| |
| |||||||
Mülltonne: 2x | Windows 7, Verdacht auf VirusWindows 7 Beiträge, die gegen unsere Regeln verstoßen haben, solche, die die Welt nicht braucht oder sonstiger Müll landet hier in der Mülltonne... |
05.04.2015, 21:50
| #1 |
| |  2x | Windows 7, Verdacht auf Virus Liebes Trojaner Board Team, ich hab den Verdacht einen Virus oder Trojaner auf dem System zu haben, doch es lassen sich keine finden. Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:52 on 05/04/2015 (Home)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Home (administrator) on HOME-PC on 05-04-2015 18:54:29
Running from C:\Users\Home\Downloads
Loaded Profiles: Home (Available profiles: Home)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
() C:\Users\Home\Desktop\ALLES\sf\sfBot.exe
(Adobe) C:\Users\Home\Downloads\install_flashplayer17x32_mssa_aaa_aih.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_239.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_239.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13776088 2014-12-11] (Realtek Semiconductor)
HKU\S-1-5-21-1233034886-2771921467-1450124296-1001\...\MountPoints2: G - G:\.\setup.exe
HKU\S-1-5-21-1233034886-2771921467-1450124296-1001\...\MountPoints2: {9ad8e7ad-4002-11e4-b7b5-e811328b38ad} - G:\.\setup.exe
IFEO\utilman.exe: [Debugger] cmd.exe
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-1233034886-2771921467-1450124296-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.youdagames.com?hp=1
HKU\S-1-5-21-1233034886-2771921467-1450124296-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://samsung.msn.com
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SMSTDF&pc=MASM&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SMSTDF&pc=MASM&src=IE-SearchBox
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll [2012-07-05] (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2012-03-08] (Microsoft Corporation)
BHO-x32: Samsung BHO Class -> {AA609D72-8482-4076-8991-8CDAE5B93BCB} -> C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll [2010-10-25] ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll [2012-07-05] (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKU\S-1-5-21-1233034886-2771921467-1450124296-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
DPF: HKLM-x32 {34635AA6-B593-4F06-9EDD-5FF60FC13310} hxxp://download.speakychat.com/speakyldr.cab
DPF: HKLM-x32 {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1373829780101
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-04-08] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\vd8evumf.default
FF DefaultSearchUrl: https://de.search.yahoo.com/yhs/search
FF SearchEngineOrder.1: Yahoo! (Avast)
FF SelectedSearchEngine: Yahoo! (Avast)
FF Homepage: https://www.google.de/
FF Keyword.URL: https://de.search.yahoo.com/yhs/search
FF NetworkProxy: "gopher", ""
FF NetworkProxy: "gopher_port", 0
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_15_0_0_239.dll [2014-11-26] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_239.dll [2014-11-26] ()
FF Plugin-x32: @java.com/DTPlugin,version=10.5.1 -> C:\windows\SysWOW64\npDeployJava1.dll [2012-07-05] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.5.1 -> C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll [2012-07-05] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2013-03-15] (Pando Networks)
FF Plugin-x32: @videolan.org/vlc,version=1.1.11 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2011-07-14] (the VideoLAN Team)
FF Plugin HKU\S-1-5-21-1233034886-2771921467-1450124296-1001: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Home\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)
FF Plugin HKU\S-1-5-21-1233034886-2771921467-1450124296-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Home\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-10] (Google Inc.)
FF Plugin HKU\S-1-5-21-1233034886-2771921467-1450124296-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Home\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-10] (Google Inc.)
FF Plugin HKU\S-1-5-21-1233034886-2771921467-1450124296-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Home\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-09-05] (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-1233034886-2771921467-1450124296-1001: @zoom.us/ZoomVideoPlugin -> C:\Users\Home\AppData\Roaming\Zoom\bin\npzoomplugin.dll [2013-12-30] (Zoom Video Communications, Inc.)
FF Plugin HKU\S-1-5-21-1233034886-2771921467-1450124296-1001: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2013-03-15] (Pando Networks)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF SearchPlugin: C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\vd8evumf.default\searchplugins\yahoo-avast.xml [2015-02-10]
FF Extension: Bitdefender QuickScan - C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\vd8evumf.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2015-04-05]
FF Extension: NoScript - C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\vd8evumf.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2015-03-08]
FF Extension: Adblock Plus - C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\vd8evumf.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-10-13]
Chrome:
=======
CHR HomePage: Default ->
CHR Profile: C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-07-24]
CHR Extension: (Google Search) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-07-24]
CHR Extension: (AdBlock) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-03-31]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-31]
CHR Extension: (Word CaptureX Extension) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjdepfkicdcciagbigfcmdhknnoaaegf [2012-07-24]
CHR Extension: (Google Wallet) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-04]
CHR Extension: (Gmail) - C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-07-24]
CHR HKLM-x32\...\Chrome\Extension: [mjdepfkicdcciagbigfcmdhknnoaaegf] - C:\Program Files (x86)\Deskperience\Word Capture\wcxChrome.crx [2010-07-23]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 EasyAntiCheat; C:\windows\SysWOW64\EasyAntiCheat.exe [182304 2015-01-01] (EasyAntiCheat Ltd)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
S4 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
S4 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-12-01] () [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 BstHdAndroidSvc; "C:\Program Files (x86)\BlueStacks\HD-Service.exe" BstHdAndroidSvc Android [X]
S2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [X]
S2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-08-25] (Windows (R) 2003 DDK 3790 provider)
S2 BstHdDrv; \??\C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [X]
S3 lmimirr; system32\DRIVERS\lmimirr.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-05 18:54 - 2015-04-05 18:55 - 00013256 _____ () C:\Users\Home\Downloads\FRST.txt
2015-04-05 18:54 - 2015-04-05 18:54 - 00000000 ____D () C:\FRST
2015-04-05 18:53 - 2015-04-05 18:53 - 02095616 _____ (Farbar) C:\Users\Home\Downloads\FRST64.exe
2015-04-05 18:52 - 2015-04-05 18:52 - 00000470 _____ () C:\Users\Home\Desktop\defogger_disable.log
2015-04-05 18:52 - 2015-04-05 18:52 - 00000000 _____ () C:\Users\Home\defogger_reenable
2015-04-05 18:50 - 2015-04-05 18:50 - 00050477 _____ () C:\Users\Home\Desktop\Defogger.exe
2015-04-05 18:42 - 2015-04-05 18:42 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-05 18:42 - 2015-04-05 18:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-04-05 18:42 - 2015-04-05 18:42 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-04-05 18:42 - 2015-03-17 06:15 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-04-05 18:42 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2015-04-05 18:41 - 2015-04-05 18:42 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Home\Downloads\mbam-setup-2.1.4.1018.exe
2015-04-05 18:34 - 2015-04-05 18:36 - 169936496 _____ (AVG Technologies) C:\Users\Home\Downloads\avg_free_x86_all_2015_ltst_222_5863.exe
2015-04-05 18:29 - 2015-04-05 18:29 - 02347384 _____ (ESET) C:\Users\Home\Downloads\esetsmartinstaller_deu.exe
2015-04-05 18:29 - 2015-04-05 18:29 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-04-05 18:27 - 2015-04-05 18:27 - 00000000 ____D () C:\Users\Home\AppData\Roaming\QuickScan
2015-04-05 18:15 - 2015-04-05 18:15 - 01055936 _____ (Adobe) C:\Users\Home\Downloads\install_flashplayer17x32_mssa_aaa_aih.exe
2015-04-04 11:41 - 2015-04-04 11:41 - 00000000 ___SD () C:\windows\SysWOW64\GWX
2015-04-04 11:41 - 2015-04-04 11:41 - 00000000 ___SD () C:\windows\system32\GWX
2015-04-04 11:40 - 2015-04-04 11:40 - 00000000 ____H () C:\ProgramData\DP45977C.lfl
2015-04-04 11:40 - 2015-04-04 11:40 - 00000000 ____D () C:\windows\system32\SRSLabs
2015-04-04 11:39 - 2015-03-11 06:06 - 00943616 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-04-04 11:39 - 2015-03-11 06:06 - 00760832 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-04-04 11:39 - 2015-03-11 06:06 - 00677888 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-04-04 11:39 - 2015-03-11 06:06 - 00414720 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-04-04 11:39 - 2015-03-11 06:05 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2015-04-04 11:39 - 2015-03-11 06:02 - 01107456 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-04-04 11:38 - 2015-03-11 06:05 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-04-04 11:38 - 2015-03-11 06:05 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2015-04-02 23:10 - 2015-04-05 18:42 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-02 23:09 - 2015-04-05 18:43 - 00136408 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-02 23:09 - 2015-04-02 23:56 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-04-02 23:08 - 2015-04-02 23:56 - 00000000 ____D () C:\Users\Home\Desktop\mbar
2015-04-02 23:08 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-04-02 23:07 - 2015-04-02 23:08 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Home\Downloads\mbar-1.09.1.1004.exe
2015-04-02 17:23 - 2015-04-02 17:23 - 01055936 _____ (Adobe) C:\Users\Home\Downloads\install_flashplayer17x32_mssd_aaa_aih(1).exe
2015-03-31 21:58 - 2015-03-31 22:00 - 161097056 _____ (AVAST Software s. r. o.) C:\Users\Home\Downloads\avast_free_antivirus_setup.exe
2015-03-31 11:17 - 2015-03-31 11:17 - 01057488 _____ (Adobe) C:\Users\Home\Downloads\install_reader11_de_mssd_aaa_aih.exe
2015-03-29 21:30 - 2015-03-29 21:31 - 01055936 _____ (Adobe) C:\Users\Home\Downloads\install_flashplayer17x32_mssd_aaa_aih.exe
2015-03-28 14:19 - 2015-03-28 14:19 - 00000000 ____D () C:\Users\Home\AppData\Roaming\mp3DirectCut
2015-03-28 14:02 - 2015-03-29 14:11 - 00000000 ____D () C:\Users\Home\Desktop\musik
2015-03-28 14:00 - 2015-03-28 14:00 - 00001019 _____ () C:\Users\Home\Desktop\mp3DirectCut.lnk
2015-03-28 14:00 - 2015-03-28 14:00 - 00000000 ____D () C:\Program Files (x86)\mp3DirectCut
2015-03-28 13:59 - 2015-03-28 14:00 - 00000000 ____D () C:\Users\Home\Downloads\mp3cut
2015-03-28 13:58 - 2015-03-28 13:58 - 00000544 _____ () C:\Users\Public\Desktop\ClipGrab.lnk
2015-03-28 13:58 - 2015-03-28 13:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClipGrab
2015-03-28 13:56 - 2015-03-28 13:57 - 16567520 _____ (Philipp Schmieder Medien ) C:\Users\Home\Downloads\clipgrab-3.4.9.exe
2015-03-11 20:03 - 2015-02-20 06:41 - 00041984 _____ (Microsoft Corporation) C:\windows\system32\lpk.dll
2015-03-11 20:03 - 2015-02-20 06:40 - 00100864 _____ (Microsoft Corporation) C:\windows\system32\fontsub.dll
2015-03-11 20:03 - 2015-02-20 06:40 - 00046080 _____ (Adobe Systems) C:\windows\system32\atmlib.dll
2015-03-11 20:03 - 2015-02-20 06:40 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\dciman32.dll
2015-03-11 20:03 - 2015-02-20 06:13 - 00070656 _____ (Microsoft Corporation) C:\windows\SysWOW64\fontsub.dll
2015-03-11 20:03 - 2015-02-20 06:13 - 00034304 _____ (Adobe Systems) C:\windows\SysWOW64\atmlib.dll
2015-03-11 20:03 - 2015-02-20 06:13 - 00010240 _____ (Microsoft Corporation) C:\windows\SysWOW64\dciman32.dll
2015-03-11 20:03 - 2015-02-20 06:12 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\lpk.dll
2015-03-11 20:03 - 2015-02-20 05:29 - 00372224 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll
2015-03-11 20:03 - 2015-02-20 05:09 - 00299008 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\atmfd.dll
2015-03-11 20:03 - 2015-02-03 05:34 - 05554104 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-03-11 20:03 - 2015-02-03 05:34 - 00693176 _____ (Microsoft Corporation) C:\windows\system32\winload.efi
2015-03-11 20:03 - 2015-02-03 05:34 - 00094656 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mountmgr.sys
2015-03-11 20:03 - 2015-02-03 05:33 - 00616360 _____ (Microsoft Corporation) C:\windows\system32\winresume.efi
2015-03-11 20:03 - 2015-02-03 05:31 - 14632960 _____ (Microsoft Corporation) C:\windows\system32\wmp.dll
2015-03-11 20:03 - 2015-02-03 05:31 - 04121600 _____ (Microsoft Corporation) C:\windows\system32\mf.dll
2015-03-11 20:03 - 2015-02-03 05:31 - 01574400 _____ (Microsoft Corporation) C:\windows\system32\quartz.dll
2015-03-11 20:03 - 2015-02-03 05:31 - 00782848 _____ (Microsoft Corporation) C:\windows\system32\wmdrmsdk.dll
2015-03-11 20:03 - 2015-02-03 05:31 - 00641024 _____ (Microsoft Corporation) C:\windows\system32\msscp.dll
2015-03-11 20:03 - 2015-02-03 05:31 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-03-11 20:03 - 2015-02-03 05:31 - 00500224 _____ (Microsoft Corporation) C:\windows\system32\AUDIOKSE.dll
2015-03-11 20:03 - 2015-02-03 05:31 - 00432128 _____ (Microsoft Corporation) C:\windows\system32\mfplat.dll
2015-03-11 20:03 - 2015-02-03 05:31 - 00371712 _____ (Microsoft Corporation) C:\windows\system32\qdvd.dll
2015-03-11 20:03 - 2015-02-03 05:31 - 00325632 _____ (Microsoft Corporation) C:\windows\system32\msnetobj.dll
2015-03-11 20:03 - 2015-02-03 05:31 - 00229376 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2015-03-11 20:03 - 2015-02-03 05:31 - 00206848 _____ (Microsoft Corporation) C:\windows\system32\mfps.dll
2015-03-11 20:03 - 2015-02-03 05:31 - 00188416 _____ (Microsoft Corporation) C:\windows\system32\pcasvc.dll
2015-03-11 20:03 - 2015-02-03 05:31 - 00063488 _____ (Microsoft Corporation) C:\windows\system32\setbcdlocale.dll
2015-03-11 20:03 - 2015-02-03 05:31 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-03-11 20:03 - 2015-02-03 05:31 - 00037376 _____ (Microsoft Corporation) C:\windows\system32\pcadm.dll
2015-03-11 20:03 - 2015-02-03 05:31 - 00011264 _____ (Microsoft Corporation) C:\windows\system32\msmmsp.dll
2015-03-11 20:03 - 2015-02-03 05:31 - 00009728 _____ (Microsoft Corporation) C:\windows\system32\spwmp.dll
2015-03-11 20:03 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\msdxm.ocx
2015-03-11 20:03 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\dxmasf.dll
2015-03-11 20:03 - 2015-02-03 05:30 - 12625920 _____ (Microsoft Corporation) C:\windows\system32\wmploc.DLL
2015-03-11 20:03 - 2015-02-03 05:30 - 01480192 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2015-03-11 20:03 - 2015-02-03 05:30 - 01202176 _____ (Microsoft Corporation) C:\windows\system32\drmv2clt.dll
2015-03-11 20:03 - 2015-02-03 05:30 - 01069056 _____ (Microsoft Corporation) C:\windows\system32\cryptui.dll
2015-03-11 20:03 - 2015-02-03 05:30 - 00842240 _____ (Microsoft Corporation) C:\windows\system32\blackbox.dll
2015-03-11 20:03 - 2015-02-03 05:30 - 00680960 _____ (Microsoft Corporation) C:\windows\system32\audiosrv.dll
2015-03-11 20:03 - 2015-02-03 05:30 - 00631808 _____ (Microsoft Corporation) C:\windows\system32\evr.dll
2015-03-11 20:03 - 2015-02-03 05:30 - 00497664 _____ (Microsoft Corporation) C:\windows\system32\drmmgrtn.dll
2015-03-11 20:03 - 2015-02-03 05:30 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\AudioEng.dll
2015-03-11 20:03 - 2015-02-03 05:30 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-03-11 20:03 - 2015-02-03 05:30 - 00296448 _____ (Microsoft Corporation) C:\windows\system32\AudioSes.dll
2015-03-11 20:03 - 2015-02-03 05:30 - 00284672 _____ (Microsoft Corporation) C:\windows\system32\EncDump.dll
2015-03-11 20:03 - 2015-02-03 05:30 - 00187904 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2015-03-11 20:03 - 2015-02-03 05:30 - 00146944 _____ (Microsoft Corporation) C:\windows\system32\appidpolicyconverter.exe
2015-03-11 20:03 - 2015-02-03 05:30 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll
2015-03-11 20:03 - 2015-02-03 05:30 - 00126464 _____ (Microsoft Corporation) C:\windows\system32\audiodg.exe
2015-03-11 20:03 - 2015-02-03 05:30 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2015-03-11 20:03 - 2015-02-03 05:30 - 00082432 _____ (Microsoft Corporation) C:\windows\system32\cryptsp.dll
2015-03-11 20:03 - 2015-02-03 05:30 - 00058880 _____ (Microsoft Corporation) C:\windows\system32\appidapi.dll
2015-03-11 20:03 - 2015-02-03 05:30 - 00055808 _____ (Microsoft Corporation) C:\windows\system32\rrinstaller.exe
2015-03-11 20:03 - 2015-02-03 05:30 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2015-03-11 20:03 - 2015-02-03 05:30 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\appidsvc.dll
2015-03-11 20:03 - 2015-02-03 05:30 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\mfpmp.exe
2015-03-11 20:03 - 2015-02-03 05:30 - 00017920 _____ (Microsoft Corporation) C:\windows\system32\appidcertstorecheck.exe
2015-03-11 20:03 - 2015-02-03 05:30 - 00011264 _____ (Microsoft Corporation) C:\windows\system32\pcawrk.exe
2015-03-11 20:03 - 2015-02-03 05:30 - 00009728 _____ (Microsoft Corporation) C:\windows\system32\pcalua.exe
2015-03-11 20:03 - 2015-02-03 05:29 - 00008704 _____ (Microsoft Corporation) C:\windows\system32\pcaevts.dll
2015-03-11 20:03 - 2015-02-03 05:28 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2015-03-11 20:03 - 2015-02-03 05:28 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\mferror.dll
2015-03-11 20:03 - 2015-02-03 05:19 - 00663552 _____ (Microsoft Corporation) C:\windows\system32\Drivers\PEAuth.sys
2015-03-11 20:03 - 2015-02-03 05:16 - 03973048 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-03-11 20:03 - 2015-02-03 05:16 - 03917760 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-03-11 20:03 - 2015-02-03 05:12 - 11411968 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmp.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 03209728 _____ (Microsoft Corporation) C:\windows\SysWOW64\mf.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 01329664 _____ (Microsoft Corporation) C:\windows\SysWOW64\quartz.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 01174528 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 01005056 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptui.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 00988160 _____ (Microsoft Corporation) C:\windows\SysWOW64\drmv2clt.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 00744960 _____ (Microsoft Corporation) C:\windows\SysWOW64\blackbox.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 00617984 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmdrmsdk.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 00519680 _____ (Microsoft Corporation) C:\windows\SysWOW64\qdvd.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 00504320 _____ (Microsoft Corporation) C:\windows\SysWOW64\msscp.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 00489984 _____ (Microsoft Corporation) C:\windows\SysWOW64\evr.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 00442880 _____ (Microsoft Corporation) C:\windows\SysWOW64\AUDIOKSE.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 00406016 _____ (Microsoft Corporation) C:\windows\SysWOW64\drmmgrtn.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 00374784 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioEng.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 00354816 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfplat.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 00265216 _____ (Microsoft Corporation) C:\windows\SysWOW64\msnetobj.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 00195584 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioSes.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 00179200 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 00143872 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 00103936 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 00103424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfps.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 00081408 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsp.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 00050688 _____ (Microsoft Corporation) C:\windows\SysWOW64\appidapi.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 00008192 _____ (Microsoft Corporation) C:\windows\SysWOW64\spwmp.dll
2015-03-11 20:03 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\msdxm.ocx
2015-03-11 20:03 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxmasf.dll
2015-03-11 20:03 - 2015-02-03 05:11 - 12625408 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmploc.DLL
2015-03-11 20:03 - 2015-02-03 05:11 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\rrinstaller.exe
2015-03-11 20:03 - 2015-02-03 05:11 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfpmp.exe
2015-03-11 20:03 - 2015-02-03 05:09 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\mferror.dll
2015-03-11 20:03 - 2015-02-03 05:08 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
2015-03-11 20:03 - 2015-02-03 04:32 - 00061440 _____ (Microsoft Corporation) C:\windows\system32\Drivers\appid.sys
2015-03-11 20:03 - 2014-11-01 00:24 - 00619056 _____ (Microsoft Corporation) C:\windows\system32\winload.exe
2015-03-11 20:02 - 2015-03-06 07:56 - 00155576 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-03-11 20:02 - 2015-03-06 07:56 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2015-03-11 20:02 - 2015-03-06 07:42 - 01461760 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-03-11 20:02 - 2015-03-06 07:42 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-03-11 20:02 - 2015-03-06 07:42 - 00341504 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-03-11 20:02 - 2015-03-06 07:42 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-03-11 20:02 - 2015-03-06 07:42 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-03-11 20:02 - 2015-03-06 07:42 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-03-11 20:02 - 2015-03-06 07:42 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2015-03-11 20:02 - 2015-03-06 07:42 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-03-11 20:02 - 2015-03-06 07:42 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2015-03-11 20:02 - 2015-03-06 07:42 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2015-03-11 20:02 - 2015-03-06 07:42 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-03-11 20:02 - 2015-03-06 07:41 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2015-03-11 20:02 - 2015-03-06 07:41 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2015-03-11 20:02 - 2015-03-06 07:39 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2015-03-11 20:02 - 2015-03-06 07:38 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-03-11 20:02 - 2015-03-06 07:36 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-03-11 20:02 - 2015-03-06 07:10 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2015-03-11 20:02 - 2015-03-06 07:10 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2015-03-11 20:02 - 2015-03-06 07:10 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-03-11 20:02 - 2015-03-06 07:10 - 00221184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2015-03-11 20:02 - 2015-03-06 07:10 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2015-03-11 20:02 - 2015-03-06 07:10 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2015-03-11 20:02 - 2015-03-06 07:10 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2015-03-11 20:02 - 2015-03-06 07:10 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2015-03-11 20:02 - 2015-03-06 07:09 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2015-03-11 20:02 - 2015-03-06 07:09 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
2015-03-11 20:02 - 2015-03-06 07:07 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2015-03-11 20:02 - 2015-03-06 07:07 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
2015-03-11 20:02 - 2015-03-06 07:06 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2015-03-11 20:02 - 2015-02-13 07:26 - 12875264 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2015-03-11 20:02 - 2015-02-13 07:22 - 14177280 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2015-03-11 20:02 - 2015-02-03 05:31 - 00215552 _____ (Microsoft Corporation) C:\windows\system32\ubpm.dll
2015-03-11 20:02 - 2015-02-03 05:12 - 00171520 _____ (Microsoft Corporation) C:\windows\SysWOW64\ubpm.dll
2015-03-11 20:02 - 2015-01-31 05:48 - 03179520 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll
2015-03-11 20:02 - 2015-01-31 05:48 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\RdpGroupPolicyExtension.dll
2015-03-11 20:02 - 2015-01-31 01:56 - 00459336 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2015-03-11 20:02 - 2015-01-31 01:56 - 00243200 _____ (Microsoft Corporation) C:\windows\system32\rdpudd.dll
2015-03-11 20:01 - 2015-02-26 05:25 - 03204096 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-03-11 20:01 - 2015-02-24 05:15 - 00389800 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-03-11 20:01 - 2015-02-24 04:32 - 00342696 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2015-03-11 20:01 - 2015-02-21 03:16 - 25021440 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-03-11 20:01 - 2015-02-21 02:41 - 12827648 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-03-11 20:01 - 2015-02-21 02:27 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2015-03-11 20:01 - 2015-02-21 02:27 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2015-03-11 20:01 - 2015-02-21 02:25 - 19720192 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-03-11 20:01 - 2015-02-21 01:58 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-03-11 20:01 - 2015-02-21 01:32 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2015-03-11 20:01 - 2015-02-20 05:06 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2015-03-11 20:01 - 2015-02-20 05:05 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2015-03-11 20:01 - 2015-02-20 04:50 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2015-03-11 20:01 - 2015-02-20 04:49 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-03-11 20:01 - 2015-02-20 04:49 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2015-03-11 20:01 - 2015-02-20 04:48 - 02886144 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-03-11 20:01 - 2015-02-20 04:47 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-03-11 20:01 - 2015-02-20 04:41 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2015-03-11 20:01 - 2015-02-20 04:40 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2015-03-11 20:01 - 2015-02-20 04:36 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-03-11 20:01 - 2015-02-20 04:35 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2015-03-11 20:01 - 2015-02-20 04:35 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2015-03-11 20:01 - 2015-02-20 04:34 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2015-03-11 20:01 - 2015-02-20 04:32 - 06035456 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-03-11 20:01 - 2015-02-20 04:26 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2015-03-11 20:01 - 2015-02-20 04:22 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2015-03-11 20:01 - 2015-02-20 04:22 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-03-11 20:01 - 2015-02-20 04:13 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2015-03-11 20:01 - 2015-02-20 04:09 - 00503296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-03-11 20:01 - 2015-02-20 04:08 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2015-03-11 20:01 - 2015-02-20 04:08 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2015-03-11 20:01 - 2015-02-20 04:08 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2015-03-11 20:01 - 2015-02-20 04:06 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2015-03-11 20:01 - 2015-02-20 04:05 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-03-11 20:01 - 2015-02-20 04:03 - 02278400 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-03-11 20:01 - 2015-02-20 04:01 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2015-03-11 20:01 - 2015-02-20 04:00 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2015-03-11 20:01 - 2015-02-20 03:58 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2015-03-11 20:01 - 2015-02-20 03:56 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2015-03-11 20:01 - 2015-02-20 03:56 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2015-03-11 20:01 - 2015-02-20 03:49 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-03-11 20:01 - 2015-02-20 03:49 - 00718848 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-03-11 20:01 - 2015-02-20 03:47 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2015-03-11 20:01 - 2015-02-20 03:46 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-03-11 20:01 - 2015-02-20 03:43 - 14398976 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-03-11 20:01 - 2015-02-20 03:41 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-03-11 20:01 - 2015-02-20 03:37 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2015-03-11 20:01 - 2015-02-20 03:30 - 04300288 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-03-11 20:01 - 2015-02-20 03:28 - 02358784 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-03-11 20:01 - 2015-02-20 03:24 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2015-03-11 20:01 - 2015-02-20 03:24 - 00689152 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-03-11 20:01 - 2015-02-20 03:23 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2015-03-11 20:01 - 2015-02-20 03:16 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-03-11 20:01 - 2015-02-20 03:03 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-03-11 20:01 - 2015-02-20 03:01 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-03-11 20:01 - 2015-02-20 02:57 - 01311232 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-03-11 20:01 - 2015-02-20 02:55 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-03-11 20:01 - 2015-02-04 05:16 - 00465920 _____ (Microsoft Corporation) C:\windows\system32\WMPhoto.dll
2015-03-11 20:01 - 2015-02-04 04:54 - 00417792 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMPhoto.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 01424896 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 01230848 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
2015-03-11 20:01 - 2015-01-17 04:48 - 01067520 _____ (Microsoft Corporation) C:\windows\system32\msctf.dll
2015-03-11 20:01 - 2015-01-17 04:30 - 00828928 _____ (Microsoft Corporation) C:\windows\SysWOW64\msctf.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-05 18:52 - 2011-10-13 19:12 - 00000000 ____D () C:\Users\Home
2015-04-05 18:23 - 2012-07-24 23:09 - 00001116 _____ () C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1233034886-2771921467-1450124296-1001UA.job
2015-04-05 18:16 - 2011-10-13 13:23 - 00000000 ____D () C:\Users\Home\AppData\Local\Adobe
2015-04-05 18:10 - 2014-09-21 16:55 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-04-05 18:10 - 2011-07-17 23:17 - 01607269 _____ () C:\windows\WindowsUpdate.log
2015-04-05 16:26 - 2014-09-29 22:10 - 00000924 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1233034886-2771921467-1450124296-1001UA.job
2015-04-05 14:41 - 2009-07-14 06:45 - 00028960 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-05 14:41 - 2009-07-14 06:45 - 00028960 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-05 13:51 - 2009-07-14 06:51 - 00114915 _____ () C:\windows\setupact.log
2015-04-05 10:39 - 2013-04-12 21:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-05 10:39 - 2012-07-02 11:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-04 22:19 - 2014-09-29 22:10 - 00000902 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1233034886-2771921467-1450124296-1001Core.job
2015-04-04 21:23 - 2014-03-29 18:55 - 00001064 _____ () C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1233034886-2771921467-1450124296-1001Core1cf4b6fb5ce965f.job
2015-04-04 12:52 - 2011-07-17 22:34 - 00700118 _____ () C:\windows\system32\perfh007.dat
2015-04-04 12:52 - 2011-07-17 22:34 - 00149968 _____ () C:\windows\system32\perfc007.dat
2015-04-04 12:52 - 2009-07-14 07:13 - 01622228 _____ () C:\windows\system32\PerfStringBackup.INI
2015-04-04 12:44 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-04-04 12:42 - 2014-12-11 18:25 - 00000000 ____D () C:\windows\system32\appraiser
2015-04-04 12:42 - 2014-04-23 13:51 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-04-04 11:47 - 2012-02-05 17:25 - 01596508 _____ () C:\windows\SysWOW64\PerfStringBackup.INI
2015-04-04 11:40 - 2011-07-17 07:25 - 00000000 ____D () C:\windows\SysWOW64\RTCOM
2015-04-04 10:38 - 2012-07-24 23:12 - 00002317 _____ () C:\Users\Home\Desktop\Google Chrome.lnk
2015-04-03 16:56 - 2012-02-05 17:26 - 00000000 ____D () C:\Users\Home\AppData\Roaming\SoftGrid Client
2015-03-30 01:30 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\rescache
2015-03-28 15:16 - 2013-05-21 13:40 - 00000000 ____D () C:\Users\Home\AppData\Roaming\Skype
2015-03-28 15:00 - 2010-11-21 05:47 - 01666550 _____ () C:\windows\PFRO.log
2015-03-21 23:45 - 2009-07-14 06:45 - 00277360 _____ () C:\windows\system32\FNTCACHE.DAT
2015-03-21 23:42 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\SysWOW64\Dism
2015-03-21 23:42 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\system32\Dism
2015-03-21 23:27 - 2014-04-22 23:53 - 00000000 ____D () C:\windows\system32\MRT
2015-03-21 23:14 - 2011-10-13 15:03 - 122905848 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-03-21 23:05 - 2011-10-13 23:00 - 00000000 ____D () C:\Users\Home\AppData\Local\CrashDumps
2015-03-21 22:39 - 2011-10-13 22:54 - 00000000 ____D () C:\Users\Home\Desktop\ALLES
2015-03-21 22:38 - 2012-11-17 21:57 - 00000000 ____D () C:\Users\Home\Desktop\Spiele
2015-03-11 19:41 - 2011-10-13 23:07 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-03-08 22:58 - 2014-06-29 11:27 - 00000000 ____D () C:\Users\Home\AppData\Roaming\uTorrent
2015-03-08 22:58 - 2014-04-29 19:43 - 00000000 ____D () C:\Program Files (x86)\Pokemon Online
2015-03-08 22:49 - 2013-05-09 17:29 - 00000000 ____D () C:\windows\pss
2015-03-08 22:47 - 2011-10-13 22:25 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Pro
==================== Files in the root of some directories =======
2014-04-22 22:14 - 2014-04-22 22:14 - 0003072 _____ () C:\Users\Home\AppData\Local\file__0.localstorage
2014-04-22 22:14 - 2014-04-22 22:14 - 0003072 _____ () C:\Users\Home\AppData\Local\https_drm.youdagames.com_0.localstorage
2013-07-16 20:40 - 2013-07-16 20:43 - 0000600 _____ () C:\Users\Home\AppData\Local\PUTTY.RND
2014-06-01 13:19 - 2014-08-19 21:30 - 0007606 _____ () C:\Users\Home\AppData\Local\Resmon.ResmonCfg
2015-04-04 11:40 - 2015-04-04 11:40 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2011-07-17 07:47 - 2011-07-17 07:48 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
2011-07-17 07:32 - 2011-07-17 07:34 - 0000113 _____ () C:\ProgramData\{34FBC7C4-CD31-4D93-A428-0E524EAC4586}.log
2011-07-17 07:41 - 2011-07-17 07:42 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2011-07-17 07:35 - 2011-07-17 07:41 - 0000106 _____ () C:\ProgramData\{80E158EA-7181-40FE-A701-301CE6BE64AB}.log
2011-07-17 07:43 - 2011-07-17 07:47 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
Some content of TEMP:
====================
C:\Users\Home\AppData\Local\Temp\AskSLib.dll
C:\Users\Home\AppData\Local\Temp\BullseyeCoverage-2-x86.dll
C:\Users\Home\AppData\Local\Temp\ConResGr_ami.dll
C:\Users\Home\AppData\Local\Temp\fcddkrh6.dll
C:\Users\Home\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Home\AppData\Local\Temp\GovernorOfPoker2.exe
C:\Users\Home\AppData\Local\Temp\GUR2700.exe
C:\Users\Home\AppData\Local\Temp\GUR781B.exe
C:\Users\Home\AppData\Local\Temp\GUR859.exe
C:\Users\Home\AppData\Local\Temp\GUR9A0F.exe
C:\Users\Home\AppData\Local\Temp\GURB3F3.exe
C:\Users\Home\AppData\Local\Temp\GURCB2A.exe
C:\Users\Home\AppData\Local\Temp\GURE58D.exe
C:\Users\Home\AppData\Local\Temp\GUREABB.exe
C:\Users\Home\AppData\Local\Temp\i4jdel0.exe
C:\Users\Home\AppData\Local\Temp\install_flashplayer11x32au_mssd_aih.exe
C:\Users\Home\AppData\Local\Temp\install_flashplayer12x32_mssd_aaa_aih.exe
C:\Users\Home\AppData\Local\Temp\install_flashplayer12x32_mssd_aaa_aih_1.exe
C:\Users\Home\AppData\Local\Temp\install_flashplayer12x32_mssd_aaa_aih_2.exe
C:\Users\Home\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih.exe
C:\Users\Home\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih_1.exe
C:\Users\Home\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih_2.exe
C:\Users\Home\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih_3.exe
C:\Users\Home\AppData\Local\Temp\install_flashplayer13x32au_mssd_aaa_aih_4.exe
C:\Users\Home\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\Home\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Home\AppData\Local\Temp\procexp64.exe
C:\Users\Home\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Home\AppData\Local\Temp\sdapskill.exe
C:\Users\Home\AppData\Local\Temp\sdaspwn.exe
C:\Users\Home\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Home\AppData\Local\Temp\sqlite-3.7.2-sqlitejdbc.dll
C:\Users\Home\AppData\Local\Temp\sweetpage_294wld.exe
C:\Users\Home\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Home\AppData\Local\Temp\swt-win32-3740.dll
C:\Users\Home\AppData\Local\Temp\Uninstaller-1184.exe
C:\Users\Home\AppData\Local\Temp\Uninstaller-1628.exe
C:\Users\Home\AppData\Local\Temp\Uninstaller-2392.exe
C:\Users\Home\AppData\Local\Temp\Uninstaller-2800.exe
C:\Users\Home\AppData\Local\Temp\Uninstaller-3320.exe
C:\Users\Home\AppData\Local\Temp\Uninstaller-3340.exe
C:\Users\Home\AppData\Local\Temp\Uninstaller-3508.exe
C:\Users\Home\AppData\Local\Temp\Uninstaller-4184.exe
C:\Users\Home\AppData\Local\Temp\{5E7E71D2-B798-4ADF-83E5-BA20BC753B3B}-36.0.1985.143_35.0.1916.153_chrome_updater.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-04-04 00:57
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-04-05 19:20:30
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000006c SAMSUNG_ rev.2AR1 465,76GB
Running: xh2esoiv.exe; Driver: C:\Users\Home\AppData\Local\Temp\kxldipow.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[3312] C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe!?SparseBitMask@DataSourceDescription@FlexUI@@2HB + 960 000000002de35984 4 bytes [DF, 3D, 2D, 5F]
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[3312] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076b41401 2 bytes JMP 769cb21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[3312] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076b41419 2 bytes JMP 769cb346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[3312] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076b41431 2 bytes JMP 76a48ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[3312] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076b4144a 2 bytes CALL 769a48ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[3312] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076b414dd 2 bytes JMP 76a487a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[3312] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076b414f5 2 bytes JMP 76a48978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[3312] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076b4150d 2 bytes JMP 76a48698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[3312] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076b41525 2 bytes JMP 76a48a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[3312] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076b4153d 2 bytes JMP 769bfca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[3312] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076b41555 2 bytes JMP 769c68ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[3312] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076b4156d 2 bytes JMP 76a48f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[3312] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076b41585 2 bytes JMP 76a48ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[3312] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076b4159d 2 bytes JMP 76a4865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[3312] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076b415b5 2 bytes JMP 769bfd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[3312] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076b415cd 2 bytes JMP 769cb2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[3312] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076b416b2 2 bytes JMP 76a48e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[3312] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076b416bd 2 bytes JMP 76a485f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtClose 00000000777cf9e0 5 bytes JMP 0000000166856f86
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtQueryObject 00000000777cf9f8 5 bytes JMP 000000016685741f
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtOpenKey 00000000777cfa28 5 bytes JMP 0000000166851027
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtEnumerateValueKey 00000000777cfa40 5 bytes JMP 00000001668508b2
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtQueryKey 00000000777cfa90 5 bytes JMP 000000016685072c
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtQueryValueKey 00000000777cfaa8 5 bytes JMP 000000016685083a
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtCreateKey 00000000777cfb40 5 bytes JMP 00000001668513d1
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtSetInformationFile 00000000777cfc38 5 bytes JMP 00000001668553c5
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtEnumerateKey 00000000777cfd4c 5 bytes JMP 00000001668506b4
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtOpenFile 00000000777cfd64 5 bytes JMP 00000001668559b5
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile 00000000777cfd98 5 bytes JMP 0000000166854a3a
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtDuplicateObject 00000000777cfe44 5 bytes JMP 0000000166857001
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtQueryAttributesFile 00000000777cfe5c 5 bytes JMP 0000000166855b37
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtCreateFile 00000000777d00b4 5 bytes JMP 00000001668557ed
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtSetValueKey 00000000777d01c4 5 bytes JMP 000000016685092a
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtDeleteFile 00000000777d09e4 5 bytes JMP 00000001668555e0
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtDeleteKey 00000000777d09fc 5 bytes JMP 000000016684d7fa
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtDeleteValueKey 00000000777d0a44 5 bytes JMP 000000016684d8c8
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtFlushKey 00000000777d0b80 5 bytes JMP 000000016684d861
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtNotifyChangeKey 00000000777d0f70 5 bytes JMP 00000001668509a2
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtNotifyChangeMultipleKeys 00000000777d0f88 5 bytes JMP 0000000166850dff
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtOpenKeyEx 00000000777d1018 5 bytes JMP 000000016685112f
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile 00000000777d133c 5 bytes JMP 0000000166855bc7
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtQueryMultipleValueKey 00000000777d147c 5 bytes JMP 0000000166850d83
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtQuerySecurityObject 00000000777d1528 5 bytes JMP 0000000166857397
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtRenameKey 00000000777d1718 5 bytes JMP 000000016684dd06
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtSetInformationKey 00000000777d1a58 5 bytes JMP 00000001668507b4
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\ntdll.dll!NtSetSecurityObject 00000000777d1b9c 5 bytes JMP 000000016685712e
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\kernel32.dll!CreateProcessW 00000000769a103d 5 bytes JMP 0000000166829bba
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\kernel32.dll!CreateProcessA 00000000769a1072 5 bytes JMP 0000000166829cf8
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\kernel32.dll!ReplaceFile 00000000769c0de4 5 bytes JMP 0000000166827e04
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\kernel32.dll!CreateProcessAsUserW 00000000769cc9b5 5 bytes JMP 0000000166829f2e
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\kernel32.dll!ReplaceFileA 0000000076a1eef1 5 bytes JMP 0000000166827d24
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\kernel32.dll!SetDllDirectoryW 0000000076a20423 5 bytes JMP 000000016682a851
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\kernel32.dll!SetDllDirectoryA 0000000076a204cb 5 bytes JMP 000000016682ab84
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\kernel32.dll!WinExec 0000000076a22ff1 5 bytes JMP 000000016682a3f3
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\kernel32.dll!AllocConsole 0000000076a4705e 5 bytes JMP 0000000166858595
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\kernel32.dll!AttachConsole 0000000076a47122 5 bytes JMP 00000001668585a7
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW 00000000751b2ab1 5 bytes JMP 000000016682ad8f
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\USER32.dll!CreateWindowExW 0000000075358a29 5 bytes JMP 000000016685857d
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\USER32.dll!CreateWindowExA 000000007535d22e 5 bytes JMP 0000000166858565
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\GDI32.dll!AddFontResourceW 0000000076e8d40a 5 bytes JMP 00000001668381eb
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\GDI32.dll!AddFontResourceA 0000000076e8d913 5 bytes JMP 00000001668381cf
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ADVAPI32.dll!EnumDependentServicesW 0000000077121e3a 7 bytes JMP 000000016683b1d3
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ADVAPI32.dll!EnumServicesStatusExW 000000007712b406 7 bytes JMP 000000016683c0f4
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ADVAPI32.dll!GetServiceKeyNameW 0000000077147897 7 bytes JMP 000000016683b87a
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ADVAPI32.dll!GetServiceDisplayNameW 0000000077147953 7 bytes JMP 000000016683ba2b
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ADVAPI32.dll!EnumServicesStatusExA 000000007714a37a 7 bytes JMP 000000016683c1ba
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ADVAPI32.dll!CreateProcessAsUserA 0000000077162642 5 bytes JMP 000000016682a070
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ADVAPI32.dll!GetServiceKeyNameA 0000000077181d74 7 bytes JMP 000000016683b932
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ADVAPI32.dll!GetServiceDisplayNameA 0000000077181e11 7 bytes JMP 000000016683bae3
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ADVAPI32.dll!EnumServicesStatusA 0000000077182201 7 bytes JMP 000000016683c036
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ADVAPI32.dll!EnumDependentServicesA 00000000771822e4 7 bytes JMP 000000016683b28a
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ADVAPI32.dll!EnumServicesStatusW 0000000077182401 5 bytes JMP 000000016683bf78
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!ControlService 00000000758d4d5c 7 bytes JMP 000000016683b018
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!CloseServiceHandle 00000000758d4dc3 7 bytes JMP 000000016683b341
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!QueryServiceStatus 00000000758d4e4b 7 bytes JMP 000000016683b0a4
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!QueryServiceStatusEx 00000000758d4eaf 7 bytes JMP 000000016683b137
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!StartServiceW 00000000758d4f35 7 bytes JMP 000000016683ae93
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!StartServiceA 00000000758d508d 7 bytes JMP 000000016683af29
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!QueryServiceObjectSecurity 00000000758d50f4 7 bytes JMP 000000016683be46
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 00000000758d5181 7 bytes JMP 000000016683bee2
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!ChangeServiceConfigA 00000000758d5254 7 bytes JMP 000000016683b542
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000758d53d5 7 bytes JMP 000000016683b45d
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000758d54c2 7 bytes JMP 000000016683b7e4
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000758d55e2 7 bytes JMP 000000016683b74e
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!CreateServiceA 00000000758d567c 7 bytes JMP 000000016683ac75
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!CreateServiceW 00000000758d589f 7 bytes JMP 000000016683ab9f
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!DeleteService 00000000758d5a22 7 bytes JMP 000000016683b3cf
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!QueryServiceConfigA 00000000758d5a83 7 bytes JMP 000000016683bc75
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!QueryServiceConfigW 00000000758d5b29 7 bytes JMP 000000016683bbdc
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!ControlServiceExA 00000000758d5ca0 7 bytes JMP 000000016683a34f
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!ControlServiceExW 00000000758d5d8c 7 bytes JMP 000000016683a2d6
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!OpenSCManagerW 00000000758d63ad 7 bytes JMP 000000016683a89d
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!OpenSCManagerA 00000000758d64f0 7 bytes JMP 000000016683a929
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!QueryServiceConfig2A 00000000758d6633 7 bytes JMP 000000016683bdaa
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!QueryServiceConfig2W 00000000758d680c 7 bytes JMP 000000016683bd0e
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!OpenServiceW 00000000758d714b 7 bytes JMP 000000016683aa12
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\SysWOW64\sechost.dll!OpenServiceA 00000000758d7245 7 bytes JMP 000000016683aa9e
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ole32.dll!CoRegisterPSClsid 000000007725c56e 5 bytes JMP 000000016684196d
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ole32.dll!CoResumeClassObjects + 7 000000007725ea09 7 bytes JMP 0000000166841f3e
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ole32.dll!OleRun 00000000772607de 5 bytes JMP 0000000166841df9
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ole32.dll!CoRegisterClassObject 00000000772621e1 5 bytes JMP 0000000166842a6e
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ole32.dll!OleUninitialize 000000007726eba1 6 bytes JMP 0000000166841d18
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ole32.dll!OleInitialize 000000007726efd7 5 bytes JMP 0000000166841ca8
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ole32.dll!CoGetPSClsid 00000000772726b9 5 bytes JMP 0000000166841ae5
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ole32.dll!CoGetClassObject 00000000772854ad 5 bytes JMP 0000000166842ffc
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ole32.dll!CoInitializeEx 00000000772909ad 5 bytes JMP 0000000166841b58
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ole32.dll!CoUninitialize 00000000772986d3 5 bytes JMP 0000000166841bda
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ole32.dll!CoCreateInstance 0000000077299d0b 5 bytes JMP 00000001668442ca
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ole32.dll!CoCreateInstanceEx 0000000077299d4e 5 bytes JMP 0000000166842405
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ole32.dll!CoSuspendClassObjects + 7 00000000772bbb09 7 bytes JMP 0000000166841e69
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ole32.dll!CoRevokeClassObject 00000000772deacf 5 bytes JMP 00000001668413ca
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ole32.dll!CoGetInstanceFromFile 000000007731340b 5 bytes JMP 00000001668434bc
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\ole32.dll!OleRegEnumFormatEtc 000000007735cfd9 5 bytes JMP 0000000166841d83
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\oleaut32.dll!RegisterActiveObject 00000000752327a6 5 bytes JMP 000000016684165d
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\oleaut32.dll!RevokeActiveObject 000000007523329c 5 bytes JMP 000000016684177e
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[3844] C:\windows\syswow64\oleaut32.dll!GetActiveObject 0000000075248f68 5 bytes JMP 00000001668417f1
---- Threads - GMER 2.1 ----
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [1448:2804] 00000000758d7587
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [1448:2808] 0000000072df8aa6
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [1448:988] 0000000077802e65
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [1448:3084] 0000000077803e85
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [1448:2464] 0000000077803e85
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [1448:3300] 0000000077803e85
Thread C:\windows\System32\svchost.exe [3224:3392] 000007fef18a9688
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\4cedde691e40
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\4cedde691e40 (not active ControlSet)
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
|
|
06.04.2015, 00:59
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | 2x | Windows 7, Verdacht auf Virus Du hast bereits einen Thread => http://www.trojaner-board.de/165827-...ayer-geht.html
__________________Dieser überflüssige wird tonniert.
__________________ |
| Themen zu 2x | Windows 7, Verdacht auf Virus |
| antivirus, avg, bluestacks, browser, defender, desktop, firefox, flash player, helper, home, homepage, mozilla, port, realtek, registry, scan, security, services.exe, software, svchost.exe, symantec, system, trojaner, trojaner board, virus, windows |
Linear-Darstellung
