mirjana\AppData\Local\Temp\Quarantine.exe
C:\Users\Mirjana\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Mirjana\AppData\Local\Temp\sqlite3.dll
C:\Users\Mirjana\AppData\Local\Temp\tmd_34011708.exe
C:\Users\Mirjana\AppData\Local\Temp\tmd_34011843.exe
C:\Users\Mirjana\AppData\Local\Temp\tmd_34014067.exe
C:\Users\Mirjana\AppData\Local\Temp\tmd_34015104.exe
C:\Users\Mirjana\AppData\Local\Temp\tmd_34015433.exe
C:\Users\Mirjana\AppData\Local\Temp\tmd_34015856.exe
C:\Users\Mirjana\AppData\Local\Temp\tmd_34016561.exe
C:\Users\Mirjana\AppData\Local\Temp\tmd_34017711.exe
C:\Users\Mirjana\AppData\Local\Temp\tmd_34018169.exe
C:\Users\Mirjana\AppData\Local\Temp\tmd_34018388.exe
C:\Users\Mirjana\AppData\Local\Temp\tmd_34019758.exe
C:\Users\Mirjana\AppData\Local\Temp\vlc-2.0.6-win32.exe
C:\Users\Mirjana\AppData\Local\Temp\vlc-2.0.7-win32.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-27 06:00

==================== End Of Log ============================

Mira_11 · 29.12.2014, 01:57

Gmer, Teil 1:

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-12-28 22:00:41
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950032 rev.0006 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Mirjana\AppData\Local\Temp\uxlorkog.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                                                                                                                                            fffff800035eb000 45 bytes [00, 10, D0, 08, A0, F8, FF, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575                                                                                                                                                                                            fffff800035eb02f 16 bytes [00, 01, 00, 00, 00, 00, 00, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe[1180] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                  00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe[1180] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                 00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Windows\system32\Dwm.exe[1632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                                                                                                 0000000076ea1510 6 bytes {JMP QWORD [RIP+0x929eb20]}
.text     C:\Windows\system32\Dwm.exe[1632] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                                                                          0000000076ea1520 6 bytes {JMP QWORD [RIP+0x92feb10]}
.text     C:\Windows\system32\Dwm.exe[1632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                                                                    0000000076ea15e0 6 bytes {JMP QWORD [RIP+0x92dea50]}
.text     C:\Windows\system32\Dwm.exe[1632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                                                                  0000000076ea1800 6 bytes {JMP QWORD [RIP+0x92be830]}
.text     C:\Windows\system32\Dwm.exe[1632] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                                                                 0000000076ea18b0 6 bytes {JMP QWORD [RIP+0x925e780]}
.text     C:\Windows\system32\Dwm.exe[1632] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                                                              0000000076ea1e40 6 bytes {JMP QWORD [RIP+0x927e1f0]}
.text     C:\Windows\system32\Dwm.exe[1632] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                                                            0000000076ea27e0 6 bytes {JMP QWORD [RIP+0x931d850]}
.text     C:\Windows\system32\Dwm.exe[1632] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                                                                                                                     0000000076d4db80 6 bytes {JMP QWORD [RIP+0x94924b0]}
.text     C:\Windows\system32\Dwm.exe[1632] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                                                                                                     000007fefcec9055 3 bytes [B5, 6F, 06]
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                                                                                                     0000000076ea1510 6 bytes {JMP QWORD [RIP+0x929eb20]}
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                                                                              0000000076ea1520 6 bytes {JMP QWORD [RIP+0x92feb10]}
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                                                                        0000000076ea15e0 6 bytes {JMP QWORD [RIP+0x92dea50]}
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                                                                      0000000076ea1800 6 bytes {JMP QWORD [RIP+0x92be830]}
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                                                                     0000000076ea18b0 6 bytes {JMP QWORD [RIP+0x925e780]}
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                                                                  0000000076ea1e40 6 bytes {JMP QWORD [RIP+0x927e1f0]}
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                                                                0000000076ea27e0 6 bytes {JMP QWORD [RIP+0x931d850]}
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\system32\kernel32.dll!CopyFileExW                                                                                                                                                                                    0000000076d41890 5 bytes JMP 000000016fff00d8
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                                                                                                                         0000000076d4db80 6 bytes {JMP QWORD [RIP+0x94924b0]}
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\system32\kernel32.dll!MoveFileWithProgressW                                                                                                                                                                          0000000076dbf490 8 bytes JMP 000000016fff0110
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                                                                                                         000007fefcec9055 3 bytes CALL 9000027
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                                                                                                                                  000007fefee97490 11 bytes JMP 000007fffee600d8
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\system32\msi.dll!MsiSetInternalUI                                                                                                                                                                                    000007fef9065c70 6 bytes {JMP QWORD [RIP+0xafa3c0]}
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\system32\msi.dll!MsiInstallProductA                                                                                                                                                                                  000007fef90e2ad4 2 bytes [FF, 25]
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\system32\msi.dll!MsiInstallProductA + 3                                                                                                                                                                              000007fef90e2ad7 3 bytes [D5, A3, 00]
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\system32\msi.dll!MsiInstallProductW                                                                                                                                                                                  000007fef90f167c 6 bytes {JMP QWORD [RIP+0xa4e9b4]}
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA                                                                                                                                                                              000007fefa0f7b34 6 bytes JMP 300030
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW                                                                                                                                                                              000007fefa1003c0 6 bytes {JMP QWORD [RIP+0x9fc70]}
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW                                                                                                                                                                           000007fefe2b3030 6 bytes {JMP QWORD [RIP+0x63d000]}
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\system32\WS2_32.dll!connect + 1                                                                                                                                                                                      000007fefe2b45c1 5 bytes {JMP QWORD [RIP+0xb5ba70]}
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\system32\WS2_32.dll!listen                                                                                                                                                                                           000007fefe2b8290 6 bytes {JMP QWORD [RIP+0x607da0]}
.text     C:\Windows\Explorer.EXE[1644] C:\Windows\system32\WS2_32.dll!WSAConnect                                                                                                                                                                                       000007fefe2de0f0 6 bytes {JMP QWORD [RIP+0xeb1f40]}
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe[1052] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                               00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe[1052] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                              00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Windows\system32\taskhost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                                                                                            0000000076ea1510 6 bytes {JMP QWORD [RIP+0x929eb20]}
.text     C:\Windows\system32\taskhost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                                                                     0000000076ea1520 6 bytes {JMP QWORD [RIP+0x92feb10]}
.text     C:\Windows\system32\taskhost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                                                               0000000076ea15e0 6 bytes {JMP QWORD [RIP+0x92dea50]}
.text     C:\Windows\system32\taskhost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                                                             0000000076ea1800 6 bytes {JMP QWORD [RIP+0x92be830]}
.text     C:\Windows\system32\taskhost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                                                            0000000076ea18b0 6 bytes {JMP QWORD [RIP+0x925e780]}
.text     C:\Windows\system32\taskhost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                                                         0000000076ea1e40 6 bytes {JMP QWORD [RIP+0x927e1f0]}
.text     C:\Windows\system32\taskhost.exe[1544] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                                                       0000000076ea27e0 6 bytes {JMP QWORD [RIP+0x931d850]}
.text     C:\Windows\system32\taskhost.exe[1544] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                                                                                                                0000000076d4db80 6 bytes {JMP QWORD [RIP+0x94924b0]}
.text     C:\Windows\system32\taskhost.exe[1544] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                                                                                                000007fefcec9055 3 bytes CALL 77000026
.text     C:\Windows\system32\taskhost.exe[1544] C:\Windows\system32\ADVAPI32.dll!CreateServiceW                                                                                                                                                                        000007fefecb55c8 6 bytes {JMP QWORD [RIP+0x19aa68]}
.text     C:\Windows\system32\taskhost.exe[1544] C:\Windows\system32\ADVAPI32.dll!CreateServiceA                                                                                                                                                                        000007fefeccb85c 6 bytes {JMP QWORD [RIP+0x1647d4]}
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2088] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                    00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2088] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                   00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                    00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                   00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2476] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                  00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2476] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                 00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Windows\system32\taskeng.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                                                                                             0000000076ea1510 6 bytes {JMP QWORD [RIP+0x929eb20]}
.text     C:\Windows\system32\taskeng.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                                                                      0000000076ea1520 6 bytes {JMP QWORD [RIP+0x92feb10]}
.text     C:\Windows\system32\taskeng.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                                                                0000000076ea15e0 6 bytes {JMP QWORD [RIP+0x92dea50]}
.text     C:\Windows\system32\taskeng.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                                                              0000000076ea1800 6 bytes {JMP QWORD [RIP+0x92be830]}
.text     C:\Windows\system32\taskeng.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                                                             0000000076ea18b0 6 bytes {JMP QWORD [RIP+0x925e780]}
.text     C:\Windows\system32\taskeng.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                                                          0000000076ea1e40 6 bytes {JMP QWORD [RIP+0x927e1f0]}
.text     C:\Windows\system32\taskeng.exe[2488] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                                                        0000000076ea27e0 6 bytes {JMP QWORD [RIP+0x931d850]}
.text     C:\Windows\system32\taskeng.exe[2488] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                                                                                                                 0000000076d4db80 6 bytes {JMP QWORD [RIP+0x94924b0]}
.text     C:\Windows\system32\taskeng.exe[2488] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                                                                                                 000007fefcec9055 3 bytes [B5, 6F, 06]
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                              00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                             00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Windows\system32\taskeng.exe[2636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                                                                                             0000000076ea1510 6 bytes {JMP QWORD [RIP+0x929eb20]}
.text     C:\Windows\system32\taskeng.exe[2636] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                                                                      0000000076ea1520 6 bytes {JMP QWORD [RIP+0x92feb10]}
.text     C:\Windows\system32\taskeng.exe[2636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                                                                0000000076ea15e0 6 bytes {JMP QWORD [RIP+0x92dea50]}
.text     C:\Windows\system32\taskeng.exe[2636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                                                              0000000076ea1800 6 bytes {JMP QWORD [RIP+0x92be830]}
.text     C:\Windows\system32\taskeng.exe[2636] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                                                             0000000076ea18b0 6 bytes {JMP QWORD [RIP+0x925e780]}
.text     C:\Windows\system32\taskeng.exe[2636] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                                                          0000000076ea1e40 6 bytes {JMP QWORD [RIP+0x927e1f0]}
.text     C:\Windows\system32\taskeng.exe[2636] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                                                        0000000076ea27e0 6 bytes {JMP QWORD [RIP+0x931d850]}
.text     C:\Windows\system32\taskeng.exe[2636] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                                                                                                                 0000000076d4db80 6 bytes {JMP QWORD [RIP+0x94924b0]}
.text     C:\Windows\system32\taskeng.exe[2636] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                                                                                                 000007fefcec9055 3 bytes CALL 9000027
.text     C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe[2876] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                       00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe[2876] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                      00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[1304] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                   00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[1304] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                  00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                                                                               0000000076ea1510 6 bytes {JMP QWORD [RIP+0x929eb20]}
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2788] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                                                        0000000076ea1520 6 bytes {JMP QWORD [RIP+0x92feb10]}
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                                                  0000000076ea15e0 6 bytes {JMP QWORD [RIP+0x92dea50]}
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                                                0000000076ea1800 6 bytes {JMP QWORD [RIP+0x92be830]}
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2788] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                                               0000000076ea18b0 6 bytes {JMP QWORD [RIP+0x925e780]}
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2788] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                                            0000000076ea1e40 6 bytes {JMP QWORD [RIP+0x927e1f0]}
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2788] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                                          0000000076ea27e0 6 bytes {JMP QWORD [RIP+0x931d850]}
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2788] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                                                                                                   0000000076d4db80 6 bytes {JMP QWORD [RIP+0x94924b0]}
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2788] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                                                                                   000007fefcec9055 3 bytes [B5, 6F, 06]
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2788] C:\Windows\system32\ADVAPI32.dll!CreateServiceW                                                                                                                                                           000007fefecb55c8 6 bytes {JMP QWORD [RIP+0x19aa68]}
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2788] C:\Windows\system32\ADVAPI32.dll!CreateServiceA                                                                                                                                                           000007fefeccb85c 6 bytes JMP 1801
.text     C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe[3156] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                     00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe[3156] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                    00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe[3228] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe[3228] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                               00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                         00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[3296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                        00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe[3344] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                       00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe[3344] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                      00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[3480] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                  00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[3480] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                 00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
?         C:\Windows\system32\mssprxy.dll [3480] entry point in ".rdata" section                                                                                                                                                                                        0000000069a471e6
.text     C:\Windows\SysWOW64\DllHost.exe[3656] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                                                 00000000754b1465 2 bytes [4B, 75]
.text     C:\Windows\SysWOW64\DllHost.exe[3656] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                                                00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3684] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                   00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3684] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                  00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                                                                                                   000000007704fc20 3 bytes JMP 7178000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                                                                                                               000000007704fc24 2 bytes JMP 7178000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                                                                                                            000000007704fc38 3 bytes JMP 716f000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4                                                                                                                                        000000007704fc3c 2 bytes JMP 716f000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                                                                                                      000000007704fd64 3 bytes JMP 7172000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                                                                                                                  000000007704fd68 2 bytes JMP 7172000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                                                                                    00000000770500b4 3 bytes JMP 7175000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                                                                                                                00000000770500b8 2 bytes JMP 7175000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                                                                                   00000000770501c4 3 bytes JMP 717e000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                                                                                                               00000000770501c8 2 bytes JMP 717e000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                                                                                                0000000077050a44 3 bytes JMP 717b000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                                                                                                            0000000077050a48 2 bytes JMP 717b000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                                                                                              0000000077051920 3 bytes JMP 716c000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                                                                                                          0000000077051924 2 bytes JMP 716c000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                                                                                                       0000000074cf3bbb 3 bytes JMP 7169000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                                                                                                                   0000000074cf3bbf 2 bytes JMP 7169000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                                                                                                       0000000075fa2c9e 4 bytes CALL 71af0000
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\syswow64\USER32.dll!SendMessageW                                                                                                                                                   0000000074fc9679 6 bytes JMP 718d000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                                                                                                   0000000074fd12a5 6 bytes JMP 7187000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                                                                                                   0000000074fd3baa 6 bytes JMP 718a000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\syswow64\USER32.dll!SendMessageA                                                                                                                                                   0000000074fd612e 6 bytes JMP 7190000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\syswow64\USER32.dll!SendInput                                                                                                                                                      0000000074feff4a 3 bytes JMP 7193000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\syswow64\USER32.dll!SendInput + 4                                                                                                                                                  0000000074feff4e 2 bytes JMP 7193000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\syswow64\USER32.dll!mouse_event                                                                                                                                                    000000007502027b 6 bytes JMP 7199000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\syswow64\USER32.dll!keybd_event                                                                                                                                                    00000000750202bf 6 bytes JMP 7196000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                                                                                               00000000751e70c4 6 bytes JMP 7181000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                                                                                               0000000075203264 6 bytes JMP 7184000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\syswow64\WS2_32.dll!WSALookupServiceBeginW                                                                                                                                         0000000074de575a 6 bytes JMP 719c000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\syswow64\WS2_32.dll!connect                                                                                                                                                        0000000074de6bdd 6 bytes JMP 71a5000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\syswow64\WS2_32.dll!listen                                                                                                                                                         0000000074deb001 6 bytes JMP 719f000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\syswow64\WS2_32.dll!WSAConnect                                                                                                                                                     0000000074decc3f 6 bytes JMP 71a2000a
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                       00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                      00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
?         C:\Windows\system32\mssprxy.dll [3716] entry point in ".rdata" section                                                                                                                                                                                        0000000069a471e6
.text     C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[3764] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                                                                      0000000076ea1510 6 bytes {JMP QWORD [RIP+0x929eb20]}
.text     C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[3764] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                                               0000000076ea1520 6 bytes {JMP QWORD [RIP+0x92feb10]}
.text     C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[3764] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                                         0000000076ea15e0 6 bytes {JMP QWORD [RIP+0x92dea50]}
.text     C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[3764] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                                       0000000076ea1800 6 bytes {JMP QWORD [RIP+0x92be830]}
.text     C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[3764] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                                      0000000076ea18b0 6 bytes {JMP QWORD [RIP+0x925e780]}
.text     C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[3764] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                                   0000000076ea1e40 6 bytes {JMP QWORD [RIP+0x927e1f0]}
.text     C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[3764] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                                 0000000076ea27e0 6 bytes {JMP QWORD [RIP+0x931d850]}
.text     C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[3764] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                                                                                          0000000076d4db80 6 bytes {JMP QWORD [RIP+0x94924b0]}
.text     C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[3764] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                                                                          000007fefcec9055 3 bytes [B5, 6F, 10]
.text     C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[3764] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA                                                                                                                                               000007fefa0f7b34 6 bytes JMP 300030
.text     C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[3764] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW                                                                                                                                               000007fefa1003c0 6 bytes {JMP QWORD [RIP+0x9fc70]}
.text     C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[3764] C:\Windows\system32\RASAPI32.dll!RasDialW + 1                                                                                                                                                    000007fef5e996f5 5 bytes JMP 87e8
.text     C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[3764] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW                                                                                                                                            000007fefe2b3030 6 bytes {JMP QWORD [RIP+0x64d000]}
.text     C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[3764] C:\Windows\system32\WS2_32.dll!connect + 1                                                                                                                                                       000007fefe2b45c1 5 bytes {JMP QWORD [RIP+0x5eba70]}
.text     C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[3764] C:\Windows\system32\WS2_32.dll!listen                                                                                                                                                            000007fefe2b8290 6 bytes {JMP QWORD [RIP+0x627da0]}
.text     C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[3764] C:\Windows\system32\WS2_32.dll!WSAConnect                                                                                                                                                        000007fefe2de0f0 6 bytes {JMP QWORD [RIP+0x5e1f40]}
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                                                                              0000000076ea1510 6 bytes {JMP QWORD [RIP+0x929eb20]}
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                                                       0000000076ea1520 6 bytes {JMP QWORD [RIP+0x92feb10]}
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                                                 0000000076ea15e0 6 bytes {JMP QWORD [RIP+0x92dea50]}
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                                               0000000076ea1800 6 bytes {JMP QWORD [RIP+0x92be830]}
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                                              0000000076ea18b0 6 bytes {JMP QWORD [RIP+0x925e780]}
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                                           0000000076ea1e40 6 bytes {JMP QWORD [RIP+0x927e1f0]}
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                                         0000000076ea27e0 6 bytes {JMP QWORD [RIP+0x931d850]}
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3328] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                                                                                                  0000000076d4db80 6 bytes {JMP QWORD [RIP+0x94924b0]}
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3328] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                                                                                  000007fefcec9055 3 bytes [B5, 6F, 06]
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3328] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA                                                                                                                                                       000007fefa0f7b34 6 bytes {JMP QWORD [RIP+0x884fc]}
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3328] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW                                                                                                                                                       000007fefa1003c0 6 bytes {JMP QWORD [RIP+0x9fc70]}
.text     C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                    00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4132] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                   00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                                                                                               000000007704fc20 3 bytes JMP 7184000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                                                                                                           000000007704fc24 2 bytes JMP 7184000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                                                                                                        000000007704fc38 3 bytes JMP 717b000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4                                                                                                                                    000000007704fc3c 2 bytes JMP 717b000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                                                                                                  000000007704fd64 3 bytes JMP 717e000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                                                                                                              000000007704fd68 2 bytes JMP 717e000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                                                                                00000000770500b4 3 bytes JMP 7181000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                                                                                                            00000000770500b8 2 bytes JMP 7181000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                                                                               00000000770501c4 3 bytes JMP 718a000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                                                                                                           00000000770501c8 2 bytes JMP 718a000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                                                                                            0000000077050a44 3 bytes JMP 7187000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                                                                                                        0000000077050a48 2 bytes JMP 7187000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                                                                                          0000000077051920 3 bytes JMP 7178000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                                                                                                      0000000077051924 2 bytes JMP 7178000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                                                                                                   0000000074cf3bbb 3 bytes JMP 7175000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                                                                                                               0000000074cf3bbf 2 bytes JMP 7175000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                                                                                                   0000000075fa2c9e 4 bytes CALL 71af0000
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\syswow64\USER32.dll!SendMessageW                                                                                                                                               0000000074fc9679 6 bytes JMP 7199000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                                                                                               0000000074fd12a5 6 bytes JMP 7193000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                                                                                               0000000074fd3baa 6 bytes JMP 7196000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\syswow64\USER32.dll!SendMessageA                                                                                                                                               0000000074fd612e 6 bytes JMP 719c000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\syswow64\USER32.dll!SendInput                                                                                                                                                  0000000074feff4a 3 bytes JMP 719f000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\syswow64\USER32.dll!SendInput + 4                                                                                                                                              0000000074feff4e 2 bytes JMP 719f000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\syswow64\USER32.dll!mouse_event                                                                                                                                                000000007502027b 6 bytes JMP 71a5000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\syswow64\USER32.dll!keybd_event                                                                                                                                                00000000750202bf 6 bytes JMP 71a2000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                                                                                           00000000751e70c4 6 bytes JMP 718d000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                                                                                           0000000075203264 6 bytes JMP 7190000a
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                   00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                  00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                                                                                         000000007704fc20 3 bytes JMP 717e000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                                                                                                     000000007704fc24 2 bytes JMP 717e000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                                                                                                  000000007704fc38 3 bytes JMP 7175000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4                                                                                                                              000000007704fc3c 2 bytes JMP 7175000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                                                                                            000000007704fd64 3 bytes JMP 7178000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                                                                                                        000000007704fd68 2 bytes JMP 7178000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                                                                          00000000770500b4 3 bytes JMP 717b000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                                                                                                      00000000770500b8 2 bytes JMP 717b000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                                                                         00000000770501c4 3 bytes JMP 7184000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                                                                                                     00000000770501c8 2 bytes JMP 7184000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                                                                                      0000000077050a44 3 bytes JMP 7181000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                                                                                                  0000000077050a48 2 bytes JMP 7181000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                                                                                    0000000077051920 3 bytes JMP 7172000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                                                                                                0000000077051924 2 bytes JMP 7172000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                                                                                             0000000074cf3bbb 3 bytes JMP 716f000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                                                                                                         0000000074cf3bbf 2 bytes JMP 716f000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                                                                                             0000000075fa2c9e 4 bytes CALL 71af0000
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\syswow64\WS2_32.dll!WSALookupServiceBeginW                                                                                                                               0000000074de575a 6 bytes JMP 71a2000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\syswow64\WS2_32.dll!connect                                                                                                                                              0000000074de6bdd 6 bytes JMP 71ab000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\syswow64\WS2_32.dll!listen                                                                                                                                               0000000074deb001 6 bytes JMP 71a5000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\syswow64\WS2_32.dll!WSAConnect                                                                                                                                           0000000074decc3f 6 bytes JMP 71a8000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\syswow64\USER32.dll!SendMessageW                                                                                                                                         0000000074fc9679 6 bytes JMP 7193000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                                                                                         0000000074fd12a5 6 bytes JMP 718d000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                                                                                         0000000074fd3baa 6 bytes JMP 7190000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\syswow64\USER32.dll!SendMessageA                                                                                                                                         0000000074fd612e 6 bytes JMP 7196000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\syswow64\USER32.dll!SendInput                                                                                                                                            0000000074feff4a 3 bytes JMP 7199000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\syswow64\USER32.dll!SendInput + 4                                                                                                                                        0000000074feff4e 2 bytes JMP 7199000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\syswow64\USER32.dll!mouse_event                                                                                                                                          000000007502027b 6 bytes JMP 719f000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\syswow64\USER32.dll!keybd_event                                                                                                                                          00000000750202bf 6 bytes JMP 719c000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                                                                                     00000000751e70c4 6 bytes JMP 7187000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                                                                                     0000000075203264 6 bytes JMP 718a000a
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                             00000000754b1465 2 bytes [4B, 75]
.text     C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe[4492] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                            00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                                                                      0000000076ea1510 6 bytes {JMP QWORD [RIP+0x929eb20]}
.text     C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                                               0000000076ea1520 6 bytes {JMP QWORD [RIP+0x92feb10]}
.text     C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                                         0000000076ea15e0 6 bytes {JMP QWORD [RIP+0x92dea50]}
.text     C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                                       0000000076ea1800 6 bytes {JMP QWORD [RIP+0x92be830]}
.text     C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                                      0000000076ea18b0 6 bytes {JMP QWORD [RIP+0x925e780]}
.text     C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                                   0000000076ea1e40 6 bytes {JMP QWORD [RIP+0x927e1f0]}
.text     C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4540] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                                 0000000076ea27e0 6 bytes {JMP QWORD [RIP+0x931d850]}
.text     C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4540] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                                                                                          0000000076d4db80 6 bytes {JMP QWORD [RIP+0x94924b0]}
.text     C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4540] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                                                                          000007fefcec9055 3 bytes [B5, 6F, 06]
.text     C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4540] C:\Windows\system32\msi.dll!MsiSetInternalUI                                                                                                                                                     000007fef9065c70 6 bytes {JMP QWORD [RIP+0x37a3c0]}
.text     C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4540] C:\Windows\system32\msi.dll!MsiInstallProductA                                                                                                                                                   000007fef90e2ad4 2 bytes JMP 0
.text     C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4540] C:\Windows\system32\msi.dll!MsiInstallProductA + 3                                                                                                                                               000007fef90e2ad7 3 bytes JMP 0
.text     C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4540] C:\Windows\system32\msi.dll!MsiInstallProductW                                                                                                                                                   000007fef90f167c 6 bytes JMP 690072
.text     C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4540] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW                                                                                                                                            000007fefe2b3030 6 bytes {JMP QWORD [RIP+0x1dd000]}
.text     C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4540] C:\Windows\system32\WS2_32.dll!connect + 1                                                                                                                                                       000007fefe2b45c1 5 bytes {JMP QWORD [RIP+0x17ba70]}
.text     C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4540] C:\Windows\system32\WS2_32.dll!listen                                                                                                                                                            000007fefe2b8290 6 bytes {JMP QWORD [RIP+0x1b7da0]}
.text     C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4540] C:\Windows\system32\WS2_32.dll!WSAConnect                                                                                                                                                        000007fefe2de0f0 6 bytes JMP 19a3
.text     C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4540] C:\Windows\system32\RASAPI32.dll!RasDialW + 1                                                                                                                                                    000007fef5e996f5 5 bytes {JMP QWORD [RIP+0x7693c]}
.text     C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4540] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA                                                                                                                                               000007fefa0f7b34 6 bytes {JMP QWORD [RIP+0x884fc]}
.text     C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[4540] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW                                                                                                                                               000007fefa1003c0 6 bytes {JMP QWORD [RIP+0x9fc70]}
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                                                                                                        000000007704fc20 3 bytes JMP 718a000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                                                                                                                    000000007704fc24 2 bytes JMP 718a000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                                                                                                                 000000007704fc38 3 bytes JMP 7181000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4                                                                                                                                             000000007704fc3c 2 bytes JMP 7181000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                                                                                                           000000007704fd64 3 bytes JMP 7184000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                                                                                                                       000000007704fd68 2 bytes JMP 7184000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                                                                                         00000000770500b4 3 bytes JMP 7187000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                                                                                                                     00000000770500b8 2 bytes JMP 7187000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                                                                                        00000000770501c4 3 bytes JMP 7190000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                                                                                                                    00000000770501c8 2 bytes JMP 7190000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                                                                                                     0000000077050a44 3 bytes JMP 718d000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                                                                                                                 0000000077050a48 2 bytes JMP 718d000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                                                                                                   0000000077051920 3 bytes JMP 717e000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                                                                                                               0000000077051924 2 bytes JMP 717e000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                                                                                                            0000000074cf3bbb 3 bytes JMP 717b000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                                                                                                                        0000000074cf3bbf 2 bytes JMP 717b000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                                                                                                            0000000075fa2c9e 4 bytes CALL 71af0000
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\syswow64\USER32.dll!SendMessageW                                                                                                                                                        0000000074fc9679 6 bytes JMP 719f000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                                                                                                        0000000074fd12a5 6 bytes JMP 7199000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                                                                                                        0000000074fd3baa 6 bytes JMP 719c000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\syswow64\USER32.dll!SendMessageA                                                                                                                                                        0000000074fd612e 6 bytes JMP 71a2000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\syswow64\USER32.dll!SendInput                                                                                                                                                           0000000074feff4a 3 bytes JMP 71a5000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\syswow64\USER32.dll!SendInput + 4                                                                                                                                                       0000000074feff4e 2 bytes JMP 71a5000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\syswow64\USER32.dll!mouse_event                                                                                                                                                         000000007502027b 6 bytes JMP 71ab000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\syswow64\USER32.dll!keybd_event                                                                                                                                                         00000000750202bf 6 bytes JMP 71a8000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                                                                                                    00000000751e70c4 6 bytes JMP 7193000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                                                                                                    0000000075203264 6 bytes JMP 7196000a
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                            00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe[4668] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                           00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2

Mira_11 · 29.12.2014, 02:01

Gmer, Teil 2:

Code:

ATTFilter

.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                                                                                                          000000007704fc20 3 bytes JMP 7184000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                                                                                                                      000000007704fc24 2 bytes JMP 7184000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                                                                                                                   000000007704fc38 3 bytes JMP 717b000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4                                                                                                                                               000000007704fc3c 2 bytes JMP 717b000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                                                                                                             000000007704fd64 3 bytes JMP 717e000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                                                                                                                         000000007704fd68 2 bytes JMP 717e000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                                                                                           00000000770500b4 3 bytes JMP 7181000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                                                                                                                       00000000770500b8 2 bytes JMP 7181000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                                                                                          00000000770501c4 3 bytes JMP 718a000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                                                                                                                      00000000770501c8 2 bytes JMP 718a000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                                                                                                       0000000077050a44 3 bytes JMP 7187000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                                                                                                                   0000000077050a48 2 bytes JMP 7187000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                                                                                                     0000000077051920 3 bytes JMP 7178000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                                                                                                                 0000000077051924 2 bytes JMP 7178000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                                                                                                              0000000074cf3bbb 3 bytes JMP 7175000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                                                                                                                          0000000074cf3bbf 2 bytes JMP 7175000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                                                                                                              0000000075fa2c9e 4 bytes CALL 71af0000
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                                                                                                      00000000751e70c4 6 bytes JMP 718d000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                                                                                                      0000000075203264 6 bytes JMP 7190000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\syswow64\USER32.dll!SendMessageW                                                                                                                                                          0000000074fc9679 6 bytes JMP 7199000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                                                                                                          0000000074fd12a5 6 bytes JMP 7193000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                                                                                                          0000000074fd3baa 6 bytes JMP 7196000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\syswow64\USER32.dll!SendMessageA                                                                                                                                                          0000000074fd612e 6 bytes JMP 719c000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\syswow64\USER32.dll!SendInput                                                                                                                                                             0000000074feff4a 3 bytes JMP 719f000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\syswow64\USER32.dll!SendInput + 4                                                                                                                                                         0000000074feff4e 2 bytes JMP 719f000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\syswow64\USER32.dll!mouse_event                                                                                                                                                           000000007502027b 6 bytes JMP 71a5000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\syswow64\USER32.dll!keybd_event                                                                                                                                                           00000000750202bf 6 bytes JMP 71a2000a
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                              00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe[4684] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                             00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                                                                               000000007704fc20 3 bytes JMP 718a000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                                                                                           000000007704fc24 2 bytes JMP 718a000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                                                                                        000000007704fc38 3 bytes JMP 7181000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4                                                                                                                    000000007704fc3c 2 bytes JMP 7181000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                                                                                  000000007704fd64 3 bytes JMP 7184000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                                                                                              000000007704fd68 2 bytes JMP 7184000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                                                                00000000770500b4 3 bytes JMP 7187000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                                                                                            00000000770500b8 2 bytes JMP 7187000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                                                               00000000770501c4 3 bytes JMP 7190000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                                                                                           00000000770501c8 2 bytes JMP 7190000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                                                                            0000000077050a44 3 bytes JMP 718d000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                                                                                        0000000077050a48 2 bytes JMP 718d000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                                                                          0000000077051920 3 bytes JMP 717e000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                                                                                      0000000077051924 2 bytes JMP 717e000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\syswow64\KERNEL32.dll!CreateProcessInternalW                                                                                                                   0000000074cf3bbb 3 bytes JMP 717b000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\syswow64\KERNEL32.dll!CreateProcessInternalW + 4                                                                                                               0000000074cf3bbf 2 bytes JMP 717b000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                                                                                   0000000075fa2c9e 4 bytes CALL 71af0000
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\syswow64\USER32.dll!SendMessageW                                                                                                                               0000000074fc9679 6 bytes JMP 719f000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                                                                               0000000074fd12a5 6 bytes JMP 7199000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                                                                               0000000074fd3baa 6 bytes JMP 719c000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\syswow64\USER32.dll!SendMessageA                                                                                                                               0000000074fd612e 6 bytes JMP 71a2000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\syswow64\USER32.dll!SendInput                                                                                                                                  0000000074feff4a 3 bytes JMP 71a5000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\syswow64\USER32.dll!SendInput + 4                                                                                                                              0000000074feff4e 2 bytes JMP 71a5000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\syswow64\USER32.dll!mouse_event                                                                                                                                000000007502027b 6 bytes JMP 71ab000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\syswow64\USER32.dll!keybd_event                                                                                                                                00000000750202bf 6 bytes JMP 71a8000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                                                                           00000000751e70c4 6 bytes JMP 7193000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                                                                           0000000075203264 6 bytes JMP 7196000a
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                   00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[4700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                  00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                                                                              000000007704fc20 3 bytes JMP 717e000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                                                                                          000000007704fc24 2 bytes JMP 717e000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                                                                                       000000007704fc38 3 bytes JMP 7175000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4                                                                                                                   000000007704fc3c 2 bytes JMP 7175000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                                                                                 000000007704fd64 3 bytes JMP 7178000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                                                                                             000000007704fd68 2 bytes JMP 7178000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                                                               00000000770500b4 3 bytes JMP 717b000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                                                                                           00000000770500b8 2 bytes JMP 717b000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                                                              00000000770501c4 3 bytes JMP 7184000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                                                                                          00000000770501c8 2 bytes JMP 7184000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                                                                           0000000077050a44 3 bytes JMP 7181000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                                                                                       0000000077050a48 2 bytes JMP 7181000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                                                                         0000000077051920 3 bytes JMP 7172000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                                                                                     0000000077051924 2 bytes JMP 7172000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                                                                                  0000000074cf3bbb 3 bytes JMP 716f000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                                                                                              0000000074cf3bbf 2 bytes JMP 716f000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                                                                                  0000000075fa2c9e 4 bytes CALL 71af0000
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\syswow64\USER32.dll!SendMessageW                                                                                                                              0000000074fc9679 6 bytes JMP 7193000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                                                                              0000000074fd12a5 6 bytes JMP 718d000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                                                                              0000000074fd3baa 6 bytes JMP 7190000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\syswow64\USER32.dll!SendMessageA                                                                                                                              0000000074fd612e 6 bytes JMP 7196000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\syswow64\USER32.dll!SendInput                                                                                                                                 0000000074feff4a 3 bytes JMP 7199000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\syswow64\USER32.dll!SendInput + 4                                                                                                                             0000000074feff4e 2 bytes JMP 7199000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\syswow64\USER32.dll!mouse_event                                                                                                                               000000007502027b 6 bytes JMP 719f000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\syswow64\USER32.dll!keybd_event                                                                                                                               00000000750202bf 6 bytes JMP 719c000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                                                                          00000000751e70c4 6 bytes JMP 7187000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                                                                          0000000075203264 6 bytes JMP 718a000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\syswow64\WS2_32.dll!WSALookupServiceBeginW                                                                                                                    0000000074de575a 6 bytes JMP 71a2000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\syswow64\WS2_32.dll!connect                                                                                                                                   0000000074de6bdd 6 bytes JMP 71ab000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\syswow64\WS2_32.dll!listen                                                                                                                                    0000000074deb001 6 bytes JMP 71a5000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\syswow64\WS2_32.dll!WSAConnect                                                                                                                                0000000074decc3f 6 bytes JMP 71a8000a
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                  00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe[4744] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                 00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                                                                                                                      000000007704fc20 3 bytes JMP 7184000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                                                                                                                                  000000007704fc24 2 bytes JMP 7184000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                                                                                                                               000000007704fc38 3 bytes JMP 717b000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4                                                                                                                                                           000000007704fc3c 2 bytes JMP 717b000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                                                                                                                         000000007704fd64 3 bytes JMP 717e000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                                                                                                                                     000000007704fd68 2 bytes JMP 717e000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                                                                                                       00000000770500b4 3 bytes JMP 7181000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                                                                                                                                   00000000770500b8 2 bytes JMP 7181000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                                                                                                      00000000770501c4 3 bytes JMP 718a000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                                                                                                                                  00000000770501c8 2 bytes JMP 718a000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                                                                                                                   0000000077050a44 3 bytes JMP 7187000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                                                                                                                               0000000077050a48 2 bytes JMP 7187000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                                                                                                                 0000000077051920 3 bytes JMP 7178000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                                                                                                                             0000000077051924 2 bytes JMP 7178000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                                                                                                                          0000000074cf3bbb 3 bytes JMP 7175000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                                                                                                                                      0000000074cf3bbf 2 bytes JMP 7175000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                                                                                                                          0000000075fa2c9e 4 bytes CALL 71af0000
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\syswow64\USER32.dll!SendMessageW                                                                                                                                                                      0000000074fc9679 6 bytes JMP 7199000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                                                                                                                      0000000074fd12a5 6 bytes JMP 7193000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                                                                                                                      0000000074fd3baa 6 bytes JMP 7196000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\syswow64\USER32.dll!SendMessageA                                                                                                                                                                      0000000074fd612e 6 bytes JMP 719c000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\syswow64\USER32.dll!SendInput                                                                                                                                                                         0000000074feff4a 3 bytes JMP 719f000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\syswow64\USER32.dll!SendInput + 4                                                                                                                                                                     0000000074feff4e 2 bytes JMP 719f000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\syswow64\USER32.dll!mouse_event                                                                                                                                                                       000000007502027b 6 bytes JMP 71a5000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\syswow64\USER32.dll!keybd_event                                                                                                                                                                       00000000750202bf 6 bytes JMP 71a2000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                                                                                                                  00000000751e70c4 6 bytes JMP 718d000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                                                                                                                  0000000075203264 6 bytes JMP 7190000a
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                                          00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\PDF24\pdf24.exe[4756] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                                         00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe[4768] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                                                                                                          000000007704fc20 3 bytes [FF, 25, 1E]
.text     C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe[4768] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                                                                                                                      000000007704fc24 2 bytes [83, 71]
.text     C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe[4768] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                                                                                                                   000000007704fc38 3 bytes [FF, 25, 1E]
.text     C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe[4768] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4                                                                                                                                               000000007704fc3c 2 bytes [7A, 71]
.text     C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe[4768] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                                                                                                             000000007704fd64 3 bytes [FF, 25, 1E]
.text     C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe[4768] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                                                                                                                         000000007704fd68 2 bytes [7D, 71]
.text     C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe[4768] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                                                                                           00000000770500b4 3 bytes [FF, 25, 1E]
.text     C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe[4768] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                                                                                                                       00000000770500b8 2 bytes [80, 71]
.text     C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe[4768] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                                                                                          00000000770501c4 3 bytes [FF, 25, 1E]
.text     C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe[4768] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                                                                                                                      00000000770501c8 2 bytes [89, 71]
.text     C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe[4768] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                                                                                                       0000000077050a44 3 bytes [FF, 25, 1E]
.text     C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe[4768] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                                                                                                                   0000000077050a48 2 bytes [86, 71]
.text     C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe[4768] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                                                                                                     0000000077051920 3 bytes [FF, 25, 1E]
.text     C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe[4768] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                                                                                                                 0000000077051924 2 bytes [77, 71]
.text     C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe[4768] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                                                                                                              0000000074cf3bbb 3 bytes [FF, 25, 1E]
.text     C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe[4768] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                                                                                                                          0000000074cf3bbf 2 bytes [74, 71]
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                                                                                                              000000007704fc20 3 bytes JMP 718a000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                                                                                                                          000000007704fc24 2 bytes JMP 718a000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                                                                                                                       000000007704fc38 3 bytes JMP 7181000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4                                                                                                                                                   000000007704fc3c 2 bytes JMP 7181000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                                                                                                                 000000007704fd64 3 bytes JMP 7184000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                                                                                                                             000000007704fd68 2 bytes JMP 7184000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                                                                                               00000000770500b4 3 bytes JMP 7187000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                                                                                                                           00000000770500b8 2 bytes JMP 7187000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                                                                                              00000000770501c4 3 bytes JMP 7190000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                                                                                                                          00000000770501c8 2 bytes JMP 7190000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                                                                                                           0000000077050a44 3 bytes JMP 718d000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                                                                                                                       0000000077050a48 2 bytes JMP 718d000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                                                                                                         0000000077051920 3 bytes JMP 717e000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                                                                                                                     0000000077051924 2 bytes JMP 717e000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                                                                                                                  0000000074cf3bbb 3 bytes JMP 717b000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                                                                                                                              0000000074cf3bbf 2 bytes JMP 717b000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                                                                                                                  0000000075fa2c9e 4 bytes CALL 71af0000
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                                                                                                          00000000751e70c4 6 bytes JMP 7193000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                                                                                                          0000000075203264 6 bytes JMP 7196000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\syswow64\USER32.dll!SendMessageW                                                                                                                                                              0000000074fc9679 6 bytes JMP 719f000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                                                                                                              0000000074fd12a5 6 bytes JMP 7199000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                                                                                                              0000000074fd3baa 6 bytes JMP 719c000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\syswow64\USER32.dll!SendMessageA                                                                                                                                                              0000000074fd612e 6 bytes JMP 71a2000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\syswow64\USER32.dll!SendInput                                                                                                                                                                 0000000074feff4a 3 bytes JMP 71a5000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\syswow64\USER32.dll!SendInput + 4                                                                                                                                                             0000000074feff4e 2 bytes JMP 71a5000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\syswow64\USER32.dll!mouse_event                                                                                                                                                               000000007502027b 6 bytes JMP 71ab000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\syswow64\USER32.dll!keybd_event                                                                                                                                                               00000000750202bf 6 bytes JMP 71a8000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                                  00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                                 00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\syswow64\WS2_32.dll!WSALookupServiceBeginW                                                                                                                                                    0000000074de575a 6 bytes JMP 716f000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\syswow64\WS2_32.dll!connect                                                                                                                                                                   0000000074de6bdd 6 bytes JMP 7178000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\syswow64\WS2_32.dll!listen                                                                                                                                                                    0000000074deb001 6 bytes JMP 7172000a
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[4780] C:\Windows\syswow64\WS2_32.dll!WSAConnect                                                                                                                                                                0000000074decc3f 6 bytes JMP 7175000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                                                                                            000000007704fc20 3 bytes JMP 718a000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                                                                                                        000000007704fc24 2 bytes JMP 718a000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                                                                                                     000000007704fc38 3 bytes JMP 7181000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4                                                                                                                                 000000007704fc3c 2 bytes JMP 7181000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                                                                                               000000007704fd64 3 bytes JMP 7184000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                                                                                                           000000007704fd68 2 bytes JMP 7184000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                                                                             00000000770500b4 3 bytes JMP 7187000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                                                                                                         00000000770500b8 2 bytes JMP 7187000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                                                                            00000000770501c4 3 bytes JMP 7190000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                                                                                                        00000000770501c8 2 bytes JMP 7190000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                                                                                         0000000077050a44 3 bytes JMP 718d000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                                                                                                     0000000077050a48 2 bytes JMP 718d000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                                                                                       0000000077051920 3 bytes JMP 717e000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                                                                                                   0000000077051924 2 bytes JMP 717e000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                                                                                                0000000074cf3bbb 3 bytes JMP 717b000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                                                                                                            0000000074cf3bbf 2 bytes JMP 717b000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                                                                                                0000000075fa2c9e 4 bytes CALL 71af0000
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                                                                                        00000000751e70c4 6 bytes JMP 7193000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                                                                                        0000000075203264 6 bytes JMP 7196000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\syswow64\USER32.dll!SendMessageW                                                                                                                                            0000000074fc9679 6 bytes JMP 719f000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                                                                                            0000000074fd12a5 6 bytes JMP 7199000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                                                                                            0000000074fd3baa 6 bytes JMP 719c000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\syswow64\USER32.dll!SendMessageA                                                                                                                                            0000000074fd612e 6 bytes JMP 71a2000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\syswow64\USER32.dll!SendInput                                                                                                                                               0000000074feff4a 3 bytes JMP 71a5000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\syswow64\USER32.dll!SendInput + 4                                                                                                                                           0000000074feff4e 2 bytes JMP 71a5000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\syswow64\USER32.dll!mouse_event                                                                                                                                             000000007502027b 6 bytes JMP 71ab000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\syswow64\USER32.dll!keybd_event                                                                                                                                             00000000750202bf 6 bytes JMP 71a8000a
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4792] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                               00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[4856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                                                         0000000076ea1510 6 bytes {JMP QWORD [RIP+0x929eb20]}
.text     C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[4856] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                                  0000000076ea1520 6 bytes {JMP QWORD [RIP+0x92feb10]}
.text     C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[4856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                            0000000076ea15e0 6 bytes {JMP QWORD [RIP+0x92dea50]}
.text     C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[4856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                          0000000076ea1800 6 bytes {JMP QWORD [RIP+0x92be830]}
.text     C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[4856] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                         0000000076ea18b0 6 bytes {JMP QWORD [RIP+0x925e780]}
.text     C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[4856] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                      0000000076ea1e40 6 bytes {JMP QWORD [RIP+0x927e1f0]}
.text     C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[4856] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                    0000000076ea27e0 6 bytes {JMP QWORD [RIP+0x931d850]}
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                                                                                                    000000007704fc20 3 bytes JMP 718a000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                                                                                                                000000007704fc24 2 bytes JMP 718a000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                                                                                                             000000007704fc38 3 bytes JMP 7181000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4                                                                                                                                         000000007704fc3c 2 bytes JMP 7181000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                                                                                                       000000007704fd64 3 bytes JMP 7184000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                                                                                                                   000000007704fd68 2 bytes JMP 7184000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                                                                                     00000000770500b4 3 bytes JMP 7187000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                                                                                                                 00000000770500b8 2 bytes JMP 7187000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                                                                                    00000000770501c4 3 bytes JMP 7190000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                                                                                                                00000000770501c8 2 bytes JMP 7190000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                                                                                                 0000000077050a44 3 bytes JMP 718d000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                                                                                                             0000000077050a48 2 bytes JMP 718d000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                                                                                               0000000077051920 3 bytes JMP 717e000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                                                                                                           0000000077051924 2 bytes JMP 717e000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                                                                                                        0000000074cf3bbb 3 bytes JMP 717b000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                                                                                                                    0000000074cf3bbf 2 bytes JMP 717b000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                                                                                                        0000000075fa2c9e 4 bytes CALL 71af0000
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\syswow64\USER32.dll!SendMessageW                                                                                                                                                    0000000074fc9679 6 bytes JMP 719f000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                                                                                                    0000000074fd12a5 6 bytes JMP 7199000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                                                                                                    0000000074fd3baa 6 bytes JMP 719c000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\syswow64\USER32.dll!SendMessageA                                                                                                                                                    0000000074fd612e 6 bytes JMP 71a2000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\syswow64\USER32.dll!SendInput                                                                                                                                                       0000000074feff4a 3 bytes JMP 71a5000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\syswow64\USER32.dll!SendInput + 4                                                                                                                                                   0000000074feff4e 2 bytes JMP 71a5000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\syswow64\USER32.dll!mouse_event                                                                                                                                                     000000007502027b 6 bytes JMP 71ab000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\syswow64\USER32.dll!keybd_event                                                                                                                                                     00000000750202bf 6 bytes JMP 71a8000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                                                                                                00000000751e70c4 6 bytes JMP 7193000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                                                                                                0000000075203264 6 bytes JMP 7196000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                        00000000754b1465 2 bytes [4B, 75]
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                       00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\syswow64\WS2_32.dll!WSALookupServiceBeginW                                                                                                                                          0000000074de575a 6 bytes JMP 716f000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\syswow64\WS2_32.dll!connect                                                                                                                                                         0000000074de6bdd 6 bytes JMP 7178000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\syswow64\WS2_32.dll!listen                                                                                                                                                          0000000074deb001 6 bytes JMP 7172000a
.text     C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe[4876] C:\Windows\syswow64\WS2_32.dll!WSAConnect                                                                                                                                                      0000000074decc3f 6 bytes JMP 7175000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\SysWOW64\ntdll.dll!KiUserExceptionDispatcher                                                                                                                                                                0000000077040124 5 bytes JMP 0000000174408620
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                                                                                                                            000000007704fc20 3 bytes JMP 7184000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                                                                                                                                        000000007704fc24 2 bytes JMP 7184000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                                                                                                                                     000000007704fc38 3 bytes JMP 717b000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4                                                                                                                                                                 000000007704fc3c 2 bytes JMP 717b000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                                                                                                                               000000007704fd64 3 bytes JMP 717e000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                                                                                                                                           000000007704fd68 2 bytes JMP 717e000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                                                                                                             00000000770500b4 3 bytes JMP 7181000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                                                                                                                                         00000000770500b8 2 bytes JMP 7181000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                                                                                                            00000000770501c4 3 bytes JMP 718a000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                                                                                                                                        00000000770501c8 2 bytes JMP 718a000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                                                                                                                         0000000077050a44 3 bytes JMP 7187000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                                                                                                                                     0000000077050a48 2 bytes JMP 7187000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                                                                                                                       0000000077051920 3 bytes JMP 7178000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                                                                                                                                   0000000077051924 2 bytes JMP 7178000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                                                                                                                                               000000007706c4dd 5 bytes JMP 0000000174404e10
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\SysWOW64\ntdll.dll!RtlExitUserThread                                                                                                                                                                        000000007708801c 5 bytes JMP 0000000174404ff0
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\kernel32.dll!WriteFile                                                                                                                                                                             0000000074ce1282 5 bytes JMP 0000000174404e70
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\kernel32.dll!FreeLibrary                                                                                                                                                                           0000000074ce3488 5 bytes JMP 0000000174405240
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\kernel32.dll!VirtualProtect                                                                                                                                                                        0000000074ce4327 5 bytes JMP 0000000174404ed0
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\kernel32.dll!LoadLibraryExA                                                                                                                                                                        0000000074ce48db 5 bytes JMP 0000000174404f50
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\kernel32.dll!LoadLibraryW                                                                                                                                                                          0000000074ce48f3 5 bytes JMP 0000000174404f10
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\kernel32.dll!LoadLibraryExW                                                                                                                                                                        0000000074ce4925 5 bytes JMP 0000000174404f30
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\kernel32.dll!LoadLibraryA                                                                                                                                                                          0000000074ce499f 5 bytes JMP 0000000174404f70
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\kernel32.dll!CreateFileA                                                                                                                                                                           0000000074ce538e 5 bytes JMP 0000000174405070
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\kernel32.dll!GlobalAlloc                                                                                                                                                                           0000000074ce5856 5 bytes JMP 0000000174404f90
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\kernel32.dll!ExitProcess                                                                                                                                                                           0000000074ce79d8 5 bytes JMP 0000000174405010
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                                                                                                                                0000000074cf3bbb 3 bytes JMP 7175000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                                                                                                                                            0000000074cf3bbf 2 bytes JMP 7175000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalA                                                                                                                                                                0000000074cfa48f 5 bytes JMP 0000000174405030
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\kernel32.dll!WriteProcessMemory                                                                                                                                                                    0000000074cfd9b0 5 bytes JMP 0000000174404e30
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\kernel32.dll!GetThreadContext                                                                                                                                                                      0000000074d0799c 5 bytes JMP 0000000174404fb0
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\kernel32.dll!VirtualProtectEx                                                                                                                                                                      0000000074d64aff 5 bytes JMP 0000000174404eb0
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\kernel32.dll!WriteFileEx                                                                                                                                                                           0000000074d64b2f 5 bytes JMP 0000000174404e50
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\kernel32.dll!SetThreadContext                                                                                                                                                                      0000000074d658d3 5 bytes JMP 0000000174404ef0
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                                                                                                                                0000000075fa2c9e 4 bytes CALL 71af0000
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\USER32.dll!SendMessageW                                                                                                                                                                            0000000074fc9679 6 bytes JMP 7199000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                                                                                                                            0000000074fd12a5 6 bytes JMP 7193000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                                                                                                                            0000000074fd3baa 6 bytes JMP 7196000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\USER32.dll!SendMessageA                                                                                                                                                                            0000000074fd612e 6 bytes JMP 719c000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\USER32.dll!SendInput                                                                                                                                                                               0000000074feff4a 3 bytes JMP 719f000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\USER32.dll!SendInput + 4                                                                                                                                                                           0000000074feff4e 2 bytes JMP 719f000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\USER32.dll!mouse_event                                                                                                                                                                             000000007502027b 6 bytes JMP 71a5000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\USER32.dll!keybd_event                                                                                                                                                                             00000000750202bf 6 bytes JMP 71a2000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                                                                                                                        00000000751e70c4 6 bytes JMP 718d000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                                                                                                                        0000000075203264 6 bytes JMP 7190000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\SysWOW64\WINSPOOL.DRV!AddPrintProvidorA                                                                                                                                                                     0000000072fd8b83 6 bytes JMP 71ab000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\SysWOW64\WINSPOOL.DRV!AddPrintProvidorW                                                                                                                                                                     0000000072fdf612 6 bytes JMP 71a8000a
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                                                00000000754b1465 2 bytes [4B, 75]
.text     C:\Windows\SysWOW64\RunDll32.exe[3976] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                                               00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[5716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                          00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[5716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                         00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                                                         0000000076ea1510 6 bytes {JMP QWORD [RIP+0x929eb20]}
.text     C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                                  0000000076ea1520 6 bytes {JMP QWORD [RIP+0x92feb10]}
.text     C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                            0000000076ea15e0 6 bytes {JMP QWORD [RIP+0x92dea50]}
.text     C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                          0000000076ea1800 6 bytes {JMP QWORD [RIP+0x92be830]}
.text     C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                         0000000076ea18b0 6 bytes {JMP QWORD [RIP+0x925e780]}
.text     C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                      0000000076ea1e40 6 bytes {JMP QWORD [RIP+0x927e1f0]}
.text     C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[4680] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                    0000000076ea27e0 6 bytes {JMP QWORD [RIP+0x931d850]}
.text     C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                                                                            0000000076ea1510 6 bytes {JMP QWORD [RIP+0x929eb20]}
.text     C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                                                     0000000076ea1520 6 bytes {JMP QWORD [RIP+0x92feb10]}
.text     C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                                               0000000076ea15e0 6 bytes {JMP QWORD [RIP+0x92dea50]}
.text     C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                                             0000000076ea1800 6 bytes {JMP QWORD [RIP+0x92be830]}
.text     C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                                            0000000076ea18b0 6 bytes {JMP QWORD [RIP+0x925e780]}
.text     C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                                         0000000076ea1e40 6 bytes {JMP QWORD [RIP+0x927e1f0]}
.text     C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[6404] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                                       0000000076ea27e0 6 bytes {JMP QWORD [RIP+0x931d850]}
.text     C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[6404] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                                                                                                0000000076d4db80 6 bytes {JMP QWORD [RIP+0x94924b0]}
.text     C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[6404] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                                                                                000007fefcec9055 3 bytes [B5, 6F, 06]
.text     C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[6404] C:\Windows\system32\ADVAPI32.dll!CreateServiceW                                                                                                                                                        000007fefecb55c8 6 bytes {JMP QWORD [RIP+0x19aa68]}
.text     C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[6404] C:\Windows\system32\ADVAPI32.dll!CreateServiceA                                                                                                                                                        000007fefeccb85c 6 bytes JMP 1801
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6864] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                             00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[6864] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                            00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5020] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                  00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5020] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                 00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Windows\system32\wuauclt.exe[5388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                                                                                             0000000076ea1510 6 bytes {JMP QWORD [RIP+0x929eb20]}
.text     C:\Windows\system32\wuauclt.exe[5388] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                                                                      0000000076ea1520 6 bytes {JMP QWORD [RIP+0x92feb10]}
.text     C:\Windows\system32\wuauclt.exe[5388] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                                                                0000000076ea15e0 6 bytes {JMP QWORD [RIP+0x92dea50]}
.text     C:\Windows\system32\wuauclt.exe[5388] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                                                              0000000076ea1800 6 bytes {JMP QWORD [RIP+0x92be830]}
.text     C:\Windows\system32\wuauclt.exe[5388] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                                                             0000000076ea18b0 6 bytes {JMP QWORD [RIP+0x925e780]}
.text     C:\Windows\system32\wuauclt.exe[5388] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                                                          0000000076ea1e40 6 bytes {JMP QWORD [RIP+0x927e1f0]}
.text     C:\Windows\system32\wuauclt.exe[5388] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                                                        0000000076ea27e0 6 bytes {JMP QWORD [RIP+0x931d850]}
.text     C:\Windows\system32\wuauclt.exe[5388] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                                                                                                                                 0000000076d4db80 6 bytes {JMP QWORD [RIP+0x94924b0]}
.text     C:\Windows\system32\wuauclt.exe[5388] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                                                                                                 000007fefcec9055 3 bytes CALL 9000027
.text     C:\Program Files\Sony\VAIO Care\VCService.exe[6188] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                                   00000000754b1465 2 bytes [4B, 75]
.text     C:\Program Files\Sony\VAIO Care\VCService.exe[6188] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                                  00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2
.text     C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[5744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                                                                                                            0000000076ea1510 6 bytes {JMP QWORD [RIP+0x929eb20]}
.text     C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[5744] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                                                     0000000076ea1520 6 bytes {JMP QWORD [RIP+0x92feb10]}
.text     C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[5744] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                                               0000000076ea15e0 6 bytes {JMP QWORD [RIP+0x92dea50]}
.text     C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[5744] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                                             0000000076ea1800 6 bytes {JMP QWORD [RIP+0x92be830]}
.text     C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[5744] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                                            0000000076ea18b0 6 bytes {JMP QWORD [RIP+0x925e780]}
.text     C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[5744] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                                         0000000076ea1e40 6 bytes {JMP QWORD [RIP+0x927e1f0]}
.text     C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[5744] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                                       0000000076ea27e0 6 bytes {JMP QWORD [RIP+0x931d850]}
.text     C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[5744] C:\Windows\system32\KERNEL32.dll!CreateProcessInternalW                                                                                                                                                0000000076d4db80 6 bytes {JMP QWORD [RIP+0x94924b0]}
.text     C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[5744] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357                                                                                                                                                000007fefcec9055 3 bytes CALL 9000027
.text     C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[5744] C:\Windows\system32\ADVAPI32.dll!CreateServiceW                                                                                                                                                        000007fefecb55c8 6 bytes {JMP QWORD [RIP+0x19aa68]}
.text     C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[5744] C:\Windows\system32\ADVAPI32.dll!CreateServiceA                                                                                                                                                        000007fefeccb85c 6 bytes {JMP QWORD [RIP+0x1647d4]}
.text     C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[5744] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW                                                                                                                                                  000007fefe2b3030 6 bytes {JMP QWORD [RIP+0x1dd000]}
.text     C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[5744] C:\Windows\system32\WS2_32.dll!connect + 1                                                                                                                                                             000007fefe2b45c1 5 bytes {JMP QWORD [RIP+0x17ba70]}
.text     C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[5744] C:\Windows\system32\WS2_32.dll!listen                                                                                                                                                                  000007fefe2b8290 6 bytes {JMP QWORD [RIP+0x1b7da0]}
.text     C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[5744] C:\Windows\system32\WS2_32.dll!WSAConnect                                                                                                                                                              000007fefe2de0f0 6 bytes {JMP QWORD [RIP+0x171f40]}
.text     C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[5744] C:\Windows\system32\rasapi32.dll!RasDialW + 1                                                                                                                                                          000007fef5e996f5 5 bytes JMP 87e8
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                                                                                                                                     000000007704fc20 3 bytes JMP 718a000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4                                                                                                                                                                 000000007704fc24 2 bytes JMP 718a000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                                                                                                                              000000007704fc38 3 bytes JMP 7181000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4                                                                                                                                                          000000007704fc3c 2 bytes JMP 7181000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                                                                                                                        000000007704fd64 3 bytes JMP 7184000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4                                                                                                                                                                    000000007704fd68 2 bytes JMP 7184000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                                                                                                                      00000000770500b4 3 bytes JMP 7187000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4                                                                                                                                                                  00000000770500b8 2 bytes JMP 7187000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                                                                                                                                     00000000770501c4 3 bytes JMP 7190000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4                                                                                                                                                                 00000000770501c8 2 bytes JMP 7190000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                                                                                                                                  0000000077050a44 3 bytes JMP 718d000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4                                                                                                                                                              0000000077050a48 2 bytes JMP 718d000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                                                                                                                0000000077051920 3 bytes JMP 717e000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4                                                                                                                                                            0000000077051924 2 bytes JMP 717e000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                                                                                                                                         0000000074cf3bbb 3 bytes JMP 717b000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4                                                                                                                                                     0000000074cf3bbf 2 bytes JMP 717b000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493                                                                                                                                                         0000000075fa2c9e 4 bytes CALL 71af0000
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\syswow64\USER32.dll!SendMessageW                                                                                                                                                                     0000000074fc9679 6 bytes JMP 719f000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\syswow64\USER32.dll!PostMessageW                                                                                                                                                                     0000000074fd12a5 6 bytes JMP 7199000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\syswow64\USER32.dll!PostMessageA                                                                                                                                                                     0000000074fd3baa 6 bytes JMP 719c000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\syswow64\USER32.dll!SendMessageA                                                                                                                                                                     0000000074fd612e 6 bytes JMP 71a2000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\syswow64\USER32.dll!SendInput                                                                                                                                                                        0000000074feff4a 3 bytes JMP 71a5000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\syswow64\USER32.dll!SendInput + 4                                                                                                                                                                    0000000074feff4e 2 bytes JMP 71a5000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\syswow64\USER32.dll!mouse_event                                                                                                                                                                      000000007502027b 6 bytes JMP 71ab000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\syswow64\USER32.dll!keybd_event                                                                                                                                                                      00000000750202bf 6 bytes JMP 71a8000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                                                                                                                                 00000000751e70c4 6 bytes JMP 7193000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                                                                                                                                 0000000075203264 6 bytes JMP 7196000a
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                                                                         00000000754b1465 2 bytes [4B, 75]
.text     C:\Users\Mirjana\Desktop\Gmer-19357.exe[7228] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                                                                        00000000754b14bb 2 bytes [4B, 75]
.text     ...                                                                                                                                                                                                                                                           * 2

Mira_11 · 29.12.2014, 02:08

Gmer, Teil 3:

Code:

ATTFilter

---- Processes - GMER 2.1 ----

Library   C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Qt5Widgets.dll (*** suspicious ***) @ C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe [4876] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:46)        0000000066a80000
Library   C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Qt5Gui.dll (*** suspicious ***) @ C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe [4876] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:38)            0000000066780000
Library   C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\libGLESv2.dll (*** suspicious ***) @ C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe [4876](2014-10-22 00:22:50)                                                                                        000000006ac00000
Library   C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Qt5Core.dll (*** suspicious ***) @ C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe [4876] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:38)           0000000066390000
Library   C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\icuin52.dll (*** suspicious ***) @ C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe [4876] (ICU I18N DLL/The ICU Project)(2014-10-22 00:22:50)                                                           000000004a900000
Library   C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\icuuc52.dll (*** suspicious ***) @ C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe [4876] (ICU Common DLL/The ICU Project)(2014-10-22 00:22:50)                                                         0000000004320000
Library   C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\icudt52.dll (*** suspicious ***) @ C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe [4876] (ICU Data DLL/The ICU Project)(2014-10-22 00:22:50)                                                           000000004ad00000
Library   c:\users\mirjana\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp7zssvz.dll (*** suspicious ***) @ C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe [4876](2014-12-28 19:00:48)                                       0000000003e00000
Library   C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Qt5Network.dll (*** suspicious ***) @ C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe [4876] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:38)        00000000695f0000
Library   C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Qt5WebKit.dll (*** suspicious ***) @ C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe [4876] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:40)         0000000062f20000
Library   C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Qt5Quick.dll (*** suspicious ***) @ C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe [4876] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:40)          0000000064ac0000
Library   C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Qt5Qml.dll (*** suspicious ***) @ C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe [4876] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:40)            0000000064600000
Library   C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Qt5Sql.dll (*** suspicious ***) @ C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe [4876] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:40)            0000000069a50000
Library   C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\libEGL.dll (*** suspicious ***) @ C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe [4876](2014-10-22 00:22:50)                                                                                           0000000069aa0000
Library   C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Qt5WebKitWidgets.dll (*** suspicious ***) @ C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe [4876] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:46)  0000000069950000
Library   C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Qt5OpenGL.dll (*** suspicious ***) @ C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe [4876] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:38)         00000000698d0000
Library   C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll (*** suspicious ***) @ C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe [4876] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:38)   0000000069830000
Library   C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll (*** suspicious ***) @ C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe [4876](2014-10-22 00:22:48)                                                                       0000000064e20000
Library   C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll (*** suspicious ***) @ C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe [4876](2014-10-22 00:22:46)                                                                       0000000069910000
Library   C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{4F51C5D2-BC1B-48C2-A445-DC641D7CDF2F}\offreg.dll (*** suspicious ***) @ C:\Windows\System32\svchost.exe [796](2014-12-27 10:30:58)                                                              000007fefa9e0000

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0c6076a27b11                                                                                                                                                                                   
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\18f46aeece45                                                                                                                                                                                   
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\18f46aeece45@0018130fbe2e                                                                                                                                                                      0x55 0x50 0x42 0x92 ...
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\18f46aeece45@bc20a4cf5c8b                                                                                                                                                                      0x5C 0xB6 0x3C 0xDD ...
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\18f46aeece45@bccfcc1b5bf2                                                                                                                                                                      0xBD 0x0E 0xA4 0x87 ...
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\18f46aeece45@6cadf843341c                                                                                                                                                                      0xF3 0x15 0x6F 0x93 ...
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\18f46aeece45@0075583bea62                                                                                                                                                                      0xA9 0x7B 0x87 0x2F ...
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c0cb38f317a0                                                                                                                                                                                   
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0c6076a27b11 (not active ControlSet)                                                                                                                                                               
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\18f46aeece45 (not active ControlSet)                                                                                                                                                               
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\18f46aeece45@0018130fbe2e                                                                                                                                                                          0x55 0x50 0x42 0x92 ...
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\18f46aeece45@bc20a4cf5c8b                                                                                                                                                                          0x5C 0xB6 0x3C 0xDD ...
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\18f46aeece45@bccfcc1b5bf2                                                                                                                                                                          0xBD 0x0E 0xA4 0x87 ...
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\18f46aeece45@6cadf843341c                                                                                                                                                                          0xF3 0x15 0x6F 0x93 ...
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\18f46aeece45@0075583bea62                                                                                                                                                                          0xA9 0x7B 0x87 0x2F ...
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c0cb38f317a0 (not active ControlSet)                                                                                                                                                               

---- EOF - GMER 2.1 ----

Sophos:

Code:

ATTFilter

20141201 092117	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141201 092729	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20141201 092729	Die Erkennungsdatenversion 5.08 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8095810 Objekte erkennen.
20141201 092729	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20141202 210253	Die Erkennungsdatenversion 5.08 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8095810 Objekte erkennen.
20141202 210254	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141202 210859	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20141202 210900	Die Erkennungsdatenversion 5.08 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8095971 Objekte erkennen.
20141202 210900	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20141203 165837	Die Erkennungsdatenversion 5.08 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8095971 Objekte erkennen.
20141203 165838	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141203 170450	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20141203 170451	Die Erkennungsdatenversion 5.08 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8096036 Objekte erkennen.
20141203 170451	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20141203 230720	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20141203 230725	Die Erkennungsdatenversion 5.08 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8096063 Objekte erkennen.
20141203 230726	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20141205 184038	Die Erkennungsdatenversion 5.08 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8096063 Objekte erkennen.
20141205 184038	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141205 201052	Die Erkennungsdatenversion 5.08 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8096063 Objekte erkennen.
20141205 201052	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141207 044822	Die Erkennungsdatenversion 5.08 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8096063 Objekte erkennen.
20141207 044822	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141209 041432	Die Erkennungsdatenversion 5.08 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8096063 Objekte erkennen.
20141209 041433	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141221 125854	Die Erkennungsdatenversion 5.08 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8096063 Objekte erkennen.
20141221 125854	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141221 130354	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20141221 130506	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263598 Objekte erkennen.
20141221 130507	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141221 130507	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263598 Objekte erkennen.
20141223 141916	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263598 Objekte erkennen.
20141223 141916	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141223 142456	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263598 Objekte erkennen.
20141223 142456	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141223 142815	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263598 Objekte erkennen.
20141223 142816	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141223 143529	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20141223 143532	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263738 Objekte erkennen.
20141223 143533	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20141223 153925	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 153926	Der Scan von 'hxxp://aihdownload.adobe.com/bin/live/install_flashplayer16x32_mssa_aaa_aih.exe' führte zu SAV Interface-Fehler 0xa0040212: Datei ist verschlüsselt.
20141223 194400	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263738 Objekte erkennen.
20141223 194400	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141223 195045	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20141223 195046	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263752 Objekte erkennen.
20141223 195046	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20141223 205208	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20141223 205218	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263767 Objekte erkennen.
20141223 205222	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20141226 115726	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263767 Objekte erkennen.
20141226 115727	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141226 120521	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20141226 120534	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263847 Objekte erkennen.
20141226 120536	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20141226 163437	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20141226 163449	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263854 Objekte erkennen.
20141226 163453	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20141226 174923	Datei "C:\Users\Mirjana\AppData\Local\Temp\21275587.bat" gehört zu Virus/Spyware 'Bat/Agent-AIAC'.
20141226 174923	On-Access-Scanner hat den Zugriff auf den Speicherort "C:\Users\Mirjana\AppData\Local\Temp\21275587.bat" für folgenden Benutzer verweigert: Mirjana_Vaio\Mirjana
20141226 175018	Datei "C:\Users\Mirjana\AppData\Local\Temp\21275587.bat" gehört zu Virus/Spyware 'Bat/Agent-AIAC'.
20141226 175021	Datei "C:\Users\Mirjana\AppData\Local\Temp\21275587.bat" wurde bereinigt.
20141226 175021	Virus/Spyware 'Bat/Agent-AIAC' entfernt.
20141226 180047	Scan 'Computer scannen' gestartet.
20141226 180229	Virus/Spyware 'Troj/ZbotMem-B' wurde in "User Memory" erkannt.
20141226 180229	'Troj/ZbotMem-B' muss vor dem Fortsetzen des Scan-Vorgangs bereinigt werden
20141226 180229	Scan 'Computer scannen' abgebrochen.
20141226 180229	Ergebniszusammenfassung für Scan 'Computer scannen':
		Gescannte Objekte: 2
		Fehler: 1
		Objekte in Quarantäne: 1
		Behandelte Objekte: 0
20141226 180706	Scan 'Computer scannen' gestartet.
20141226 180758	Virus/Spyware 'Troj/ZbotMem-B' wurde in "User Memory" erkannt.
20141226 180758	'Troj/ZbotMem-B' muss vor dem Fortsetzen des Scan-Vorgangs bereinigt werden
20141226 180758	Scan 'Computer scannen' abgebrochen.
20141226 180758	Ergebniszusammenfassung für Scan 'Computer scannen':
		Gescannte Objekte: 2
		Fehler: 1
		Objekte in Quarantäne: 1
		Behandelte Objekte: 0
20141226 203208	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263854 Objekte erkennen.
20141226 203210	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141226 203210	
	Der Scan von Datei [...\Device\HarddiskVolume3\Windows\System32\setbcdlocale.dll] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess avscan.exe, (Überprüfung des Zeitstempels [ 1d0214b064f6786]).

20141226 203210	
	Der Scan von Datei [...\Device\HarddiskVolume3\Windows\System32\sethc.exe] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess avscan.exe, (Überprüfung des Zeitstempels [ 1d0214b0651c8e6]).

20141226 203210	
	Der Scan von Datei [...evice\HarddiskVolume3\Windows\System32\SetIEInstalledDate.exe] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess avscan.exe, (Überprüfung des Zeitstempels [ 1d0214b065dafc8]).

20141226 203210	
	Der Scan von Datei [...\Device\HarddiskVolume3\Windows\System32\setspn.exe] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess avscan.exe, (Überprüfung des Zeitstempels [ 1d0214b06627288]).

20141226 203210	
	Der Scan von Datei [...\Device\HarddiskVolume3\Windows\System32\setupapi.dll] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess avscan.exe, (Überprüfung des Zeitstempels [ 1d0214b06673549]).

20141226 203211	
	Der Scan von Datei [...\Device\HarddiskVolume3\Windows\System32\setupcl.exe] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess avscan.exe, (Überprüfung des Zeitstempels [ 1d0214b0696d0ce]).

20141226 203211	
	Der Scan von Datei [...\Device\HarddiskVolume3\Windows\System32\setupcln.dll] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess avscan.exe, (Überprüfung des Zeitstempels [ 1d0214b06a9dbd0]).

20141226 203211	
	Der Scan von Datei [...\Device\HarddiskVolume3\Windows\System32\setupetw.dll] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess avscan.exe, (Überprüfung des Zeitstempels [ 1d0214b06b0fff1]).

20141226 203211	
	Der Scan von Datei [...\Device\HarddiskVolume3\Windows\System32\setupugc.exe] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess avscan.exe, (Überprüfung des Zeitstempels [ 1d0214b06b0fff1]).

20141226 203211	
	Der Scan von Datei [...\Device\HarddiskVolume3\Windows\System32\setx.exe] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess avscan.exe, (Überprüfung des Zeitstempels [ 1d0214b06bce6d2]).

20141226 210521	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263854 Objekte erkennen.
20141226 210522	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141226 210523	
	Der Scan von Datei [...ram Files (x86)\Sophos\Sophos Anti-Virus\ComponentManager.dll] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess SAVAdminServic, (Überprüfung des Zeitstempels [ 1d0214faa09dde1]).

20141226 210523	
	Der Scan von Datei [...rogram Files (x86)\Sophos\Sophos Anti-Virus\SWIManagement.dll] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess swi_service.ex, (Überprüfung des Zeitstempels [ 1d0214faa09dde1]).

20141226 210523	
	Der Scan von Datei [...gram Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess SAVAdminServic, (Überprüfung des Zeitstempels [ 1d0214faa136362]).

20141226 210523	
	Der Scan von Datei [...Program Files (x86)\Sophos\Sophos Anti-Virus\ICManagement.dll] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess SAVAdminServic, (Überprüfung des Zeitstempels [ 1d0214faa0ea0a1]).

20141226 210523	
	Der Scan von Datei [...Device\HarddiskVolume3\PROGRA~2\Sophos\SOPHOS~1\WSCClient.exe] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess SAVAdminServic, (Überprüfung des Zeitstempels [ 1d0214faa514729]).

20141226 210523	
	Der Scan von Datei [...ogram Files (x86)\Sophos\Sophos Anti-Virus\VirusDetection.dll] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess SAVAdminServic, (Überprüfung des Zeitstempels [ 1d0214faa266e64]).

20141226 210523	
	Der Scan von Datei [...es (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess swi_service.ex, (Überprüfung des Zeitstempels [ 1d0214faa34b6a6]).

20141226 210524	
	Der Scan von Datei [...\Device\HarddiskVolume3\Windows\SYSTEM32\sechost.dll] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess WSCClient.exe, (Überprüfung des Zeitstempels [ 1d0214faa6b764c]).

20141226 210524	
	Der Scan von Datei [...\Device\HarddiskVolume3\Windows\system32\IMM32.DLL] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess WSCClient.exe, (Überprüfung des Zeitstempels [ 1d0214faa7c1fee]).

20141226 210524	
	Der Scan von Datei [...\Device\HarddiskVolume3\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~2.DLL] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess WSCClient.exe, (Überprüfung des Zeitstempels [ 1d0214faa80e2ae]).

20141226 213420	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20141226 213426	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263857 Objekte erkennen.
20141226 213435	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20141226 214002	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263857 Objekte erkennen.
20141226 214003	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141226 214003	
	Der Scan von Datei [... Files (x86)\Spybot - Search & Destroy\Updates\downloaded.ini] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess SDWinSec.exe, (Überprüfung des Zeitstempels [ 1d0215481f60006]).

20141226 214003	
	Der Scan von Datei [...rogram Files (x86)\Sophos\Sophos Anti-Virus\SWIManagement.dll] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess swi_service.ex, (Überprüfung des Zeitstempels [ 1d021548229e14b]).

20141226 214003	
	Der Scan von Datei [...ram Files (x86)\Sophos\Sophos Anti-Virus\ComponentManager.dll] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess SAVAdminServic, (Überprüfung des Zeitstempels [ 1d021548229e14b]).

20141226 214003	
	Der Scan von Datei [...es (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess swi_service.ex, (Überprüfung des Zeitstempels [ 1d02154822e752c]).

20141226 214004	
	Der Scan von Datei [...Program Files (x86)\Sophos\Sophos Anti-Virus\ICManagement.dll] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess SAVAdminServic, (Überprüfung des Zeitstempels [ 1d02154823c30cd]).

20141226 214004	
	Der Scan von Datei [...gram Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess SAVAdminServic, (Überprüfung des Zeitstempels [ 1d02154824b730e]).

20141226 214004	
	Der Scan von Datei [...Device\HarddiskVolume3\PROGRA~2\Sophos\SOPHOS~1\WSCClient.exe] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess SAVAdminServic, (Überprüfung des Zeitstempels [ 1d02154825dc290]).

20141226 214004	
	Der Scan von Datei [...\Device\HarddiskVolume3\Windows\SYSTEM32\sechost.dll] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess WSCClient.exe, (Überprüfung des Zeitstempels [ 1d021548260cfd0]).

20141226 214004	
	Der Scan von Datei [...\Device\HarddiskVolume3\Windows\system32\IMM32.DLL] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess WSCClient.exe, (Überprüfung des Zeitstempels [ 1d0215482625670]).

20141226 214004	
	Der Scan von Datei [...\Device\HarddiskVolume3\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~2.DLL] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess WSCClient.exe, (Überprüfung des Zeitstempels [ 1d021548263dd11]).

20141226 214039	Scan 'Computer scannen' gestartet.
20141226 214145	Virus/Spyware 'Troj/ZbotMem-B' wurde in "User Memory" erkannt.
20141226 214145	'Troj/ZbotMem-B' muss vor dem Fortsetzen des Scan-Vorgangs bereinigt werden
20141226 214146	Scan 'Computer scannen' abgebrochen.
20141226 214146	Ergebniszusammenfassung für Scan 'Computer scannen':
		Gescannte Objekte: 2
		Fehler: 1
		Objekte in Quarantäne: 1
		Behandelte Objekte: 0
20141226 221719	Scan 'Computer scannen' gestartet.
20141226 221809	Virus/Spyware 'Troj/ZbotMem-B' wurde in "User Memory" erkannt.
20141226 221809	'Troj/ZbotMem-B' muss vor dem Fortsetzen des Scan-Vorgangs bereinigt werden
20141226 221809	Scan 'Computer scannen' abgebrochen.
20141226 221810	Ergebniszusammenfassung für Scan 'Computer scannen':
		Gescannte Objekte: 2
		Fehler: 1
		Objekte in Quarantäne: 1
		Behandelte Objekte: 0
20141226 231652	Der Scan von 'C:\Users\Mirjana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1MT6KVAE\AdwCleaner_4.106[1].exe' führte zu SAV Interface-Fehler 0x2004021f: Es wurde kein gültiges temporäres Verzeichnis gefunden.
20141226 231652	Der Scan von 'C:\Users\Mirjana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1MT6KVAE\AdwCleaner_4.106[1].exe' führte zu SAV Interface-Fehler 0xa004021c: Ungültiger Rückgabecode von einer Rückruffunktion des SAV Interface-Clients.
20141226 231652	Der Scan von 'C:\Users\Mirjana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1MT6KVAE\AdwCleaner_4.106[1].exe' führte zu SAV Interface-Fehler 0x2004021f: Es wurde kein gültiges temporäres Verzeichnis gefunden.
20141226 231652	Der Scan von 'C:\Users\Mirjana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1MT6KVAE\AdwCleaner_4.106[1].exe' führte zu SAV Interface-Fehler 0xa004021c: Ungültiger Rückgabecode von einer Rückruffunktion des SAV Interface-Clients.
20141226 233831	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263857 Objekte erkennen.
20141226 233834	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141226 233834	
	Der Scan von Datei [...iskVolume3\Program Files\WIDCOMM\Bluetooth Software\btins.dll] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess btwdins.exe, (Überprüfung des Zeitstempels [ 1d02165106c8d15]).

20141226 233835	
	Der Scan von Datei [...ume3\Program Files\WIDCOMM\Bluetooth Software\btwprofpack.dll] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess btwdins.exe, (Überprüfung des Zeitstempels [ 1d0216510aa70dc]).

20141226 233835	
	Der Scan von Datei [...\Device\HarddiskVolume3\Windows\system32\WINSPOOL.DRV] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess btwdins.exe, (Überprüfung des Zeitstempels [ 1d0216510cbc420]).

20141226 233835	
	Der Scan von Datei [...6)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess svchost.exe, (Überprüfung des Zeitstempels [ 1d02165107873f6]).

20141226 233835	
	Der Scan von Datei [...e3\Program Files (x86)\Sophos\Sophos Anti-Virus\WSCClient.exe] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess svchost.exe, (Überprüfung des Zeitstempels [ 1d0216510da0c62]).

20141226 233835	
	Der Scan von Datei [...(x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess WerFault.exe, (Überprüfung des Zeitstempels [ 1d021651081f978]).

20141226 233835	
	Der Scan von Datei [...(x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess WerFault.exe, (Überprüfung des Zeitstempels [ 1d0216510f69ce5]).

20141226 233835	
	Der Scan von Datei [...olume3\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess svchost.exe, (Überprüfung des Zeitstempels [ 1d0216510e854a3]).

20141226 233835	
	Der Scan von Datei [...isco AnyConnect Secure Mobility Client\Plugins\acfeedback.dll] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess WerFault.exe, (Überprüfung des Zeitstempels [ 1d021651117f029]).

20141226 233835	
	Der Scan von Datei [...3\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe] wurde nach einer Zeitüberschreitung/Auslastung durchgeführt. Sie wird protokolliert. Prozess svchost.exe, (Überprüfung des Zeitstempels [ 1d02165110c0947]).

20141226 234014	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263857 Objekte erkennen.
20141226 234015	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141226 234711	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263857 Objekte erkennen.
20141226 234711	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141227 000742	Scan 'Computer scannen' gestartet.
20141227 015320	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20141227 015328	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263863 Objekte erkennen.
20141227 015332	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20141227 021129	Der Scan von 'Boot Record, Laufwerk Q:' führte zu SAV Interface-Fehler 0xa0040210: Kein Zugriff auf Datei.
20141227 041215	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263863 Objekte erkennen.
20141227 041216	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141227 041841	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263863 Objekte erkennen.
20141227 041842	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141227 091547	Scan 'Computer scannen' gestartet.
20141227 102839	Scan 'Computer scannen' abgebrochen.
20141227 102840	Ergebniszusammenfassung für Scan 'Computer scannen':
		Gescannte Objekte: 117
		Fehler: 0
		Objekte in Quarantäne: 0
		Behandelte Objekte: 0
20141227 104352	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263863 Objekte erkennen.
20141227 104352	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141227 111013	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263863 Objekte erkennen.
20141227 111014	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141227 163349	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263863 Objekte erkennen.
20141227 163349	Benutzer (NT-AUTORITÄT\LOKALER DIENST) hat den On-Access-Scan auf diesem Computer gestartet.
20141227 164125	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer abgebrochen.
20141227 164130	Die Erkennungsdatenversion 5.09 (Detection Engine 3.53.0) wird verwendet. Diese Version kann 8263866 Objekte erkennen.
20141227 164132	Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.

Malwarebytes:
1. Scan:

Code:

ATTFilter

2014/12/26 23:22:38 +0100 mbam-log-2014-12-26 (23-22-33).xml yes  2.00.4.1028 v2014.12.26.11 v2014.12.23.02 trial enabled enabled disabled  Windows 7 Service Pack 1 x64 Mirjana NTFS  threat completed 371521 3553 0 0 34 8 0 19 114 0  enabled enabled enabled enabled disabled disabled enabled enabled enabled  HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}PUP.Optional.Softomate.Asuccess0e65fe6975071e182a649445fa082bd5 HKLM\SOFTWARE\CLASSES\TYPELIB\{4509D3CC-B642-4745-B030-645B79522C6D}PUP.Optional.Softomate.Asuccess0e65fe6975071e182a649445fa082bd5 HKLM\SOFTWARE\CLASSES\INTERFACE\{4897BBA6-48D9-468C-8EFA-846275D7701B}PUP.Optional.Softomate.Asuccess0e65fe6975071e182a649445fa082bd5 HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{4897BBA6-48D9-468C-8EFA-846275D7701B}PUP.Optional.Softomate.Asuccess0e65fe6975071e182a649445fa082bd5 HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{4509D3CC-B642-4745-B030-645B79522C6D}PUP.Optional.Softomate.Asuccess0e65fe6975071e182a649445fa082bd5 HKLM\SOFTWARE\CLASSES\URLSearchHook.ToolbarURLSearchHook.1PUP.Optional.Softomate.Asuccess0e65fe6975071e182a649445fa082bd5 HKLM\SOFTWARE\CLASSES\URLSearchHook.ToolbarURLSearchHookPUP.Optional.Softomate.Asuccess0e65fe6975071e182a649445fa082bd5 HKLM\SOFTWARE\WOW6432NODE\CLASSES\URLSearchHook.ToolbarURLSearchHookPUP.Optional.Softomate.Asuccess0e65fe6975071e182a649445fa082bd5 HKLM\SOFTWARE\WOW6432NODE\CLASSES\URLSearchHook.ToolbarURLSearchHook.1PUP.Optional.Softomate.Asuccess0e65fe6975071e182a649445fa082bd5 HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{DF84E609-C3A4-49CB-A160-61767DAF8899}PUP.Optional.WebCake.Asuccessb6bd1453d8a40432d51219f908fb748c HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{DF84E609-C3A4-49CB-A160-61767DAF8899}PUP.Optional.WebCake.Asuccessb6bd1453d8a40432d51219f908fb748c HKU\S-1-5-21-2462366986-3853951462-1244750843-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{BA14329E-9550-4989-B3F2-9732E92D17CC}PUP.Optional.VuzeRemoteTB.Asuccess95dea5c22359b482c7303ba113ef7f81 HKLM\SOFTWARE\CLASSES\CrossriderApp0020900.BHOPUP.Optional.CrossRider.Asuccess324192d55f1da49292db85f1c83b7090 HKLM\SOFTWARE\CLASSES\CrossriderApp0020900.BHO.1PUP.Optional.CrossRider.Asuccessd49f94d3c9b365d1115c56207390af51 HKLM\SOFTWARE\CLASSES\CrossriderApp0020900.SandboxPUP.Optional.CrossRider.Asuccessc1b2f37425579d99630afb7be22107f9 HKLM\SOFTWARE\CLASSES\CrossriderApp0020900.Sandbox.1PUP.Optional.CrossRider.Asuccessc1b28dda324a41f5fa730f67f50e37c9 HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0020900.BHOPUP.Optional.CrossRider.Asuccessfe757ceb7a02ea4c6508740211f247b9 HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0020900.BHO.1PUP.Optional.CrossRider.Asuccessc6ad4522215b092d71fc2650cb38916f HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0020900.SandboxPUP.Optional.CrossRider.Asuccessbbb84621b4c871c590dd1d59c83bd729 HKLM\SOFTWARE\WOW6432NODE\CLASSES\CrossriderApp0020900.Sandbox.1PUP.Optional.CrossRider.Asuccess3241580fceae270f88e53d397c876b95 HKU\S-1-5-21-2462366986-3853951462-1244750843-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SoftonicPUP.Optional.Softonic.Asuccess88ebc4a3d4a88babb4c1cb93996a956b HKU\S-1-5-21-2462366986-3853951462-1244750843-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\CrossriderPUP.Optional.CrossRider.Asuccess373c2e392f4dd95d1242dfea6f95c937 HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{11111111-1111-1111-1111-110211091100}PUP.Optional.CrossRider.Asuccessf97a3b2cfd7ff1458bba9be9eb1af40c HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{11111111-1111-1111-1111-110211091100}PUP.Optional.CrossRider.Asuccessf97a3b2cfd7ff1458bba9be9eb1af40c HKLM\SOFTWARE\CLASSES\TYPELIB\{44444444-4444-4444-4444-440244094400}PUP.Optional.CrossRider.Asuccessf97a3b2cfd7ff1458bba9be9eb1af40c HKLM\SOFTWARE\CLASSES\INTERFACE\{55555555-5555-5555-5555-550255095500}PUP.Optional.CrossRider.Asuccessf97a3b2cfd7ff1458bba9be9eb1af40c HKLM\SOFTWARE\CLASSES\INTERFACE\{66666666-6666-6666-6666-660266096600}PUP.Optional.CrossRider.Asuccessf97a3b2cfd7ff1458bba9be9eb1af40c HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{55555555-5555-5555-5555-550255095500}PUP.Optional.CrossRider.Asuccessf97a3b2cfd7ff1458bba9be9eb1af40c HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{66666666-6666-6666-6666-660266096600}PUP.Optional.CrossRider.Asuccessf97a3b2cfd7ff1458bba9be9eb1af40c HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{44444444-4444-4444-4444-440244094400}PUP.Optional.CrossRider.Asuccessf97a3b2cfd7ff1458bba9be9eb1af40c HKU\S-1-5-21-2462366986-3853951462-1244750843-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{11111111-1111-1111-1111-110211091100}PUP.Optional.CrossRider.Asuccessf97a3b2cfd7ff1458bba9be9eb1af40c HKU\S-1-5-21-2462366986-3853951462-1244750843-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{11111111-1111-1111-1111-110211091100}PUP.Optional.CrossRider.Asuccessf97a3b2cfd7ff1458bba9be9eb1af40c HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{11111111-1111-1111-1111-110211091100}PUP.Optional.CrossRider.Asuccessf97a3b2cfd7ff1458bba9be9eb1af40c HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{11111111-1111-1111-1111-110211091100}PUP.Optional.CrossRider.Asuccessf97a3b2cfd7ff1458bba9be9eb1af40c HKU\S-1-5-21-2462366986-3853951462-1244750843-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER{BA14329E-9550-4989-B3F2-9732E92D17CC}PUP.Optional.VuzeRemoteTB.Asuccess

2. Scan:

Code:

ATTFilter

2014/12/27 10:10:10 +0100 mbam-log-2014-12-27 (10-09-45).xml yes  2.00.4.1028 v2014.12.27.03 v2014.12.23.02 trial enabled enabled disabled  Windows 7 Service Pack 1 x64 Mirjana NTFS  threat completed 369590 2788 0 0 1 6 0 0 1 0  enabled enabled enabled enabled disabled disabled enabled enabled enabled  HKU\S-1-5-21-2462366986-3853951462-1244750843-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\CrossriderPUP.Optional.CrossRider.Afdd25314106c2a0cf3f49f2a1ce8e61a HKU\S-1-5-21-2462366986-3853951462-1244750843-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{BA14329E-9550-4989-B3F2-9732E92D17CC}PUP.Optional.VuzeRemoteTB.A06c91d4a15673ef85a024a93010156aa HKU\S-1-5-21-2462366986-3853951462-1244750843-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER{BA14329E-9550-4989-B3F2-9732E92D17CC}PUP.Optional.VuzeRemoteTB.A

3. Scan:

Code:

ATTFilter

<?xml version="1.0" encoding="UTF-16"?>

-<mbam-log>


-<header>

<date>2014/12/27 12:15:10 +0100</date>

<logfile>mbam-log-2014-12-27 (12-15-09).xml</logfile>

<isadmin>yes</isadmin>

</header>


-<engine>

<version>2.00.4.1028</version>

<malware-database>v2014.12.27.04</malware-database>

<rootkit-database>v2014.12.23.02</rootkit-database>

<license>trial</license>

<file-protection>enabled</file-protection>

<web-protection>enabled</web-protection>

<self-protection>disabled</self-protection>

</engine>


-<system>

<osversion>Windows 7 Service Pack 1</osversion>

<arch>x64</arch>

<username>Mirjana</username>

<filesys>NTFS</filesys>

</system>


-<summary>

<type>threat</type>

<result>completed</result>

<objects>369555</objects>

<time>2564</time>

<processes>0</processes>

<modules>0</modules>

<keys>1</keys>

<values>1</values>

<datas>0</datas>

<folders>0</folders>

<files>0</files>

<sectors>0</sectors>

</summary>


-<options>

<memory>enabled</memory>

<startup>enabled</startup>

<filesystem>enabled</filesystem>

<archives>enabled</archives>

<rootkits>disabled</rootkits>

<deeprootkit>disabled</deeprootkit>

<heuristics>enabled</heuristics>

<pup>enabled</pup>

<pum>enabled</pum>

</options>


-<items>


-<key>

<path>HKU\S-1-5-21-2462366986-3853951462-1244750843-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider</path>

<vendor>PUP.Optional.CrossRider.A</vendor>

<action>success</action>

<hash>844c3f288cf05adc845ea82153b113ed</hash>

</key>


-<value>

<path>HKU\S-1-5-21-2462366986-3853951462-1244750843-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\NEW WINDOWS\ALLOW</path>

<valuename>*.crossrider.com</valuename>

<vendor>PUP.Optional.CrossRider.A</vendor>

<action>success</action>

<valuedata>CR</valuedata>

<hash>834d5314245894a29d03c610e71df30d</hash>

</value>

</items>

</mbam-log>

AdwCleaner:
1. Scan:

Code:

ATTFilter

# AdwCleaner v4.106 - Bericht erstellt am 27/12/2014 um 00:37:06
# Aktualisiert 21/12/2014 von Xplode
# Database : 2014-12-21.4 [Live]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Mirjana - MIRJANA_VAIO
# Gestartet von : C:\Users\Mirjana\Desktop\AdwCleaner_4.106.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\ProgramData\Premium
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\ProgramData\Uniblue
Ordner Gelöscht : C:\Users\Mirjana\AppData\Local\Ilivid Player
Ordner Gelöscht : C:\Users\Mirjana\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Mirjana\AppData\LocalLow\CodecC
Ordner Gelöscht : C:\Users\Mirjana\AppData\LocalLow\Toolbar4
Ordner Gelöscht : C:\Users\Mirjana\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Mirjana\AppData\Roaming\GrabPro
Ordner Gelöscht : C:\Users\Mirjana\AppData\Roaming\PerformerSoft
Ordner Gelöscht : C:\Users\Mirjana\AppData\Roaming\Mozilla\Firefox\Profiles\n9w74nir.default\Extensions\info@allpremiumplay.info
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Users\Mirjana\AppData\Roaming\Mozilla\Firefox\Profiles\n9w74nir.default\user.js

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{0329E7D6-6F54-462D-93F6-F5C3118BADF2}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ButtonSite.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\PropertySync.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ScriptHost.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\TbCommonUtils.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\TbHelper.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ComObject.DeskbarEnabler
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ComObject.DeskbarEnabler.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Conduit.Engine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Directory\shell\SPEEDbitVideoConverter
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\driverscanner
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SBConvert.SBConvert
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SBConvert.SBConvert.3
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbRequest
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbRequest.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbTask
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbTask.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.ContextMenuNotifier.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.CustomInternetSecurityImpl.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.SearchProviderManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.SearchProviderManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2504091
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4CE516A7-F7AC-4628-B411-8F886DC5733E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{0329E7D6-6F54-462D-93F6-F5C3118BADF2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1C950DE5-D31E-42FB-AFB9-91B0161633D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3BDF4CE9-E81D-432B-A55E-9F0570CE811F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{57CADC46-58FF-4105-B733-5A9F3FC9783C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E45F3E8-2683-4824-A6BE-08108022FB36}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{92A9ACF4-9333-43AE-9698-DB283326F87F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9F0F16DD-4E76-4049-A9B1-7A91E48F0323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9F34B17E-FF0D-4FAB-97C4-9713FEE79052}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A9A56B8E-2DEB-4ED3-BC92-1FA450BCE1A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE338F6D-5A7C-4D1D-86E3-C618532079B5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AF175732-0D59-716D-F757-9F1492D808D9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C339D489-FABC-41DD-B39D-276101667C70}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D433A9D0-8267-40CB-8AD5-24F22FA5373F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D565B35E-B787-40FA-95E3-E3562F8FC1A0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D89031C2-10DA-4C90-9A62-FCED012BC46B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F4288797-CB12-49CE-9DF8-7CDFA1143BEA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220222092200}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0AFD55C8-ADF8-4A33-A6E1-DEDB7A36AEB4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0FA32667-9A8A-4E9C-902F-CA3323180003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6B458F62-592F-4B25-8967-E6A350A59328}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7D86A08B-0A8F-4BE0-B693-F05E6947E780}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FCC9CDD3-EFFF-11D1-A9F0-00A0244AC403}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{3BCF582D-CA87-4C6F-AF3D-B3548A976AB3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{B87F8B63-7274-43FD-87FA-09D3B7496148}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C4BAE205-5E02-4E32-876E-F34B4E2D000C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{EC4085F2-8DB3-45A6-AD0B-CA289F3C5D7E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6E45F3E8-2683-4824-A6BE-08108022FB36}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0329E7D6-6F54-462D-93F6-F5C3118BADF2}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6E45F3E8-2683-4824-A6BE-08108022FB36}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{92A9ACF4-9333-43AE-9698-DB283326F87F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0329E7D6-6F54-462D-93F6-F5C3118BADF2}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6E45F3E8-2683-4824-A6BE-08108022FB36}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{92A9ACF4-9333-43AE-9698-DB283326F87F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{6E45F3E8-2683-4824-A6BE-08108022FB36}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4250488A-CB24-0893-C066-B1AEA57BCFF2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{603C4CC9-5DC6-4C44-873F-8281509DF953}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{BA14329E-9550-4989-B3F2-9732E92D17CC}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{BA14329E-9550-4989-B3F2-9732E92D17CC}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0FA32667-9A8A-4E9C-902F-CA3323180003}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2A42D13C-D427-4787-821B-CF6973855778}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3D8478AA-7B88-48A9-8BCB-B85D594411EC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4D8ED2B3-DC62-43EC-ABA3-5B74F046B1BE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6B458F62-592F-4B25-8967-E6A350A59328}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{95B6A271-FEB4-4160-B0FF-44394C21C8DC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E67D5BC7-7129-493E-9281-F47BDAFACE4F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FCC9CDD3-EFFF-11D1-A9F0-00A0244AC403}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\filescout
Schlüssel Gelöscht : HKCU\Software\ilivid
Schlüssel Gelöscht : HKCU\Software\InstalledBrowserExtensions
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKLM\SOFTWARE\Conduit
Schlüssel Gelöscht : HKLM\SOFTWARE\DeviceVM
Schlüssel Gelöscht : HKLM\SOFTWARE\Uniblue
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DeviceVM
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Tarma Installer
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\delta.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\movshare.net

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16476


-\\ Mozilla Firefox v33.0 (x86 de)

[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091..clientLogIsEnabled", false);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.AppTrackingLastCheckTime", "Sun Apr 10 2011 01:23:42 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.CTID", "CT2504091");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.CurrentServerDate", "9-4-2011");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.DialogsAlignMode", "LTR");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.DialogsGetterLastCheckTime", "Tue Apr 05 2011 17:56:10 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.DownloadReferralCookieData", "");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.EMailNotifierPollDate", "Sun Apr 10 2011 00:48:32 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.FeedLastCount129079840422964131", 10);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.FeedPollDate128891351169457140", "Sun Apr 10 2011 04:23:32 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.FeedPollDate129079840422964131", "Sat Apr 09 2011 23:23:33 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.FeedTTL128891351169457140", 40);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.FirstServerDate", "5-4-2011");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.FirstTime", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.FirstTimeFF3", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.FixPageNotFoundErrors", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.GroupingServerCheckInterval", 1440);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.HasUserGlobalKeys", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.Initialize", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.InitializeCommonPrefs", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.InstallationAndCookieDataSentCount", 2);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.InstallationId", "StubInstaller");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.InstallationType", "ConduitIntegration");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.InstalledDate", "Tue Apr 05 2011 17:56:09 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.IsGrouping", false);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.IsMulticommunity", false);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.IsOpenThankYouPage", false);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.IsOpenUninstallPage", false);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.LanguagePackLastCheckTime", "Sat Apr 09 2011 21:23:32 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.LanguagePackReloadIntervalMM", 1440);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.LastLogin_3.3.3.2", "Sat Apr 09 2011 21:23:36 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.LatestVersion", "3.3.3.2");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.Locale", "en-us");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.MCDetectTooltipHeight", "83");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.MCDetectTooltipWidth", "295");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.SHRINK_TOOLBAR", 1);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.SearchFromAddressBarIsInit", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.SearchInNewTabEnabled", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.SearchInNewTabIntervalMM", 1440);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.SearchInNewTabLastCheckTime", "Sat Apr 09 2011 21:23:32 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageService.asmx/UsersRequests?ctid=EB_TOOLBAR_ID");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.ServiceMapLastCheckTime", "Sat Apr 09 2011 21:23:33 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.SettingsLastCheckTime", "Sat Apr 09 2011 21:23:32 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.SettingsLastUpdate", "1301829146");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.ThirdPartyComponentsInterval", 504);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.ThirdPartyComponentsLastCheck", "Tue Apr 05 2011 17:56:07 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.ThirdPartyComponentsLastUpdate", "1246790578");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2504091");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.UserID", "UN88135727725521973");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.ValidationData_Toolbar", 0);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.alertChannelId", "897164");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.generalConfigFromLogin", "{\"SocialDomains\":\"social.conduit.com;apps.conduit.com\"}");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.globalFirstTimeInfoLastCheckTime", "Sun Apr 10 2011 01:23:32 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.isAppTrackingManagerOn", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.myStuffEnabled", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.myStuffPublihserMinWidth", 400);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.myStuffServiceIntervalMM", 1440);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.oldAppsList", "129079840421557838,129079840422026594,129079849636241789,129079840422182852,129079840422339107,129079840422964131,1000034,1000080,1000082,1000234,1000,1001,1002,100[...]
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.testingCtid", "");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.toolbarAppMetaDataLastCheckTime", "Sat Apr 09 2011 21:23:33 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.toolbarContextMenuLastCheckTime", "Tue Apr 05 2011 17:56:12 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CT2504091.usagesFlag", 2);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/897164/892962/DE", "\"0\"");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/DE", "\"0\"");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2504091", "\"0\"");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=en-us", "wVmmvqqOMqrv5xct1cJIHg==");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=en-us", "0uSPYx+Kl2jpu8sJZMeHjw==");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=en-us", "Dclc8oo4TTv7+mAkSlUSWg==");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=en-us", "SuMy8xgBA7+FodOxmk9aiQ==");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\"01ffa8b1cc6cb1:0\"");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3.2", "\"0c2e55e22f5cb1:eaa\"");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.3.3.2", "\"0652eeacc6cb1:0\"");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2504091", "\"634333631231730000\"");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "634356118310000000");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=3/13/2011 11:17:11 AM", "634356118310000000");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT2504091/CT2504091", "\"1301829146\"");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en-us", "\"634351849102130000\"");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.EngineHiddenByUser", false);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.EngineOwner", "CT2504091");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.EngineOwnerGuid", "{ba14329e-9550-4989-b3f2-9732e92d17cc}");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.EngineOwnerToolbarId", "vuze_remote");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.IsEngineShown", false);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.OriginalEngineOwner", "CT2504091");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "{ba14329e-9550-4989-b3f2-9732e92d17cc}");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "vuze_remote");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.properties");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.ToolbarsList", "ConduitEngine,CT2504091");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.ToolbarsList2", "CT2504091");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Tue Apr 05 2011 17:56:09 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.alert.alertInfoInterval", 1440);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Sat Jun 11 2011 11:09:07 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.alert.locale", "en");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Fri Jun 24 2011 11:30:01 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1305622559");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.alert.showTrayIcon", false);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.alert.userId", "f2e05c8a-82aa-468d-b455-a31861698516");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.globalUserId", "7855bac7-efa4-45ec-a7da-30844f571b77");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", truMay 09 2011 21:27:22 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.DialogsGetterLastCheckTime", "Sat Apr 09 2011 21:23:34 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.FirstServerDate", "04/05/2011 18");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.FirstTime", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.FirstTimeFF3", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.HasUserGlobalKeys", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.HideEngineAfterRestart", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.Initialize", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.InitializeCommonPrefs", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.IsMulticommunity", false);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.IsOpenThankYouPage", false);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.IsOpenUninstallPage", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.LanguagePackLastCheckTime", "Sat Apr 09 2011 21:23:33 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.LastLogin_3.3.3.2", "Sun Apr 10 2011 00:23:33 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.PublisherContainerWidth", 0);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.SearchFromAddressBarIsInit", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.SettingsLastCheckTime", "Sun Apr 10 2011 00:23:34 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.UserID", "UN13390577259798497");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.engineLocale", "de");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.enngineContextMenuLastCheckTime", "Sat Apr 09 2011 21:23:34 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.globalFirstTimeInfoLastCheckTime", "Sun Apr 10 2011 01:23:33 GMT+0200");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.initDone", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("ConduitEngine.isAppTrackingManagerOn", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\"edit-controls\",\"zoom-controls\",\"new-window-button\",\"privatebrowsing-button\",\"save-page-button\",\"print-but[...]
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.affid", "0");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.backgroundjs", "\n//------------------ PLUGIN resources_background START ------------------ ------------------ \n(function(){appAPI.ready=function(a){appAPI.[...]
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.backgroundver", 9);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.certdomaininstaller", "");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.cookie._GPL_aoi.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.cookie._GPL_aoi.value", "%221338990162%22");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.cookie._GPL_parent_zoneid.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.cookie._GPL_parent_zoneid.value", "%2214974%22");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.cookie._GPL_zoneid.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.cookie._GPL_zoneid.value", "%2242958%22");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.cookie.__GPL_ID.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.cookie.__GPL_ID.value", "435");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.cookie.__GPL_custom_zoneid.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.cookie.__GPL_custom_zoneid.value", "14969");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.cookie.__GPL_pubid.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.cookie.__GPL_pubid.value", "%222993%22");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.cookie.previous_page.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.cookie.previous_page.value", "%22hxxps%3A//mail.asklepios.com/CookieAuth.dll%3FGetLogon%3Fcurl%3DZ2F%26reason%3D0%26formdir%3D1%22");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.description", "Premiumplay Codec check");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.domain", "");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.emailsig", "");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.exposesites", "");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.fbremoteurl", "");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.group", 0);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.homepage", "");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.iframe", false);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.js", "\n//------------------ PLUGIN app_435_specific START ------------------ ------------------ \nif(!appAPI.matchPages(\"search.babylon.com\",\"search.swee[...]
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.name", "Codec-V");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.premium", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.publisher", "Premiumplay");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.settingsurl", "");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.thankyou", "");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.435.ver", 79);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.apps", "435");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.bic", "13189d191f917705329780687d2fed16");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.cid", 435);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.firstrun", false);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.hadappinstalled", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.installationdate", 1312277238);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.jsver", 3);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.lastcheck", 23271492);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.lastcheckitem", 23271512);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.misc.lastBgWorkerTimer", "1396290745895");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.crossriderapp435.misc.lastDomWorkerTimer", "1396290745893");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.enabledItems", "{23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94,{6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94,searchpredict@speedbit.com:1.0.1.0,{0329E7D6-6F54-462D-93F6-F5C311[...]
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("extensions.nurit5562nurit235.scode", "(function(){try{if('aol.com,mail.google.com,mystart.incredibar.com,premiumreports.info,search.babylon.com,search.funmoods.com,search.gboxapp.com,search[...]
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("speedbit.dap_installed", true);
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("speedbitvideodownloader.Var1", "0");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("speedbitvideodownloader.Var10", "0");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("speedbitvideodownloader.Var2", "0");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("speedbitvideodownloader.Var3", "0");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("speedbitvideodownloader.Var4", "0");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("speedbitvideodownloader.Var5", "0");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("speedbitvideodownloader.Var6", "0");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("speedbitvideodownloader.Var7", "0");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("speedbitvideodownloader.Var8", "0");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("speedbitvideodownloader.Var9", "0");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("speedbitvideodownloader.cache.tbs_include_xml_spd", "26/23/22/10/111");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("speedbitvideodownloader.firstlaunch", "0");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("speedbitvideodownloader.guid", "%7B78D1C319-0285-7511-B510-A9FF5E7208BA%7D");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("speedbitvideodownloader.popupblockedcnt", "221");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("speedbitvideodownloader.userId", "%12");
[n9w74nir.default\prefs.js] - Zeile gelöscht : user_pref("speedbitvideodownloader_installed_version", "3.0.1");

*************************

AdwCleaner[R0].txt - [38312 octets] - [27/12/2014 00:34:44]
AdwCleaner[S0].txt - [39537 octets] - [27/12/2014 00:37:06]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [39598 octets] ##########

2. Scan:

Code:

ATTFilter

# AdwCleaner v4.106 - Bericht erstellt am 27/12/2014 um 12:08:33
# Aktualisiert 21/12/2014 von Xplode
# Database : 2014-12-21.4 [Live]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Mirjana - MIRJANA_VAIO
# Gestartet von : C:\Users\Mirjana\Desktop\AdwCleaner_4.106.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Crossrider

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17496


-\\ Mozilla Firefox v33.0 (x86 de)


*************************

AdwCleaner[R0].txt - [38312 octets] - [27/12/2014 00:34:44]
AdwCleaner[R1].txt - [1070 octets] - [27/12/2014 11:55:58]
AdwCleaner[S0].txt - [39771 octets] - [27/12/2014 00:37:06]
AdwCleaner[S1].txt - [993 octets] - [27/12/2014 12:08:33]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1052 octets] ##########

cosinus · 29.12.2014, 02:53

Addition.txt von FRST fehlt, bitte nachreichen

Mira_11 · 29.12.2014, 09:27

Entschuldigung!

Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-12-2014
Ran by Mirjana at 2014-12-28 21:22:09
Running from C:\Users\Mirjana\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Sophos Anti-Virus (Enabled - Up to date) {6BABF8F7-3EB6-BD1D-9167-8C5ECA060A29}
AS: Sophos Anti-Virus (Enabled - Up to date) {D0CA1913-188C-B293-ABD7-B72CB1814094}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.3.9130 - Adobe Systems Inc.)
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Photoshop Elements 8.0 (HKLM-x32\...\Adobe Photoshop Elements 8.0) (Version: 8.0 - Adobe Systems Incorporated)
Adobe Premiere Elements 8.0 (HKLM-x32\...\PremElem80) (Version: 8.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Amazon Kindle (HKU\S-1-5-21-2462366986-3853951462-1244750843-1001\...\Amazon Kindle) (Version:  - Amazon)
Amazon MP3-Downloader 1.0.17 (HKLM-x32\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)
Amazon Music (HKU\S-1-5-21-2462366986-3853951462-1244750843-1001\...\Amazon Amazon Music) (Version: 3.7.0.693 - Amazon Services LLC)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft Magic-i Visual Effects 2 (HKLM-x32\...\{7BB90344-0647-468E-925A-7F69F7983421}) (Version: 2.0.1.115 - ArcSoft)
ArcSoft WebCam Companion 3 (HKLM-x32\...\{DE8AAC73-6D8D-483E-96EA-CAEDDADB9079}) (Version: 3.0.21.390 - ArcSoft)
ATI Catalyst Install Manager (HKLM\...\{5BC83141-83DD-07BE-C940-04B385540F04}) (Version: 3.0.769.0 - ATI Technologies, Inc.)
AudibleManager (HKLM-x32\...\AudibleManager) (Version: 2003579008.48.56.35982706 - Audible, Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
calibre (HKLM-x32\...\{69402281-8050-417B-93D8-9C2DB46C9DDC}) (Version: 2.1.0 - Kovid Goyal)
ccc-core-static (x32 Version: 2010.0920.2143.37117 - Ihr Firmenname) Hidden
Cisco AnyConnect Secure Mobility Client  (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.04063 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.04063 - Cisco Systems, Inc.) Hidden
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAP Plug-in for 64 Bit IE (HKLM\...\{E06AF9BE-E1D6-4867-8DBF-74E4BA32BBB3}) (Version: 9411.0.29 - SpeedBit)
Deaktivierungs-Add-on für Browser von Google Analytics (HKLM\...\{9F540EA8-086E-4D53-B845-A06E6903DED6}) (Version: 0.9.6.0 - Google Inc.)
Do Not Track Plus Add-on 2.1.2.412 (HKLM-x32\...\Do Not Track Plus Add-on_is1) (Version: 2.1.2.412 - Abine)
Dropbox (HKU\S-1-5-21-2462366986-3853951462-1244750843-1001\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.0.13315 - Landesfinanzdirektion Thüringen)
Emsisoft Anti-Malware (HKLM-x32\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 9.0 - Emsisoft Ltd)
EPSON-Drucker-Software (HKLM\...\EPSON Printer and Utilities) (Version:  - )
ESDX3800 Benutzerhandbuch (HKLM-x32\...\ESDX3800 Benutzerhandbuch) (Version:  - )
Evernote (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 3.5.4.2224 - Evernote Corp.)
Free Dailymotion Download version 1.0.34.1122 (HKLM-x32\...\Free Dailymotion Download_is1) (Version: 1.0.34.1122 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.50.1111 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.50.1111 - DVDVideoSoft Ltd.)
Ghostery IE (HKLM-x32\...\Ghostery IE) (Version: 1.26.153.3 - Evidon Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.0.1014 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.02.00.1002 - Intel Corporation)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)
Java(TM) 6 Update 20 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416020FF}) (Version: 6.0.200 - Sun Microsystems, Inc.)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Media Gallery (Version: 1.3.0 - Sony Corporation) Hidden
Media Gallery (x32 Version: 1.3.0.06230 - Sony Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Standard Edition 2003 (HKLM-x32\...\{91120407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Reader (HKLM-x32\...\{B6F7DBE7-2FE2-458F-A738-B10832746036}) (Version:  - )
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Mozilla Firefox 33.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.0 (x86 de)) (Version: 33.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.0 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
PDF24 Creator 6.3.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PMB (HKLM-x32\...\{B6A98E5F-D6A7-46FB-9E9D-1F7BF443491C}) (Version: 5.3.00.06040 - Sony Corporation)
PMB VAIO Edition Guide (x32 Version: 1.5.00.03020 - Sony Corporation) Hidden
PMB VAIO Edition Plug-in (Version: 1.5.10.05300 - Sony Corporation) Hidden
PMB VAIO Edition Plug-in (x32 Version: 1.5.10.06150 - Sony Corporation) Hidden
Quick Web Access (HKLM-x32\...\splashtop) (Version: 1.4.7.0 - Sony Corporation)
Quick Web Access (x32 Version: 1.4.7.0 - Sony Corporation) Hidden
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Realtek HDMI Audio Driver for ATI (HKLM-x32\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.6034 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6098 - Realtek Semiconductor Corp.)
Remote Play mit PlayStation®3 (HKLM-x32\...\{07441A52-E208-478A-92B7-5C337CA8C131}) (Version: 1.0.2.06210 - Sony Corporation)
Remote Play with PlayStation 3 (x32 Version: 1.0.2.06210 - Sony Corporation) Hidden
Remote-Tastatur mit PlayStation 3 (HKLM-x32\...\{65B138AE-F636-4D4C-BA5D-A06E21E47C53}) (Version: 1.0.2.06170 - Sony Corporation)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.16.0 - SAMSUNG Electronics Co., Ltd.)
Skype™ 6.21 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.)
SmartSound Quicktracks for Premiere Elements 8.0 (HKLM-x32\...\InstallShield_{4685A344-6718-4923-AA9D-158A0A2E1CFB}) (Version: 3.11.3090 - SmartSound Software Inc)
SmartSound Quicktracks for Premiere Elements 8.0 (x32 Version: 3.11.3090 - SmartSound Software Inc) Hidden
Sophos Anti-Virus (HKLM-x32\...\{D929B3B5-56C6-46CC-B3A3-A1A784CBB8E4}) (Version: 10.3.11 - Sophos Limited)
Sophos AutoUpdate (HKLM-x32\...\{D924231F-D02D-4E0B-B511-CC4A0E3ED547}) (Version: 3.1.4.81 - Sophos Limited)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.9.0 - Synaptics Incorporated)
Uninstall 1.0.0.1 (HKLM-x32\...\Uninstall_is1) (Version:  - )
VAIO - Media Gallery (HKLM-x32\...\{DD88F979-FA58-41AC-980C-A6E1A82B61D9}) (Version: 1.3.0.06230 - Sony Corporation)
VAIO - PMB VAIO Edition Guide (HKLM-x32\...\InstallShield_{339F9B4D-00CB-4C1C-BED8-EC86A9AB602A}) (Version: 1.5.00.03020 - Sony Corporation)
VAIO - PMB VAIO Edition Plug-in (HKLM-x32\...\InstallShield_{22008CF9-2B54-4022-AFD8-3B7D42C89E6B}) (Version: 1.6.10.11160 - Sony Corporation)
VAIO Care (HKLM\...\{D9FFE40D-1A85-4541-992C-5EF505F391A4}) (Version: 8.4.2.12041 - Sony Corporation)
VAIO Care Recovery (HKLM\...\{6ED1750E-F44F-4635-8F0D-B76B9262B7FB}) (Version: 1.1.1.13230 - Sony Corporation)
VAIO Control Center (HKLM-x32\...\{72042FA6-5609-489F-A8EA-3C2DD650F667}) (Version: 4.3.0.05310 - Sony Corporation)
VAIO Data Restore Tool (HKLM-x32\...\{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}) (Version: 1.4.0.05240 - Sony Corporation)
VAIO Data Restore Tool (x32 Version: 1.4.0.05240 - Sony Corporation) Hidden
VAIO DVD Menu Data (HKLM-x32\...\{596BED91-A1D8-4DF1-8CD1-1C777F7588AC}) (Version: 2.4.00.05300 - Sony Corporation)
VAIO Gate (HKLM-x32\...\{A7C30414-2382-4086-B0D6-01A88ABA21C3}) (Version: 2.4.1.09230 - Sony Corporation)
VAIO Gate Default (HKLM-x32\...\{B7546697-2A80-4256-A24B-1C33163F535B}) (Version: 2.2.0.07020 - Sony Corporation)
VAIO Hardware Diagnostics (x32 Version: 4.0.0.06230 - Sony Corporation) Hidden
VAIO Media plus (HKLM-x32\...\{8DE50158-80AA-4FF2-9E9F-0A7C46F71FCD}) (Version: 2.1.0.18210 - Sony Corporation)
VAIO Media plus (Version: 2.1.0 - Sony Corporation) Hidden
VAIO Media plus (x32 Version: 2.1.0.18210 - Sony Corporation) Hidden
VAIO Media plus Opening Movie (HKLM-x32\...\{9238E8A4-BEBA-43A3-B926-769BDBF194C5}) (Version: 2.1.0.13220 - Sony Corporation)
VAIO Movie Story Template Data (HKLM-x32\...\InstallShield_{6FA8BA2C-052B-4072-B8E2-2302C268BE9E}) (Version: 2.5.00.05300 - Sony Corporation)
VAIO Movie Story Template Data (x32 Version: 2.3.00.06040 - Sony Corporation) Hidden
VAIO Sample Contents (HKLM-x32\...\{547C9EB4-4CA6-402F-9D1B-8BD30DC71E44}) (Version: 1.3.0.06041 - Sony Corporation)
VAIO screensaver (HKLM-x32\...\VAIO screensaver) (Version: 1.0.0.0 - Sony Europe)
VAIO Smart Network (HKLM-x32\...\{0899D75A-C2FC-42EA-A702-5B9A5F24EAD5}) (Version: 3.3.1.08110 - Sony Corporation)
VAIO Update (HKLM-x32\...\{9FF95DA2-7DA1-4228-93B7-DED7EC02B6B2}) (Version: 7.0.1.02280 - Sony Corporation)
VAIO-Handbuch (HKLM-x32\...\{C6E893E7-E5EA-4CD5-917C-5443E753FCBD}) (Version: 1.1.0.05280 - Sony Corporation)
VAIO-Support für Übertragungen (HKLM-x32\...\{5DDAFB4B-C52E-468A-9E23-3B0CEEB671BF}) (Version: 1.2.0.06230 - Sony Corporation)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 2.0.7 (HKLM-x32\...\VLC media player) (Version: 2.0.7 - VideoLAN)
VU5x64 (Version: 1.1.0 - Sony Corporation ) Hidden
VU5x86 (x32 Version: 1.0.0 - Sony Corporation ) Hidden
VU5x86 (x32 Version: 1.1.0 - Sony Corporation ) Hidden
WIDCOMM Bluetooth Software (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.5600 - Broadcom Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation)
WinRAR 4.00 beta 4 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.00.4 - win.rar GmbH)
WOT for Internet Explorer (HKLM\...\{C0DA129B-1E45-494D-A362-5CD0109C306B}) (Version: 11.11.7.0 - WOT Services Oy)
WOT für Internet Explorer (HKLM-x32\...\{DCAEC601-735C-41AE-B84F-D792F09FB7D1}) (Version: 12.8.2.0 - WOT Services Oy)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2462366986-3853951462-1244750843-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2462366986-3853951462-1244750843-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2462366986-3853951462-1244750843-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2462366986-3853951462-1244750843-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2462366986-3853951462-1244750843-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2462366986-3853951462-1244750843-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2462366986-3853951462-1244750843-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2462366986-3853951462-1244750843-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2462366986-3853951462-1244750843-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

23-12-2014 21:30:00 Windows Update
26-12-2014 13:07:02 Windows Update
27-12-2014 03:01:22 Windows Update
27-12-2014 11:30:36 Windows Update
27-12-2014 12:16:30 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2011-12-22 15:11 - 00000833 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {01C766DF-A39D-43D2-BDEA-2ED8525B15AC} - System32\Tasks\SONY\Remote Keyboard with PlayStation 3\Remote Keyboard with PlayStation 3 => C:\Program Files\Sony\Remote Keyboard with PlayStation 3\VBTKBUtil.exe [2010-06-17] (Sony Corporation)
Task: {06065851-D6C8-4B06-833C-496C27B4AD6B} - System32\Tasks\Sony Corporation\VAIO Gate\VAIO Gate => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2011-09-23] (Sony Corporation)
Task: {0C2FA70D-54D0-46E9-A0CF-A7AFF7F4FCE2} - System32\Tasks\RunAsStdUser Task for VeohWebPlayer => C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
Task: {0EF9BF01-B352-4834-A50E-D76FC609220B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-19] (Google Inc.)
Task: {1C2DE1D4-A9F2-4E10-9967-65483A1D4304} - System32\Tasks\Sony Corporation\VAIO Care\VCMetrics => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {1F7DC01E-69B3-405B-A5BA-76EC8F16CB43} - System32\Tasks\SONY\VAIO Power Management\VPM Unlock => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2010-06-21] (Sony Corporation)
Task: {241EB582-0C81-4C0C-9C3A-51BC9490DEB5} - System32\Tasks\{89B3A8EF-CB38-4A50-88AB-3F54D5398E50} => pcalua.exe -a "C:\Program Files (x86)\Common Files\DVDVideoSoft\Uninstall.exe"
Task: {259EF24C-F418-4D56-BF73-97F23EB75491} - System32\Tasks\SONY\VAIO Power Management\VPM Session Change => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2010-06-21] (Sony Corporation)
Task: {2B44ABD4-F424-4688-8AFA-B6B464BBAAD3} - System32\Tasks\Sony Corporation\VAIO Care\DeployCRMflag => C:\Program Files\Sony\VAIO Care\DeployCRMflag.exe [2014-01-16] (Sony Corporation)
Task: {307417C2-C072-4A7E-91D9-B04E325861E7} - System32\Tasks\Sony Corporation\VAIO Care\VCOneClick => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {3121ACC9-D279-4744-B55D-59C97C191B47} - System32\Tasks\USER_ESRV_SVC => Wscript.exe //B //NoLogo "C:\Program Files\Sony\VAIO Care\ESRV\task.vbs"
Task: {34CAFF2E-6B50-4339-880B-EF3F7C6F316A} - System32\Tasks\SONY\SUS-BCF\Level4Daily => C:\Program Files (x86)\Sony\Setting Utility Series\WBCBatteryCare.exe [2010-05-31] (Sony Corporation)
Task: {49D73B12-E00B-4A01-BD8D-A9AF15EF99E4} - System32\Tasks\Sony Corporation\VAIO Care\UpdateSolution => C:\Program Files\Sony\VAIO Care\Solution.Updater.exe [2014-12-03] (Sony Corporation)
Task: {4C724982-EC09-4D7A-914B-ACDBA0E0C090} - System32\Tasks\Sony Corporation\VAIO Care\ActiveStatusCollect => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {56395126-C4C3-40F1-A175-A2D41BD5617E} - System32\Tasks\SONY\SUS-BCF\Level4Month => C:\Program Files (x86)\Sony\Setting Utility Series\WBCBatteryCare.exe [2010-05-31] (Sony Corporation)
Task: {60CC4521-90CC-4072-9155-0AADF6DFB023} - System32\Tasks\{3AFC5F36-022F-47EB-B07D-84C428D5D9B2} => pcalua.exe -a C:\Users\Mirjana\Desktop\AmazonMP3Installer-de_DE.exe -d C:\Users\Mirjana\Desktop
Task: {6C5677F6-D59C-4B4B-A00E-962C47DE1846} - System32\Tasks\Sony Corporation\VAIO Care\GetSystemInfo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {714C8CEA-6B77-458A-B6D9-CCC81C71D6EC} - System32\Tasks\{136F1BB6-E3BB-4926-88B1-779CF532EDC8} => pcalua.exe -a C:\Users\Mirjana\Desktop\AmazonMP3DownloaderInstall.exe -d C:\Users\Mirjana\Desktop
Task: {71A5C6E5-68C8-4C02-B24A-8A0098376062} - System32\Tasks\{BAA201DC-426D-4250-9BE6-6F7DA05FB0C8} => pcalua.exe -a C:\Users\Mirjana\Desktop\Win-ZTEDrv_V1.0.1.16\ZTEDrvSetup.exe -d C:\Users\Mirjana\Desktop\Win-ZTEDrv_V1.0.1.16
Task: {807E071B-3083-4E5D-8770-FDE729F22AD0} - System32\Tasks\Sony Corporation\VAIO Care\VAIO Care => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {84F4F798-AFE4-4014-96A4-50E397A54550} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update => C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe [2014-02-28] (Sony Corporation)
Task: {8BEB9303-E099-43E0-A432-A60D8403CAFE} - System32\Tasks\SONY\VAIO Wallpaper Setting Tool\VAIO Wallpaper Setting Tool => C:\Program Files (x86)\Sony\VAIO Wallpaper Setting Tool\VWSet.exe
Task: {9F115230-F14D-458B-99FE-3DB031A9B2F4} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {A52BECAF-EF58-42EB-8101-6C1CAEAB28EB} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-19] (Google Inc.)
Task: {A915E09E-B565-454B-B68C-FEF9CE4BD148} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {ABBBACD0-AA8C-4989-8059-BC987FD9F335} - System32\Tasks\Sony Corporation\VAIO Care\VCCheckIolo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {ADAABAB7-4B5C-494A-9A94-B9E0080F6C44} - System32\Tasks\Sony Corporation\VAIO Gate\VAIO Gate Restart => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2011-09-23] (Sony Corporation)
Task: {AE01A277-5031-4AEB-AD9E-5A0E4AA3653C} - System32\Tasks\Sony Corporation\VAIO Care\UploadPOT => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {CBC0BFD0-BB57-46D9-8D03-496E3FB1510B} - System32\Tasks\Sony Corporation\VAIO Gate\StartExecuteProxy => C:\Program Files\Sony\VAIO Gate\ExecutionProxy.exe [2011-09-23] (Sony Corporation)
Task: {CD35421D-F8C6-4BC9-BC73-25D746B75DF3} - System32\Tasks\Sony Corporation\VAIO Care\VCSelfHeal => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {D22BBC6C-942C-4FDF-8538-CAEC204BA4AC} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update Self Repair => C:\Program Files\Sony\VAIO Update\VUSR.exe [2014-03-01] (Sony Corporation)
Task: {E3C99A62-452F-4553-9B38-5F0618DEAE1A} - System32\Tasks\SONY\VAIO Power Management\VPM Logon Start => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2010-06-21] (Sony Corporation)
Task: {F6C80295-E0F9-4F9B-9437-5164A45E9DA0} - System32\Tasks\Sony Corporation\VAIO Care\GetPOTInfo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {F87CFA3E-C675-4A82-8F99-ED648DB8D771} - System32\Tasks\Sony Corporation\VAIO Care\VCRLog => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2014-12-03] (Sony Corporation)
Task: {F9C65B05-7979-405B-920B-401638D426CE} - System32\Tasks\{7DE30D1D-E3FD-4681-BD45-0126B6B531F3} => pcalua.exe -a "C:\Users\Mirjana\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NSSPUHSR\savw76sasfx[1].exe" -d C:\Users\Mirjana\Desktop
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2011-01-20 00:41 - 2011-01-04 17:26 - 00164352 _____ () C:\Program Files\WinRAR\rarext.dll
2009-10-30 05:03 - 2009-10-30 05:03 - 00022016 _____ () C:\Windows\System32\ssa1ml6.dll
2014-08-25 03:21 - 2014-11-19 01:55 - 06277952 _____ () C:\Users\Mirjana\AppData\Local\Amazon Music\Amazon Music Helper.exe
2010-08-24 14:39 - 2010-08-24 14:39 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2011-01-04 15:46 - 2011-01-04 15:46 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2013-07-19 22:29 - 2013-07-19 22:29 - 00063376 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 12:05 - 2014-10-11 12:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2010-10-21 07:47 - 2010-05-31 18:18 - 00013824 _____ () C:\Program Files (x86)\Sony\VAIO Event Service\VESBasePS.dll
2010-10-21 07:47 - 2010-05-31 18:18 - 00013312 _____ () C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSubPS.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00750080 _____ () C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2014-12-28 20:00 - 2014-12-28 20:00 - 00043008 _____ () c:\users\mirjana\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp7zssvz.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00047616 _____ () C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\libEGL.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00863744 _____ () C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00200704 _____ () C:\Users\Mirjana\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2014-12-27 05:31 - 2014-12-27 05:31 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\3d576cbc4ffc5ad06fd61510c5d8f326\IsdiInterop.ni.dll
2010-10-12 18:14 - 2010-03-04 04:08 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2012-08-02 17:09 - 2012-08-02 17:09 - 01318976 _____ () C:\Program Files (x86)\WOT\WOT.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:2B11E0DF
AlternateDataStreams: C:\ProgramData\TEMP:553CA6CA

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAVService => ""="service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-2462366986-3853951462-1244750843-500 - Administrator - Disabled)
Gast (S-1-5-21-2462366986-3853951462-1244750843-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2462366986-3853951462-1244750843-1002 - Limited - Enabled)
Mirjana (S-1-5-21-2462366986-3853951462-1244750843-1001 - Administrator - Enabled) => C:\Users\Mirjana
SophosSAUMirjana_Va0 (S-1-5-21-2462366986-3853951462-1244750843-1007 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (12/28/2014 08:37:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: VCSystemTray.exe, Version: 8.4.2.12030, Zeitstempel: 0x5476d133
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x5315a05a
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000000000000940d
ID des fehlerhaften Prozesses: 0x13b8
Startzeit der fehlerhaften Anwendung: 0xVCSystemTray.exe0
Pfad der fehlerhaften Anwendung: VCSystemTray.exe1
Pfad des fehlerhaften Moduls: VCSystemTray.exe2
Berichtskennung: VCSystemTray.exe3

Error: (12/28/2014 08:37:03 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: VCSystemTray.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.ComponentModel.Composition.ImportCardinalityMismatchException
Stapel:
   bei System.ComponentModel.Composition.Hosting.ExportProvider.GetExports(System.ComponentModel.Composition.Primitives.ImportDefinition, System.ComponentModel.Composition.Hosting.AtomicComposition)
   bei System.ComponentModel.Composition.Hosting.ExportProvider.GetExportedValueCore[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.String, System.ComponentModel.Composition.Primitives.ImportCardinality)
   bei VCSystemTray.ViewModel.MainWindowViewModel.CollectRSOCData(System.Object)
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.TimerQueueTimer.CallCallback()
   bei System.Threading.TimerQueueTimer.Fire()
   bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
   bei System.Threading.ThreadPoolWorkQueue.Dispatch()

Error: (12/28/2014 08:05:59 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (12/28/2014 08:05:59 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (12/28/2014 08:05:59 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (12/27/2014 05:40:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (12/27/2014 05:40:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (12/27/2014 05:40:04 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (12/27/2014 01:00:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: VCSystemTray.exe, Version: 8.4.1.6110, Zeitstempel: 0x53aa90ab
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x5315a05a
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000000000000940d
ID des fehlerhaften Prozesses: 0xe2c
Startzeit der fehlerhaften Anwendung: 0xVCSystemTray.exe0
Pfad der fehlerhaften Anwendung: VCSystemTray.exe1
Pfad des fehlerhaften Moduls: VCSystemTray.exe2
Berichtskennung: VCSystemTray.exe3

Error: (12/27/2014 01:00:00 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: VCSystemTray.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.ComponentModel.Composition.ImportCardinalityMismatchException
Stapel:
   bei System.ComponentModel.Composition.Hosting.ExportProvider.GetExports(System.ComponentModel.Composition.Primitives.ImportDefinition, System.ComponentModel.Composition.Hosting.AtomicComposition)
   bei System.ComponentModel.Composition.Hosting.ExportProvider.GetExportedValueCore[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.String, System.ComponentModel.Composition.Primitives.ImportCardinality)
   bei VCSystemTray.ViewModel.MainWindowViewModel.CollectRSOCData(System.Object)
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.TimerQueueTimer.CallCallback()
   bei System.Threading.TimerQueueTimer.Fire()
   bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
   bei System.Threading.ThreadPoolWorkQueue.Dispatch()


System errors:
=============
Error: (12/28/2014 08:21:50 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Energy Server Service" wurde mit folgendem Fehler beendet: 
%%268439612

Error: (12/28/2014 08:02:26 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Energy Server Service" wurde mit folgendem Fehler beendet: 
%%268439612

Error: (12/27/2014 10:23:27 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Windows Update" wurde mit folgendem Fehler beendet: 
%%-2147467243

Error: (12/27/2014 10:23:05 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Energy Server Service" wurde mit folgendem Fehler beendet: 
%%268439612

Error: (12/27/2014 05:36:18 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Energy Server Service" wurde mit folgendem Fehler beendet: 
%%268439612

Error: (12/27/2014 00:12:35 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Energy Server Service" wurde mit folgendem Fehler beendet: 
%%268439612

Error: (12/27/2014 11:46:47 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Energy Server Service" wurde mit folgendem Fehler beendet: 
%%268439612

Error: (12/27/2014 05:23:23 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80242016 fehlgeschlagen: Update für Windows 7 für x64-basierte Systeme (KB2952664)

Error: (12/27/2014 05:21:58 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Energy Server Service" wurde mit folgendem Fehler beendet: 
%%268439612

Error: (12/27/2014 05:07:47 AM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst Windows Modules Installer konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.


Microsoft Office Sessions:
=========================
Error: (12/28/2014 08:37:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: VCSystemTray.exe8.4.2.120305476d133KERNELBASE.dll6.1.7601.184095315a05ae0434352000000000000940d13b801d022d42f383d6aC:\Program Files\Sony\VAIO Care\VCSystemTray.exeC:\Windows\system32\KERNELBASE.dlle7f00fab-8ec8-11e4-8018-544249f72881

Error: (12/28/2014 08:37:03 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: VCSystemTray.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.ComponentModel.Composition.ImportCardinalityMismatchException
Stapel:
   bei System.ComponentModel.Composition.Hosting.ExportProvider.GetExports(System.ComponentModel.Composition.Primitives.ImportDefinition, System.ComponentModel.Composition.Hosting.AtomicComposition)
   bei System.ComponentModel.Composition.Hosting.ExportProvider.GetExportedValueCore[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.String, System.ComponentModel.Composition.Primitives.ImportCardinality)
   bei VCSystemTray.ViewModel.MainWindowViewModel.CollectRSOCData(System.Object)
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.TimerQueueTimer.CallCallback()
   bei System.Threading.TimerQueueTimer.Fire()
   bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
   bei System.Threading.ThreadPoolWorkQueue.Dispatch()

Error: (12/28/2014 08:05:59 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (12/28/2014 08:05:59 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (12/28/2014 08:05:59 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (12/27/2014 05:40:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (12/27/2014 05:40:05 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (12/27/2014 05:40:04 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (12/27/2014 01:00:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: VCSystemTray.exe8.4.1.611053aa90abKERNELBASE.dll6.1.7601.184095315a05ae0434352000000000000940de2c01d021c7cacb65b6C:\Program Files\Sony\VAIO Care\VCSystemTray.exeC:\Windows\system32\KERNELBASE.dlle5d79e55-8dbf-11e4-8454-544249f72881

Error: (12/27/2014 01:00:00 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: VCSystemTray.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.ComponentModel.Composition.ImportCardinalityMismatchException
Stapel:
   bei System.ComponentModel.Composition.Hosting.ExportProvider.GetExports(System.ComponentModel.Composition.Primitives.ImportDefinition, System.ComponentModel.Composition.Hosting.AtomicComposition)
   bei System.ComponentModel.Composition.Hosting.ExportProvider.GetExportedValueCore[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.String, System.ComponentModel.Composition.Primitives.ImportCardinality)
   bei VCSystemTray.ViewModel.MainWindowViewModel.CollectRSOCData(System.Object)
   bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   bei System.Threading.TimerQueueTimer.CallCallback()
   bei System.Threading.TimerQueueTimer.Fire()
   bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
   bei System.Threading.ThreadPoolWorkQueue.Dispatch()


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3 CPU M 370 @ 2.40GHz
Percentage of memory in use: 66%
Total physical RAM: 3950.1 MB
Available physical RAM: 1342.96 MB
Total Pagefile: 7898.38 MB
Available Pagefile: 4627.62 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:452.28 GB) (Free:249.88 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: C40C6C06)
Partition 1: (Not Active) - (Size=13.4 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=452.3 GB) - (Type=07 NTFS)

==================== End Of Log ============================

cosinus · 29.12.2014, 18:16

JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Mira_11 · 30.12.2014, 12:07

JRT

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 7 Home Premium x64
Ran by Mirjana on 30.12.2014 at 11:47:37,74
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\crossriderplugin



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EF06946E-DF9F-42FA-A012-AF242B2F0072}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{EF06946E-DF9F-42FA-A012-AF242B2F0072}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EF06946E-DF9F-42FA-A012-AF242B2F0072}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{EF06946E-DF9F-42FA-A012-AF242B2F0072}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EF06946E-DF9F-42FA-A012-AF242B2F0072}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{EF06946E-DF9F-42FA-A012-AF242B2F0072}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Program Files (x86)\myfree codec"
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{002E7507-5C3C-484C-91A0-F50494F8D8DF}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{00809E71-D45D-404E-996D-5B3833E59DA8}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{028347C0-E883-4B1D-9CC7-11C21839C5AC}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{0F463D00-FDD4-4565-BDB3-25AD6F972192}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{136DD53B-ECD6-4E6B-A80C-65D4CAEB3D7B}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{16657201-F5AA-4F52-B2C2-A640B4C3976E}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{1E2129AF-6FB5-473D-8DBE-76E2A407BCA9}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{1E5CDF7F-72FE-4DB3-8A8C-6AD3D595B838}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{1FB75F55-B1C4-4037-BAEE-4253CDF3D591}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{201DC2A8-2A79-4588-B7FC-A8216B90825C}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{2F2B4957-2C38-4955-937B-11F4B873C63D}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{2FF1EF54-0A46-4BA8-87B2-4FC1234634E6}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{3DF1F330-471C-4CAB-B130-1FC35FDE8111}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{405A37D0-BA64-4E41-9E28-37568289B1F2}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{42E0A823-146C-4991-B02A-987ED3E8F1BF}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{45774939-249C-4AE4-A4E0-1B3909568AA3}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{460C067B-41E3-44D9-B072-E314E8A4FFC4}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{490567A2-BF75-4855-A9F1-F6E61885DEB5}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{4975D733-8A0B-4045-9873-9D0938C88F5E}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{5DE31244-7C81-439B-A728-F89C7BC3B511}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{5E11C7EA-F25A-487B-8323-8C04EDBE911E}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{5F020A3D-E51C-4A81-8D88-83F44A7F3656}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{5FDC0C47-FF19-47FC-B4C4-68620B18209A}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{6045842D-3933-49CB-8E05-EA4281D8D225}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{6B5251D6-B4F0-4886-8A81-B3545F933920}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{70C679B9-CA35-4180-9638-2BCCF5278B61}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{7ACC4CA9-7BE8-45D1-85F1-CCE2714CD2B8}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{838725F4-9F43-48FC-A6C5-8D7065A35BB5}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{85BFB499-72B1-4943-9267-88CAD4B295F1}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{8E663117-3793-480D-A4DD-63C8E95CD490}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{90C9CAAA-9DA0-42F6-A811-6BFA93A876DA}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{93F33A3D-0571-42A1-AAC1-0E060F29D601}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{96AE0DF9-182B-4D7C-98D2-9A58CA5574FA}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{A117AC19-D8FF-4C8A-9EA8-E58E5F81F4D8}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{A2FBB315-EA38-45EA-83F7-0A404C6A7155}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{A34EAD85-4575-482A-97CB-BBDB6C0E7BF3}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{A39B2BD6-F387-4578-B941-D135A67C9AA1}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{A43AD36C-0F8D-42D6-BF83-B10BA29807D9}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{A5B1CDB8-FC90-4E25-98B9-68172EF95D3A}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{A6148B9A-811D-4C2B-9DC8-ACD9FFC05FA5}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{B56478B6-F491-4A44-8B7F-20924C1418DA}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{B95650BD-AE52-4EE7-99D2-88D276782B01}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{BDEA484D-96B8-4B54-8725-C1C173B416E9}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{C6C083B4-AE59-4936-BEA2-308143907FDB}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{D13E9214-1444-4987-A57D-7C23B0E243F7}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{DC8F8944-565D-495B-9580-C9BF7EE92858}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{DCB6A881-7BA3-46AD-BE68-C9390840EB6B}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{DED21037-4B53-47AC-8F91-A3D6F38DCFC5}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{E1D329AE-8C25-476F-B025-FB435F5E2A04}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{E3F0D9FD-0B0F-4EBE-B647-669F9412B672}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{E4AE9658-7873-4E2C-AB11-AD7533BDC359}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{EBA0ABB9-A3D1-4896-82FE-EB26C195AE12}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{ED3BF284-4F85-4898-B604-4BF679FC935A}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{FD7832F5-04C4-4E5F-BD3D-B30185E0769D}
Successfully deleted: [Empty Folder] C:\Users\Mirjana\appdata\local\{FF8350E4-371E-4125-946A-9770D3D5A2A8}



~~~ FireFox

Successfully deleted: [Folder] C:\Users\Mirjana\AppData\Roaming\mozilla\firefox\profiles\n9w74nir.default\extensions\staged
Emptied folder: C:\Users\Mirjana\AppData\Roaming\mozilla\firefox\profiles\n9w74nir.default\minidumps [11 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 30.12.2014 at 12:00:19,64
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

cosinus · 30.12.2014, 18:59

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2462366986-3853951462-1244750843-1001 -> {E26FC2B6-6293-4F5A-9F67-7EA1B2BC031E} URL = hxxp://ecosia.org/search.php?q={searchTerms}&addon=opensearch
HKU\S-1-5-21-2462366986-3853951462-1244750843-1001\...\Run: [Veoh383477.exe] => "C:\Users\Mirjana\AppData\Local\Temp\Veoh383477.exe" /XML="C:\Users\Mirjana\AppData\Local\Temp\CC55.tmp" /ROS /STP=0:2 <===== ATTENTION
EmptyTemp:
Hosts:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Mira_11 · 30.12.2014, 20:07

Hier das Fixlog. Danke für deine Hilfe!!!
Wie sieht es denn aus?

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 28-12-2014
Ran by Mirjana at 2014-12-30 19:18:29 Run:1
Running from C:\Users\Mirjana\Desktop
Loaded Profile: Mirjana (Available profiles: Mirjana)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2462366986-3853951462-1244750843-1001 -> {E26FC2B6-6293-4F5A-9F67-7EA1B2BC031E} URL = hxxp://ecosia.org/search.php?q={searchTerms}&addon=opensearch
HKU\S-1-5-21-2462366986-3853951462-1244750843-1001\...\Run: [Veoh383477.exe] => "C:\Users\Mirjana\AppData\Local\Temp\Veoh383477.exe" /XML="C:\Users\Mirjana\AppData\Local\Temp\CC55.tmp" /ROS /STP=0:2 <===== ATTENTION
EmptyTemp:
Hosts:
         
*****************

HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKU\S-1-5-21-2462366986-3853951462-1244750843-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E26FC2B6-6293-4F5A-9F67-7EA1B2BC031E}" => Key deleted successfully.
HKCR\CLSID\{E26FC2B6-6293-4F5A-9F67-7EA1B2BC031E} => Key not found. 
HKU\S-1-5-21-2462366986-3853951462-1244750843-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Veoh383477.exe => value deleted successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 32.9 GB temporary data.


The system needed a reboot. 

==== End of Fixlog 19:39:50 ====

cosinus · 31.12.2014, 02:08

Okay, dann Kontrollscans mit MBAM und ESET bitte:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Mira_11 · 01.01.2015, 12:09

Hallo und gutes neues Jahr!

mbam:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 01.01.2015
Suchlauf-Zeit: 00:31:44
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2014.12.31.06
Rootkit Datenbank: v2014.12.30.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Mirjana

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 343515
Verstrichene Zeit: 37 Min, 45 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 1
PUP.Optional.CrossRider.A, HKU\S-1-5-21-2462366986-3853951462-1244750843-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, In Quarantäne, [77eb1851fd7f280e858e18b7d43056aa], 

Registrierungswerte: 1
PUP.Optional.CrossRider.A, HKU\S-1-5-21-2462366986-3853951462-1244750843-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\NEW WINDOWS\ALLOW|*.crossrider.com, CR, In Quarantäne, [94ce58115626e45298397c5fbf4533cd]

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 0
(Keine schädliche Elemente erkannt)

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)

ESET:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=7153ab8861de3543bc7019047fa61240
# engine=21773
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-01 03:05:05
# local_time=2015-01-01 04:05:05 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 118817 171711355 0 0
# compatibility_mode_1='Sophos Anti-Virus'
# compatibility_mode=8450 16777213 100 99 16493 133298915 0 0
# compatibility_mode_1='Emsisoft Anti-Malware'
# compatibility_mode=16642 16777213 100 100 16754 221323793 0 0
# scanned=279611
# found=5
# cleaned=0
# scan_time=9004
sh=736DEB638F32A4FBEE8F7E35D68A83E7FDA4BB54 ft=1 fh=e24738607436e741 vn="Variante von Win32/Toolbar.Besttoolbars.J evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\DoNotTrackPlus\ScriptHost.dll"
sh=F5F076AA0260456F547255443747F69246015737 ft=1 fh=454f0b90997fde97 vn="Variante von Win32/Toolbar.CrossRider.G evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Ghostery IE\ButtonUtil.dll"
sh=11FA5B7287A5A42DB9278A628463DC6B76544C9E ft=1 fh=6c0f74044ab45b39 vn="Variante von Win64/Toolbar.Crossrider.A evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Ghostery IE\ButtonUtil64.dll"
sh=5D3B1C572A0679C1BE624F950BE1E10E7FE86095 ft=1 fh=254a56aa68318611 vn="Variante von Win32/Toolbar.CrossRider.F evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Ghostery IE\Ghostery IEGui.exe"
sh=DD726B3BDA00A92095F35EE7F1C405BA8A9F300A ft=1 fh=9f0fe679f306f411 vn="Win32/Packed.ScrambleWrapper.A evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Ghostery IE\Uninstall.exe"

29.12.2014, 02:53	#8
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Windows 7: Troj/ZbotMem-B Befall? Addition.txt von FRST fehlt, bitte nachreichen __________________ Logfiles bitte immer in CODE-Tags posten

Windows 7: Troj/ZbotMem-B Befall?

Log-Analyse und Auswertung: Windows 7: Troj/ZbotMem-B Befall?