Windows7: Malware-Befall? PC langsam, "Keine Rückmeldung" etc.

Argiel · 25.05.2015, 21:04

Liebes Trojaner-Board,
seit einiger Zeit ist mein ca. 2 Jahre alter Stand-PC unendlich langsam, Internetseiten bauen sich langsam auf & hängen sich dann auf ("Keine Rückmeldung"), ich komme nur sehr langsam in den Task-Manager, um sie überhaupt schließen zu können. Ein Neustart des PCs bringt gar nichts, normales Arbeiten am PC ist so kaum möglich. Eine Nutzerin vor mir hatte ein ähnliches Problem - so bin ich auf Eure Seite gestoßen. Hoffentlich könnt Ihr mir helfen & ich bitte sehr darum. Ich habe mir Eure Anleitung zur Vorbereitung durchgelesen & die ersten Schritte selbst ausgeführt & hänge die erforderlichen Dateien hier mit an. Ich bin morgen (Di, 26. Mai) & Mittwoch (27. Mai) den ganzen Tag daheim, bin dann aber erst wieder die Woche drauf am Mittwoch (3. Juni) wieder an diesem "kranken" PC erreichbar. Ich fürchte, er hat sich eine Malware oder dergleichen eingefangen, die ich selbst nicht losbringe...vielen Dank schon mal im Voraus

defogger_disable.log:

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:11 on 25/05/2015 (Sou)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

FRST.txt, Addition.txt und Gmer.txt musste ich zippen, da sie für diese Meldung zu groß waren - sorry für die Mehrarbeit, ging aber nicht anders.

Vielen Dank!

schrauber · 26.05.2015, 05:56

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Argiel · 26.05.2015, 07:19

Hallo schrauber, alles klar, mach ich

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 24-05-2015 01
Ran by Sou (administrator) on SOU-ARLT on 25-05-2015 18:50:02
Running from C:\Users\Sou\Desktop\Anti-Malware
Loaded Profiles: Sou & UpdatusUser (Available Profiles: Sou & UpdatusUser)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Akamai Technologies, Inc.) C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Akamai Technologies, Inc.) C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe
() C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [DSL Soforthilfe] => C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe [20585888 2013-11-21] ()
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-30] (Akamai Technologies, Inc.)
HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2888384 2015-05-15] (Valve Corporation)
HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
ShellIconOverlayIdentifiers: [  00BitrixShellExt] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506B} => C:\Program Files (x86)\Bitrix24\64\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers: [  00BitrixShellExt_C] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506E} => C:\Program Files (x86)\Bitrix24\64\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers: [  00BitrixShellExt_E] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506D} => C:\Program Files (x86)\Bitrix24\64\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers: [  00BitrixShellExt_S] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506C} => C:\Program Files (x86)\Bitrix24\64\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: [  00BitrixShellExt] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506B} => C:\Program Files (x86)\Bitrix24\32\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers-x32: [  00BitrixShellExt_C] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506E} => C:\Program Files (x86)\Bitrix24\32\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers-x32: [  00BitrixShellExt_E] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506D} => C:\Program Files (x86)\Bitrix24\32\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers-x32: [  00BitrixShellExt_S] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506C} => C:\Program Files (x86)\Bitrix24\32\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll [2015-04-19] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.web.de/
hxxp://www.facebook.de/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll [2013-12-14] (IObit)
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-04-19] (Microsoft Corporation)
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-12-03] (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-04-14] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-09-20] (Hewlett-Packard Co.)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-12-03] (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-24] (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2012-03-08] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-04-14] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-24] (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-09-20] (Hewlett-Packard Co.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-04-19] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174
FF Homepage: hxxp://www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-19] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-19] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-24] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-24] (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-12-03] ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-12-03] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-12-03] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-04-19] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2012-09-13] (Pando Networks)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1564645244-1967886891-1609600129-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin1017325.dll [2012-10-04] (Amazon.com, Inc.)
FF Plugin HKU\S-1-5-21-1564645244-1967886891-1609600129-1000: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2012-09-13] (Pando Networks)
FF Plugin HKU\S-1-5-21-1564645244-1967886891-1609600129-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2015-03-12] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npmieze.dll [2011-09-16] (Synatix GmbH)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Extension: FoxyDeal - C:\Users\Sou\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{F58A62EB-38DC-43C4-A539-DC52E135208D} [2013-05-08]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\Extensions\adblockpopups@jessehakanen.net.xpi [2014-09-08]
FF Extension: Element Hiding Helper for Adblock Plus - C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\Extensions\elemhidehelper@adblockplus.org.xpi [2014-09-08]
FF Extension: Bitrix Intranet Integration - C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\Extensions\ff_bx_integration@bitrixsoft.com.xpi [2014-11-07]
FF Extension: Ghostery - C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\Extensions\firefox@ghostery.com.xpi [2014-09-08]
FF Extension: Facebook Secret Emoticons - C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\Extensions\jid0-XZn6pYCdV3ANrfYigxlyyGDrxAM@jetpack.xpi [2014-09-14]
FF Extension: Adblock Plus - C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-09-08]
FF Extension: Adblock Edge - C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-09-08]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak [2014-02-15]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak [2014-02-15]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-02-15]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-06-10]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-12-03]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-12-03]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-12-03]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-12-03]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-12-03]
FF HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [icmijdhkcgeclpfjmibnginbbkfcbpep] - C:\Program Files\SearchGBY\Extensions\Chrome\searchgby.chrome.v0.9.55.crx [2012-07-06]
CHR HKLM-x32\...\Chrome\Extension: [pnbbffeddnekkhjmokkhdebbfbibbflc] - C:\Program Files (x86)\LyricsPal\128.crx [Not Found]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
S4 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) []
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2736824 2015-04-07] (Microsoft Corporation)
R2 DiagTrack; C:\Windows\system32\diagtrack.dll [1254400 2015-04-27] (Microsoft Corporation)
S3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) []
R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) []
S4 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2151744 2013-12-14] (IObit)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) []
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) []
S4 ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [430592 2008-04-07] (Nokia.) []
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 adp3132; C:\Windows\system32\drivers\adp3132.sys [385072 2010-01-28] (Adaptec, Inc.)
S3 amdide64; C:\Windows\system32\drivers\amdide64.sys [10632 2007-10-12] (Advanced Micro Devices)
R3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2013-06-02] (Wondershare)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [88480 2013-07-09] ()
S3 FLxHCIh; C:\Windows\system32\drivers\FLxHCIh.sys [44544 2010-04-17] (Fresco Logic)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-10-30] () []
S3 ISASerial; C:\Windows\system32\drivers\ISASerial.sys [72192 2008-02-20] (Windows (R) Codename Longhorn DDK provider)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [141320 2014-12-03] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [793800 2014-12-03] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [46400 2013-07-09] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-05-25] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
S3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-07-16] ()
S3 MtsHID; C:\Windows\system32\drivers\MtsHID.sys [27664 2009-07-15] (TechniSat Provide)
S3 nvamacpi; C:\Windows\system32\drivers\NVAMACPI.sys [28192 2009-07-17] (NVIDIA Corporation)
S3 nvrd64; C:\Windows\system32\drivers\nvrd64.sys [175648 2009-08-04] (NVIDIA Corporation)
S3 PciIsaSerial; C:\Windows\system32\drivers\PciIsaSerial.sys [72192 2008-05-22] (Windows (R) Codename Longhorn DDK provider)
S3 PciPPorts; C:\Windows\system32\drivers\PciPPorts.sys [95744 2008-05-22] ()
S3 PciSPorts; C:\Windows\system32\drivers\PciSPorts.sys [126464 2008-05-22] ()
S3 PPorts; C:\Windows\system32\drivers\PPorts.sys [95744 2008-02-20] ()
S3 Si3124r5; C:\Windows\system32\drivers\Si3124r5.sys [340008 2010-04-13] (Silicon Image, Inc)
R0 SiFilter; C:\Windows\System32\drivers\SiWinAcc.sys [22568 2010-04-13] (Silicon Image, Inc.)
R0 SiRemFil; C:\Windows\System32\drivers\SiRemFil.sys [16936 2010-04-13] (Silicon Image, Inc.)
S3 SPorts; C:\Windows\system32\drivers\SPorts.sys [124416 2008-02-20] ()
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [52736 2012-04-25] (Apple, Inc.) []
S3 NmPar; \SystemRoot\system32\drivers\NmPar.sys [X]
S3 nmserial; \SystemRoot\system32\drivers\nmserial.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-25 18:13 - 2015-05-25 18:51 - 00000000 ___DC () C:\FRST
2015-05-25 18:11 - 2015-05-25 18:11 - 00000000 _____ () C:\Users\Sou\defogger_reenable
2015-05-21 18:12 - 2015-05-21 18:12 - 00000000 ____D () C:\Users\Sou\AppData\Roaming\EurekaLab s.a.s
2015-05-21 12:35 - 2015-05-21 12:35 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-SOU-ARLT-Windows-7-Home-Premium-(64-bit).dat
2015-05-21 12:35 - 2015-05-21 12:35 - 00000000 ___DC () C:\RegBackup
2015-05-21 11:46 - 2015-05-25 18:50 - 00000000 ____D () C:\Users\Sou\Desktop\Anti-Malware
2015-05-20 09:57 - 2015-05-20 09:57 - 51789024 _____ (Microsoft Corporation) C:\Users\Sou\Downloads\Windows-KB890830-x64-v5.24.exe
2015-05-19 22:10 - 2015-05-25 18:31 - 00000672 _____ () C:\Windows\setupact.log
2015-05-19 22:10 - 2015-05-19 22:10 - 00000000 _____ () C:\Windows\setuperr.log
2015-05-19 22:02 - 2015-05-19 22:02 - 00274782 _____ () C:\Users\Sou\Documents\cc_20150519_220207.reg
2015-05-19 03:02 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-19 03:02 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-19 00:16 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-19 00:16 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-19 00:16 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-19 00:16 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-19 00:16 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-19 00:16 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-19 00:16 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-19 00:16 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-19 00:16 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-19 00:16 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-19 00:16 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-19 00:16 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-19 00:16 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-19 00:16 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-19 00:16 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-19 00:16 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-19 00:16 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-19 00:16 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-19 00:16 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-19 00:16 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-19 00:16 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-19 00:16 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-19 00:16 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-19 00:16 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-19 00:16 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-19 00:16 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-19 00:16 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-19 00:16 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-19 00:16 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-19 00:16 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-19 00:16 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-19 00:16 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-19 00:16 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-19 00:16 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-19 00:16 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-19 00:16 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-19 00:16 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-19 00:16 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-19 00:16 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-19 00:16 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-19 00:16 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-19 00:16 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-19 00:16 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-19 00:16 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-19 00:16 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-19 00:16 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-19 00:16 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-19 00:16 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-19 00:16 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-19 00:16 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-19 00:16 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-19 00:16 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-19 00:16 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-19 00:16 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-19 00:16 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-19 00:16 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-19 00:16 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-19 00:16 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-19 00:16 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-19 00:16 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-19 00:16 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-19 00:16 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-19 00:16 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-19 00:16 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-19 00:16 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-19 00:16 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-19 00:16 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-19 00:13 - 2015-04-27 21:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-19 00:13 - 2015-04-27 21:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-19 00:13 - 2015-04-27 21:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-19 00:13 - 2015-04-27 21:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-05-19 00:13 - 2015-04-27 21:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-19 00:13 - 2015-04-27 21:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-19 00:13 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-05-19 00:13 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-05-19 00:13 - 2015-04-27 21:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-05-19 00:13 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-05-19 00:13 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-19 00:13 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-05-19 00:13 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-05-19 00:13 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-05-19 00:13 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-05-19 00:13 - 2015-04-27 21:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-05-19 00:13 - 2015-04-27 21:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-05-19 00:13 - 2015-04-27 21:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-05-19 00:13 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-19 00:13 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-05-19 00:13 - 2015-04-27 20:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-19 00:12 - 2015-04-27 21:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-19 00:12 - 2015-04-27 21:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-19 00:12 - 2015-04-27 21:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-05-19 00:12 - 2015-04-27 21:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-19 00:12 - 2015-04-27 21:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-19 00:12 - 2015-04-27 21:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-19 00:12 - 2015-04-27 21:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-05-19 00:12 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-19 00:12 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 19:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-05-19 00:12 - 2015-04-27 19:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-05-19 00:12 - 2015-04-27 19:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-05-19 00:10 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-19 00:10 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-19 00:10 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-19 00:10 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-19 00:10 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-19 00:10 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-19 00:10 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-19 00:10 - 2015-01-29 05:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-19 00:10 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-19 00:07 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-19 00:07 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-19 00:07 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-19 00:07 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-19 00:07 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-05-19 00:07 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-05-19 00:07 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-25 18:43 - 2013-12-14 19:13 - 01554930 _____ () C:\Windows\WindowsUpdate.log
2015-05-25 18:42 - 2009-07-14 06:45 - 00028944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-25 18:42 - 2009-07-14 06:45 - 00028944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-25 18:32 - 2014-12-03 13:12 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-25 18:32 - 2014-06-03 12:28 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-05-25 18:32 - 2011-11-25 22:12 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-05-25 18:31 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-25 18:12 - 2012-04-02 18:45 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-25 18:11 - 2011-06-01 11:45 - 00000000 ____D () C:\Users\Sou
2015-05-22 16:08 - 2011-07-20 20:14 - 00000000 ____D () C:\Users\Sou\AppData\Roaming\SoftGrid Client
2015-05-22 12:28 - 2012-11-27 01:02 - 00000000 ___RD () C:\Users\Sou\Desktop\mfm
2015-05-22 00:38 - 2015-04-07 23:53 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-05-22 00:38 - 2015-04-07 23:53 - 00000000 ___SD () C:\Windows\system32\GWX
2015-05-21 18:38 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-05-21 17:29 - 2011-06-01 19:46 - 00000000 ____D () C:\Users\Sou\AppData\Roaming\TS3Client
2015-05-21 12:39 - 2014-02-15 01:25 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-21 11:52 - 2014-12-03 13:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-05-21 11:52 - 2014-12-03 13:12 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-05-21 11:45 - 2014-12-03 12:52 - 00000000 ___DC () C:\AdwCleaner
2015-05-20 09:50 - 2012-05-04 08:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-19 21:52 - 2012-08-13 19:50 - 00000000 ___RD () C:\Users\Sou\Desktop\Bilder
2015-05-19 21:52 - 2012-02-02 21:01 - 00000000 ___RD () C:\Users\Sou\Desktop\Komponistinnen
2015-05-19 20:32 - 2014-09-03 00:11 - 00000000 ____D () C:\Users\Sou\AppData\Local\Adobe
2015-05-19 20:31 - 2012-04-02 18:45 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-19 20:31 - 2012-04-02 18:45 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-19 20:31 - 2011-06-02 13:49 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-19 19:37 - 2015-04-19 17:34 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2015-05-19 13:46 - 2012-09-13 20:19 - 00000000 ____D () C:\Users\Sou\AppData\Local\Turbine
2015-05-19 04:27 - 2014-04-11 09:17 - 00000000 ____D () C:\Windows\rescache
2015-05-19 03:45 - 2010-11-21 08:50 - 00715336 _____ () C:\Windows\system32\perfh007.dat
2015-05-19 03:45 - 2010-11-21 08:50 - 00157212 _____ () C:\Windows\system32\perfc007.dat
2015-05-19 03:45 - 2009-07-14 07:13 - 01665376 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-19 03:38 - 2009-07-14 06:45 - 00555696 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-19 03:37 - 2012-05-18 02:14 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-19 03:37 - 2012-05-18 02:14 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-05-19 03:34 - 2010-11-21 09:00 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-19 03:34 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-19 03:16 - 2011-07-20 20:14 - 01692058 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-05-19 03:16 - 2011-07-20 20:13 - 00000000 ____D () C:\Program Files (x86)\Microsoft Application Virtualization Client
2015-05-19 03:14 - 2013-08-08 03:09 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-19 03:02 - 2012-05-18 02:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-19 01:17 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2015-05-19 00:27 - 2014-05-23 14:00 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-04-30 10:07 - 2011-06-02 13:47 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

==================== Files in the root of some directories =======

2014-11-29 12:32 - 2014-11-29 12:32 - 0000093 _____ () C:\Users\Sou\AppData\Roaming\ARCompanion.log
2012-09-01 09:49 - 2012-09-01 09:51 - 0000198 _____ () C:\Users\Sou\AppData\Roaming\burnaware.ini
2012-08-31 18:32 - 2012-08-31 18:32 - 0003584 _____ () C:\Users\Sou\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-09-13 20:17 - 2012-09-13 20:17 - 0000091 _____ () C:\Users\Sou\AppData\Local\fusioncache.dat
2015-03-11 21:30 - 2015-03-11 21:30 - 0005253 _____ () C:\Users\Sou\AppData\Local\recently-used.xbel
2011-11-11 18:37 - 2011-11-11 18:37 - 0000017 _____ () C:\Users\Sou\AppData\Local\resmon.resmoncfg
2011-11-25 22:14 - 2011-11-25 22:14 - 0017408 _____ () C:\Users\Sou\AppData\Local\WebpageIcons.db
2012-06-10 19:51 - 2012-06-10 20:23 - 0001396 _____ () C:\ProgramData\hpzinstall.log

Some files in TEMP:
====================
C:\Users\Sou\AppData\Local\Temp\ARCompanionForSession1.exe
C:\Users\Sou\AppData\Local\Temp\EsgInstallerx64Stub.exe
C:\Users\Sou\AppData\Local\Temp\iv_uninstall.exe
C:\Users\Sou\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\Sou\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Sou\AppData\Local\Temp\obmm_setup.exe
C:\Users\Sou\AppData\Local\Temp\Quarantine.exe
C:\Users\Sou\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-19 01:05

==================== End of log ============================

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-05-2015 01
Ran by Sou at 2015-05-25 18:55:21
Running from C:\Users\Sou\Desktop\Anti-Malware
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1564645244-1967886891-1609600129-500 - Administrator - Disabled)
ASPNET (S-1-5-21-1564645244-1967886891-1609600129-1004 - Limited - Enabled)
Gast (S-1-5-21-1564645244-1967886891-1609600129-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1564645244-1967886891-1609600129-1002 - Limited - Enabled)
Sou (S-1-5-21-1564645244-1967886891-1609600129-1000 - Administrator - Enabled) => C:\Users\Sou
UpdatusUser (S-1-5-21-1564645244-1967886891-1609600129-1005 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
AIO_CDA_Software (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
AIO_Scan (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
Akamai NetSession Interface (HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\...\Akamai) (Version:  - Akamai Technologies, Inc)
Amazon MP3-Downloader 1.0.17 (HKLM-x32\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)
Apowersoft kostenloser Bildschirmrekorder V1.3.2 (HKLM-x32\...\{4EFA42DB-E4EC-4537-9DF3-5158D08A9785}_is1) (Version: 1.3.2 - Apowersoft)
Audacity 2.0.3 (HKLM-x32\...\Audacity_is1) (Version: 2.0.3 - Audacity Team)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
BioShock 2 (x32 Version: 1.0.0005.131 - Take-Two Interactive Software) Hidden
Brother MFL-Pro Suite DCP-J125 (HKLM-x32\...\{FB83EAC4-E3F6-4666-B45B-44522F2344B6}) (Version: 1.0.3.0 - Brother Industries, Ltd.)
BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.01 - Piriform)
ConEdit - Deus Ex Conversation Editor (HKLM-x32\...\ST6UNST #1) (Version:  - )
Cry of Fear (HKLM-x32\...\Steam App 223710) (Version:  - Team Psykskallar)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Der Herr der Ringe Online v03.03.05.8039 (HKLM-x32\...\12bbe590-c890-11d9-9669-0800200c9a66_is1) (Version: 03.03.05.8039 - Turbine, Inc.)
Deus Ex: Game of the Year Edition (HKLM-x32\...\Steam App 6910) (Version:  - Ion Storm)
Deus Ex: Human Revolution - Director's Cut (HKLM-x32\...\Steam App 238010) (Version:  - Eidos Montreal)
Deus Ex: Human Revolution (HKLM-x32\...\Steam App 28050) (Version:  - Eidos Montreal)
Deus Ex: Invisible War (HKLM-x32\...\Steam App 6920) (Version:  - Ion Storm)
DEUTSCHLAND SPIELT GAME CENTER (HKLM-x32\...\DSGPlayer) (Version: 2.4.2.14 - INTENIUM GmbH)
Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)
Dishonored (HKLM-x32\...\Steam App 205100) (Version: 1.0 - Bethesda Softworks)
DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
DSL Soforthilfe (HKLM-x32\...\DSL Soforthilfe) (Version: 1.1.0.51 - Telefónica Germany GmbH & Co. OHG)
EAX4 Unified Redist (HKLM-x32\...\{89661B04-C646-4412-B6D3-5E19F02F1F37}) (Version: 4.001 - Creative Labs)
Free WMA to MP3 Converter 1.16 (HKLM-x32\...\Free WMA to MP3 Converter_is1) (Version:  - Jodix Technologies Ltd.)
Free YouTube Download version 3.0.20.1228 (HKLM-x32\...\Free YouTube Download_is1) (Version:  - DVDVideoSoft Ltd.)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Gothic (HKLM-x32\...\{BBF10B37-4ED3-11D5-A818-00500435FC18}) (Version:  - )
Gothic 3 (HKLM-x32\...\Steam App 39500) (Version:  - Piranha – Bytes )
Gothic 3 LCTM 1.1 (HKLM-x32\...\Gothic 3 LCTM) (Version: 1.1 - LCTM-Team)
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
HP Photosmart All-In-One Driver Software 13.0 Rel. A (HKLM\...\{17016DA1-F040-4032-BD36-34DD317BC9D5}) (Version: 13.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Smart Web Printing 4.51 (HKLM\...\HP Smart Web Printing) (Version: 4.51 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM-x32\...\{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}) (Version: 5.003.001.001 - Hewlett-Packard)
HPPhotoGadget (x32 Version: 130.0.282.000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
Internet-TV für Windows Media Center (HKLM-x32\...\{9D318C86-AF4C-409F-A6AC-7183FF4CF424}) (Version: 4.2.2.0 - Microsoft Corporation)
IObit Uninstaller (HKLM-x32\...\IObitUninstall) (Version: 3.0.4.922 - IObit)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version:  - )
LEGO® Harry Potter™: Die Jahre 1-4 (HKLM-x32\...\{C5A8DF48-580B-44D3-B2B2-E965A9368F28}) (Version: 1.0.0.0 - WB Games)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 1.1 (HKLM-x32\...\Microsoft .NET Framework 1.1  (1033)) (Version:  - )
Microsoft .NET Framework 1.1 German Language Pack (HKLM-x32\...\{E78BFA60-5393-4C38-82AB-E8019E464EB4}) (Version: 1.1.4322 - Microsoft)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4719.1002 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\...\OneDriveSetup.exe) (Version: 17.3.4604.0120 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Morrowind (HKLM-x32\...\{1D108D70-E7D1-4089-9A0A-99629C4D0CB8}) (Version:  - )
Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0 - Mozilla)
MP3 Skype recorder (HKLM-x32\...\{2950ED4F-18AD-4571-9045-27D6EBF62320}) (Version: 4.3.0.0 - Alexander Nikiforov)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MuseScore 1.3 (HKLM-x32\...\MuseScore) (Version: 1.3.0 - Werner Schweer and Others)
Network64 (Version: 130.0.572.000 - Hewlett-Packard) Hidden
Network64 (Version: 140.0.221.000 - Hewlett-Packard) Hidden
NO ONE LIVES FOREVER - GAME OF THE YEAR EDITION (HKLM-x32\...\{EE3E60BC-F29F-4E7B-A110-B538387D34DA}) (Version:  - )
NVIDIA Grafiktreiber 307.83 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 307.83 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{46ED2B64-85C7-4E1F-920C-A555B21F2E4C}) (Version: 9.11.1111 - NVIDIA Corporation)
NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
Oblivion mod manager 1.1.12 (HKLM-x32\...\Oblivion mod manager_is1) (Version:  - Timeslip)
OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4719.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4719.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4719.1002 - Microsoft Corporation) Hidden
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.8 - Pando Networks Inc.)
PC Connectivity Solution (HKLM-x32\...\{AC599724-5755-48C1-ABE7-ABB857652930}) (Version: 8.15.0.0 - Nokia)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6316 - Realtek Semiconductor Corp.)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.3.2.12054_20 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.3.2.12054_20 - Samsung Electronics Co., Ltd.) Hidden
Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version:  - )
Samsung New PC Studio (HKLM-x32\...\InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}) (Version: 1.00.0000 - Samsung Electronics Co., Ltd.)
Samsung New PC Studio (x32 Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Hidden
Samsung New PC Studio USB Driver Installer (HKLM-x32\...\InstallShield_{AF7E85DC-317C-47F5-810E-B82EE093A612}) (Version: 1.00.0000 - Samsung Electronics Co., Ltd.)
Samsung New PC Studio USB Driver Installer (x32 Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Hidden
Samsung Story Album Viewer (HKLM-x32\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)
Samsung Story Album Viewer (x32 Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.29.0 - SAMSUNG Electronics Co., Ltd.)
SamsungConnectivityCableDriver (HKLM-x32\...\{7E84FAC8-C518-40F9-9807-7455301D6D25}) (Version: 6.83.6.2.1 - Samsung)
Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
SmartWebPrinting (x32 Version: 130.0.457.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Streaming Audio Recorder V3.3.4 (HKLM-x32\...\{B6D9D06B-4B4D-4B41-B963-C056B627F704}_is1) (Version: 3.3.4 - Apowersoft)
StuffIt Expander 2011 (HKLM\...\{6B62B973-49F5-4C51-B738-93B56A963417}) (Version: 15.0.1.17 - Smith Micro Software, Inc.)
TeamSpeak 3 Client (HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)
The Elder Scrolls IV: Oblivion  (HKLM-x32\...\Steam App 22330) (Version:  - Bethesda Game Studios)
Thief (HKLM-x32\...\Steam App 239160) (Version:  - Eidos-Montréal)
Tomb Raider: The Last Revelation (HKLM-x32\...\Steam App 224980) (Version:  - Core Design)
Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
Two Worlds II (HKLM-x32\...\Steam App 7520) (Version:  - Reality Pump Studios)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden
Uplay (HKLM-x32\...\Uplay) (Version: 4.7 - Ubisoft)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007 6.85.4.0) (HKLM\...\BC15EA930074932BB2C4B4493C9FD4EA95087D1A) (Version: 10/12/2007 6.85.4.0 - Nokia)
Xilisoft Download YouTube Video (HKLM-x32\...\Xilisoft Download YouTube Video) (Version: 3.3.0.20120525 - Xilisoft)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1564645244-1967886891-1609600129-1000_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32 -> C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1564645244-1967886891-1609600129-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1564645244-1967886891-1609600129-1000_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32 -> C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1564645244-1967886891-1609600129-1000_Classes\CLSID\{B7E372B0-E010-6A1E-FFA5-3B188A9FD122}\InprocServer32 -> No File path
CustomCLSID: HKU\S-1-5-21-1564645244-1967886891-1609600129-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1564645244-1967886891-1609600129-1000_Classes\CLSID\{c1edfb3c-db7a-4ade-bcee-f76529a141aa}\InprocServer32 -> C:\Windows\system32\dfshim.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1564645244-1967886891-1609600129-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1564645244-1967886891-1609600129-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1564645244-1967886891-1609600129-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================

21-05-2015 03:00:42 Windows Update
22-05-2015 00:37:00 Windows Update

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {265656A6-DE55-4F27-93A3-A9AFD5D2B83E} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-04-14] (Microsoft Corporation)
Task: {2723AAAD-5B64-4988-827D-7A5B249905F3} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-07] (Microsoft Corporation)
Task: {2E6F7DA4-A342-4309-AA23-246309BFF128} - System32\Tasks\{D97349DA-8511-4C64-A953-8FCCB7337EDC} => pcalua.exe -a C:\Users\Sou\Desktop\dxwebsetup9.29.1974.exe -d C:\Users\Sou\Desktop
Task: {2FFE1995-D787-4A70-AF72-1AA45BECCE15} - System32\Tasks\{C6955354-2EC9-4CD4-84F1-B4E3F8D741F4} => C:\SIERRA\Pharao\Pharaoh.exe
Task: {3B48CA09-F4C9-40BD-AF8E-6A2DCEC0FA9E} - System32\Tasks\{69598AC0-6F56-4BED-BADC-FCC05116D710} => C:\SIERRA\Pharao\Pharaoh.exe
Task: {469DB521-6E5C-4D47-9CA0-814F7C5E6337} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-04-23] (Piriform Ltd)
Task: {6643A624-5B68-4867-A0A0-871386B9DDDB} - System32\Tasks\{A5A04121-7ADD-4986-8364-864C38A76474} => E:\setup.exe
Task: {6C5EEFF7-EDD8-4460-B538-E99F08053FDF} - System32\Tasks\{76FE6F7C-441D-421A-B109-C0F3775DFFFF} => pcalua.exe -a C:\Users\Sou\Downloads\setup(1).exe -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {6D9C57B2-BF5A-454B-8272-7D5BACD85A3E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-05-19] (Adobe Systems Incorporated)
Task: {71461526-0712-4FD7-B730-D108019DB9AC} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-04-14] (Microsoft Corporation)
Task: {74BC74CE-F721-4E96-B51B-7646ED982306} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {7EA995BB-7BA2-4A88-9A73-F88B1A1388F6} - System32\Tasks\{B6ACD82B-BDFF-4DB2-BFE1-B5BE63145368} => Firefox.exe hxxp://ui.skype.com/ui/0/6.3.0.105/de/abandoninstall?source=lightinstaller&amp;page=tsMain
Task: {93DDCFE6-2999-4A2E-8859-D02920429FCE} - System32\Tasks\{92826AB8-9A51-47E2-8C52-215CAA6F7C84} => C:\SIERRA\Pharao\Pharaoh.exe
Task: {9CA9AD65-E88A-4C78-BF5C-F46ED31849A3} - System32\Tasks\{D4B88FE1-355B-4DA9-AFCB-5DCFBE73AFFC} => pcalua.exe -a C:\Windows\IsUn0407.exe -c -f"C:\Program Files (x86)\Terminal Reality\Nocturne\Uninst.isu"
Task: {9ED28F51-FF41-4D01-8C5C-377EDBFB3B74} - System32\Tasks\{78073BE8-7BE8-4465-9451-268278934F88} => pcalua.exe -a "C:\Program Files (x86)\Steam\steam.exe" -c steam://uninstall/32370
Task: {ABC1B85D-91E7-4757-B6D3-3FE307E6A317} - System32\Tasks\{24E19B89-8DAE-4571-B071-5F96FE3F379E} => pcalua.exe -a "C:\Users\Sou\AppData\Local\TeamSpeak 3 Client\plugins\ts3overlay\InstallHook.exe" -d "C:\Users\Sou\AppData\Local\TeamSpeak 3 Client\plugins\ts3overlay\" -c 10000
Task: {B38F2214-78DC-4EC6-A209-8469960C8810} - System32\Tasks\{27505488-9591-4DEB-AD77-6FAB86859A9E} => E:\setup.exe
Task: {C39D79D6-8564-4046-8A7F-7218CC6D19B6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {CAA08CB7-AE07-4CE3-90D6-ABE2471D62D2} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-04-14] (Microsoft Corporation)
Task: {D7A9D204-563C-44BA-9C1C-8F3F135F9FCE} - System32\Tasks\{0DC7B5A8-54BF-4F35-8A97-E013D3A740FE} => pcalua.exe -a D:\install.exe -d D:\
Task: {DB0CE6FB-92FF-4ADB-AEE7-4F1FC3EA0148} - System32\Tasks\{64FDAA67-F5AF-448C-B3E3-BAF8ABE20EDF} => E:\setup.exe
Task: {DEB6A5EB-24C4-437E-B075-DB4F8C45C455} - System32\Tasks\{D7482B85-2F11-4E7A-8B9D-E11DB62E5BC5} => E:\setup.exe
Task: {E300C60A-F651-4997-8321-56BCFAFE72FF} - System32\Tasks\{46560813-3D7F-41D9-873F-309404868FEC} => pcalua.exe -a E:\setup.exe -d E:\
Task: {EEA51F51-095C-45A4-B160-62F5577DE0DE} - System32\Tasks\{6733E145-E0D2-4145-B493-FE16B47DE3DF} => E:\setup.exe
Task: {F99FCFD1-F448-4C2B-9D84-A13288289898} - System32\Tasks\{933EDA53-7931-4E2B-90E3-0C2695B1BF78} => E:\setup.exe
Task: {FFE67244-87D1-4673-A62E-B3D09A2A2921} - System32\Tasks\{7F5F0CA9-0922-4AF9-B7D5-5F5799ACCBDB} => C:\Program Files (x86)\Steam\steam\games\Thief2\t2x\t2x.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (Whitelisted) ==============

2013-04-14 03:05 - 2013-01-31 11:25 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-04-19 17:34 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-04-19 17:24 - 2013-11-21 22:57 - 20585888 ____N () C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe
2014-03-06 16:00 - 2014-03-06 16:00 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\kpcengine.2.3.dll
2014-06-03 12:30 - 2015-04-16 19:40 - 00776192 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2015-01-19 22:01 - 2015-04-23 04:16 - 04962816 _____ () C:\Program Files (x86)\Steam\v8.dll
2015-01-19 22:01 - 2015-04-23 04:16 - 01556992 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2015-01-19 22:01 - 2015-04-23 04:16 - 01187840 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2014-06-03 12:30 - 2015-05-15 03:58 - 02396352 _____ () C:\Program Files (x86)\Steam\video.dll
2014-09-15 12:14 - 2014-12-01 23:31 - 02396672 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2014-09-15 12:14 - 2014-12-01 23:31 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2014-09-15 12:14 - 2014-12-01 23:31 - 00479744 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2014-09-15 12:14 - 2014-12-01 23:31 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2014-09-15 12:14 - 2014-12-01 23:31 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2014-06-03 12:30 - 2015-05-15 03:57 - 00703168 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2014-06-03 12:30 - 2015-05-11 21:01 - 36302728 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2014-04-20 02:42 - 2014-12-03 12:50 - 00642344 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com\npvkplugin.dll
2014-04-20 02:42 - 2014-04-20 02:42 - 00468672 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com\npcontentblocker.dll
2014-04-20 02:42 - 2014-04-20 02:42 - 00347328 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com\nponlinebanking.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:0EC7A545
AlternateDataStreams: C:\ProgramData\TEMP:0ED1C542
AlternateDataStreams: C:\ProgramData\TEMP:206470A5
AlternateDataStreams: C:\ProgramData\TEMP:2B9555D8
AlternateDataStreams: C:\ProgramData\TEMP:2CB9631F
AlternateDataStreams: C:\ProgramData\TEMP:3B454A5C
AlternateDataStreams: C:\ProgramData\TEMP:5164A01F
AlternateDataStreams: C:\ProgramData\TEMP:51E66512
AlternateDataStreams: C:\ProgramData\TEMP:53BA2DF6
AlternateDataStreams: C:\ProgramData\TEMP:561B1D2B
AlternateDataStreams: C:\ProgramData\TEMP:6ECE93A8
AlternateDataStreams: C:\ProgramData\TEMP:92BD9737
AlternateDataStreams: C:\ProgramData\TEMP:C22674B6
AlternateDataStreams: C:\ProgramData\TEMP:C3E7F2E9
AlternateDataStreams: C:\ProgramData\TEMP:D7D0B4AF
AlternateDataStreams: C:\ProgramData\TEMP:E91ADC66
AlternateDataStreams: C:\ProgramData\TEMP:F6A0889A

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Sou\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER Error getting ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: BrYNSvc => 3
MSCONFIG\Services: IBUpdaterService => 2
MSCONFIG\Services: LiveUpdateSvc => 2
MSCONFIG\Services: McComponentHostService => 3
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: ServiceLayer => 3
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: Steam Client Service => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: AutoStartNPSAgent => C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe
MSCONFIG\startupreg: Bitrix24 Desktop => C:\Program Files (x86)\Bitrix24\BitrixDesktop.exe
MSCONFIG\startupreg: BrStsMon00 => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN
MSCONFIG\startupreg: ControlCenter3 => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe /autorun
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: KiesPDLR => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MSCONFIG\startupreg: KiesPreload => C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
MSCONFIG\startupreg: MP3 Skype recorder => C:\Users\Sou\AppData\Local\MP3 Skype recorder\MP3SkypeRecorder.exe
MSCONFIG\startupreg: Ocs_SM => C:\Users\Sou\AppData\Roaming\OCS\SM\SearchAnonymizer.exe
MSCONFIG\startupreg: RtHDVCpl => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
MSCONFIG\startupreg: SugarSync => "C:\Program Files (x86)\SugarSync\SugarSync.exe" -startInTray -usedelay=true

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{57B6A156-4C9F-4ED7-8F3C-6AB584D91F36}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{E0DD7006-AC64-4965-8BAB-62682E15E166}] => (Allow) LPort=2869
FirewallRules: [{AFB11902-DCAC-4F6F-ADC6-1CD8C3771842}] => (Allow) LPort=1900
FirewallRules: [{9E03866E-80C9-475E-844D-8CD8FDFCD28B}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{CC00810A-A139-4D72-9FD2-01CA978B717C}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [{EB7ADFB5-3990-4321-9AD9-FBB9FF9E1F98}] => (Allow) C:\Program Files (x86)\Samsung\Samsung New PC Studio\npsasvr.exe
FirewallRules: [{F80CD1C5-C91F-4E9A-A3C5-8766C62335BB}] => (Allow) C:\Program Files (x86)\Samsung\Samsung New PC Studio\npsasvr.exe
FirewallRules: [{58A24B7E-1E96-41C9-955D-CCB746C5A4B9}] => (Allow) C:\Program Files (x86)\Samsung\Samsung New PC Studio\npsvsvr.exe
FirewallRules: [{97E71F8D-5687-47CC-A7B5-F249A2A09BEB}] => (Allow) C:\Program Files (x86)\Samsung\Samsung New PC Studio\npsvsvr.exe
FirewallRules: [{76C7883D-B4A4-454D-8AAC-AB3E254489A2}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{2AE6B164-E71A-4FA2-AA71-9EAB4BF62F26}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{9AD1918D-E9C4-408F-9BB5-14BC15AACB64}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{328DEB8A-5AA0-4DF5-9257-7E9AF9481194}] => (Allow) LPort=49163
FirewallRules: [{B71B0690-D536-49BC-AE58-7CC4FDD36A13}] => (Allow) LPort=5000
FirewallRules: [TCP Query User{B9B4C25A-A182-4956-888C-075DEFF9BE54}C:\users\sou\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\sou\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{2F58205C-A3CA-4966-99E9-30F37A01C3E7}C:\users\sou\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\sou\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{1E99A4CC-4E87-445C-9FF4-39EFEF8EE751}C:\users\sou\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\sou\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{9EA6A9C0-1685-4306-9B6A-AF9E382E9D2F}C:\users\sou\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\sou\appdata\local\akamai\netsession_win.exe
FirewallRules: [{FE620203-FF0C-4077-9694-BF0162D7845B}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hposid01.exe
FirewallRules: [{A8A3402C-5C10-4CB3-8CDF-BB093FE967D7}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqkygrp.exe
FirewallRules: [{6BF53F32-87B5-47DB-B599-5AE39C0D72C9}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpfccopy.exe
FirewallRules: [{98B6698E-A843-46EB-A9BD-BD45B4CBD82B}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpoews01.exe
FirewallRules: [{861E55F8-079A-4754-9F2B-5F1B4369C5FD}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqnrs08.exe
FirewallRules: [{27509DAB-85EB-4D09-BC24-4E28AD89B561}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpiscnapp.exe
FirewallRules: [{3BB0165D-BC28-4EF1-BEC1-BF2B803D7DD6}] => (Allow) C:\Program Files (x86)\common files\hp\digital imaging\bin\hpqphotocrm.exe
FirewallRules: [{9740E097-676E-4DD4-8824-1785C32A02B3}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqsudi.exe
FirewallRules: [{3C96637D-FF9B-4194-A1AD-EC1D88B91655}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqpsapp.exe
FirewallRules: [{013AA513-064D-4645-8AAF-89D78BBBE716}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqpse.exe
FirewallRules: [{9B7A24C3-DAB7-4D04-9C58-1534F0D89561}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgplgtupl.exe
FirewallRules: [{1B62CE1F-8B48-47CA-BF2D-01ED104BCCA8}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
FirewallRules: [{B7EDF4AC-9C93-453C-BE54-1ED50C4D4942}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgm.exe
FirewallRules: [{AB362EB2-1B32-4785-9BCF-0F171CA0D64A}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgh.exe
FirewallRules: [{681888E3-8C27-4E8A-A0AA-AE38FA98D2D6}] => (Allow) C:\Program Files (x86)\HP\hp software update\hpwucli.exe
FirewallRules: [{397524FF-55EE-4DA2-A829-0F8A56CDD086}] => (Allow) C:\Program Files (x86)\HP\digital imaging\smart web printing\smartwebprintexe.exe
FirewallRules: [{292C25C3-53C1-490F-A29B-A700FCE49E1A}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{24D64C69-D374-40F5-AFC6-A017FCC080A1}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{64F0D0E4-575A-4AB1-B672-4A10D05661D3}] => (Allow) C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe
FirewallRules: [{A93A10F3-BF7C-4612-9DE2-E534CC095575}] => (Allow) C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe
FirewallRules: [{A60ABD44-E252-431D-9BEA-8FA5104EDD20}] => (Allow) C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
FirewallRules: [{D3D0C72E-168C-4E65-8CA7-E50391F078BB}] => (Allow) C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
FirewallRules: [{9C4098CD-2524-4B9D-B160-37E883D597D9}] => (Allow) C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
FirewallRules: [{C5A58FFE-62DE-4713-9FFD-E63ADF547F4E}] => (Allow) C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
FirewallRules: [{88874F3D-8EA0-45B2-8FA2-66B91EA8FDFC}] => (Allow) C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
FirewallRules: [{6A4C686D-D9B1-4CA2-80BC-796AEFD8B981}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{FF521E41-E5A0-46D7-9F0A-98DA63D8A741}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{8EF031C2-8538-407D-B25D-5766B565C2E8}] => (Allow) E:\o2CD.exe
FirewallRules: [{FE9A63D0-5163-4E25-9C38-959B5FB8EFD1}] => (Allow) E:\o2CD.exe
FirewallRules: [{13E67BC3-66AB-4A96-904F-BB4836863132}] => (Allow) D:\SteamLibrary\SteamApps\common\Thief\Binaries\Win64\Shipping-ThiefGame.exe
FirewallRules: [{FCF8F8E9-3535-4352-B147-C53B9163D3BD}] => (Allow) D:\SteamLibrary\SteamApps\common\Thief\Binaries\Win64\Shipping-ThiefGame.exe
FirewallRules: [{4428E408-9CA4-44B2-B455-751631432AFB}] => (Allow) C:\Program Files (x86)\Apowersoft\Apowersoft Free Screen Recorder\Apowersoft Free Screen Recorder.exe
FirewallRules: [{4B5BE3FA-9301-428D-B2AE-CDC43886A593}] => (Allow) C:\Program Files (x86)\Apowersoft\Apowersoft Free Screen Recorder\Apowersoft Free Screen Recorder.exe
FirewallRules: [{24DD42C7-E6BF-4D1D-94C6-E2E3712974FF}] => (Allow) C:\Program Files (x86)\Apowersoft\Streaming Audio Recorder\Streaming Audio Recorder.exe
FirewallRules: [{CC79A1EC-803B-47D5-A6AB-A7B0D2C89D03}] => (Allow) C:\Program Files (x86)\Apowersoft\Streaming Audio Recorder\Streaming Audio Recorder.exe
FirewallRules: [{07435DF4-DBD2-4C98-849E-FFC945E68372}] => (Allow) F:\GAMES\Steam\Steam.exe
FirewallRules: [{40ACFC60-8C27-4D7D-B43A-06BE179254B4}] => (Allow) F:\GAMES\Steam\Steam.exe
FirewallRules: [{5C4A0A31-58E9-4BB3-8F74-05AF7EFD24F7}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Two Worlds II\TwoWorlds2.exe
FirewallRules: [{DE6D7964-AB54-49E3-9E0E-978F02227D3A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Two Worlds II\TwoWorlds2.exe
FirewallRules: [{044BC29F-E699-4BC1-AF1E-AA92417252AC}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Two Worlds II\TwoWorlds2_DX10.exe
FirewallRules: [{CC8B4783-0980-4017-ABA4-DA12FB65C143}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Two Worlds II\TwoWorlds2_DX10.exe
FirewallRules: [{2603B0ED-63E3-4857-AE00-06BEE59B7965}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{83606705-1D45-4433-9CC3-2771CF54968B}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{BEDBA693-C664-46BC-B30E-693D312E42F5}] => (Allow) D:\SteamLibrary\SteamApps\common\Dishonored\Binaries\Win32\Dishonored.exe
FirewallRules: [{03FDC6F5-CE46-4214-873D-E795BC34949B}] => (Allow) D:\SteamLibrary\SteamApps\common\Dishonored\Binaries\Win32\Dishonored.exe
FirewallRules: [{07DA0024-79CD-4708-9FFE-88609670DA8A}] => (Allow) D:\SteamLibrary\SteamApps\common\Tomb Raider (IV) The Last Revelation\tomb4.exe
FirewallRules: [{1F169507-9C71-4229-A89B-763001E82294}] => (Allow) D:\SteamLibrary\SteamApps\common\Tomb Raider (IV) The Last Revelation\tomb4.exe
FirewallRules: [{6B9D7B87-9872-4603-9D06-7ACA28ED4498}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\AMD Driver Updater, Vista and 7, 64 bit\Setup.exe
FirewallRules: [{1A8CE064-52D4-4EC8-82D8-16A23593B436}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\AMD Driver Updater, Vista and 7, 64 bit\Setup.exe
FirewallRules: [{A17E0007-7442-4495-8E57-717D497A2DCD}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{0162D88B-3928-467E-896E-DAC3BD255A2E}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{02294D20-BAB9-4333-8FE2-FB5FC15638D3}] => (Allow) D:\Diablo III\Diablo III.exe
FirewallRules: [{20FE2F6E-EA16-4904-8C0E-D4EEDC3E4637}] => (Allow) D:\Diablo III\Diablo III.exe
FirewallRules: [{B5FF8E54-F676-4DF7-94F8-54E1A8FC69C2}] => (Allow) D:\SteamLibrary\SteamApps\common\Deus Ex\System\DeusEx.exe
FirewallRules: [{654B8886-AE6A-4075-8282-45757BDEE853}] => (Allow) D:\SteamLibrary\SteamApps\common\Deus Ex\System\DeusEx.exe
FirewallRules: [{9A6292AB-C627-4951-8322-121565FFDE5A}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{12F66E77-C780-489F-8C1A-0491801F5B3C}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{816748AD-B753-48B4-BFF8-3723A999AAB8}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3689\Agent.exe
FirewallRules: [{B6BC3C93-DA21-428D-A7B5-B6A5F33F71E9}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3689\Agent.exe
FirewallRules: [{803CEE24-8C53-4019-9902-4C6B1D1EA5B9}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe
FirewallRules: [{CED62E0B-127C-4FB9-9970-75B677717132}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe
FirewallRules: [{085876A4-C2BE-4D97-95DF-6C6E8FCDA895}] => (Allow) D:\SteamLibrary\SteamApps\common\Cry of Fear\CoFLaunchApp.exe
FirewallRules: [{3E606C11-46B2-4EB7-9065-017D2CAB8AAD}] => (Allow) D:\SteamLibrary\SteamApps\common\Cry of Fear\CoFLaunchApp.exe
FirewallRules: [{14A8BAC9-420E-445C-8081-E242FED3ECB0}] => (Allow) D:\SteamLibrary\SteamApps\common\Oblivion\OblivionLauncher.exe
FirewallRules: [{A4497EC6-989D-4040-82FD-704F27B898AE}] => (Allow) D:\SteamLibrary\SteamApps\common\Oblivion\OblivionLauncher.exe
FirewallRules: [{8DEEE2FA-3F89-4D30-B119-597E9D25F210}] => (Allow) D:\SteamLibrary\SteamApps\common\Deus Ex Invisible War\System\dx2.exe
FirewallRules: [{60FE9414-D2D3-4587-BC38-E6AAA33256AC}] => (Allow) D:\SteamLibrary\SteamApps\common\Deus Ex Invisible War\System\dx2.exe
FirewallRules: [{C76BCD4D-6931-4B12-917C-5F67547BD60E}] => (Allow) D:\SteamLibrary\SteamApps\common\Deus Ex Human Revolution Director's Cut\DXHRDC.exe
FirewallRules: [{12AC826F-79AA-4CA5-8FBF-E465D47B9CDA}] => (Allow) D:\SteamLibrary\SteamApps\common\Deus Ex Human Revolution Director's Cut\DXHRDC.exe
FirewallRules: [{383B1995-1116-49A6-AD94-6BA651F725D3}] => (Allow) C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe
FirewallRules: [{84B9A636-CB6F-4053-B44E-1B5C613450AE}] => (Allow) C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe
FirewallRules: [{8F87A52C-954F-47E8-BB12-33447FC8BB3E}] => (Allow) C:\Users\Sou\AppData\Local\Microsoft\OneDrive\OneDrive.exe
FirewallRules: [{D4EB42AB-8B64-4047-96FB-DCDBE08457CF}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe

==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (05/25/2015 06:32:54 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/25/2015 06:28:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 38.0.1.5611, Zeitstempel: 0x55541a90
Name des fehlerhaften Moduls: mozalloc.dll, Version: 38.0.1.5611, Zeitstempel: 0x55540a1e
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0x6b8
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (05/25/2015 06:28:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 38.0.1.5611, Zeitstempel: 0x55541a90
Name des fehlerhaften Moduls: mozalloc.dll, Version: 38.0.1.5611, Zeitstempel: 0x55540a1e
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0xa5c
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (05/25/2015 06:28:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 38.0.1.5611, Zeitstempel: 0x55541a90
Name des fehlerhaften Moduls: mozalloc.dll, Version: 38.0.1.5611, Zeitstempel: 0x55540a1e
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0x1584
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (05/25/2015 06:28:11 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm firefox.exe, Version 38.0.1.5611 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1260

Startzeit: 01d0970799d14b60

Endzeit: 65

Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Berichts-ID: 02efe071-02fb-11e5-80ea-6c626d72b2af

Error: (05/25/2015 06:28:11 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 38.0.1.5611, Zeitstempel: 0x55541a90
Name des fehlerhaften Moduls: mozalloc.dll, Version: 38.0.1.5611, Zeitstempel: 0x55540a1e
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0x394
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (05/25/2015 06:26:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 38.0.1.5611, Zeitstempel: 0x55541a90
Name des fehlerhaften Moduls: mozalloc.dll, Version: 38.0.1.5611, Zeitstempel: 0x55540a1e
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0xf6c
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (05/25/2015 06:26:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 38.0.1.5611, Zeitstempel: 0x55541a90
Name des fehlerhaften Moduls: mozalloc.dll, Version: 38.0.1.5611, Zeitstempel: 0x55540a1e
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0x1508
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (05/25/2015 06:26:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 38.0.1.5611, Zeitstempel: 0x55541a90
Name des fehlerhaften Moduls: mozalloc.dll, Version: 38.0.1.5611, Zeitstempel: 0x55540a1e
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0x1778
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (05/25/2015 06:26:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 38.0.1.5611, Zeitstempel: 0x55541a90
Name des fehlerhaften Moduls: mozalloc.dll, Version: 38.0.1.5611, Zeitstempel: 0x55540a1e
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0xee8
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3


System errors:
=============
Error: (05/25/2015 06:31:17 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎25.‎05.‎2015 um 18:29:34 unerwartet heruntergefahren.

Error: (05/25/2015 06:20:38 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎25.‎05.‎2015 um 18:18:59 unerwartet heruntergefahren.

Error: (05/25/2015 05:48:49 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.

Error: (05/22/2015 09:16:04 AM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "PAULCHEN",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{07606107-204C-4EAB-87F6-5D94912F6481}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (05/21/2015 00:36:26 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Application Virtualization Client" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (05/21/2015 00:36:25 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Software Protection" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (05/21/2015 00:36:24 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "NVIDIA Update Service Daemon" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (05/21/2015 00:36:24 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Steam Client Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (05/21/2015 00:36:24 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (05/21/2015 00:36:24 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Application Virtualization Service Agent" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Microsoft Office:
=========================
Error: (05/25/2015 06:32:54 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/25/2015 06:28:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe38.0.1.561155541a90mozalloc.dll38.0.1.561155540a1e8000000300001aa16b801d09707af30a370C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll11348690-02fb-11e5-80ea-6c626d72b2af

Error: (05/25/2015 06:28:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe38.0.1.561155541a90mozalloc.dll38.0.1.561155540a1e8000000300001aa1a5c01d097079d93aa90C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll0f505d40-02fb-11e5-80ea-6c626d72b2af

Error: (05/25/2015 06:28:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe38.0.1.561155541a90mozalloc.dll38.0.1.561155540a1e8000000300001aa1158401d097079de2b4f0C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll0bc98070-02fb-11e5-80ea-6c626d72b2af

Error: (05/25/2015 06:28:11 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: firefox.exe38.0.1.5611126001d0970799d14b6065C:\Program Files (x86)\Mozilla Firefox\firefox.exe02efe071-02fb-11e5-80ea-6c626d72b2af

Error: (05/25/2015 06:28:11 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe38.0.1.561155541a90mozalloc.dll38.0.1.561155540a1e8000000300001aa139401d097079d33b040C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll0849f6a0-02fb-11e5-80ea-6c626d72b2af

Error: (05/25/2015 06:26:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe38.0.1.561155541a90mozalloc.dll38.0.1.561155540a1e8000000300001aa1f6c01d097075357e9a0C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dlld05e51f0-02fa-11e5-80ea-6c626d72b2af

Error: (05/25/2015 06:26:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe38.0.1.561155541a90mozalloc.dll38.0.1.561155540a1e8000000300001aa1150801d097073b156ed0C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dllcef3ec80-02fa-11e5-80ea-6c626d72b2af

Error: (05/25/2015 06:26:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe38.0.1.561155541a90mozalloc.dll38.0.1.561155540a1e8000000300001aa1177801d0970739bc4770C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dllcb39f1c0-02fa-11e5-80ea-6c626d72b2af

Error: (05/25/2015 06:26:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe38.0.1.561155541a90mozalloc.dll38.0.1.561155540a1e8000000300001aa1ee801d097073a88fdb0C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dllc7986100-02fa-11e5-80ea-6c626d72b2af


CodeIntegrity Errors:
===================================
  Date: 2015-02-12 11:29:03.295
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-12 11:29:03.211
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-12 10:34:33.339
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-12 10:34:33.323
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-12 10:27:43.948
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-12 10:27:43.864
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-03 11:36:04.282
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-03 11:36:04.223
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-03 11:33:59.600
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-03 11:33:59.598
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: AMD Athlon(tm) II X2 220 Processor
Percentage of memory in use: 50%
Total physical RAM: 3967.24 MB
Available physical RAM: 1977.19 MB
Total Pagefile: 7932.69 MB
Available Pagefile: 5021.27 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:149.04 GB) (Free:20.23 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:149.05 GB) (Free:57.42 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 346D2824)
Partition 1: (Active) - (Size=149 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=149 GB) - (Type=07 NTFS)

==================== End of log ============================

Argiel · 26.05.2015, 07:23

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-05-25 21:19:41
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000065 WDC_WD32 rev.01.0 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\Sou\AppData\Local\Temp\ufloypow.sys


---- Kernel code sections - GMER 2.1 ----

.text  C:\Windows\System32\win32k.sys!W32pServiceTable                                                                                                                fffff96000144b00 7 bytes [C0, 8C, F3, FF, 01, 9E, F0]
.text  C:\Windows\System32\win32k.sys!W32pServiceTable + 8                                                                                                            fffff96000144b08 3 bytes [C0, 06, 02]

---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe[1640] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey                            0000000077dbfaf4 5 bytes JMP 0000000173cd2e10
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe[1640] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                     0000000077dc0084 5 bytes JMP 0000000173cd2dd0
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[776] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                0000000075981401 2 bytes JMP 777bb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[776] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                  0000000075981419 2 bytes JMP 777bb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[776] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                0000000075981431 2 bytes JMP 77838f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[776] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                000000007598144a 2 bytes CALL 7779489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                            * 9
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[776] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                   00000000759814dd 2 bytes JMP 77838822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[776] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                            00000000759814f5 2 bytes JMP 778389f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[776] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                   000000007598150d 2 bytes JMP 77838718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[776] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                            0000000075981525 2 bytes JMP 77838ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[776] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                  000000007598153d 2 bytes JMP 777afca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[776] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                       0000000075981555 2 bytes JMP 777b68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[776] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                000000007598156d 2 bytes JMP 77838fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[776] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                  0000000075981585 2 bytes JMP 77838b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[776] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                     000000007598159d 2 bytes JMP 778386dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[776] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                  00000000759815b5 2 bytes JMP 777afd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[776] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                00000000759815cd 2 bytes JMP 777bb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[776] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                            00000000759816b2 2 bytes JMP 77838ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[776] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                            00000000759816bd 2 bytes JMP 77838671 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[1380] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                 0000000075981401 2 bytes JMP 777bb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[1380] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                   0000000075981419 2 bytes JMP 777bb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[1380] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                 0000000075981431 2 bytes JMP 77838f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[1380] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                 000000007598144a 2 bytes CALL 7779489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                            * 9
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[1380] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                    00000000759814dd 2 bytes JMP 77838822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[1380] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                             00000000759814f5 2 bytes JMP 778389f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[1380] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                    000000007598150d 2 bytes JMP 77838718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[1380] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                             0000000075981525 2 bytes JMP 77838ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[1380] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                   000000007598153d 2 bytes JMP 777afca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[1380] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                        0000000075981555 2 bytes JMP 777b68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[1380] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                 000000007598156d 2 bytes JMP 77838fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[1380] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                   0000000075981585 2 bytes JMP 77838b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[1380] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                      000000007598159d 2 bytes JMP 778386dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[1380] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                   00000000759815b5 2 bytes JMP 777afd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[1380] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                 00000000759815cd 2 bytes JMP 777bb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[1380] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                             00000000759816b2 2 bytes JMP 77838ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[1380] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                             00000000759816bd 2 bytes JMP 77838671 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                        0000000075981401 2 bytes JMP 777bb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2336] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                          0000000075981419 2 bytes JMP 777bb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                        0000000075981431 2 bytes JMP 77838f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                        000000007598144a 2 bytes CALL 7779489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                            * 9
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2336] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                           00000000759814dd 2 bytes JMP 77838822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                    00000000759814f5 2 bytes JMP 778389f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2336] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                           000000007598150d 2 bytes JMP 77838718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                    0000000075981525 2 bytes JMP 77838ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                          000000007598153d 2 bytes JMP 777afca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2336] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                               0000000075981555 2 bytes JMP 777b68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                        000000007598156d 2 bytes JMP 77838fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                          0000000075981585 2 bytes JMP 77838b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2336] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                             000000007598159d 2 bytes JMP 778386dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                          00000000759815b5 2 bytes JMP 777afd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                        00000000759815cd 2 bytes JMP 777bb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                    00000000759816b2 2 bytes JMP 77838ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2336] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                    00000000759816bd 2 bytes JMP 77838671 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3152] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17           0000000075981401 2 bytes JMP 777bb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3152] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17             0000000075981419 2 bytes JMP 777bb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17           0000000075981431 2 bytes JMP 77838f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42           000000007598144a 2 bytes CALL 7779489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                            * 9
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3152] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17              00000000759814dd 2 bytes JMP 77838822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3152] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17       00000000759814f5 2 bytes JMP 778389f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3152] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17              000000007598150d 2 bytes JMP 77838718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3152] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17       0000000075981525 2 bytes JMP 77838ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3152] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17             000000007598153d 2 bytes JMP 777afca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3152] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                  0000000075981555 2 bytes JMP 777b68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3152] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17           000000007598156d 2 bytes JMP 77838fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3152] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17             0000000075981585 2 bytes JMP 77838b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3152] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                000000007598159d 2 bytes JMP 778386dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3152] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17             00000000759815b5 2 bytes JMP 777afd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3152] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17           00000000759815cd 2 bytes JMP 777bb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3152] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20       00000000759816b2 2 bytes JMP 77838ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3152] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31       00000000759816bd 2 bytes JMP 77838671 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[4020] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                             0000000075981401 2 bytes JMP 777bb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[4020] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                               0000000075981419 2 bytes JMP 777bb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[4020] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                             0000000075981431 2 bytes JMP 77838f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[4020] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                             000000007598144a 2 bytes CALL 7779489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                            * 9
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[4020] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                00000000759814dd 2 bytes JMP 77838822 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[4020] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                         00000000759814f5 2 bytes JMP 778389f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[4020] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                000000007598150d 2 bytes JMP 77838718 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[4020] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                         0000000075981525 2 bytes JMP 77838ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[4020] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                               000000007598153d 2 bytes JMP 777afca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[4020] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                    0000000075981555 2 bytes JMP 777b68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[4020] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                             000000007598156d 2 bytes JMP 77838fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[4020] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                               0000000075981585 2 bytes JMP 77838b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[4020] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                  000000007598159d 2 bytes JMP 778386dc C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[4020] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                               00000000759815b5 2 bytes JMP 777afd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[4020] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                             00000000759815cd 2 bytes JMP 777bb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[4020] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                         00000000759816b2 2 bytes JMP 77838ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[4020] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                         00000000759816bd 2 bytes JMP 77838671 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3144] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17                                                           0000000075981401 2 bytes JMP 777bb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3144] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17                                                             0000000075981419 2 bytes JMP 777bb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3144] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17                                                           0000000075981431 2 bytes JMP 77838f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3144] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42                                                           000000007598144a 2 bytes CALL 7779489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                            * 9
.text  C:\Program Files (x86)\Steam\Steam.exe[3144] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17                                                              00000000759814dd 2 bytes JMP 77838822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3144] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17                                                       00000000759814f5 2 bytes JMP 778389f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3144] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17                                                              000000007598150d 2 bytes JMP 77838718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3144] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17                                                       0000000075981525 2 bytes JMP 77838ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3144] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17                                                             000000007598153d 2 bytes JMP 777afca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3144] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17                                                                  0000000075981555 2 bytes JMP 777b68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3144] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17                                                           000000007598156d 2 bytes JMP 77838fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3144] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17                                                             0000000075981585 2 bytes JMP 77838b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3144] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17                                                                000000007598159d 2 bytes JMP 778386dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3144] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17                                                             00000000759815b5 2 bytes JMP 777afd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3144] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17                                                           00000000759815cd 2 bytes JMP 777bb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3144] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20                                                       00000000759816b2 2 bytes JMP 77838ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\Steam.exe[3144] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31                                                       00000000759816bd 2 bytes JMP 77838671 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[3564] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                             0000000075981401 2 bytes JMP 777bb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[3564] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                               0000000075981419 2 bytes JMP 777bb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[3564] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                             0000000075981431 2 bytes JMP 77838f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[3564] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                             000000007598144a 2 bytes CALL 7779489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                            * 9
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[3564] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                00000000759814dd 2 bytes JMP 77838822 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[3564] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                         00000000759814f5 2 bytes JMP 778389f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[3564] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                000000007598150d 2 bytes JMP 77838718 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[3564] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                         0000000075981525 2 bytes JMP 77838ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[3564] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                               000000007598153d 2 bytes JMP 777afca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[3564] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                    0000000075981555 2 bytes JMP 777b68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[3564] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                             000000007598156d 2 bytes JMP 77838fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[3564] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                               0000000075981585 2 bytes JMP 77838b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[3564] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                  000000007598159d 2 bytes JMP 778386dc C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[3564] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                               00000000759815b5 2 bytes JMP 777afd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[3564] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                             00000000759815cd 2 bytes JMP 777bb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[3564] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                         00000000759816b2 2 bytes JMP 77838ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe[3564] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                         00000000759816bd 2 bytes JMP 77838671 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                       0000000075981401 2 bytes JMP 777bb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe[2232] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                         0000000075981419 2 bytes JMP 777bb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                       0000000075981431 2 bytes JMP 77838f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                       000000007598144a 2 bytes CALL 7779489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                            * 9
.text  C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe[2232] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                          00000000759814dd 2 bytes JMP 77838822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                   00000000759814f5 2 bytes JMP 778389f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe[2232] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                          000000007598150d 2 bytes JMP 77838718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                   0000000075981525 2 bytes JMP 77838ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                         000000007598153d 2 bytes JMP 777afca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe[2232] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                              0000000075981555 2 bytes JMP 777b68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                       000000007598156d 2 bytes JMP 77838fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                         0000000075981585 2 bytes JMP 77838b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe[2232] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                            000000007598159d 2 bytes JMP 778386dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                         00000000759815b5 2 bytes JMP 777afd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                       00000000759815cd 2 bytes JMP 777bb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                   00000000759816b2 2 bytes JMP 77838ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                   00000000759816bd 2 bytes JMP 77838671 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                             0000000077bc13ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                             0000000077bc1544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                     0000000077bc18ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                    0000000077bc1ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                       0000000077bc1d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                           0000000077bc1e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                         0000000077bc1f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                             0000000077bc2238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531                                  0000000077bc2683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                         0000000077bc26a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                       0000000077bc26c2 8 bytes {JMP 0x10}
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                        0000000077bc271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184                       0000000077bc2788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 4
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                               0000000077bc2b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375                               0000000077bc2b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 2
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                           0000000077bc306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                                           0000000077bc31f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                          0000000077bc388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                          0000000077bc38e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                              0000000077bc39b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                       0000000077bc3f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                                      0000000077bc4001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                                      0000000077bc4075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 3
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                                          0000000077bc41b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                                          0000000077bc41f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                                                    0000000077bc4461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                                       0000000077bc464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                                       0000000077bc4713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                                                    0000000077bc4807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                                                    0000000077bc4926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 2
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256                                   0000000077bc4a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                                      0000000077bc4aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501                                   0000000077bc4ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                                              0000000077bc4ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                                        0000000077bc4fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                                          0000000077bc5193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                                          0000000077bc5f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                                          0000000077bc6016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!atol + 194                                                             0000000077bc610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76                                                             0000000077bc62fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45                               0000000077bc633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4                                   0000000077bc6354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92                                  0000000077bc63ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                                            0000000077bc6b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                 0000000077c0dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                               0000000077c0de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                     0000000077c0de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                   0000000077c0df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                       0000000077c0e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                       0000000077c0e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                     0000000077c0e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                     0000000077c0f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                   00000000742f13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                   00000000742f146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                00000000742f16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                             00000000742f19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                             00000000742f19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                       00000000742f1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                              0000000075981401 2 bytes JMP 777bb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                0000000075981419 2 bytes JMP 777bb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                              0000000075981431 2 bytes JMP 77838f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                              000000007598144a 2 bytes CALL 7779489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                            * 9
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                 00000000759814dd 2 bytes JMP 77838822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                          00000000759814f5 2 bytes JMP 778389f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                 000000007598150d 2 bytes JMP 77838718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                          0000000075981525 2 bytes JMP 77838ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                000000007598153d 2 bytes JMP 777afca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                     0000000075981555 2 bytes JMP 777b68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                              000000007598156d 2 bytes JMP 77838fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                0000000075981585 2 bytes JMP 77838b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                   000000007598159d 2 bytes JMP 778386dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                00000000759815b5 2 bytes JMP 777afd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                              00000000759815cd 2 bytes JMP 777bb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                          00000000759816b2 2 bytes JMP 77838ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                          00000000759816bd 2 bytes JMP 77838671 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                      0000000077bc13ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                      0000000077bc1544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                              0000000077bc18ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                             0000000077bc1ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                0000000077bc1d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                    0000000077bc1e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                  0000000077bc1f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                      0000000077bc2238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531                           0000000077bc2683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                  0000000077bc26a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                0000000077bc26c2 8 bytes {JMP 0x10}
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                 0000000077bc271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184                0000000077bc2788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 4
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                        0000000077bc2b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375                        0000000077bc2b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 2
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                    0000000077bc306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                                    0000000077bc31f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                   0000000077bc388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                   0000000077bc38e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                       0000000077bc39b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                0000000077bc3f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                               0000000077bc4001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                               0000000077bc4075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 3
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                                   0000000077bc41b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                                   0000000077bc41f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                                             0000000077bc4461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                                0000000077bc464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                                0000000077bc4713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                                             0000000077bc4807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                                             0000000077bc4926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 2
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256                            0000000077bc4a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                               0000000077bc4aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501                            0000000077bc4ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                                       0000000077bc4ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                                 0000000077bc4fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                                   0000000077bc5193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                                   0000000077bc5f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                                   0000000077bc6016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!atol + 194                                                      0000000077bc610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76                                                      0000000077bc62fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45                        0000000077bc633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4                            0000000077bc6354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92                           0000000077bc63ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                                     0000000077bc6b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                          0000000077c0dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                        0000000077c0de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                              0000000077c0de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                            0000000077c0df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                0000000077c0e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                0000000077c0e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                              0000000077c0e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                              0000000077c0f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                            00000000742f13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                            00000000742f146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                         00000000742f16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                      00000000742f19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                      00000000742f19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                00000000742f1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17                                       0000000075981401 2 bytes JMP 777bb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17                                         0000000075981419 2 bytes JMP 777bb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17                                       0000000075981431 2 bytes JMP 77838f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42                                       000000007598144a 2 bytes CALL 7779489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                            * 9
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17                                          00000000759814dd 2 bytes JMP 77838822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17                                   00000000759814f5 2 bytes JMP 778389f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17                                          000000007598150d 2 bytes JMP 77838718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17                                   0000000075981525 2 bytes JMP 77838ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17                                         000000007598153d 2 bytes JMP 777afca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17                                              0000000075981555 2 bytes JMP 777b68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17                                       000000007598156d 2 bytes JMP 77838fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17                                         0000000075981585 2 bytes JMP 77838b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17                                            000000007598159d 2 bytes JMP 778386dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17                                         00000000759815b5 2 bytes JMP 777afd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17                                       00000000759815cd 2 bytes JMP 777bb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20                                   00000000759816b2 2 bytes JMP 77838ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Steam\SteamService.exe[2628] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31                                   00000000759816bd 2 bytes JMP 77838671 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                        0000000077bc13ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                        0000000077bc1544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                0000000077bc18ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                               0000000077bc1ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                  0000000077bc1d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                      0000000077bc1e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                    0000000077bc1f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                        0000000077bc2238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531             0000000077bc2683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                    0000000077bc26a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                  0000000077bc26c2 8 bytes {JMP 0x10}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79   0000000077bc271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184  0000000077bc2788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 4
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299          0000000077bc2b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375          0000000077bc2b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 2
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                      0000000077bc306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                      0000000077bc31f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                     0000000077bc388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                     0000000077bc38e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197         0000000077bc39b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                  0000000077bc3f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                 0000000077bc4001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                 0000000077bc4075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 3
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                     0000000077bc41b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                     0000000077bc41f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                               0000000077bc4461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                  0000000077bc464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                  0000000077bc4713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                               0000000077bc4807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                               0000000077bc4926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 2
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256              0000000077bc4a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                 0000000077bc4aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501              0000000077bc4ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                         0000000077bc4ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                   0000000077bc4fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                     0000000077bc5193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                     0000000077bc5f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                     0000000077bc6016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!atol + 194                                        0000000077bc610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76                                        0000000077bc62fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45          0000000077bc633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4              0000000077bc6354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92             0000000077bc63ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                       0000000077bc6b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                            0000000077c0dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                          0000000077c0de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                0000000077c0de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                              0000000077c0df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                  0000000077c0e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                  0000000077c0e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                0000000077c0e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                0000000077c0f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312              00000000742f13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471              00000000742f146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                           00000000742f16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                        00000000742f19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                        00000000742f19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                  00000000742f1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                         0000000075981401 2 bytes JMP 777bb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                           0000000075981419 2 bytes JMP 777bb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                         0000000075981431 2 bytes JMP 77838f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                         000000007598144a 2 bytes CALL 7779489d C:\Windows\syswow64\kernel32.dll
.text  ...

(ACHTUNG: ENDE TEIL 1)

Argiel · 26.05.2015, 07:24

Code:

ATTFilter

                                        * 9
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                            00000000759814dd 2 bytes JMP 77838822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                     00000000759814f5 2 bytes JMP 778389f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                            000000007598150d 2 bytes JMP 77838718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                     0000000075981525 2 bytes JMP 77838ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                           000000007598153d 2 bytes JMP 777afca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                0000000075981555 2 bytes JMP 777b68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                         000000007598156d 2 bytes JMP 77838fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                           0000000075981585 2 bytes JMP 77838b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                              000000007598159d 2 bytes JMP 778386dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                           00000000759815b5 2 bytes JMP 777afd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                         00000000759815cd 2 bytes JMP 777bb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                     00000000759816b2 2 bytes JMP 77838ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4172] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                     00000000759816bd 2 bytes JMP 77838671 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                              0000000077bc13ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                              0000000077bc1544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                      0000000077bc18ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                     0000000077bc1ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                        0000000077bc1d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                            0000000077bc1e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                          0000000077bc1f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                              0000000077bc2238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531                                   0000000077bc2683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                          0000000077bc26a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                        0000000077bc26c2 8 bytes {JMP 0x10}
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                         0000000077bc271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184                        0000000077bc2788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 4
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                0000000077bc2b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375                                0000000077bc2b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 2
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                            0000000077bc306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                                            0000000077bc31f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                           0000000077bc388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                           0000000077bc38e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                               0000000077bc39b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                        0000000077bc3f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                                       0000000077bc4001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                                       0000000077bc4075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 3
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                                           0000000077bc41b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                                           0000000077bc41f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                                                     0000000077bc4461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                                        0000000077bc464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                                        0000000077bc4713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                                                     0000000077bc4807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                                                     0000000077bc4926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 2
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256                                    0000000077bc4a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                                       0000000077bc4aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501                                    0000000077bc4ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                                               0000000077bc4ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                                         0000000077bc4fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                                           0000000077bc5193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                                           0000000077bc5f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                                           0000000077bc6016 8 bytes [70, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!atol + 194                                                              0000000077bc610e 8 bytes [60, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76                                                              0000000077bc62fc 8 bytes [50, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45                                0000000077bc633d 8 bytes [40, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4                                    0000000077bc6354 8 bytes [30, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92                                   0000000077bc63ac 8 bytes [20, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                                             0000000077bc6b76 8 bytes [10, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                  0000000077c0dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                0000000077c0de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                      0000000077c0de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                    0000000077c0df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                        0000000077c0e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                        0000000077c0e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                      0000000077c0e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                      0000000077c0f0e0 8 bytes JMP 3f3f3f3f
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                    00000000742f13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                    00000000742f146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                 00000000742f16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                              00000000742f19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                              00000000742f19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\firefox.exe[5196] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                        00000000742f1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                     0000000077bc13ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                     0000000077bc1544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                             0000000077bc18ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                            0000000077bc1ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                               0000000077bc1d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                   0000000077bc1e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                 0000000077bc1f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                     0000000077bc2238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531                          0000000077bc2683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                 0000000077bc26a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                               0000000077bc26c2 8 bytes {JMP 0x10}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                0000000077bc271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184               0000000077bc2788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 4
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                       0000000077bc2b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375                       0000000077bc2b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 2
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                   0000000077bc306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                                   0000000077bc31f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                  0000000077bc388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                  0000000077bc38e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                      0000000077bc39b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                               0000000077bc3f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                              0000000077bc4001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                              0000000077bc4075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 3
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                                  0000000077bc41b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                                  0000000077bc41f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                                            0000000077bc4461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                               0000000077bc464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                               0000000077bc4713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                                            0000000077bc4807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                                            0000000077bc4926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 2
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256                           0000000077bc4a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                              0000000077bc4aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501                           0000000077bc4ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                                      0000000077bc4ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                                0000000077bc4fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                                  0000000077bc5193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                                  0000000077bc5f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                                  0000000077bc6016 8 bytes [70, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!atol + 194                                                     0000000077bc610e 8 bytes [60, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76                                                     0000000077bc62fc 8 bytes [50, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45                       0000000077bc633d 8 bytes [40, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4                           0000000077bc6354 8 bytes [30, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92                          0000000077bc63ac 8 bytes [20, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                                    0000000077bc6b76 8 bytes [10, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                         0000000077c0dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                       0000000077c0de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                             0000000077c0de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                           0000000077c0df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                               0000000077c0e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                               0000000077c0e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                             0000000077c0e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                             0000000077c0f0e0 8 bytes JMP 3f3f3f3f
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                           00000000742f13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                           00000000742f146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                        00000000742f16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                     00000000742f19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                     00000000742f19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[5508] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                               00000000742f1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                     0000000077bc13ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                     0000000077bc1544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                             0000000077bc18ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                            0000000077bc1ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                               0000000077bc1d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                   0000000077bc1e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                 0000000077bc1f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                     0000000077bc2238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531                          0000000077bc2683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                 0000000077bc26a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                               0000000077bc26c2 8 bytes {JMP 0x10}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                0000000077bc271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184               0000000077bc2788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 4
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                       0000000077bc2b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375                       0000000077bc2b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 2
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                   0000000077bc306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                                   0000000077bc31f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                  0000000077bc388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                  0000000077bc38e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                      0000000077bc39b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                               0000000077bc3f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                              0000000077bc4001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                              0000000077bc4075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 3
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                                  0000000077bc41b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                                  0000000077bc41f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                                            0000000077bc4461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                               0000000077bc464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                               0000000077bc4713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                                            0000000077bc4807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                                            0000000077bc4926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 2
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256                           0000000077bc4a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                              0000000077bc4aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501                           0000000077bc4ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                                      0000000077bc4ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                                0000000077bc4fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                                  0000000077bc5193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                                  0000000077bc5f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                                  0000000077bc6016 8 bytes [70, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!atol + 194                                                     0000000077bc610e 8 bytes [60, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76                                                     0000000077bc62fc 8 bytes [50, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45                       0000000077bc633d 8 bytes [40, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4                           0000000077bc6354 8 bytes [30, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92                          0000000077bc63ac 8 bytes [20, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                                    0000000077bc6b76 8 bytes [10, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                         0000000077c0dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                       0000000077c0de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                             0000000077c0de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                           0000000077c0df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                               0000000077c0e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                               0000000077c0e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                             0000000077c0e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                             0000000077c0f0e0 8 bytes JMP 3f3f3f3f
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                           00000000742f13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                           00000000742f146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                        00000000742f16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                     00000000742f19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                     00000000742f19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[4624] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                               00000000742f1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                     0000000077bc13ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                     0000000077bc1544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                             0000000077bc18ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                            0000000077bc1ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                               0000000077bc1d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                   0000000077bc1e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                 0000000077bc1f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                     0000000077bc2238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531                          0000000077bc2683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                 0000000077bc26a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                               0000000077bc26c2 8 bytes {JMP 0x10}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                0000000077bc271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184               0000000077bc2788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 4
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                       0000000077bc2b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375                       0000000077bc2b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 2
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                   0000000077bc306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                                   0000000077bc31f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                  0000000077bc388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                  0000000077bc38e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                      0000000077bc39b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                               0000000077bc3f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                              0000000077bc4001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                              0000000077bc4075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 3
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                                  0000000077bc41b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                                  0000000077bc41f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                                            0000000077bc4461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                               0000000077bc464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                               0000000077bc4713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                                            0000000077bc4807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                                            0000000077bc4926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 2
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256                           0000000077bc4a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                              0000000077bc4aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501                           0000000077bc4ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                                      0000000077bc4ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                                0000000077bc4fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                                  0000000077bc5193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                                  0000000077bc5f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                                  0000000077bc6016 8 bytes [70, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!atol + 194                                                     0000000077bc610e 8 bytes [60, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76                                                     0000000077bc62fc 8 bytes [50, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45                       0000000077bc633d 8 bytes [40, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4                           0000000077bc6354 8 bytes [30, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92                          0000000077bc63ac 8 bytes [20, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                                    0000000077bc6b76 8 bytes [10, 6C, F8, FF, 00, 00, 00, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                         0000000077c0dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                       0000000077c0de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                             0000000077c0de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                           0000000077c0df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                               0000000077c0e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                               0000000077c0e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                             0000000077c0e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                             0000000077c0f0e0 8 bytes JMP 3f3f3f3f
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                           00000000742f13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                           00000000742f146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                        00000000742f16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                     00000000742f19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                     00000000742f19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[3964] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                               00000000742f1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                 0000000077bc13ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                                 0000000077bc1544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                         0000000077bc18ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                        0000000077bc1ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                           0000000077bc1d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                               0000000077bc1e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                             0000000077bc1f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                                 0000000077bc2238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531                                                      0000000077bc2683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                             0000000077bc26a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                           0000000077bc26c2 8 bytes {JMP 0x10}
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                            0000000077bc271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184                                           0000000077bc2788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 4
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                   0000000077bc2b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375                                                   0000000077bc2b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 2
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                               0000000077bc306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                                                               0000000077bc31f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                              0000000077bc388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                              0000000077bc38e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                  0000000077bc39b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                           0000000077bc3f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                                                          0000000077bc4001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                                                          0000000077bc4075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 3
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                                                              0000000077bc41b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                                                              0000000077bc41f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                                                                        0000000077bc4461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                                                           0000000077bc464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                                                           0000000077bc4713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                                                                        0000000077bc4807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                                                                        0000000077bc4926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 2
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256                                                       0000000077bc4a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                                                          0000000077bc4aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501                                                       0000000077bc4ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                                                                  0000000077bc4ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                                                            0000000077bc4fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                                                              0000000077bc5193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                                                              0000000077bc5f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                                                              0000000077bc6016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!atol + 194                                                                                 0000000077bc610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76                                                                                 0000000077bc62fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45                                                   0000000077bc633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4                                                       0000000077bc6354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92                                                      0000000077bc63ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                                                                0000000077bc6b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                     0000000077c0dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                   0000000077c0de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                         0000000077c0de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                       0000000077c0df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                           0000000077c0e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                           0000000077c0e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                         0000000077c0e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                         0000000077c0f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                       00000000742f13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                       00000000742f146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                    00000000742f16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                 00000000742f19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                 00000000742f19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Windows\SysWOW64\DllHost.exe[6200] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                           00000000742f1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                0000000077bc13ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                0000000077bc1544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                        0000000077bc18ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                       0000000077bc1ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                          0000000077bc1d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31                                                              0000000077bc1e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                            0000000077bc1f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                0000000077bc2238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 531                                     0000000077bc2683 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                            0000000077bc26a0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                          0000000077bc26c2 8 bytes {JMP 0x10}
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                           0000000077bc271f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184                          0000000077bc2788 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 4
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                  0000000077bc2b4b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375                                  0000000077bc2b97 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 2
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                              0000000077bc306b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                                              0000000077bc31f8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                             0000000077bc388e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                             0000000077bc38e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                 0000000077bc39b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                          0000000077bc3f50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                                         0000000077bc4001 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                                         0000000077bc4075 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 3
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                                             0000000077bc41b6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                                             0000000077bc41f4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                                                       0000000077bc4461 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                                          0000000077bc464c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                                          0000000077bc4713 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                                                       0000000077bc4807 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                                                       0000000077bc4926 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  ...                                                                                                                                                            * 2
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256                                      0000000077bc4a50 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                                         0000000077bc4aa3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501                                      0000000077bc4ca5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                                                 0000000077bc4ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                                           0000000077bc4fa7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                                             0000000077bc5193 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                                             0000000077bc5f46 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                                             0000000077bc6016 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!atol + 194                                                                0000000077bc610e 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76                                                                0000000077bc62fc 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45                                  0000000077bc633d 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4                                      0000000077bc6354 8 bytes [30, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92                                     0000000077bc63ac 8 bytes [20, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                                               0000000077bc6b76 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                    0000000077c0dc80 8 bytes {JMP QWORD [RIP-0x47949]}
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                  0000000077c0de00 8 bytes {JMP QWORD [RIP-0x47ab2]}
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                        0000000077c0de30 8 bytes {JMP QWORD [RIP-0x47e20]}
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                      0000000077c0df50 8 bytes {JMP QWORD [RIP-0x47c5a]}
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                          0000000077c0e000 8 bytes {JMP QWORD [RIP-0x47ef8]}
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                          0000000077c0e630 8 bytes {JMP QWORD [RIP-0x47102]}
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                        0000000077c0e880 8 bytes {JMP QWORD [RIP-0x47d10]}
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                        0000000077c0f0e0 8 bytes {JMP QWORD [RIP-0x48d3a]}
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                      00000000742f13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                      00000000742f146b 8 bytes {JMP 0xffffffffffffffb0}
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                   00000000742f16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                00000000742f19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                00000000742f19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text  C:\Users\Sou\Desktop\Anti-Malware\Gmer-19357.exe[5308] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                          00000000742f1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

---- EOF - GMER 2.1 ----

schrauber · 26.05.2015, 20:08

hi,

Downloade dir bitte

Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Argiel · 26.05.2015, 21:17

Hallo schrauber,
vielen Dank für Deine Hilfe. mbar ergab Folgendes:

Code:

ATTFilter

Malwarebytes Anti-Rootkit BETA 1.09.1.1004
www.malwarebytes.org

Database version:
  main:    v2015.05.26.06
  rootkit: v2015.05.24.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17801
Sou :: SOU-ARLT [administrator]

26.05.2015 21:13:40
mbar-log-2015-05-26 (21-13-40).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 433660
Time elapsed: 41 minute(s), 55 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\Sou\Desktop\Verknüpfungen\OMODS\Deus_Ex_Human_Revolution_-_Directors_Cut_V2.0.66.0_Trainer_plus7\Deus Ex Human Revolution - Directors Cut V2.0.66.0 Trainer +7 MrAntiFun.EXE (Hacktool.CheatEngine) -> Delete on reboot. [86b80a8ec9c17eb8015caf8d8c747c84]

Physical Sectors Detected: 0
(No malicious items detected)

(end)

Das andere läuft grade noch durch

Code:

ATTFilter

22:10:30.0906 0x08b0  TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
22:10:33.0978 0x08b0  ============================================================
22:10:33.0978 0x08b0  Current date / time: 2015/05/26 22:10:33.0978
22:10:33.0978 0x08b0  SystemInfo:
22:10:33.0978 0x08b0  
22:10:33.0978 0x08b0  OS Version: 6.1.7601 ServicePack: 1.0
22:10:33.0978 0x08b0  Product type: Workstation
22:10:33.0978 0x08b0  ComputerName: SOU-ARLT
22:10:33.0978 0x08b0  UserName: Sou
22:10:33.0978 0x08b0  Windows directory: C:\Windows
22:10:33.0978 0x08b0  System windows directory: C:\Windows
22:10:33.0978 0x08b0  Running under WOW64
22:10:33.0978 0x08b0  Processor architecture: Intel x64
22:10:33.0978 0x08b0  Number of processors: 2
22:10:33.0978 0x08b0  Page size: 0x1000
22:10:33.0978 0x08b0  Boot type: Normal boot
22:10:33.0978 0x08b0  ============================================================
22:10:40.0462 0x08b0  KLMD registered as C:\Windows\system32\drivers\46592731.sys
22:10:41.0966 0x08b0  System UUID: {114FCB01-0CDF-F0C8-F4C2-540EBEF494D3}
22:10:43.0776 0x08b0  Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 ( 298.09 Gb ), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
22:10:43.0786 0x08b0  ============================================================
22:10:43.0786 0x08b0  \Device\Harddisk0\DR0:
22:10:43.0816 0x08b0  MBR partitions:
22:10:43.0816 0x08b0  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x12A16000
22:10:43.0816 0x08b0  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x12A16800, BlocksNum 0x12A17800
22:10:43.0816 0x08b0  ============================================================
22:10:44.0046 0x08b0  C: <-> \Device\Harddisk0\DR0\Partition1
22:10:44.0306 0x08b0  D: <-> \Device\Harddisk0\DR0\Partition2
22:10:44.0306 0x08b0  ============================================================
22:10:44.0306 0x08b0  Initialize success
22:10:44.0306 0x08b0  ============================================================
22:11:18.0711 0x0f9c  ============================================================
22:11:18.0711 0x0f9c  Scan started
22:11:18.0711 0x0f9c  Mode: Manual; SigCheck; TDLFS; 
22:11:18.0711 0x0f9c  ============================================================
22:11:18.0711 0x0f9c  KSN ping started
22:11:21.0192 0x0f9c  KSN ping finished: true
22:11:38.0918 0x0f9c  ================ Scan system memory ========================
22:11:38.0918 0x0f9c  System memory - ok
22:11:38.0918 0x0f9c  ================ Scan services =============================
22:11:43.0398 0x0f9c  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
22:11:44.0298 0x0f9c  1394ohci - ok
22:11:44.0498 0x0f9c  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
22:11:44.0538 0x0f9c  ACPI - ok
22:11:44.0608 0x0f9c  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys
22:11:45.0788 0x0f9c  AcpiPmi - ok
22:11:46.0408 0x0f9c  [ FC5B75CA6A1DA31EDD4F8D53F5540B98, CDC445F2790ADFC4C5568C40D4DA8BB95CD71991665B38AEC3D84571C99C3520 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
22:11:46.0568 0x0f9c  AdobeARMservice - ok
22:11:49.0898 0x0f9c  [ 00CC35F515079F5F94FABC3AC5C7D363, 7CE8B1715009602059DEDD6CBCA9C18EF079EDA344E7809813D6C0A395622B82 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
22:11:49.0918 0x0f9c  AdobeFlashPlayerUpdateSvc - ok
22:11:50.0098 0x0f9c  [ 132190688D8E51D61F88A150D7DF9FB4, 76E1C520CCA50509AD60B7257099855674E4BB8E63CE933A0B53C7A8DCAE55C9 ] adp3132         C:\Windows\system32\drivers\adp3132.sys
22:11:50.0138 0x0f9c  adp3132 - ok
22:11:50.0328 0x0f9c  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx         C:\Windows\system32\drivers\adp94xx.sys
22:11:50.0348 0x0f9c  adp94xx - ok
22:11:50.0418 0x0f9c  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci         C:\Windows\system32\drivers\adpahci.sys
22:11:50.0468 0x0f9c  adpahci - ok
22:11:50.0598 0x0f9c  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320         C:\Windows\system32\drivers\adpu320.sys
22:11:50.0628 0x0f9c  adpu320 - ok
22:11:50.0758 0x0f9c  [ 83BFCCAC53795E8A5055A93672D0C46C, B2B03473D950A5BA9DE59D81E7B14C1FAFF17B2A4D8A5808588F5CC21D63B291 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
22:11:50.0958 0x0f9c  AeLookupSvc - ok
22:11:51.0158 0x0f9c  [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD             C:\Windows\system32\drivers\afd.sys
22:11:51.0358 0x0f9c  AFD - ok
22:11:51.0438 0x0f9c  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\Windows\system32\drivers\agp440.sys
22:11:51.0468 0x0f9c  agp440 - ok
22:11:51.0608 0x0f9c  [ AF53917D9741A84627FA689EA622558A, 44DA81150854B126A460C2A1E6FB5427C9E3A77B81FFBC5BC7FD222BE4D6A313 ] ahcix64s        C:\Windows\system32\drivers\ahcix64s.sys
22:11:51.0648 0x0f9c  ahcix64s - ok
22:11:51.0768 0x0f9c  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG             C:\Windows\System32\alg.exe
22:11:52.0118 0x0f9c  ALG - ok
22:11:52.0228 0x0f9c  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\Windows\system32\drivers\aliide.sys
22:11:52.0258 0x0f9c  aliide - ok
22:11:52.0318 0x0f9c  [ 5EBA5E837D6635AEA999BAE47E186C6F, F185EAB171B8298ABCAE61B8265F57580AE8A2F424D5BD51E56C6AB482D26FCE ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
22:11:52.0798 0x0f9c  AMD External Events Utility - ok
22:11:52.0888 0x0f9c  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\Windows\system32\drivers\amdide.sys
22:11:52.0938 0x0f9c  amdide - ok
22:11:53.0008 0x0f9c  [ D52A2E98C5EEFF88CED28793B6B04D84, 0EAB3B6659D3D0D572CAE79ACE12F8018BA5AB8AC1DDE10555D18A6E3D267AC5 ] amdide64        C:\Windows\system32\drivers\amdide64.sys
22:11:53.0038 0x0f9c  amdide64 - ok
22:11:53.0098 0x0f9c  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8           C:\Windows\system32\drivers\amdk8.sys
22:11:53.0148 0x0f9c  AmdK8 - ok
22:11:54.0806 0x0f9c  [ DCC8177244FE79C61C4E73C65E63922A, 1AF6FB52FD7499F1E1C0530C9A75BDC62A2D2EEBC138496DA28E941454708E1E ] amdkmdag        C:\Windows\system32\DRIVERS\atikmdag.sys
22:11:55.0234 0x0f9c  amdkmdag - ok
22:11:55.0384 0x0f9c  [ 7FE67D107329DC2CF89136A8E19BCEB7, B8048BF857E52CB5CACC1503F6246F12302DC43FA7B814EE169D2EAD3294C8D1 ] amdkmdap        C:\Windows\system32\DRIVERS\atikmpag.sys
22:11:55.0474 0x0f9c  amdkmdap - ok
22:11:55.0554 0x0f9c  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
22:11:55.0624 0x0f9c  AmdPPM - ok
22:11:55.0704 0x0f9c  [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
22:11:55.0744 0x0f9c  amdsata - ok
22:11:55.0846 0x0f9c  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
22:11:55.0866 0x0f9c  amdsbs - ok
22:11:55.0916 0x0f9c  [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata         C:\Windows\system32\drivers\amdxata.sys
22:11:55.0946 0x0f9c  amdxata - ok
22:11:56.0046 0x0f9c  [ 80A508D0C7A21BC13C01D4C671541203, EC9B465B92C87522ED216CECB099AD91833C224E55969E1B3A033EE8A4A4F68D ] amd_sata        C:\Windows\system32\drivers\amd_sata.sys
22:11:56.0076 0x0f9c  amd_sata - ok
22:11:56.0096 0x0f9c  [ 2BE940F3A632A1A301B22B096BF221F1, 6D828467CE0D76223C29BDB77E62422014A5842A1FE90E79C179DFDCA8AFDF71 ] amd_xata        C:\Windows\system32\drivers\amd_xata.sys
22:11:56.0126 0x0f9c  amd_xata - ok
22:11:56.0206 0x0f9c  [ C65A3C67630A67A97AD26C21173BA61E, 9C66AF6FC15FEA0B0352540C037AD87B4113CE401C10B6A35DE98901E74152DC ] Apowersoft_AudioDevice C:\Windows\system32\drivers\Apowersoft_AudioDevice.sys
22:11:56.0236 0x0f9c  Apowersoft_AudioDevice - ok
22:11:56.0346 0x0f9c  [ 90C53BD47979FB8814F465A08B885102, 5EDFC1909FC1FF9133A534DFCC5408CF3A777AC41FB21FAD375436E3D86C02EC ] AppID           C:\Windows\system32\drivers\appid.sys
22:11:56.0686 0x0f9c  AppID - ok
22:11:56.0726 0x0f9c  [ 72D4757510FDA69D729169C00AFC211E, FB9686D0D94EE7C19A3994C29E8331A6EC3020B2980B2CC75F72F3AB25512C15 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
22:11:56.0816 0x0f9c  AppIDSvc - ok
22:11:56.0886 0x0f9c  [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo         C:\Windows\System32\appinfo.dll
22:11:57.0056 0x0f9c  Appinfo - ok
22:11:57.0146 0x0f9c  [ D73AAD4946051D074909FDFD34D94C7B, F959C1E63EAFF88C9F15F71607DF1B604981AA75AE3C0D33F6EBBFB452F634CD ] arc             C:\Windows\system32\drivers\arc.sys
22:11:57.0196 0x0f9c  arc - ok
22:11:57.0236 0x0f9c  [ 46E8C3EB03224A1E55C6F0C100A9D2CC, 7CF7A92942117D45345C5324E1ADA5AD77EECF36C4AA63339E676D72D7624F01 ] arcsas          C:\Windows\system32\drivers\arcsas.sys
22:11:57.0256 0x0f9c  arcsas - ok
22:11:57.0296 0x0f9c  [ E3B9C89D2ED4A538AB2FC6EC76FA2B17, E812C6573B0F794BC1B4F2963841440CE521F1C00BB1C50530134C9A5EFC7135 ] asmthub3        C:\Windows\system32\drivers\asmthub3.sys
22:11:57.0506 0x0f9c  asmthub3 - ok
22:11:57.0636 0x0f9c  [ 88CE83BE5176020BE39194A6369AF2C2, A80FB26A91D29F9EC27D49F6502934C60BBF7B7EB78271F5C326B9F250EB9F6E ] asmtxhci        C:\Windows\system32\drivers\asmtxhci.sys
22:11:57.0786 0x0f9c  asmtxhci - ok
22:11:58.0536 0x0f9c  [ F15AB80B867D3332D5DDFB0A05B9CE04, 5A16577106246AB5DCC04FE0A0B00B7C5702557B75F958721E4C00383AB99809 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
22:11:58.0646 0x0f9c  aspnet_state - ok
22:11:58.0896 0x0f9c  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
22:12:00.0778 0x0f9c  AsyncMac - ok
22:12:00.0828 0x0f9c  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi           C:\Windows\system32\drivers\atapi.sys
22:12:00.0858 0x0f9c  atapi - ok
22:12:00.0958 0x0f9c  [ B4BDE3F758A34658A37DFED3D9783CD8, BC9F6B9BDD639457894DE0F596AB3A655374E078796762FE5E8E5414F0481208 ] atksgt          C:\Windows\system32\DRIVERS\atksgt.sys
22:12:00.0978 0x0f9c  atksgt - ok
22:12:01.0088 0x0f9c  [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
22:12:01.0148 0x0f9c  AudioEndpointBuilder - ok
22:12:01.0178 0x0f9c  [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioSrv        C:\Windows\System32\Audiosrv.dll
22:12:01.0208 0x0f9c  AudioSrv - ok
22:12:01.0700 0x0f9c  [ 058734C95991F6BEBF3D3075B8776234, D94A0E5893723C0F30D8215F001039AE9D903BF8EC3782D9583DEFD9B304B0CA ] AVP15.0.0       C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
22:12:01.0730 0x0f9c  AVP15.0.0 - ok
22:12:01.0900 0x0f9c  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\Windows\System32\AxInstSV.dll
22:12:02.0490 0x0f9c  AxInstSV - ok
22:12:02.0620 0x0f9c  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv         C:\Windows\system32\drivers\bxvbda.sys
22:12:02.0710 0x0f9c  b06bdrv - ok
22:12:02.0780 0x0f9c  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
22:12:02.0830 0x0f9c  b57nd60a - ok
22:12:02.0950 0x0f9c  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\Windows\System32\bdesvc.dll
22:12:03.0120 0x0f9c  BDESVC - ok
22:12:03.0190 0x0f9c  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\Windows\system32\drivers\Beep.sys
22:12:03.0260 0x0f9c  Beep - ok
22:12:03.0550 0x0f9c  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE             C:\Windows\System32\bfe.dll
22:12:03.0712 0x0f9c  BFE - ok
22:12:03.0972 0x0f9c  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\Windows\System32\qmgr.dll
22:12:06.0462 0x0f9c  BITS - ok
22:12:06.0572 0x0f9c  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
22:12:06.0632 0x0f9c  blbdrive - ok
22:12:06.0692 0x0f9c  [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
22:12:06.0862 0x0f9c  bowser - ok
22:12:06.0872 0x0f9c  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\Windows\system32\drivers\BrFiltLo.sys
22:12:06.0992 0x0f9c  BrFiltLo - ok
22:12:07.0032 0x0f9c  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\Windows\system32\drivers\BrFiltUp.sys
22:12:07.0092 0x0f9c  BrFiltUp - ok
22:12:07.0132 0x0f9c  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser         C:\Windows\System32\browser.dll
22:12:07.0262 0x0f9c  Browser - ok
22:12:07.0392 0x0f9c  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
22:12:07.0562 0x0f9c  Brserid - ok
22:12:07.0582 0x0f9c  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
22:12:07.0642 0x0f9c  BrSerWdm - ok
22:12:07.0682 0x0f9c  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
22:12:07.0742 0x0f9c  BrUsbMdm - ok
22:12:07.0762 0x0f9c  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
22:12:07.0812 0x0f9c  BrUsbSer - ok
22:12:08.0032 0x0f9c  [ EA7E57F87D6FEE5FD6C5F813C04E8CD2, 1EB84F4DEE3034FAFBEA2A3F84EECE036E803872DA94D54E958E9F2F09519E88 ] BrYNSvc         C:\Program Files (x86)\Browny02\BrYNSvc.exe
22:12:08.0102 0x0f9c  BrYNSvc - detected UnsignedFile.Multi.Generic ( 1 )
22:12:10.0642 0x0f9c  Detect skipped due to KSN trusted
22:12:10.0642 0x0f9c  BrYNSvc - ok
22:12:10.0732 0x0f9c  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
22:12:10.0792 0x0f9c  BTHMODEM - ok
22:12:10.0922 0x0f9c  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv         C:\Windows\system32\bthserv.dll
22:12:10.0982 0x0f9c  bthserv - ok
22:12:11.0022 0x0f9c  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
22:12:11.0072 0x0f9c  cdfs - ok
22:12:11.0132 0x0f9c  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys
22:12:11.0162 0x0f9c  cdrom - ok
22:12:11.0232 0x0f9c  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc     C:\Windows\System32\certprop.dll
22:12:11.0292 0x0f9c  CertPropSvc - ok
22:12:11.0332 0x0f9c  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\Windows\system32\drivers\circlass.sys
22:12:11.0372 0x0f9c  circlass - ok
22:12:11.0502 0x0f9c  [ 404B7DF9CA4D1CB675045AF220FF3285, 91FFADE2ABE5C48849E63134D5FFD20671FE0D1720F7D486F904391B3D142C96 ] CLFS            C:\Windows\system32\CLFS.sys
22:12:11.0542 0x0f9c  CLFS - ok
22:12:13.0494 0x0f9c  [ 42C5B8010D47EF3F4BAE6D1B427E80F4, 721C24522C43D50081EA01FD521D68EB365B91561CCF2E7AD1F091FBD61E67FB ] ClickToRunSvc   C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
22:12:13.0950 0x0f9c  ClickToRunSvc - ok
22:12:14.0326 0x0f9c  [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
22:12:14.0357 0x0f9c  clr_optimization_v2.0.50727_32 - ok
22:12:14.0434 0x0f9c  [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
22:12:14.0528 0x0f9c  clr_optimization_v2.0.50727_64 - ok
22:12:14.0678 0x0f9c  [ F5AB4D2E36625F355E81539239765107, 48E6AD65EEFD6C54F938F5753EF58377CDA77ADBB41CD8635F0040D61EFB92A4 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
22:12:15.0278 0x0f9c  clr_optimization_v4.0.30319_32 - ok
22:12:15.0308 0x0f9c  [ 9ACBE5EC13C2CC95833BFB7636CA8B1A, 6224DA9FB335D2A8374C60B8DEA539DD3A0E43230DB888B137B71A56EC57D6AF ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
22:12:15.0928 0x0f9c  clr_optimization_v4.0.30319_64 - ok
22:12:16.0078 0x0f9c  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\Windows\system32\drivers\CmBatt.sys
22:12:16.0178 0x0f9c  CmBatt - ok
22:12:16.0228 0x0f9c  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
22:12:16.0258 0x0f9c  cmdide - ok
22:12:16.0328 0x0f9c  [ 27667A788130A7F7A5858DE27572E6D7, 5501D80BCCB7A811ECCED3828DFD0A5D948BBED8504E9BCC4A3BFB840DD41CBC ] CNG             C:\Windows\system32\Drivers\cng.sys
22:12:16.0378 0x0f9c  CNG - ok
22:12:16.0428 0x0f9c  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\Windows\system32\drivers\compbatt.sys
22:12:16.0438 0x0f9c  Compbatt - ok
22:12:16.0459 0x0f9c  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\Windows\system32\DRIVERS\CompositeBus.sys
22:12:16.0490 0x0f9c  CompositeBus - ok
22:12:16.0510 0x0f9c  COMSysApp - ok
22:12:16.0530 0x0f9c  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk         C:\Windows\system32\drivers\crcdisk.sys
22:12:16.0550 0x0f9c  crcdisk - ok
22:12:16.0640 0x0f9c  [ 1CD76A83B9E8E9A5A3519B39E28354D9, F9931743B99820FFBFB13136DFFD92F86802D543F9D8478648CDC554FB38899D ] CryptSvc        C:\Windows\system32\cryptsvc.dll
22:12:16.0770 0x0f9c  CryptSvc - ok
22:12:16.0950 0x0f9c  [ B4D1D62A09F09CB2DFD55628350CDAFB, 7DD3CE77D88B5AFAC4B6187F4CA6D50B7BD3398207163B2A1E4C76467801FF28 ] cvhsvc          C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
22:12:16.0980 0x0f9c  cvhsvc - ok
22:12:17.0060 0x0f9c  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch      C:\Windows\system32\rpcss.dll
22:12:17.0130 0x0f9c  DcomLaunch - ok
22:12:17.0202 0x0f9c  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc       C:\Windows\System32\defragsvc.dll
22:12:17.0352 0x0f9c  defragsvc - ok
22:12:17.0382 0x0f9c  [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
22:12:17.0472 0x0f9c  DfsC - ok
22:12:17.0592 0x0f9c  [ E428DFFA96FAD07D8CA3C9082563A225, F3D2E94A9FF2CF68CC99A8B42B8DEA5E57D46000D1845DC0908224493480C79F ] dg_ssudbus      C:\Windows\system32\DRIVERS\ssudbus.sys
22:12:17.0612 0x0f9c  dg_ssudbus - ok
22:12:17.0672 0x0f9c  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\Windows\system32\dhcpcore.dll
22:12:17.0782 0x0f9c  Dhcp - ok
22:12:18.0222 0x0f9c  [ EA8A3E8C674B03CB4AFA1D344DBD7BC1, 564D9370AE4D12973647997684B9637B2A5A7480F66B87018F789CE4E43C8191 ] DiagTrack       C:\Windows\system32\diagtrack.dll
22:12:18.0362 0x0f9c  DiagTrack - ok
22:12:18.0412 0x0f9c  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\Windows\system32\drivers\discache.sys
22:12:18.0482 0x0f9c  discache - ok
22:12:18.0562 0x0f9c  [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk            C:\Windows\system32\drivers\disk.sys
22:12:18.0602 0x0f9c  Disk - ok
22:12:18.0672 0x0f9c  [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
22:12:18.0782 0x0f9c  Dnscache - ok
22:12:18.0832 0x0f9c  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc         C:\Windows\System32\dot3svc.dll
22:12:18.0892 0x0f9c  dot3svc - ok
22:12:19.0002 0x0f9c  [ B42ED0320C6E41102FDE0005154849BB, 4DB872E23AD049C3C9FDC0759FC58BFA60DA91B18BC82B611BFA300D26DDFC7A ] dot4            C:\Windows\system32\DRIVERS\Dot4.sys
22:12:19.0042 0x0f9c  dot4 - ok
22:12:19.0062 0x0f9c  [ E9F5969233C5D89F3C35E3A66A52A361, C4BD35795C78FB11E6022372CB25DEB570730EFDAD3DC1584368235FF622638C ] Dot4Print       C:\Windows\system32\DRIVERS\Dot4Prt.sys
22:12:19.0092 0x0f9c  Dot4Print - ok
22:12:19.0152 0x0f9c  [ FD05A02B0370BC3000F402E543CA5814, 089B1113E640F495F470E8F57060B89546270481B309DC8ED3C3D13A849076A3 ] dot4usb         C:\Windows\system32\DRIVERS\dot4usb.sys
22:12:19.0192 0x0f9c  dot4usb - ok
22:12:19.0252 0x0f9c  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS             C:\Windows\system32\dps.dll
22:12:19.0312 0x0f9c  DPS - ok
22:12:19.0362 0x0f9c  [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
22:12:19.0432 0x0f9c  drmkaud - ok
22:12:19.0542 0x0f9c  [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
22:12:19.0582 0x0f9c  DXGKrnl - ok
22:12:19.0652 0x0f9c  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost         C:\Windows\System32\eapsvc.dll
22:12:19.0712 0x0f9c  EapHost - ok
22:12:20.0263 0x0f9c  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv           C:\Windows\system32\drivers\evbda.sys
22:12:20.0406 0x0f9c  ebdrv - ok
22:12:20.0456 0x0f9c  [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] EFS             C:\Windows\System32\lsass.exe
22:12:20.0546 0x0f9c  EFS - ok
22:12:20.0766 0x0f9c  [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
22:12:20.0896 0x0f9c  ehRecvr - ok
22:12:20.0936 0x0f9c  [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched         C:\Windows\ehome\ehsched.exe
22:12:20.0986 0x0f9c  ehSched - ok
22:12:21.0086 0x0f9c  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor         C:\Windows\system32\drivers\elxstor.sys
22:12:21.0116 0x0f9c  elxstor - ok
22:12:21.0126 0x0f9c  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
22:12:21.0166 0x0f9c  ErrDev - ok
22:12:21.0446 0x0f9c  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem     C:\Windows\system32\es.dll
22:12:21.0556 0x0f9c  EventSystem - ok
22:12:21.0586 0x0f9c  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat           C:\Windows\system32\drivers\exfat.sys
22:12:21.0706 0x0f9c  exfat - ok
22:12:21.0746 0x0f9c  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
22:12:21.0806 0x0f9c  fastfat - ok
22:12:21.0906 0x0f9c  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax             C:\Windows\system32\fxssvc.exe
22:12:22.0006 0x0f9c  Fax - ok
22:12:22.0036 0x0f9c  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc             C:\Windows\system32\drivers\fdc.sys
22:12:22.0066 0x0f9c  fdc - ok
22:12:22.0086 0x0f9c  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost         C:\Windows\system32\fdPHost.dll
22:12:22.0146 0x0f9c  fdPHost - ok
22:12:22.0166 0x0f9c  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\Windows\system32\fdrespub.dll
22:12:22.0206 0x0f9c  FDResPub - ok
22:12:22.0226 0x0f9c  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
22:12:22.0246 0x0f9c  FileInfo - ok
22:12:22.0276 0x0f9c  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
22:12:22.0336 0x0f9c  Filetrace - ok
22:12:22.0346 0x0f9c  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\Windows\system32\drivers\flpydisk.sys
22:12:22.0386 0x0f9c  flpydisk - ok
22:12:22.0446 0x0f9c  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
22:12:22.0466 0x0f9c  FltMgr - ok
22:12:22.0486 0x0f9c  [ E35F19855192D025DA41E8DFA318206A, 9A588B139830B8767DEE86977ADD23DF480C1BB84F1EDE7301513C92B8FD130C ] FLxHCIc         C:\Windows\system32\drivers\FLxHCIc.sys
22:12:22.0536 0x0f9c  FLxHCIc - ok
22:12:22.0556 0x0f9c  [ BBBD5D42D8CB3AD0F43F7BC4DB92EB5E, B8FE7D78C6CDBEFF4F66DC2627A5E4025930E5021EF4D10A4A0932F7B72A6573 ] FLxHCIh         C:\Windows\system32\drivers\FLxHCIh.sys
22:12:22.0626 0x0f9c  FLxHCIh - ok
22:12:22.0976 0x0f9c  [ E612E86FA15EA1EF9A52433A2743C447, 8A66164541D2EE2334B6DE3995C31138EA85E3A06BC7FD901E60D345E4E1E8A8 ] FontCache       C:\Windows\system32\FntCache.dll
22:12:23.0216 0x0f9c  FontCache - ok
22:12:23.0276 0x0f9c  [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
22:12:23.0296 0x0f9c  FontCache3.0.0.0 - ok
22:12:23.0306 0x0f9c  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
22:12:23.0316 0x0f9c  FsDepends - ok
22:12:23.0396 0x0f9c  [ 07DA62C960DDCCC2D35836AEAB4FC578, C67A29E928AF59BF7FB573FAC2176C5598F595406AA90DDB4A364A15BC89A6C4 ] fssfltr         C:\Windows\system32\DRIVERS\fssfltr.sys
22:12:23.0416 0x0f9c  fssfltr - ok
22:12:23.0656 0x0f9c  [ 28DDEEEC44E988657B732CF404D504CB, 47F83018E5449CDCED3DD447991788EBAAC92C418D4513FBA9408C45E9AB8E7E ] fsssvc          C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
22:12:23.0716 0x0f9c  fsssvc - ok
22:12:24.0018 0x0f9c  [ DDEE99DC54EFA20BD5A442CD733C4462, 941D6C5D91F6419198F1A53BF7D33AA2D9118CEAC028B6ED8E5308751810B9B5 ] FsUsbExDisk     C:\Windows\SysWOW64\FsUsbExDisk.SYS
22:12:24.0033 0x0f9c  FsUsbExDisk - detected UnsignedFile.Multi.Generic ( 1 )
22:12:26.0560 0x0f9c  Detect skipped due to KSN trusted
22:12:26.0570 0x0f9c  FsUsbExDisk - ok
22:12:26.0630 0x0f9c  [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
22:12:26.0640 0x0f9c  Fs_Rec - ok
22:12:26.0740 0x0f9c  [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
22:12:26.0770 0x0f9c  fvevol - ok
22:12:26.0990 0x0f9c  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
22:12:27.0030 0x0f9c  gagp30kx - ok
22:12:27.0160 0x0f9c  [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc           C:\Windows\System32\gpsvc.dll
22:12:27.0220 0x0f9c  gpsvc - ok
22:12:27.0270 0x0f9c  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
22:12:27.0370 0x0f9c  hcw85cir - ok
22:12:27.0430 0x0f9c  [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
22:12:27.0540 0x0f9c  HdAudAddService - ok
22:12:27.0620 0x0f9c  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
22:12:27.0660 0x0f9c  HDAudBus - ok
22:12:27.0670 0x0f9c  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt         C:\Windows\system32\drivers\HidBatt.sys
22:12:27.0720 0x0f9c  HidBatt - ok
22:12:27.0740 0x0f9c  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\Windows\system32\drivers\hidbth.sys
22:12:27.0780 0x0f9c  HidBth - ok
22:12:27.0790 0x0f9c  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr           C:\Windows\system32\drivers\hidir.sys
22:12:27.0840 0x0f9c  HidIr - ok
22:12:27.0870 0x0f9c  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv         C:\Windows\system32\hidserv.dll
22:12:27.0930 0x0f9c  hidserv - ok
22:12:28.0030 0x0f9c  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
22:12:28.0130 0x0f9c  HidUsb - ok
22:12:28.0180 0x0f9c  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\Windows\system32\kmsvc.dll
22:12:28.0230 0x0f9c  hkmsvc - ok
22:12:28.0260 0x0f9c  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
22:12:28.0350 0x0f9c  HomeGroupListener - ok
22:12:28.0390 0x0f9c  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
22:12:28.0430 0x0f9c  HomeGroupProvider - ok
22:12:28.0660 0x0f9c  [ 1DAE5C46D42B02A6D5862E1482EFB390, 90B14E0A8376AE51872D89C141E88AE144B742805F94B4F7948E295322C78B9D ] hpqcxs08        C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll
22:12:28.0730 0x0f9c  hpqcxs08 - detected UnsignedFile.Multi.Generic ( 1 )
22:12:31.0220 0x0f9c  Detect skipped due to KSN trusted
22:12:31.0220 0x0f9c  hpqcxs08 - ok
22:12:31.0280 0x0f9c  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
22:12:31.0290 0x0f9c  HpSAMD - ok
22:12:31.0400 0x0f9c  [ F37882F128EFACEFE353E0BAE2766909, 2F9D21613500F092DFC0DB879180B549EE615D9B07408A5CC1A7F84663B2F47A ] HPSLPSVC        C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL
22:12:31.0470 0x0f9c  HPSLPSVC - detected UnsignedFile.Multi.Generic ( 1 )
22:12:34.0000 0x0f9c  Detect skipped due to KSN trusted
22:12:34.0000 0x0f9c  HPSLPSVC - ok
22:12:34.0120 0x0f9c  [ F61634BEC53F73702A10DE69F6DCAF57, BBA7344CF3AB96A46D1A6F1D50F2758EA8D097FE558C38B4EF45C8C334AF96E1 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
22:12:34.0250 0x0f9c  HTTP - ok
22:12:34.0280 0x0f9c  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
22:12:34.0300 0x0f9c  hwpolicy - ok
22:12:34.0310 0x0f9c  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
22:12:34.0340 0x0f9c  i8042prt - ok
22:12:34.0400 0x0f9c  [ D7921D5A870B11CC1ADAB198A519D50A, 5DF99EB5D5504E9D9EB21658E8B4A58DEE2AD143A1875DB7F9B7BF4877FCB57F ] iaStor          C:\Windows\system32\drivers\iaStor.sys
22:12:34.0430 0x0f9c  iaStor - ok
22:12:34.0552 0x0f9c  [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
22:12:34.0582 0x0f9c  iaStorV - ok
22:12:34.0722 0x0f9c  [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
22:12:34.0762 0x0f9c  idsvc - ok
22:12:34.0832 0x0f9c  IEEtwCollectorService - ok
22:12:34.0882 0x0f9c  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp           C:\Windows\system32\drivers\iirsp.sys
22:12:34.0902 0x0f9c  iirsp - ok
22:12:35.0032 0x0f9c  [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT          C:\Windows\System32\ikeext.dll
22:12:35.0082 0x0f9c  IKEEXT - ok
22:12:35.0152 0x0f9c  [ DD587A55390ED2295BCE6D36AD567DA9, AEB7DCB8EF89BEE8D9649A05FC482B1E4E3F44243D57A2577C862EB69166C48E ] Impcd           C:\Windows\system32\drivers\Impcd.sys
22:12:35.0222 0x0f9c  Impcd - ok
22:12:35.0512 0x0f9c  [ 9297BC7FB61F58670EE176DD18F4DD92, 92B165ACDBF2AC602BBA63FD62D62ABE2E39FA398709C41601D314D36B552D74 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
22:12:35.0632 0x0f9c  IntcAzAudAddService - ok
22:12:35.0672 0x0f9c  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\Windows\system32\drivers\intelide.sys
22:12:35.0692 0x0f9c  intelide - ok
22:12:35.0762 0x0f9c  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\Windows\system32\drivers\intelppm.sys
22:12:35.0802 0x0f9c  intelppm - ok
22:12:35.0832 0x0f9c  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
22:12:35.0902 0x0f9c  IPBusEnum - ok
22:12:35.0922 0x0f9c  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
22:12:35.0972 0x0f9c  IpFilterDriver - ok
22:12:36.0082 0x0f9c  [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
22:12:36.0232 0x0f9c  iphlpsvc - ok
22:12:36.0282 0x0f9c  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys
22:12:36.0312 0x0f9c  IPMIDRV - ok
22:12:36.0342 0x0f9c  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
22:12:36.0442 0x0f9c  IPNAT - ok
22:12:36.0512 0x0f9c  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\Windows\system32\drivers\irenum.sys
22:12:36.0562 0x0f9c  IRENUM - ok
22:12:36.0582 0x0f9c  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
22:12:36.0602 0x0f9c  isapnp - ok
22:12:36.0662 0x0f9c  [ AC45D94185CF67267D06BF2F45E9E31E, 737EA8220EC265AF3C61611C2B005D2825E6ABBB19DB934ECA0BCBB88CB42EA9 ] ISASerial       C:\Windows\system32\drivers\ISASerial.sys
22:12:36.0712 0x0f9c  ISASerial - ok
22:12:36.0772 0x0f9c  [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
22:12:36.0792 0x0f9c  iScsiPrt - ok
22:12:36.0842 0x0f9c  [ 50DE7DD7EDB1B512B13666588AEFBF6F, 47FFBA2CA40718614C5A43C2D231B46C22E96221B9EFD8BD4C2D355412811DF4 ] JRAID           C:\Windows\system32\drivers\jraid.sys
22:12:36.0862 0x0f9c  JRAID - ok
22:12:36.0902 0x0f9c  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
22:12:36.0922 0x0f9c  kbdclass - ok
22:12:36.0962 0x0f9c  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
22:12:37.0012 0x0f9c  kbdhid - ok
22:12:37.0022 0x0f9c  [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] KeyIso          C:\Windows\system32\lsass.exe
22:12:37.0042 0x0f9c  KeyIso - ok
22:12:37.0202 0x0f9c  [ 67D1F7FA1DF9502DE12027D7C7782863, BCB92C1C11A7576FD7E91B160CBC3FB5A0C31FE028305021D7C10EC40C4D5013 ] KL1             C:\Windows\system32\DRIVERS\kl1.sys
22:12:37.0232 0x0f9c  KL1 - ok
22:12:37.0442 0x0f9c  [ 2A88EFE87B5F23BA47FF7AF2DEAEB98F, 8D702249A462F8A233B594DF1B7C843A2C90F8A0D4FA7358B096020FF2C3E115 ] klflt           C:\Windows\system32\DRIVERS\klflt.sys
22:12:37.0512 0x0f9c  klflt - ok
22:12:37.0702 0x0f9c  [ 7ED6B6805B3E1BC9DC2418F1C5C920B4, 7FF90C32C95E2141A3D3B378DDE8035C8C6EB811C087A9AF7D20C735CB74142A ] klhk            C:\Windows\system32\DRIVERS\klhk.sys
22:12:37.0782 0x0f9c  klhk - ok
22:12:38.0112 0x0f9c  [ CD81447AB991F3E7F1FCF59CEA07D1E0, FB6EDDCA703952FAD7FEE24A75DB5C957C45C83B17D4871D1009CA24450CB040 ] KLIF            C:\Windows\system32\DRIVERS\klif.sys
22:12:38.0162 0x0f9c  KLIF - ok
22:12:38.0282 0x0f9c  [ FEAD1F401CBE9383A642877A6EA1398F, 0529A96D406DAB1C0715692441BDBC1C05123EB62005B806A8EFF5B0B6DCD5DB ] KLIM6           C:\Windows\system32\DRIVERS\klim6.sys
22:12:38.0312 0x0f9c  KLIM6 - ok
22:12:38.0422 0x0f9c  [ 3FAE739F2AFEA18BCBB9C5E7DC6E889D, 5990C074BCB8E2172AE0A2AC0A31E6636B3C3EF0A5BB1F593E62D22D53FC5BF0 ] klkbdflt        C:\Windows\system32\DRIVERS\klkbdflt.sys
22:12:38.0442 0x0f9c  klkbdflt - ok
22:12:38.0542 0x0f9c  [ 72CF64FBF38CD681FA7F37176047E967, BE5683C119DCEF7E678EE477D6CADF873E32D42372A253B7E86B8C335DF28E1C ] klmouflt        C:\Windows\system32\DRIVERS\klmouflt.sys
22:12:38.0622 0x0f9c  klmouflt - ok
22:12:38.0742 0x0f9c  [ 8C0EC95AD65A0DE3D6C040591D02BF02, 272FB83752B73684FA7BDBE256FAFD56138E4755AAEFED9E7EF8F0E3D0ACFAF2 ] klpd            C:\Windows\system32\DRIVERS\klpd.sys
22:12:38.0762 0x0f9c  klpd - ok
22:12:38.0832 0x0f9c  [ 5BB9E329FE48904108BBBF9C73073920, 402E88770C12C9E8D809D2A8C130CA9E5083CDB1D50C38D4CE2F0D24F2D32E82 ] kltdi           C:\Windows\system32\DRIVERS\kltdi.sys
22:12:38.0852 0x0f9c  kltdi - ok
22:12:38.0922 0x0f9c  [ D043624FE4AE0A4894A785097C02EF09, 2259CA9BAC73902D291176AB689C101CACE115A8A1C2E6824CC66E928FA27552 ] kneps           C:\Windows\system32\DRIVERS\kneps.sys
22:12:38.0942 0x0f9c  kneps - ok
22:12:39.0012 0x0f9c  [ F7DFAE6040AC910B7C64EE208A34157D, AEF1100F12391692D9DB78519D843A90C97E199A80DDC4D43E3AF1919A9E8E56 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
22:12:39.0052 0x0f9c  KSecDD - ok
22:12:39.0132 0x0f9c  [ 8FE94F2EF9BF444E93E35D87E210D02F, 78E8F6FD7C1EA3556194947707BE6893538A9E25A550C22045866C5B30251D14 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
22:12:39.0172 0x0f9c  KSecPkg - ok
22:12:39.0242 0x0f9c  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
22:12:39.0332 0x0f9c  ksthunk - ok
22:12:39.0462 0x0f9c  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm           C:\Windows\system32\msdtckrm.dll
22:12:39.0532 0x0f9c  KtmRm - ok
22:12:39.0614 0x0f9c  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\Windows\system32\srvsvc.dll
22:12:39.0674 0x0f9c  LanmanServer - ok
22:12:39.0734 0x0f9c  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
22:12:39.0804 0x0f9c  LanmanWorkstation - ok
22:12:39.0964 0x0f9c  [ 955982BF4421B77722196552B62E8DC2, 3732449ACDBB78E1ED8436DF153C899C28573F458FDCFE345DFA1B305D085033 ] lirsgt          C:\Windows\system32\DRIVERS\lirsgt.sys
22:12:40.0024 0x0f9c  lirsgt - ok
22:12:40.0844 0x0f9c  [ 2892647EE6493131370BBDE8C2AD3B63, DA036CC642FC6B1A1C6E689679D3D9560DB02B84039208CFDF110BA98E1E113A ] LiveUpdateSvc   C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe
22:12:40.0954 0x0f9c  LiveUpdateSvc - ok
22:12:41.0046 0x0f9c  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
22:12:41.0096 0x0f9c  lltdio - ok
22:12:41.0208 0x0f9c  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
22:12:41.0258 0x0f9c  lltdsvc - ok
22:12:41.0285 0x0f9c  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts         C:\Windows\System32\lmhsvc.dll
22:12:41.0370 0x0f9c  lmhosts - ok
22:12:41.0460 0x0f9c  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
22:12:41.0480 0x0f9c  LSI_FC - ok
22:12:41.0520 0x0f9c  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS         C:\Windows\system32\drivers\lsi_sas.sys
22:12:41.0530 0x0f9c  LSI_SAS - ok
22:12:41.0550 0x0f9c  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
22:12:41.0570 0x0f9c  LSI_SAS2 - ok
22:12:41.0600 0x0f9c  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
22:12:41.0620 0x0f9c  LSI_SCSI - ok
22:12:41.0650 0x0f9c  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv           C:\Windows\system32\drivers\luafv.sys
22:12:41.0720 0x0f9c  luafv - ok
22:12:41.0840 0x0f9c  [ 0C85B2B6FB74B36A251792D45E0EF860, 2E04204560C1159ABC25F273B0B7F81FDF9BA5E88C17929FD924C4E945DE5020 ] LVRS64          C:\Windows\system32\DRIVERS\lvrs64.sys
22:12:41.0860 0x0f9c  LVRS64 - ok
22:12:42.0050 0x0f9c  [ 0307CF4184F4F22DB75F36ACCCEF7ED1, 32EAC5DADDD70175EA7AD4FC0A8624BECB138B9ED9E66AF74AC4A06EEB3EB4B7 ] mbamchameleon   C:\Windows\system32\drivers\mbamchameleon.sys
22:12:42.0080 0x0f9c  mbamchameleon - ok
22:12:42.0170 0x0f9c  [ 1E9E32AEC3E1EB1B31B8169F33168B56, 39114585E1FDBBA31E1F781C6A627281907183F94626EB347B08D1F78992ED2A ] MBAMProtector   C:\Windows\system32\drivers\mbam.sys
22:12:42.0180 0x0f9c  MBAMProtector - ok
22:12:42.0560 0x0f9c  [ 516E29AD03BDF610CC36A95AE692FE42, 09F913B169AD775FF587AE59AEC5DD2A2D8646803F48BF616C74EEC0DE3BE7A2 ] MBAMScheduler   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
22:12:42.0640 0x0f9c  MBAMScheduler - ok
22:12:42.0850 0x0f9c  [ 2B983F067AEE3F9EB4DF5E97F45D21D1, 0B9ED0E91FF01A5445927650113E320C3C0EA16F1401AA55A509DDBF704DF22F ] MBAMService     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
22:12:42.0890 0x0f9c  MBAMService - ok
22:12:43.0030 0x0f9c  [ E9CD058C79EA15B4AA93E259FA713B07, 2B09F65188D8782F9C797545F2F791EC7EAB85D8914B2C0B30BD869C412E3980 ] MBAMSwissArmy   C:\Windows\system32\drivers\MBAMSwissArmy.sys
22:12:43.0050 0x0f9c  MBAMSwissArmy - ok
22:12:43.0140 0x0f9c  [ F49FB3C88E263AE9A246593B0BB29294, FB53D6FA4A98B98334DCFF81E40712265256D31A9E9FF36022887BABD50F39EB ] MBAMWebAccessControl C:\Windows\system32\drivers\mwac.sys
22:12:43.0180 0x0f9c  MBAMWebAccessControl - ok
22:12:43.0340 0x0f9c  [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
22:12:43.0360 0x0f9c  Mcx2Svc - ok
22:12:43.0390 0x0f9c  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas         C:\Windows\system32\drivers\megasas.sys
22:12:43.0410 0x0f9c  megasas - ok
22:12:43.0470 0x0f9c  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\Windows\system32\drivers\MegaSR.sys
22:12:43.0510 0x0f9c  MegaSR - ok
22:12:43.0540 0x0f9c  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS           C:\Windows\system32\mmcss.dll
22:12:43.0610 0x0f9c  MMCSS - ok
22:12:43.0630 0x0f9c  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem           C:\Windows\system32\drivers\modem.sys
22:12:43.0670 0x0f9c  Modem - ok
22:12:43.0710 0x0f9c  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
22:12:43.0750 0x0f9c  monitor - ok
22:12:43.0780 0x0f9c  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
22:12:43.0800 0x0f9c  mouclass - ok
22:12:43.0860 0x0f9c  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
22:12:43.0910 0x0f9c  mouhid - ok
22:12:43.0950 0x0f9c  [ 87BCD1034CBF33537D4D4C251D39BA26, CB9DD235B62B79383F99873D75E26EEA5EE7914CA89E4B75992207F83420437F ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
22:12:43.0970 0x0f9c  mountmgr - ok
22:12:44.0110 0x0f9c  [ DD370A8148862150BA81A3F5C56A1E40, F56B84297BDC32266CB69D10FB2D66B8B332D60CAB7E64E4E3AC2BB749BBD31B ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
22:12:44.0140 0x0f9c  MozillaMaintenance - ok
22:12:44.0180 0x0f9c  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\Windows\system32\drivers\mpio.sys
22:12:44.0210 0x0f9c  mpio - ok
22:12:44.0220 0x0f9c  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
22:12:44.0270 0x0f9c  mpsdrv - ok
22:12:44.0370 0x0f9c  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\Windows\system32\mpssvc.dll
22:12:44.0439 0x0f9c  MpsSvc - ok
22:12:44.0482 0x0f9c  [ AE3334958D8F631FF14A0AEB3D7EFB3A, F5FD6B61F896104C20DFC43FEE2FCE6930B73F78DF876BD19A333EABB9139C6D ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
22:12:44.0602 0x0f9c  MRxDAV - ok
22:12:44.0662 0x0f9c  [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
22:12:44.0722 0x0f9c  mrxsmb - ok
22:12:44.0802 0x0f9c  [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
22:12:44.0862 0x0f9c  mrxsmb10 - ok
22:12:44.0902 0x0f9c  [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
22:12:44.0932 0x0f9c  mrxsmb20 - ok
22:12:44.0982 0x0f9c  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\Windows\system32\drivers\msahci.sys
22:12:45.0002 0x0f9c  msahci - ok
22:12:45.0062 0x0f9c  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
22:12:45.0072 0x0f9c  msdsm - ok
22:12:45.0132 0x0f9c  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC           C:\Windows\System32\msdtc.exe
22:12:45.0192 0x0f9c  MSDTC - ok
22:12:45.0252 0x0f9c  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
22:12:45.0302 0x0f9c  Msfs - ok
22:12:45.0352 0x0f9c  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
22:12:45.0422 0x0f9c  mshidkmdf - ok
22:12:45.0442 0x0f9c  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
22:12:45.0462 0x0f9c  msisadrv - ok
22:12:45.0522 0x0f9c  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
22:12:45.0582 0x0f9c  MSiSCSI - ok
22:12:45.0582 0x0f9c  msiserver - ok
22:12:45.0632 0x0f9c  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
22:12:45.0682 0x0f9c  MSKSSRV - ok
22:12:45.0692 0x0f9c  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
22:12:45.0762 0x0f9c  MSPCLOCK - ok
22:12:45.0772 0x0f9c  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
22:12:45.0832 0x0f9c  MSPQM - ok
22:12:45.0892 0x0f9c  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
22:12:45.0922 0x0f9c  MsRPC - ok
22:12:45.0942 0x0f9c  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
22:12:45.0962 0x0f9c  mssmbios - ok
22:12:45.0992 0x0f9c  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
22:12:46.0042 0x0f9c  MSTEE - ok
22:12:46.0052 0x0f9c  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\Windows\system32\drivers\MTConfig.sys
22:12:46.0102 0x0f9c  MTConfig - ok
22:12:46.0122 0x0f9c  [ 19B006B181E3875FD254F7B67ACF1E7C, 1D68D19522E71F16B8B50F8CCFBC9D884CF2DAC40CC409BD5A40A4D4223ABC61 ] MTsensor        C:\Windows\system32\drivers\ASACPI.sys
22:12:46.0142 0x0f9c  MTsensor - ok
22:12:46.0192 0x0f9c  [ 07AD6825D5C658595CAB7F8F5849401C, 21DEC409C781848B8104CE23E42D3D3DFABE9CC2527C78B1ED9167E063DB1542 ] MtsHID          C:\Windows\system32\drivers\MtsHID.sys
22:12:46.0212 0x0f9c  MtsHID - ok
22:12:46.0222 0x0f9c  [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup             C:\Windows\system32\Drivers\mup.sys
22:12:46.0242 0x0f9c  Mup - ok
22:12:46.0282 0x0f9c  [ 049F1ED7F1B5DBB9D6C8767E7DE02741, F3E55B872AC11F8D4FA9FB912CCCE6BB969DCFD71B8A5592878B3ABB25603A8C ] mv91cons        C:\Windows\system32\drivers\mv91cons.sys
22:12:46.0302 0x0f9c  mv91cons - ok
22:12:46.0402 0x0f9c  [ 4FAD606C7AEB336E5AA4A005DE09CA80, 5BF117B7B369ED13ADEE262B19169FF63356B60C482BF24DC4A0B0741C77B996 ] mv91xx          C:\Windows\system32\drivers\mv91xx.sys
22:12:46.0422 0x0f9c  mv91xx - ok
22:12:46.0492 0x0f9c  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\Windows\system32\qagentRT.dll
22:12:46.0572 0x0f9c  napagent - ok
22:12:46.0662 0x0f9c  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
22:12:46.0712 0x0f9c  NativeWifiP - ok
22:12:46.0882 0x0f9c  [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS            C:\Windows\system32\drivers\ndis.sys
22:12:46.0932 0x0f9c  NDIS - ok
22:12:46.0962 0x0f9c  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
22:12:47.0022 0x0f9c  NdisCap - ok
22:12:47.0062 0x0f9c  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
22:12:47.0122 0x0f9c  NdisTapi - ok
22:12:47.0152 0x0f9c  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
22:12:47.0212 0x0f9c  Ndisuio - ok
22:12:47.0252 0x0f9c  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
22:12:47.0302 0x0f9c  NdisWan - ok
22:12:47.0312 0x0f9c  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
22:12:47.0352 0x0f9c  NDProxy - ok
22:12:47.0472 0x0f9c  [ 2334DC48997BA203B794DF3EE70521DB, 832F4EC1586C9669F2D54AB3B212943E43B87A33B24DCC8CDAD6A0264291EE2F ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll
22:12:47.0522 0x0f9c  Net Driver HPZ12 - detected UnsignedFile.Multi.Generic ( 1 )
22:12:50.0052 0x0f9c  Detect skipped due to KSN trusted
22:12:50.0052 0x0f9c  Net Driver HPZ12 - ok
22:12:50.0072 0x0f9c  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
22:12:50.0132 0x0f9c  NetBIOS - ok
22:12:50.0172 0x0f9c  [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
22:12:50.0222 0x0f9c  NetBT - ok
22:12:50.0232 0x0f9c  [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] Netlogon        C:\Windows\system32\lsass.exe
22:12:50.0252 0x0f9c  Netlogon - ok
22:12:50.0292 0x0f9c  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\Windows\System32\netman.dll
22:12:50.0362 0x0f9c  Netman - ok
22:12:50.0502 0x0f9c  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
22:12:50.0572 0x0f9c  NetMsmqActivator - ok
22:12:50.0632 0x0f9c  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
22:12:50.0652 0x0f9c  NetPipeActivator - ok
22:12:50.0692 0x0f9c  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\Windows\System32\netprofm.dll
22:12:50.0752 0x0f9c  netprofm - ok
22:12:50.0792 0x0f9c  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
22:12:50.0812 0x0f9c  NetTcpActivator - ok
22:12:50.0832 0x0f9c  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
22:12:50.0842 0x0f9c  NetTcpPortSharing - ok
22:12:50.0892 0x0f9c  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960         C:\Windows\system32\drivers\nfrd960.sys
22:12:50.0912 0x0f9c  nfrd960 - ok
22:12:50.0972 0x0f9c  [ 8B301D474B478E9A92823BAB50A7BC49, 8181816035F41B1DABEC05E65E4F67BCD785F56760A61F1049E91BA39D42F01D ] NlaSvc          C:\Windows\System32\nlasvc.dll
22:12:51.0062 0x0f9c  NlaSvc - ok
22:12:51.0072 0x0f9c  NmPar - ok
22:12:51.0072 0x0f9c  nmserial - ok
22:12:51.0092 0x0f9c  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\Windows\system32\drivers\Npfs.sys
22:12:51.0132 0x0f9c  Npfs - ok
22:12:51.0182 0x0f9c  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi             C:\Windows\system32\nsisvc.dll
22:12:51.0242 0x0f9c  nsi - ok
22:12:51.0262 0x0f9c  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
22:12:51.0324 0x0f9c  nsiproxy - ok
22:12:51.0586 0x0f9c  [ 1A29A59A4C5BA6F8C85062A613B7E2B2, CC137F499A12C724D4166C2D85E9F447413419A0683DAC6F1A802B7F210C77F1 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
22:12:51.0666 0x0f9c  Ntfs - ok
22:12:51.0688 0x0f9c  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\Windows\system32\drivers\Null.sys
22:12:51.0728 0x0f9c  Null - ok
22:12:51.0758 0x0f9c  [ 158AD24745BD85BA9BE3C51C38F48C32, B053A3B5A5CAE2CBC47E2C19E636AD70F376334EFFBB391A76562E67CBF3AC86 ] nusb3hub        C:\Windows\system32\drivers\nusb3hub.sys
22:12:51.0818 0x0f9c  nusb3hub - ok
22:12:51.0868 0x0f9c  [ D40A13B2C0891E218F9523B376955DB6, 9A2AAAF960868B860A65579EAD507B35C64CFD6C3581F8D731ADF975F778D10E ] nusb3xhc        C:\Windows\system32\drivers\nusb3xhc.sys
22:12:51.0918 0x0f9c  nusb3xhc - ok
22:12:51.0938 0x0f9c  [ 7FD5C060CB907489A5702F628226F54A, 56101B878DCBFDEF4D5C8BBC6BE0D7710108E651809812BAB876A2E1D4ACB256 ] nvamacpi        C:\Windows\system32\drivers\NVAMACPI.sys
22:12:51.0958 0x0f9c  nvamacpi - ok
22:12:53.0438 0x0f9c  [ 8E6247F418B4C8AE9EEB0B532CABCC21, 42AD2588CBC8C9478F289955AB1391C65788D0564CCA7E0F9A41B8498A8BA117 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
22:12:53.0918 0x0f9c  nvlddmkm - ok
22:12:53.0968 0x0f9c  [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
22:12:53.0988 0x0f9c  nvraid - ok
22:12:54.0048 0x0f9c  [ 694F5E9D9D624D47F432F5B2E66A0528, 5ACE83A62CBBA735D516FD1C603C69A2136132203679D1F3C92AC5266E84DD8C ] nvrd64          C:\Windows\system32\drivers\nvrd64.sys
22:12:54.0068 0x0f9c  nvrd64 - ok
22:12:54.0118 0x0f9c  [ E58D81FB8616D0CB55C1E36AA0B213C9, D83F78615889A466ADE2BFEF7AB357C0D31B7FA9A1A52668DED32A51FEFA87B5 ] nvsmu           C:\Windows\system32\drivers\nvsmu.sys
22:12:54.0148 0x0f9c  nvsmu - ok
22:12:54.0208 0x0f9c  [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
22:12:54.0228 0x0f9c  nvstor - ok
22:12:54.0268 0x0f9c  [ 05DE5DC43AFE6CAB78F9C7CA044CBCBE, 59643F2B07DC964EDCE583CEA6AD81B33CB6D5923C9A5881268E7FCD5700601E ] nvstor64        C:\Windows\system32\drivers\nvstor64.sys
22:12:54.0288 0x0f9c  nvstor64 - ok
22:12:54.0448 0x0f9c  [ 41B97DCE2B2D113B831EB197F02A7398, 3168C646327E5C72741A326C12AD46A73234DA6A67DC21F66FF1D195A971FBFE ] NVSvc           C:\Windows\system32\nvvsvc.exe
22:12:54.0478 0x0f9c  NVSvc - ok
22:12:54.0808 0x0f9c  [ A3A25E0509F67473B960DAF214828BE3, F2EC38B82DF46E5765FD8976AA5A7043637AC716F56B17D6DC7524E774602DE3 ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
22:12:54.0873 0x0f9c  nvUpdatusService - ok
22:12:54.0900 0x0f9c  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
22:12:54.0920 0x0f9c  nv_agp - ok
22:12:54.0950 0x0f9c  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
22:12:54.0970 0x0f9c  ohci1394 - ok
22:12:55.0110 0x0f9c  [ 30B5F9FB0C35AE6B4A0851D24CE2EE8B, 0340E77E8EC2ADC21B8DDD9C9CC95B3F4BCAFD54618A333C72D7D9587D593B83 ] ose             C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
22:12:55.0140 0x0f9c  ose - ok
22:12:55.0760 0x0f9c  [ FE9C0029E1AF26350D9985D00520E5C8, 967079CCF7B2CBD4B48C9F076675C26AF93A1CEC26C96811F279414E34004EE6 ] osppsvc         C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
22:12:55.0950 0x0f9c  osppsvc - ok
22:12:56.0060 0x0f9c  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
22:12:56.0140 0x0f9c  p2pimsvc - ok
22:12:56.0200 0x0f9c  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\Windows\system32\p2psvc.dll
22:12:56.0240 0x0f9c  p2psvc - ok
22:12:56.0280 0x0f9c  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport         C:\Windows\system32\DRIVERS\parport.sys
22:12:56.0320 0x0f9c  Parport - ok
22:12:56.0370 0x0f9c  [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
22:12:56.0400 0x0f9c  partmgr - ok
22:12:56.0470 0x0f9c  [ DB2D62AA2DF6B1F3D690A9EC9701AA2C, BEAC55E1AA0494565F1547DF5E6FE20FCEA66461764C016FCB68D8BFF0F0C375 ] PcaSvc          C:\Windows\System32\pcasvc.dll
22:12:56.0550 0x0f9c  PcaSvc - ok
22:12:56.0600 0x0f9c  [ 81B5E63131090879AD6EF9F32109B88D, 581680BFE9B2BACBD5E55D807EFB17C69488AE3F5C61358B0955E1494FD3514E ] pccsmcfd        C:\Windows\system32\DRIVERS\pccsmcfdx64.sys
22:12:56.0690 0x0f9c  pccsmcfd - ok
22:12:56.0740 0x0f9c  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci             C:\Windows\system32\drivers\pci.sys
22:12:56.0760 0x0f9c  pci - ok
22:12:56.0770 0x0f9c  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\Windows\system32\drivers\pciide.sys
22:12:56.0790 0x0f9c  pciide - ok
22:12:56.0830 0x0f9c  [ D7C203015E2C2A2EAC8DACEF156D8DC3, FDE6B49A36588C22D92B591576FF1A1D8E60BE11EC3FBE8242FA671CF5A27031 ] PciIsaSerial    C:\Windows\system32\drivers\PciIsaSerial.sys
22:12:56.0910 0x0f9c  PciIsaSerial - ok
22:12:56.0930 0x0f9c  [ 088B509B2F35A3CEE00AC0E0BC4C5BED, BD778FE0BAE72045511F1D66F980749443CC6EE2C3600FD55BD908BCCFD18B24 ] PciPPorts       C:\Windows\system32\drivers\PciPPorts.sys
22:12:56.0940 0x0f9c  PciPPorts - ok
22:12:56.0960 0x0f9c  [ 7F97CDD5E91FC73DA2B01344957AA058, 72A887B477ADBBC9CC7071AF1A62EF3D62B3385B7D817AFE140CEBBA59948B41 ] PciSPorts       C:\Windows\system32\drivers\PciSPorts.sys
22:12:57.0000 0x0f9c  PciSPorts - ok
22:12:57.0060 0x0f9c  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
22:12:57.0080 0x0f9c  pcmcia - ok
22:12:57.0120 0x0f9c  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw             C:\Windows\system32\drivers\pcw.sys
22:12:57.0140 0x0f9c  pcw - ok
22:12:57.0230 0x0f9c  [ ED6E75158D28D33A2E2A020AC5B2B59D, 0F364D9A88304C45F31318605C417A70A9D0E4CF087D73E949B42C12CC76CD6C ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
22:12:57.0290 0x0f9c  PEAUTH - ok
22:12:57.0570 0x0f9c  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\Windows\SysWow64\perfhost.exe
22:12:57.0590 0x0f9c  PerfHost - ok
22:12:57.0730 0x0f9c  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla             C:\Windows\system32\pla.dll
22:12:57.0800 0x0f9c  pla - ok
22:12:57.0900 0x0f9c  [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
22:12:58.0030 0x0f9c  PlugPlay - ok
22:12:58.0250 0x0f9c  [ AC78DF349F0E4CFB8B667C0CFFF83CCE, 7E635AA2E7350FCA0C954E697F1480A6204920AEFBCF06B90FFA02398DA82822 ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
22:12:58.0300 0x0f9c  Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic ( 1 )
22:13:00.0780 0x0f9c  Detect skipped due to KSN trusted
22:13:00.0780 0x0f9c  Pml Driver HPZ12 - ok
22:13:00.0800 0x0f9c  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
22:13:00.0820 0x0f9c  PNRPAutoReg - ok
22:13:00.0870 0x0f9c  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
22:13:00.0900 0x0f9c  PNRPsvc - ok
22:13:00.0960 0x0f9c  [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
22:13:01.0040 0x0f9c  PolicyAgent - ok
22:13:01.0080 0x0f9c  [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power           C:\Windows\system32\umpo.dll
22:13:01.0130 0x0f9c  Power - ok
22:13:01.0160 0x0f9c  [ 14C04684A25C221EBE2105D169B4B6FF, 7331F3C7419102D1C710310BA82642EA50FDA05AC81D713506A60AAD208C74F8 ] PPorts          C:\Windows\system32\drivers\PPorts.sys
22:13:01.0180 0x0f9c  PPorts - ok
22:13:01.0250 0x0f9c  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
22:13:01.0310 0x0f9c  PptpMiniport - ok
22:13:01.0320 0x0f9c  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor       C:\Windows\system32\drivers\processr.sys
22:13:01.0360 0x0f9c  Processor - ok
22:13:01.0430 0x0f9c  [ B6A58491307B4CADA572583D863DC602, 5C44936605E52C9533E4CE22F18FAB8211475877F71EFD88DA4D02FD608C90A3 ] ProfSvc         C:\Windows\system32\profsvc.dll
22:13:01.0520 0x0f9c  ProfSvc - ok
22:13:01.0530 0x0f9c  [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] ProtectedStorage C:\Windows\system32\lsass.exe
22:13:01.0550 0x0f9c  ProtectedStorage - ok
22:13:01.0570 0x0f9c  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
22:13:01.0620 0x0f9c  Psched - ok
22:13:01.0852 0x0f9c  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
22:13:01.0914 0x0f9c  ql2300 - ok
22:13:01.0944 0x0f9c  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
22:13:01.0964 0x0f9c  ql40xx - ok
22:13:02.0024 0x0f9c  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE           C:\Windows\system32\qwave.dll
22:13:02.0054 0x0f9c  QWAVE - ok
22:13:02.0074 0x0f9c  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
22:13:02.0134 0x0f9c  QWAVEdrv - ok
22:13:02.0154 0x0f9c  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
22:13:02.0194 0x0f9c  RasAcd - ok
22:13:02.0244 0x0f9c  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
22:13:02.0284 0x0f9c  RasAgileVpn - ok
22:13:02.0314 0x0f9c  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto         C:\Windows\System32\rasauto.dll
22:13:02.0364 0x0f9c  RasAuto - ok
22:13:02.0394 0x0f9c  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
22:13:02.0454 0x0f9c  Rasl2tp - ok
22:13:02.0494 0x0f9c  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\Windows\System32\rasmans.dll
22:13:02.0564 0x0f9c  RasMan - ok
22:13:02.0594 0x0f9c  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
22:13:02.0644 0x0f9c  RasPppoe - ok
22:13:02.0674 0x0f9c  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
22:13:02.0744 0x0f9c  RasSstp - ok
22:13:02.0794 0x0f9c  [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
22:13:02.0834 0x0f9c  rdbss - ok
22:13:02.0874 0x0f9c  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\Windows\system32\drivers\rdpbus.sys
22:13:02.0894 0x0f9c  rdpbus - ok
22:13:02.0944 0x0f9c  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
22:13:03.0004 0x0f9c  RDPCDD - ok
22:13:03.0044 0x0f9c  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
22:13:03.0084 0x0f9c  RDPENCDD - ok
22:13:03.0104 0x0f9c  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
22:13:03.0174 0x0f9c  RDPREFMP - ok
22:13:03.0326 0x0f9c  [ 313F68E1A3E6345A4F47A36B07062F34, B8318A0AE06BDE278931CA52F960B9FE226FD9894B076858DDB755AE26E1E66F ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
22:13:03.0436 0x0f9c  RdpVideoMiniport - ok
22:13:03.0516 0x0f9c  [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
22:13:03.0616 0x0f9c  RDPWD - ok
22:13:04.0006 0x0f9c  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
22:13:04.0036 0x0f9c  rdyboost - ok
22:13:04.0056 0x0f9c  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\Windows\System32\mprdim.dll
22:13:04.0316 0x0f9c  RemoteAccess - ok
22:13:04.0396 0x0f9c  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
22:13:04.0526 0x0f9c  RemoteRegistry - ok
22:13:04.0576 0x0f9c  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
22:13:04.0676 0x0f9c  RpcEptMapper - ok
22:13:04.0706 0x0f9c  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\Windows\system32\locator.exe
22:13:04.0746 0x0f9c  RpcLocator - ok
22:13:04.0776 0x0f9c  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs           C:\Windows\system32\rpcss.dll
22:13:04.0816 0x0f9c  RpcSs - ok
22:13:04.0906 0x0f9c  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
22:13:04.0936 0x0f9c  rspndr - ok
22:13:05.0088 0x0f9c  [ AFC12DFA4C7B089673AD67402CA19EDB, 9CA430E8DFAE9B7A245FCD766CB60245418C80CEBCD2E9FACA9DE62E3E60ADDF ] RTL8167         C:\Windows\system32\DRIVERS\Rt64win7.sys
22:13:05.0108 0x0f9c  RTL8167 - ok
22:13:05.0128 0x0f9c  [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] SamSs           C:\Windows\system32\lsass.exe
22:13:05.0144 0x0f9c  SamSs - ok
22:13:05.0170 0x0f9c  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
22:13:05.0190 0x0f9c  sbp2port - ok
22:13:05.0230 0x0f9c  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
22:13:05.0290 0x0f9c  SCardSvr - ok
22:13:05.0340 0x0f9c  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
22:13:05.0390 0x0f9c  scfilter - ok
22:13:05.0470 0x0f9c  [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule        C:\Windows\system32\schedsvc.dll
22:13:05.0580 0x0f9c  Schedule - ok
22:13:05.0650 0x0f9c  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc     C:\Windows\System32\certprop.dll
22:13:05.0680 0x0f9c  SCPolicySvc - ok
22:13:05.0730 0x0f9c  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
22:13:05.0870 0x0f9c  SDRSVC - ok
22:13:05.0970 0x0f9c  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys
22:13:06.0040 0x0f9c  secdrv - ok
22:13:06.0070 0x0f9c  [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon        C:\Windows\system32\seclogon.dll
22:13:06.0150 0x0f9c  seclogon - ok
22:13:06.0200 0x0f9c  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\Windows\System32\sens.dll
22:13:06.0240 0x0f9c  SENS - ok
22:13:06.0280 0x0f9c  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\Windows\system32\sensrsvc.dll
22:13:06.0380 0x0f9c  SensrSvc - ok
22:13:06.0390 0x0f9c  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
22:13:06.0410 0x0f9c  Serenum - ok
22:13:06.0430 0x0f9c  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\Windows\system32\DRIVERS\serial.sys
22:13:06.0470 0x0f9c  Serial - ok
22:13:06.0520 0x0f9c  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\Windows\system32\drivers\sermouse.sys
22:13:06.0570 0x0f9c  sermouse - ok
22:13:06.0710 0x0f9c  [ 9D38320BB32230349379DF5DDBBF7FCE, 8AAA8B0B60E65F596C3276DCCD0D8146B40172B6D509B597EDFDA46AC8A72A4C ] ServiceLayer    C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
22:13:06.0740 0x0f9c  ServiceLayer - detected UnsignedFile.Multi.Generic ( 1 )
22:13:09.0240 0x0f9c  Detect skipped due to KSN trusted
22:13:09.0240 0x0f9c  ServiceLayer - ok
22:13:09.0290 0x0f9c  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\Windows\system32\sessenv.dll
22:13:09.0330 0x0f9c  SessionEnv - ok
22:13:09.0390 0x0f9c  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
22:13:09.0440 0x0f9c  sffdisk - ok
22:13:09.0460 0x0f9c  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
22:13:09.0510 0x0f9c  sffp_mmc - ok
22:13:09.0530 0x0f9c  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
22:13:09.0610 0x0f9c  sffp_sd - ok
22:13:09.0630 0x0f9c  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy         C:\Windows\system32\drivers\sfloppy.sys
22:13:09.0690 0x0f9c  sfloppy - ok
22:13:09.0970 0x0f9c  [ 21AB491BBCC8C1B26FDC402A374AB196, DD973C9963C840200D153A15078152D499639730D065BB8122C6BE65D4372300 ] Sftfs           C:\Windows\system32\DRIVERS\Sftfslh.sys
22:13:10.0000 0x0f9c  Sftfs - ok
22:13:10.0230 0x0f9c  [ 4E1BB8A9CCDB4BAF41F7F9A930EB121D, D994B20DACEB187BEB6530309E2185040B58105E4FD5AC1DA435712F9DE027D0 ] sftlist         C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
22:13:10.0250 0x0f9c  sftlist - ok
22:13:10.0310 0x0f9c  [ 3B8D43FEEFF7A187534DDDFD675FE123, 9308D5C552FE3AF1121A3F7B7595547C6B892FF500377953F3B623511D84698C ] Sftplay         C:\Windows\system32\DRIVERS\Sftplaylh.sys
22:13:10.0340 0x0f9c  Sftplay - ok
22:13:10.0370 0x0f9c  [ F1D1B1DC7A8765A09D7640FBF8D20970, 72E59B04BC44DAFFB88987C16CF3F9DC35438B15879E102FD83013673E0DB66F ] Sftredir        C:\Windows\system32\DRIVERS\Sftredirlh.sys
22:13:10.0380 0x0f9c  Sftredir - ok
22:13:10.0440 0x0f9c  [ B3B9ADE7F8C4AF0C20E712E040588543, 9A6BB11DA046BF6F0239952871263E148FAE91FB21065613645114B5FA054EC5 ] Sftvol          C:\Windows\system32\DRIVERS\Sftvollh.sys
22:13:10.0460 0x0f9c  Sftvol - ok
22:13:10.0530 0x0f9c  [ CECFDE5D3701B2D914862F5E6C3DFE18, E7627F90630C306324A39DC3C652B37D255F90636AC19D3302EE5B85BD504BD5 ] sftvsa          C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
22:13:10.0560 0x0f9c  sftvsa - ok
22:13:10.0660 0x0f9c  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
22:13:10.0710 0x0f9c  SharedAccess - ok
22:13:10.0770 0x0f9c  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
22:13:10.0820 0x0f9c  ShellHWDetection - ok
22:13:10.0890 0x0f9c  [ DA492C8305434EC6F9BDD60C8B83B10E, 572C5A1F77E0644B4EB2EAC89C141869F071748CA5BB33F846D284C545166A35 ] Si3124r5        C:\Windows\system32\drivers\Si3124r5.sys
22:13:10.0910 0x0f9c  Si3124r5 - ok
22:13:10.0930 0x0f9c  [ 8D10887A1699CF61E74467694B929B09, 096A1284092B0002B1405485690C7FC05D9A0FA8809D04327FA2BDEAECA2D199 ] SiFilter        C:\Windows\system32\drivers\SiWinAcc.sys
22:13:10.0940 0x0f9c  SiFilter - ok
22:13:10.0970 0x0f9c  [ 94E1EDA9A0B305A67EE1BBD0A68CE21A, 1EC0E459117100F8C8C325DD4CE2250D51D44B36E5C46FE598A319C353499524 ] SiRemFil        C:\Windows\system32\drivers\SiRemFil.sys
22:13:10.0990 0x0f9c  SiRemFil - ok
22:13:11.0050 0x0f9c  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
22:13:11.0070 0x0f9c  SiSRaid2 - ok
22:13:11.0080 0x0f9c  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
22:13:11.0110 0x0f9c  SiSRaid4 - ok
22:13:11.0280 0x0f9c  [ F6EF225A23D336CA30001E5007644C24, B0A4B1256C1074F1B4F73E3BBA16FD4683D6EEA583DEEF8E11EFD29BA7541F2A ] SkypeUpdate     C:\Program Files (x86)\Skype\Updater\Updater.exe
22:13:11.0310 0x0f9c  SkypeUpdate - ok
22:13:11.0340 0x0f9c  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
22:13:11.0400 0x0f9c  Smb - ok
22:13:11.0480 0x0f9c  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
22:13:11.0550 0x0f9c  SNMPTRAP - ok
22:13:11.0570 0x0f9c  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr           C:\Windows\system32\drivers\spldr.sys
22:13:11.0590 0x0f9c  spldr - ok
22:13:11.0630 0x0f9c  [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler         C:\Windows\System32\spoolsv.exe
22:13:11.0750 0x0f9c  Spooler - ok
22:13:11.0770 0x0f9c  [ 739C2571867F351167D1D958990E9D84, 0560C2E7FF35790D1B64E9D736DEEA22B4C194809E1435A60FCFA466B19B63B0 ] SPorts          C:\Windows\system32\drivers\SPorts.sys
22:13:11.0820 0x0f9c  SPorts - ok
22:13:12.0091 0x0f9c  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\Windows\system32\sppsvc.exe
22:13:12.0292 0x0f9c  sppsvc - ok
22:13:12.0322 0x0f9c  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
22:13:12.0372 0x0f9c  sppuinotify - ok
22:13:12.0492 0x0f9c  [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv             C:\Windows\system32\DRIVERS\srv.sys
22:13:12.0572 0x0f9c  srv - ok
22:13:12.0682 0x0f9c  [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
22:13:12.0722 0x0f9c  srv2 - ok
22:13:12.0752 0x0f9c  [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
22:13:12.0772 0x0f9c  srvnet - ok
22:13:12.0832 0x0f9c  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
22:13:12.0892 0x0f9c  SSDPSRV - ok
22:13:12.0912 0x0f9c  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc         C:\Windows\system32\sstpsvc.dll
22:13:12.0962 0x0f9c  SstpSvc - ok
22:13:13.0012 0x0f9c  [ AAF6F247F1DC370C593B4430974EAD9C, 232D0D62EC83A5537ADB28B5DC01074BA812FE6C70C54F70CD7A5EF1BC19D3E1 ] ssudmdm         C:\Windows\system32\DRIVERS\ssudmdm.sys
22:13:13.0042 0x0f9c  ssudmdm - ok
22:13:13.0252 0x0f9c  [ 0398BF35F898BA77033E678609AAB64F, E48D2E1E1C8FD314340BA1AA69E8942F630139B1E7019C8828BA5525444320D4 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe
22:13:13.0292 0x0f9c  Steam Client Service - ok
22:13:13.0322 0x0f9c  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\Windows\system32\drivers\stexstor.sys
22:13:13.0342 0x0f9c  stexstor - ok
22:13:13.0452 0x0f9c  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\Windows\System32\wiaservc.dll
22:13:13.0482 0x0f9c  stisvc - ok
22:13:13.0502 0x0f9c  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
22:13:13.0532 0x0f9c  swenum - ok
22:13:13.0742 0x0f9c  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv           C:\Windows\System32\swprv.dll
22:13:13.0842 0x0f9c  swprv - ok
22:13:14.0082 0x0f9c  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain         C:\Windows\system32\sysmain.dll
22:13:14.0172 0x0f9c  SysMain - ok
22:13:14.0222 0x0f9c  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
22:13:14.0272 0x0f9c  TabletInputService - ok
22:13:14.0302 0x0f9c  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv         C:\Windows\System32\tapisrv.dll
22:13:14.0352 0x0f9c  TapiSrv - ok
22:13:14.0382 0x0f9c  [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS             C:\Windows\System32\tbssvc.dll
22:13:14.0792 0x0f9c  TBS - ok
22:13:15.0024 0x0f9c  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
22:13:15.0114 0x0f9c  Tcpip - ok
22:13:15.0464 0x0f9c  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
22:13:15.0528 0x0f9c  TCPIP6 - ok
22:13:15.0588 0x0f9c  [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
22:13:15.0618 0x0f9c  tcpipreg - ok
22:13:15.0648 0x0f9c  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
22:13:15.0688 0x0f9c  TDPIPE - ok
22:13:15.0738 0x0f9c  [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
22:13:16.0058 0x0f9c  TDTCP - ok
22:13:16.0110 0x0f9c  [ 70988118145F5F10EF24720B97F35F65, F80C806417A68047FFB3D63214BC4AE5445315219AC594E043293006B704A63D ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
22:13:16.0170 0x0f9c  tdx - ok
22:13:16.0240 0x0f9c  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
22:13:16.0280 0x0f9c  TermDD - ok
22:13:16.0340 0x0f9c  [ 008CD4EBFABCF78D0F19B3778492648C, 9050490EEE0AD86E73F0A82D83E4FC29DF84F6B6FDB389AE135FD712B5F425BE ] TermService     C:\Windows\System32\termsrv.dll
22:13:16.0480 0x0f9c  TermService - ok
22:13:16.0530 0x0f9c  TFsExDisk - ok
22:13:16.0570 0x0f9c  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\Windows\system32\themeservice.dll
22:13:16.0640 0x0f9c  Themes - ok
22:13:16.0660 0x0f9c  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER     C:\Windows\system32\mmcss.dll
22:13:16.0690 0x0f9c  THREADORDER - ok
22:13:16.0740 0x0f9c  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\Windows\System32\trkwks.dll
22:13:16.0790 0x0f9c  TrkWks - ok
22:13:16.0830 0x0f9c  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
22:13:16.0950 0x0f9c  TrustedInstaller - ok
22:13:16.0990 0x0f9c  [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
22:13:17.0210 0x0f9c  tssecsrv - ok
22:13:17.0240 0x0f9c  [ E9981ECE8D894CEF7038FD1D040EB426, DCDDCE933CAECE8180A3447199B07F2F0413704EEC1A09606EE357901A84A7CF ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
22:13:17.0360 0x0f9c  TsUsbFlt - ok
22:13:17.0440 0x0f9c  [ AD64450A4ABE076F5CB34CC08EEACB07, B5C386635441A19178E7FEEE299BA430C8D72F9110866C13A216B12A1080AD12 ] TsUsbGD         C:\Windows\system32\drivers\TsUsbGD.sys
22:13:17.0500 0x0f9c  TsUsbGD - ok
22:13:17.0570 0x0f9c  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
22:13:17.0690 0x0f9c  tunnel - ok
22:13:17.0710 0x0f9c  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
22:13:17.0720 0x0f9c  uagp35 - ok
22:13:17.0770 0x0f9c  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
22:13:17.0850 0x0f9c  udfs - ok
22:13:17.0910 0x0f9c  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect       C:\Windows\system32\UI0Detect.exe
22:13:17.0940 0x0f9c  UI0Detect - ok
22:13:17.0990 0x0f9c  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
22:13:18.0010 0x0f9c  uliagpkx - ok
22:13:18.0030 0x0f9c  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus           C:\Windows\system32\DRIVERS\umbus.sys
22:13:18.0050 0x0f9c  umbus - ok
22:13:18.0060 0x0f9c  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\Windows\system32\drivers\umpass.sys
22:13:18.0130 0x0f9c  UmPass - ok
22:13:18.0240 0x0f9c  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\Windows\System32\upnphost.dll
22:13:18.0330 0x0f9c  upnphost - ok
22:13:18.0390 0x0f9c  [ FB251567F41BC61988B26731DEC19E4B, 6A535F5A18EB43DD2E18AF0A05301630A1D1484B7D85DA79A7CD122DA4D018E2 ] USBAAPL64       C:\Windows\system32\Drivers\usbaapl64.sys
22:13:18.0420 0x0f9c  USBAAPL64 - detected UnsignedFile.Multi.Generic ( 1 )
22:13:20.0914 0x0f9c  Detect skipped due to KSN trusted
22:13:20.0914 0x0f9c  USBAAPL64 - ok
22:13:20.0974 0x0f9c  [ B0435098C81D04CAFFF80DDB746CD3A2, A17B207740382E38729571F0B0BC98FF874E856A7C7CE9EB930328A2AD88F52A ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
22:13:21.0054 0x0f9c  usbaudio - ok
22:13:21.0094 0x0f9c  [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
22:13:21.0184 0x0f9c  usbccgp - ok
22:13:21.0224 0x0f9c  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir          C:\Windows\system32\drivers\usbcir.sys
22:13:21.0274 0x0f9c  usbcir - ok
22:13:21.0314 0x0f9c  [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys
22:13:21.0354 0x0f9c  usbehci - ok
22:13:21.0394 0x0f9c  [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
22:13:21.0434 0x0f9c  usbhub - ok
22:13:21.0444 0x0f9c  [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci         C:\Windows\system32\DRIVERS\usbohci.sys
22:13:21.0484 0x0f9c  usbohci - ok
22:13:21.0524 0x0f9c  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
22:13:21.0544 0x0f9c  usbprint - ok
22:13:21.0574 0x0f9c  [ 9661DA76B4531B2DA272ECCE25A8AF24, FEA93254A21E71A7EB8AD35FCCAD2C1E41F7329EC33B1734F5B41307A34D8637 ] usbscan         C:\Windows\system32\DRIVERS\usbscan.sys
22:13:21.0614 0x0f9c  usbscan - ok
22:13:21.0624 0x0f9c  [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
22:13:21.0704 0x0f9c  USBSTOR - ok
22:13:21.0714 0x0f9c  [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys
22:13:21.0734 0x0f9c  usbuhci - ok
22:13:21.0804 0x0f9c  [ 1F775DA4CF1A3A1834207E975A72E9D7, 6D3DE5BD3EF3A76E997E5BAF900C51D25308F5A9682D1F62017F577A24095B90 ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys
22:13:21.0824 0x0f9c  usbvideo - ok
22:13:21.0854 0x0f9c  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms           C:\Windows\System32\uxsms.dll
22:13:21.0904 0x0f9c  UxSms - ok
22:13:21.0924 0x0f9c  [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] VaultSvc        C:\Windows\system32\lsass.exe
22:13:21.0934 0x0f9c  VaultSvc - ok
22:13:21.0974 0x0f9c  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
22:13:21.0994 0x0f9c  vdrvroot - ok
22:13:22.0044 0x0f9c  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds             C:\Windows\System32\vds.exe
22:13:22.0094 0x0f9c  vds - ok
22:13:22.0146 0x0f9c  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
22:13:22.0176 0x0f9c  vga - ok
22:13:22.0186 0x0f9c  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave         C:\Windows\System32\drivers\vga.sys
22:13:22.0236 0x0f9c  VgaSave - ok
22:13:22.0278 0x0f9c  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys
22:13:22.0308 0x0f9c  vhdmp - ok
22:13:22.0358 0x0f9c  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\Windows\system32\drivers\viaide.sys
22:13:22.0378 0x0f9c  viaide - ok
22:13:22.0398 0x0f9c  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
22:13:22.0418 0x0f9c  volmgr - ok
22:13:22.0468 0x0f9c  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
22:13:22.0498 0x0f9c  volmgrx - ok
22:13:22.0518 0x0f9c  [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap         C:\Windows\system32\drivers\volsnap.sys
22:13:22.0538 0x0f9c  volsnap - ok
22:13:22.0598 0x0f9c  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid         C:\Windows\system32\drivers\vsmraid.sys
22:13:22.0618 0x0f9c  vsmraid - ok
22:13:22.0748 0x0f9c  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS             C:\Windows\system32\vssvc.exe
22:13:22.0838 0x0f9c  VSS - ok
22:13:22.0848 0x0f9c  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
22:13:22.0888 0x0f9c  vwifibus - ok
22:13:22.0928 0x0f9c  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time         C:\Windows\system32\w32time.dll
22:13:22.0978 0x0f9c  W32Time - ok
22:13:23.0018 0x0f9c  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
22:13:23.0048 0x0f9c  WacomPen - ok
22:13:23.0098 0x0f9c  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
22:13:23.0158 0x0f9c  WANARP - ok
22:13:23.0198 0x0f9c  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
22:13:23.0228 0x0f9c  Wanarpv6 - ok
22:13:23.0498 0x0f9c  [ 3CEC96DE223E49EAAE3651FCF8FAEA6C, 4150DAB33E8D61076F1D4767BCAFC9B4ECCCCBD58FD4FB3CFE5B8D27DCDCAB61 ] WatAdminSvc     C:\Windows\system32\Wat\WatAdminSvc.exe
22:13:23.0558 0x0f9c  WatAdminSvc - ok
22:13:23.0768 0x0f9c  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\Windows\system32\wbengine.exe
22:13:23.0908 0x0f9c  wbengine - ok
22:13:23.0938 0x0f9c  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
22:13:23.0998 0x0f9c  WbioSrvc - ok
22:13:24.0038 0x0f9c  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc         C:\Windows\System32\wcncsvc.dll
22:13:24.0078 0x0f9c  wcncsvc - ok
22:13:24.0108 0x0f9c  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
22:13:24.0178 0x0f9c  WcsPlugInService - ok
22:13:24.0208 0x0f9c  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\Windows\system32\drivers\wd.sys
22:13:24.0218 0x0f9c  Wd - ok
22:13:24.0298 0x0f9c  [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
22:13:24.0348 0x0f9c  Wdf01000 - ok
22:13:24.0398 0x0f9c  [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiServiceHost  C:\Windows\system32\wdi.dll
22:13:24.0448 0x0f9c  WdiServiceHost - ok
22:13:24.0458 0x0f9c  [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiSystemHost   C:\Windows\system32\wdi.dll
22:13:24.0478 0x0f9c  WdiSystemHost - ok
22:13:24.0538 0x0f9c  [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient       C:\Windows\System32\webclnt.dll
22:13:24.0608 0x0f9c  WebClient - ok
22:13:24.0668 0x0f9c  [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc          C:\Windows\system32\wecsvc.dll
22:13:24.0728 0x0f9c  Wecsvc - ok
22:13:24.0738 0x0f9c  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
22:13:24.0788 0x0f9c  wercplsupport - ok
22:13:24.0818 0x0f9c  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\Windows\System32\WerSvc.dll
22:13:24.0898 0x0f9c  WerSvc - ok
22:13:24.0918 0x0f9c  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
22:13:24.0958 0x0f9c  WfpLwf - ok
22:13:24.0978 0x0f9c  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
22:13:24.0998 0x0f9c  WIMMount - ok
22:13:25.0018 0x0f9c  WinDefend - ok
22:13:25.0038 0x0f9c  WinHttpAutoProxySvc - ok
22:13:25.0128 0x0f9c  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
22:13:25.0188 0x0f9c  Winmgmt - ok
22:13:25.0568 0x0f9c  [ D929ABD465A2DED963DA8B30946A8D5C, DE8DBFB01C11D2AE903CBD6A974D6F995E9813CE2D6484B7DA06EAE4C545842A ] WinRM           C:\Windows\system32\WsmSvc.dll
22:13:25.0692 0x0f9c  WinRM - ok
22:13:25.0762 0x0f9c  [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb          C:\Windows\system32\drivers\WinUsb.sys
22:13:25.0782 0x0f9c  WinUsb - ok
22:13:25.0872 0x0f9c  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc         C:\Windows\System32\wlansvc.dll
22:13:25.0952 0x0f9c  Wlansvc - ok
22:13:26.0012 0x0f9c  [ 06C8FA1CF39DE6A735B54D906BA791C6, D8FEC7DE227781CDA876904701B2AA995268F74DCD6CB34AA0296C557FC283B6 ] wlcrasvc        C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
22:13:26.0022 0x0f9c  wlcrasvc - ok
22:13:26.0252 0x0f9c  [ 2BACD71123F42CEA603F4E205E1AE337, 1FEF20554110371D738F462ECFFA999158EFEED02062414C58C1B61C422BF0B9 ] wlidsvc         C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
22:13:26.0352 0x0f9c  wlidsvc - ok
22:13:26.0382 0x0f9c  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys
22:13:26.0412 0x0f9c  WmiAcpi - ok
22:13:26.0442 0x0f9c  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
22:13:26.0492 0x0f9c  wmiApSrv - ok
22:13:26.0532 0x0f9c  WMPNetworkSvc - ok
22:13:26.0602 0x0f9c  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\Windows\System32\wpcsvc.dll
22:13:26.0762 0x0f9c  WPCSvc - ok
22:13:26.0822 0x0f9c  [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
22:13:27.0042 0x0f9c  WPDBusEnum - ok
22:13:27.0072 0x0f9c  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
22:13:27.0102 0x0f9c  ws2ifsl - ok
22:13:27.0142 0x0f9c  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\Windows\System32\wscsvc.dll
22:13:27.0172 0x0f9c  wscsvc - ok
22:13:27.0172 0x0f9c  WSearch - ok
22:13:27.0392 0x0f9c  [ 0814A74C853F50B354F08F83DDA9F7FB, 0A63BAA8DE451B8C2C71FEF961718E769B9BAC305C76D24048C664CB27D0DF28 ] wuauserv        C:\Windows\system32\wuaueng.dll
22:13:27.0552 0x0f9c  wuauserv - ok
22:13:27.0592 0x0f9c  [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
22:13:27.0682 0x0f9c  WudfPf - ok
22:13:27.0732 0x0f9c  [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd          C:\Windows\system32\drivers\WUDFRd.sys
22:13:27.0762 0x0f9c  WUDFRd - ok
22:13:27.0812 0x0f9c  [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
22:13:27.0882 0x0f9c  wudfsvc - ok
22:13:27.0932 0x0f9c  [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc         C:\Windows\System32\wwansvc.dll
22:13:28.0002 0x0f9c  WwanSvc - ok
22:13:28.0022 0x0f9c  ================ Scan global ===============================
22:13:28.0042 0x0f9c  [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
22:13:28.0112 0x0f9c  [ D17DD01601460F5899E5C154B3FD0BFA, B2FCFDE4B6F87634EA1F6D8AEA6D9B3C641D41D999C68B76F95491539B19D422 ] C:\Windows\system32\winsrv.dll
22:13:28.0142 0x0f9c  [ D17DD01601460F5899E5C154B3FD0BFA, B2FCFDE4B6F87634EA1F6D8AEA6D9B3C641D41D999C68B76F95491539B19D422 ] C:\Windows\system32\winsrv.dll
22:13:28.0172 0x0f9c  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
22:13:28.0222 0x0f9c  [ 71C85477DF9347FE8E7BC55768473FCA, A86D6A6D1F5A0EFCD649792A06F3AE9B37158D48493D2ECA7F52DCC1CB9B6536 ] C:\Windows\system32\services.exe
22:13:28.0242 0x0f9c  [ Global ] - ok
22:13:28.0242 0x0f9c  ================ Scan MBR ==================================
22:13:28.0262 0x0f9c  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
22:13:29.0042 0x0f9c  \Device\Harddisk0\DR0 - ok
22:13:29.0042 0x0f9c  ================ Scan VBR ==================================
22:13:29.0062 0x0f9c  [ A0241B462152D0F15B13AA740DE787D7 ] \Device\Harddisk0\DR0\Partition1
22:13:29.0072 0x0f9c  \Device\Harddisk0\DR0\Partition1 - ok
22:13:29.0092 0x0f9c  [ EFC154BFBCC0C3926D6EBADD563F4156 ] \Device\Harddisk0\DR0\Partition2
22:13:29.0132 0x0f9c  \Device\Harddisk0\DR0\Partition2 - ok
22:13:29.0132 0x0f9c  ================ Scan generic autorun ======================
22:13:29.0242 0x0f9c  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
22:13:29.0412 0x0f9c  Sidebar - ok
22:13:29.0442 0x0f9c  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
22:13:29.0472 0x0f9c  mctadmin - ok
22:13:29.0582 0x0f9c  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
22:13:29.0622 0x0f9c  Sidebar - ok
22:13:29.0642 0x0f9c  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
22:13:29.0662 0x0f9c  mctadmin - ok
22:13:29.0702 0x0f9c  [ B22CB67919EBAD88B0E8BB9CDA446010, 2F744FEAC48EDE7D6B6D2727F7DDFA80B26D9E3B0009741B00992B19AD85E128 ] C:\Windows\System32\StikyNot.exe
22:13:29.0762 0x0f9c  RESTART_STICKY_NOTES - ok
22:13:30.0252 0x0f9c  [ D6E2ED7F1F7BE7CCB8676491BF950B57, CBF07EE746F2C27ACC532E83ADC43FBE954DC3C598C4333F13B1A7615AEA9AD5 ] C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe
22:13:30.0422 0x0f9c  Akamai NetSession Interface - ok
22:13:30.0623 0x0f9c  [ 38FFE94BC02E5E7525AEB654CF7A4F55, 426D35DC84B59ECECCFC21ACA74A3A11682BC95232939A5EFFECFCC8FE492A70 ] C:\Program Files (x86)\Steam\steam.exe
22:13:30.0724 0x0f9c  Steam - ok
22:13:30.0804 0x0f9c  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
22:13:30.0864 0x0f9c  Sidebar - ok
22:13:30.0874 0x0f9c  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
22:13:30.0894 0x0f9c  mctadmin - ok
22:13:30.0904 0x0f9c  Waiting for KSN requests completion. In queue: 69
22:13:31.0904 0x0f9c  Waiting for KSN requests completion. In queue: 69
22:13:32.0904 0x0f9c  Waiting for KSN requests completion. In queue: 69
22:13:34.0084 0x0f9c  AV detected via SS2: Kaspersky Internet Security, C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\wmiav.exe ( 15.0.0.463 ), 0x41000 ( enabled : updated )
22:13:34.0114 0x0f9c  FW detected via SS2: Kaspersky Internet Security, C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\wmifw.exe ( 15.0.0.463 ), 0x41010 ( enabled )
22:13:36.0594 0x0f9c  ============================================================
22:13:36.0594 0x0f9c  Scan finished
22:13:36.0594 0x0f9c  ============================================================
22:13:36.0604 0x0b2c  Detected object count: 0
22:13:36.0604 0x0b2c  Actual detected object count: 0

Ergebnis: Szenario 1: "No threats found", Processed: 495 objects
Klingt doch ganz gut...

schrauber · 27.05.2015, 18:13

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Argiel · 27.05.2015, 22:39

Code:

ATTFilter

Combofix Logfile:

	Code: 

 ATTFilter

  
	ComboFix 15-05-25.01 - Sou 27.05.2015  20:34:20.1.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3967.2194 [GMT 2:00]
ausgeführt von:: c:\users\Sou\Desktop\Anti-Malware\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {179979E8-273D-D14E-0543-2861940E4886}
FW: Kaspersky Internet Security *Disabled* {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
SP: Kaspersky Internet Security *Disabled/Updated* {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\IsUn0407.exe
D:\install.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2015-04-27 bis 2015-05-27  ))))))))))))))))))))))))))))))
.
.
2015-05-27 18:49 . 2015-05-27 18:49	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2015-05-27 18:49 . 2015-05-27 18:49	--------	d-----w-	c:\users\Default\AppData\Local\temp
2015-05-27 18:46 . 2015-05-27 18:46	--------	d-----w-	c:\users\Sou\AppData\Local\TempTaskUpdateDetection524569E5-F553-4F79-A4B2-E88183FEFFC1
2015-05-27 18:41 . 2015-05-27 18:41	75888	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{43CCA483-967D-4066-BFFE-8140DCCD9055}\offreg.3676.dll
2015-05-26 19:13 . 2015-05-27 04:11	--------	d-----w-	c:\programdata\Malwarebytes' Anti-Malware (portable)
2015-05-26 14:23 . 2015-05-03 03:16	12214312	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{43CCA483-967D-4066-BFFE-8140DCCD9055}\mpengine.dll
2015-05-26 01:07 . 2015-05-26 01:07	0	----a-w-	c:\windows\SysWow64\shoABA3.tmp
2015-05-25 16:13 . 2015-05-25 16:57	--------	dc----w-	C:\FRST
2015-05-21 16:12 . 2015-05-21 16:12	--------	d-----w-	c:\users\Sou\AppData\Roaming\EurekaLab s.a.s
2015-05-21 10:35 . 2015-05-21 10:35	--------	dc----w-	C:\RegBackup
2015-05-19 01:02 . 2015-05-01 13:17	124112	----a-w-	c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-19 01:02 . 2015-05-01 13:16	102608	----a-w-	c:\windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll
2015-05-18 22:13 . 2015-04-27 19:23	1254400	----a-w-	c:\windows\system32\diagtrack.dll
2015-05-18 22:12 . 2015-04-27 19:23	29184	----a-w-	c:\windows\system32\sspisrv.dll
2015-05-18 22:10 . 2015-04-20 03:17	1647104	----a-w-	c:\windows\system32\DWrite.dll
2015-05-18 22:07 . 2015-03-04 04:41	6656	----a-w-	c:\windows\system32\shimeng.dll
2015-05-18 22:07 . 2015-03-04 04:41	72192	----a-w-	c:\windows\system32\aelupsvc.dll
2015-05-18 22:07 . 2015-03-04 04:41	342016	----a-w-	c:\windows\system32\apphelp.dll
2015-05-18 22:07 . 2015-03-04 04:41	23552	----a-w-	c:\windows\system32\sdbinst.exe
2015-05-18 22:07 . 2015-03-04 04:11	5120	----a-w-	c:\windows\SysWow64\shimeng.dll
2015-05-18 22:07 . 2015-03-04 04:10	295936	----a-w-	c:\windows\SysWow64\apphelp.dll
2015-05-18 22:07 . 2015-03-04 04:10	20992	----a-w-	c:\windows\SysWow64\sdbinst.exe
2015-05-01 18:10 . 2015-05-01 18:10	229608	----a-w-	c:\program files (x86)\Mozilla Firefox\plugins\nppdf32.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-05-27 18:03 . 2014-12-03 11:12	136408	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-05-26 20:03 . 2014-12-03 11:12	107736	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2015-05-19 18:31 . 2012-04-02 16:45	778416	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2015-05-19 18:31 . 2011-06-02 11:49	142512	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-04-30 08:07 . 2011-06-02 11:47	140425016	----a-w-	c:\windows\system32\MRT.exe
2015-04-27 19:04 . 2015-05-18 22:13	44032	----a-w-	c:\windows\apppatch\acwow64.dll
2015-04-19 15:38 . 2015-04-19 15:40	627920	----a-w-	c:\programdata\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
2015-04-14 07:37 . 2014-12-03 11:12	63704	----a-w-	c:\windows\system32\drivers\mwac.sys
2015-04-14 07:37 . 2014-12-03 11:12	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
2015-03-25 03:24 . 2015-04-19 14:49	3298816	----a-w-	c:\windows\system32\wucltux.dll
2015-03-25 03:24 . 2015-04-19 14:49	98304	----a-w-	c:\windows\system32\wudriver.dll
2015-03-25 03:24 . 2015-04-19 14:49	37376	----a-w-	c:\windows\system32\wups2.dll
2015-03-25 03:24 . 2015-04-19 14:49	35328	----a-w-	c:\windows\system32\wups.dll
2015-03-25 03:24 . 2015-04-19 14:49	2553856	----a-w-	c:\windows\system32\wuaueng.dll
2015-03-25 03:24 . 2015-04-19 14:49	191488	----a-w-	c:\windows\system32\wuwebv.dll
2015-03-25 03:24 . 2015-04-19 14:49	696320	----a-w-	c:\windows\system32\wuapi.dll
2015-03-25 03:24 . 2015-04-19 14:49	60416	----a-w-	c:\windows\system32\WinSetupUI.dll
2015-03-25 03:23 . 2015-04-19 14:49	12288	----a-w-	c:\windows\system32\wu.upgrade.ps.dll
2015-03-25 03:23 . 2015-04-19 14:49	36864	----a-w-	c:\windows\system32\wuapp.exe
2015-03-25 03:23 . 2015-04-19 14:49	135168	----a-w-	c:\windows\system32\wuauclt.exe
2015-03-25 03:00 . 2015-04-19 14:49	92672	----a-w-	c:\windows\SysWow64\wudriver.dll
2015-03-25 03:00 . 2015-04-19 14:49	566784	----a-w-	c:\windows\SysWow64\wuapi.dll
2015-03-25 03:00 . 2015-04-19 14:49	29696	----a-w-	c:\windows\SysWow64\wups.dll
2015-03-25 03:00 . 2015-04-19 14:49	173056	----a-w-	c:\windows\SysWow64\wuwebv.dll
2015-03-25 03:00 . 2015-04-19 14:49	33792	----a-w-	c:\windows\SysWow64\wuapp.exe
2015-03-23 19:17 . 2015-03-23 19:17	286720	------w-	c:\windows\Setup1.exe
2015-03-23 19:17 . 2015-03-23 19:17	73216	----a-w-	c:\windows\ST6UNST.EXE
2015-03-23 03:25 . 2015-04-19 14:48	726528	----a-w-	c:\windows\system32\generaltel.dll
2015-03-23 03:25 . 2015-04-19 14:48	769536	----a-w-	c:\windows\system32\invagent.dll
2015-03-23 03:24 . 2015-04-19 14:48	419840	----a-w-	c:\windows\system32\devinv.dll
2015-03-23 03:24 . 2015-04-19 14:48	957952	----a-w-	c:\windows\system32\appraiser.dll
2015-03-23 03:24 . 2015-04-19 14:48	30720	----a-w-	c:\windows\system32\acmigration.dll
2015-03-23 03:24 . 2015-04-19 14:48	227328	----a-w-	c:\windows\system32\aepdu.dll
2015-03-23 03:24 . 2015-04-19 14:48	192000	----a-w-	c:\windows\system32\aepic.dll
2015-03-23 03:17 . 2015-04-19 14:48	1111552	----a-w-	c:\windows\system32\aeinv.dll
2015-03-10 03:25 . 2015-04-19 14:48	1882624	----a-w-	c:\windows\system32\msxml3.dll
2015-03-10 03:21 . 2015-04-19 14:48	2048	----a-w-	c:\windows\system32\msxml3r.dll
2015-03-10 03:08 . 2015-04-19 14:48	1237504	----a-w-	c:\windows\SysWow64\msxml3.dll
2015-03-10 03:05 . 2015-04-19 14:48	2048	----a-w-	c:\windows\SysWow64\msxml3r.dll
2015-03-05 05:12 . 2015-04-19 14:48	404480	----a-w-	c:\windows\system32\gdi32.dll
2015-03-05 04:05 . 2015-04-19 14:48	311808	----a-w-	c:\windows\SysWow64\gdi32.dll
2015-03-04 04:55 . 2015-04-19 14:43	367552	----a-w-	c:\windows\system32\clfs.sys
2015-03-04 04:41 . 2015-04-19 14:43	79360	----a-w-	c:\windows\system32\clfsw32.dll
2015-03-04 04:41 . 2015-05-18 22:07	309248	----a-w-	c:\windows\apppatch\AppPatch64\AcGenral.dll
2015-03-04 04:41 . 2015-05-18 22:07	103424	----a-w-	c:\windows\apppatch\AppPatch64\acspecfc.dll
2015-03-04 04:10 . 2015-04-19 14:43	58880	----a-w-	c:\windows\SysWow64\clfsw32.dll
2015-03-04 04:10 . 2015-05-18 22:07	470528	----a-w-	c:\windows\apppatch\AcSpecfc.dll
2015-03-04 04:10 . 2015-05-18 22:07	2178560	----a-w-	c:\windows\apppatch\AcGenral.dll
2015-03-04 04:06 . 2015-05-18 22:07	2560	----a-w-	c:\windows\apppatch\AcRes.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\  00BitrixShellExt]
@="{A11A1EE5-F9F8-4BE0-907F-D74A49CC506B}"
[HKEY_CLASSES_ROOT\CLSID\{A11A1EE5-F9F8-4BE0-907F-D74A49CC506B}]
2014-11-11 15:33	2686608	----a-w-	c:\program files (x86)\Bitrix24\32\BitrixShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\  00BitrixShellExt_C]
@="{A11A1EE5-F9F8-4BE0-907F-D74A49CC506E}"
[HKEY_CLASSES_ROOT\CLSID\{A11A1EE5-F9F8-4BE0-907F-D74A49CC506E}]
2014-11-11 15:33	2686608	----a-w-	c:\program files (x86)\Bitrix24\32\BitrixShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\  00BitrixShellExt_E]
@="{A11A1EE5-F9F8-4BE0-907F-D74A49CC506D}"
[HKEY_CLASSES_ROOT\CLSID\{A11A1EE5-F9F8-4BE0-907F-D74A49CC506D}]
2014-11-11 15:33	2686608	----a-w-	c:\program files (x86)\Bitrix24\32\BitrixShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\  00BitrixShellExt_S]
@="{A11A1EE5-F9F8-4BE0-907F-D74A49CC506C}"
[HKEY_CLASSES_ROOT\CLSID\{A11A1EE5-F9F8-4BE0-907F-D74A49CC506C}]
2014-11-11 15:33	2686608	----a-w-	c:\program files (x86)\Bitrix24\32\BitrixShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive1]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2015-04-19 15:48	329376	----a-w-	c:\users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive2]
@="{5AB7172C-9C11-405C-8DD5-AF20F3606282}"
[HKEY_CLASSES_ROOT\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}]
2015-04-19 15:48	329376	----a-w-	c:\users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive3]
@="{A78ED123-AB77-406B-9962-2A5D9D2F7F30}"
[HKEY_CLASSES_ROOT\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}]
2015-04-19 15:48	329376	----a-w-	c:\users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive4]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2015-04-19 15:48	329376	----a-w-	c:\users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive5]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2015-04-19 15:48	329376	----a-w-	c:\users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Akamai NetSession Interface"="c:\users\Sou\AppData\Local\Akamai\netsession_win.exe" [2014-10-29 4673432]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2015-05-15 2888384]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"DSL Soforthilfe"="c:\program files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe" [2013-11-21 20585888]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-12-19 1022152]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 adp3132;adp3132;c:\windows\system32\drivers\adp3132.sys;c:\windows\SYSNATIVE\drivers\adp3132.sys [x]
R3 ahcix64s;ahcix64s;c:\windows\system32\drivers\ahcix64s.sys;c:\windows\SYSNATIVE\drivers\ahcix64s.sys [x]
R3 amd_sata;amd_sata;c:\windows\system32\drivers\amd_sata.sys;c:\windows\SYSNATIVE\drivers\amd_sata.sys [x]
R3 amdide64;amdide64;c:\windows\system32\drivers\amdide64.sys;c:\windows\SYSNATIVE\drivers\amdide64.sys [x]
R3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\drivers\asmthub3.sys;c:\windows\SYSNATIVE\drivers\asmthub3.sys [x]
R3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\drivers\asmtxhci.sys;c:\windows\SYSNATIVE\drivers\asmtxhci.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver;c:\windows\system32\drivers\FLxHCIc.sys;c:\windows\SYSNATIVE\drivers\FLxHCIc.sys [x]
R3 FLxHCIh;Fresco Logic xHCI (USB3) Hub Device Driver;c:\windows\system32\drivers\FLxHCIh.sys;c:\windows\SYSNATIVE\drivers\FLxHCIh.sys [x]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\SysWOW64\FsUsbExDisk.SYS;c:\windows\SysWOW64\FsUsbExDisk.SYS [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys;c:\windows\SYSNATIVE\drivers\Impcd.sys [x]
R3 ISASerial;PCIe-ISA Communication Port;c:\windows\system32\drivers\ISASerial.sys;c:\windows\SYSNATIVE\drivers\ISASerial.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 MtsHID;TechniSat Mantis BDA HID Driver;c:\windows\system32\drivers\MtsHID.sys;c:\windows\SYSNATIVE\drivers\MtsHID.sys [x]
R3 mv91cons;mv91cons;c:\windows\system32\drivers\mv91cons.sys;c:\windows\SYSNATIVE\drivers\mv91cons.sys [x]
R3 mv91xx;mv91xx;c:\windows\system32\drivers\mv91xx.sys;c:\windows\SYSNATIVE\drivers\mv91xx.sys [x]
R3 NmPar;MosChip PCI Parallel Port;c:\windows\system32\drivers\NmPar.sys;c:\windows\SYSNATIVE\drivers\NmPar.sys [x]
R3 nmserial;MosChip PCI Serial Port;c:\windows\system32\drivers\nmserial.sys;c:\windows\SYSNATIVE\drivers\nmserial.sys [x]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys;c:\windows\SYSNATIVE\drivers\nusb3hub.sys [x]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x]
R3 nvamacpi;nvamacpi;c:\windows\system32\drivers\NVAMACPI.sys;c:\windows\SYSNATIVE\drivers\NVAMACPI.sys [x]
R3 PciIsaSerial;PCI-ISA Communication Port;c:\windows\system32\drivers\PciIsaSerial.sys;c:\windows\SYSNATIVE\drivers\PciIsaSerial.sys [x]
R3 PciPPorts;PCI ECP Parallel Port;c:\windows\system32\drivers\PciPPorts.sys;c:\windows\SYSNATIVE\drivers\PciPPorts.sys [x]
R3 PciSPorts;High-Speed PCI Serial Port;c:\windows\system32\drivers\PciSPorts.sys;c:\windows\SYSNATIVE\drivers\PciSPorts.sys [x]
R3 PPorts;PCIe ECP Parallel Port;c:\windows\system32\drivers\PPorts.sys;c:\windows\SYSNATIVE\drivers\PPorts.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Si3124r5;Si3124r5;c:\windows\system32\drivers\Si3124r5.sys;c:\windows\SYSNATIVE\drivers\Si3124r5.sys [x]
R3 SPorts;High-Speed PCIe Serial Port;c:\windows\system32\drivers\SPorts.sys;c:\windows\SYSNATIVE\drivers\SPorts.sys [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys;c:\windows\SYSNATIVE\Drivers\TFsExDisk.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 BrYNSvc;BrYNSvc;c:\program files (x86)\Browny02\BrYNSvc.exe;c:\program files (x86)\Browny02\BrYNSvc.exe [x]
R4 LiveUpdateSvc;LiveUpdate;c:\program files (x86)\IObit\LiveUpdate\LiveUpdate.exe;c:\program files (x86)\IObit\LiveUpdate\LiveUpdate.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 amd_xata;amd_xata;c:\windows\system32\drivers\amd_xata.sys;c:\windows\SYSNATIVE\drivers\amd_xata.sys [x]
S1 klhk;klhk;c:\windows\system32\DRIVERS\klhk.sys;c:\windows\SYSNATIVE\DRIVERS\klhk.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 klpd;klpd;c:\windows\system32\DRIVERS\klpd.sys;c:\windows\SYSNATIVE\DRIVERS\klpd.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AVP15.0.0;Kaspersky Anti-Virus Service 15.0.0;c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe;c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [x]
S2 ClickToRunSvc;Microsoft Office-Klick-und-Los-Dienst;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S3 Apowersoft_AudioDevice;Apowersoft_AudioDevice;c:\windows\system32\drivers\Apowersoft_AudioDevice.sys;c:\windows\SYSNATIVE\drivers\Apowersoft_AudioDevice.sys [x]
S3 klflt;Kaspersky Lab Kernel DLL;c:\windows\system32\DRIVERS\klflt.sys;c:\windows\SYSNATIVE\DRIVERS\klflt.sys [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08
.
Inhalt des "geplante Tasks" Ordners
.
2015-05-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 18:31]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}]
2013-12-14 17:14	2486592	----a-w-	c:\program files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\  00BitrixShellExt]
@="{A11A1EE5-F9F8-4BE0-907F-D74A49CC506B}"
[HKEY_CLASSES_ROOT\CLSID\{A11A1EE5-F9F8-4BE0-907F-D74A49CC506B}]
2014-11-11 15:33	2705552	----a-w-	c:\program files (x86)\Bitrix24\64\BitrixShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\  00BitrixShellExt_C]
@="{A11A1EE5-F9F8-4BE0-907F-D74A49CC506E}"
[HKEY_CLASSES_ROOT\CLSID\{A11A1EE5-F9F8-4BE0-907F-D74A49CC506E}]
2014-11-11 15:33	2705552	----a-w-	c:\program files (x86)\Bitrix24\64\BitrixShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\  00BitrixShellExt_E]
@="{A11A1EE5-F9F8-4BE0-907F-D74A49CC506D}"
[HKEY_CLASSES_ROOT\CLSID\{A11A1EE5-F9F8-4BE0-907F-D74A49CC506D}]
2014-11-11 15:33	2705552	----a-w-	c:\program files (x86)\Bitrix24\64\BitrixShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\  00BitrixShellExt_S]
@="{A11A1EE5-F9F8-4BE0-907F-D74A49CC506C}"
[HKEY_CLASSES_ROOT\CLSID\{A11A1EE5-F9F8-4BE0-907F-D74A49CC506C}]
2014-11-11 15:33	2705552	----a-w-	c:\program files (x86)\Bitrix24\64\BitrixShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive1]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2015-04-19 15:48	358064	----a-w-	c:\users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive2]
@="{5AB7172C-9C11-405C-8DD5-AF20F3606282}"
[HKEY_CLASSES_ROOT\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}]
2015-04-19 15:48	358064	----a-w-	c:\users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive3]
@="{A78ED123-AB77-406B-9962-2A5D9D2F7F30}"
[HKEY_CLASSES_ROOT\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}]
2015-04-19 15:48	358064	----a-w-	c:\users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive4]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2015-04-19 15:48	358064	----a-w-	c:\users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ OneDrive5]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2015-04-19 15:48	358064	----a-w-	c:\users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2015-04-14 14:30	2334936	----a-w-	c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2015-04-14 14:30	2334936	----a-w-	c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2015-04-14 14:30	2334936	----a-w-	c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\grooveex.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
IE: Download with Xilisoft Download YouTube Video - c:\program files (x86)\Xilisoft\Download YouTube Video\upod_link.HTM
IE: E&xport to Microsoft Excel - c:\program files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
IE: Free YouTube Download - c:\users\Sou\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Se&nd to OneNote - c:\program files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
IE: Zu Anti-Banner hinzufügen - c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\ie_banner_deny.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1564645244-1967886891-1609600129-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:63,00,4c,07,9a,ed,af,b9,ff,51,f1,08,b1,6d,f7,d2,1e,cf,8f,fb,4d,fd,8e,
   55,71,ef,eb,f7,f8,0c,89,ba,ab,23,53,c6,0f,3c,26,ff,cf,5f,38,86,a5,0a,2a,b3,\
"??"=hex:2f,5c,cb,8d,45,90,08,88,81,9e,dc,4e,a4,0c,46,34
.
[HKEY_USERS\S-1-5-21-1564645244-1967886891-1609600129-1000\Software\SecuROM\License information*]
"datasecu"=hex:30,b1,4b,e8,ba,0f,93,ea,f5,14,13,fd,88,a6,33,a0,71,36,46,83,42,
   c5,13,5d,7d,1b,04,53,f6,6d,ea,56,d0,c3,a6,01,41,f9,90,dd,45,c6,72,b3,f3,86,\
"rkeysecu"=hex:82,c3,15,4f,bb,1d,3b,7f,84,f5,53,93,76,d6,d1,ff
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.15"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-05-27  21:12:25
ComboFix-quarantined-files.txt  2015-05-27 19:12
.
Vor Suchlauf: 11 Verzeichnis(se), 21.716.738.048 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 23.526.854.656 Bytes frei
.
- - End Of File - - 3B445C7D79A296A512A26F5506082250
         
 --- --- ---
A36C5E4F47E84449FF07ED3517B43A31

Hallo schrauber, es gab keine Zwischenmeldungen, kein Gezicke

Ok, ab jetzt kann ich bis kommenden Dienstag nicht mehr an diesen PC, da auf Reisen. Vielen Dank für die Hilfe bis jetzt - der PC läuft jetzt bereits wieder ziemlich fix, ab & zu kommt bei manchen Seitenaufbauten (z.B. spiegel.de) trotzdem noch immer oft "Keine Rückmeldung"...Dir ein entspanntes entwurmtes Wochenende

schrauber · 28.05.2015, 19:55

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Argiel · 02.06.2015, 21:39

Hallo schrauber, weiter gehts - vielen Dank bis hierher

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 02.06.2015
Suchlauf-Zeit: 21:07:45
Logdatei: MBAM neu.txt
Administrator: Ja

Version: 2.01.6.1022
Malware Datenbank: v2015.06.02.05
Rootkit Datenbank: v2015.06.02.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Sou

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 434739
Verstrichene Zeit: 50 Min, 45 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 0
(Keine schädliche Elemente gefunden)

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 0
(Keine schädliche Elemente gefunden)

Dateien: 0
(Keine schädliche Elemente gefunden)

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)

AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v4.206 - Bericht erstellt 02/06/2015 um 22:13:09
# Aktualisiert 01/06/2015 von Xplode
# Datenbank : 2015-06-01.1 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : Sou - SOU-ARLT
# Gestarted von : C:\Users\Sou\Desktop\AdwCleaner_4.206.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files (x86)\DriverToolkit
Ordner Gelöscht : C:\Users\Sou\AppData\Local\DriverToolkit
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\plugins\npmieze.dll

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SDP
Schlüssel Gelöscht : HKCU\Software\OCS
Daten Gelöscht : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <local>
Daten Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <local>

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17801


-\\ Mozilla Firefox v38.0.5 (x86 de)


-\\ Chromium v


*************************

AdwCleaner[R0].txt - [36877 Bytes] - [03/12/2014 12:52:09]
AdwCleaner[R1].txt - [2742 Bytes] - [21/05/2015 11:43:05]
AdwCleaner[R2].txt - [1601 Bytes] - [02/06/2015 22:10:50]
AdwCleaner[S0].txt - [37209 Bytes] - [03/12/2014 12:55:01]
AdwCleaner[S1].txt - [2677 Bytes] - [21/05/2015 11:45:00]
AdwCleaner[S2].txt - [1475 Bytes] - [02/06/2015 22:13:09]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1534  Bytes] ##########

--- --- ---

[/CODE]

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.8.7 (06.01.2015:1)
OS: Windows 7 Home Premium x64
Ran by Sou on 02.06.2015 at 22:20:24,37
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values



~~~ Registry Keys



~~~ Files

Successfully deleted: [File] C:\Windows\syswow64\shoABA3.tmp



~~~ Folders

Successfully deleted: [Folder] C:\ProgramData\productdata



~~~ FireFox

Emptied folder: C:\Users\Sou\AppData\Roaming\mozilla\firefox\profiles\8rhavx4s.default-1409726291174\minidumps [1 files]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 02.06.2015 at 22:25:33,37
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST.txt - Teil 1

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 29-05-2015
Ran by Sou (administrator) on SOU-ARLT on 02-06-2015 22:29:39
Running from C:\Users\Sou\Desktop\Anti-Malware
Loaded Profiles: Sou (Available Profiles: Sou & UpdatusUser)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [DSL Soforthilfe] => C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe [20585888 2013-11-21] ()
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-30] (Akamai Technologies, Inc.)
HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2892992 2015-06-02] (Valve Corporation)
HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
ShellIconOverlayIdentifiers: [  00BitrixShellExt] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506B} => C:\Program Files (x86)\Bitrix24\64\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers: [  00BitrixShellExt_C] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506E} => C:\Program Files (x86)\Bitrix24\64\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers: [  00BitrixShellExt_E] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506D} => C:\Program Files (x86)\Bitrix24\64\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers: [  00BitrixShellExt_S] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506C} => C:\Program Files (x86)\Bitrix24\64\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: [  00BitrixShellExt] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506B} => C:\Program Files (x86)\Bitrix24\32\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers-x32: [  00BitrixShellExt_C] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506E} => C:\Program Files (x86)\Bitrix24\32\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers-x32: [  00BitrixShellExt_E] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506D} => C:\Program Files (x86)\Bitrix24\32\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers-x32: [  00BitrixShellExt_S] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506C} => C:\Program Files (x86)\Bitrix24\32\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll [2015-04-19] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll [2013-12-14] (IObit)
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-04-19] (Microsoft Corporation)
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-12-03] (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-04-14] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-09-20] (Hewlett-Packard Co.)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-12-03] (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-24] (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2012-03-08] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-04-14] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-24] (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-09-20] (Hewlett-Packard Co.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-04-19] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174
FF Homepage: hxxp://www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-19] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-19] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-24] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-24] (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-12-03] ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-12-03] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-12-03] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-04-19] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2012-09-13] (Pando Networks)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1564645244-1967886891-1609600129-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin1017325.dll [2012-10-04] (Amazon.com, Inc.)
FF Plugin HKU\S-1-5-21-1564645244-1967886891-1609600129-1000: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2012-09-13] (Pando Networks)
FF Plugin HKU\S-1-5-21-1564645244-1967886891-1609600129-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2015-03-12] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Extension: FoxyDeal - C:\Users\Sou\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{F58A62EB-38DC-43C4-A539-DC52E135208D} [2013-05-08]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\Extensions\adblockpopups@jessehakanen.net.xpi [2014-09-08]
FF Extension: Element Hiding Helper for Adblock Plus - C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\Extensions\elemhidehelper@adblockplus.org.xpi [2014-09-08]
FF Extension: Bitrix Intranet Integration - C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\Extensions\ff_bx_integration@bitrixsoft.com.xpi [2014-11-07]
FF Extension: Ghostery - C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\Extensions\firefox@ghostery.com.xpi [2014-09-08]
FF Extension: Facebook Secret Emoticons - C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\Extensions\jid0-XZn6pYCdV3ANrfYigxlyyGDrxAM@jetpack.xpi [2014-09-14]
FF Extension: Adblock Plus - C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-09-08]
FF Extension: Adblock Edge - C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-09-08]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak [2014-02-15]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak [2014-02-15]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-02-15]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-06-10]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-12-03]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-12-03]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-12-03]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-12-03]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-12-03]
FF HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [icmijdhkcgeclpfjmibnginbbkfcbpep] - C:\Program Files\SearchGBY\Extensions\Chrome\searchgby.chrome.v0.9.55.crx [2012-07-06]
CHR HKLM-x32\...\Chrome\Extension: [pnbbffeddnekkhjmokkhdebbfbibbflc] - C:\Program Files (x86)\LyricsPal\128.crx [Not Found]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
S4 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2736824 2015-04-07] (Microsoft Corporation)
S3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]
S4 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2151744 2013-12-14] (IObit)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
S4 ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [430592 2008-04-07] (Nokia.) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 adp3132; C:\Windows\system32\drivers\adp3132.sys [385072 2010-01-28] (Adaptec, Inc.)
S3 amdide64; C:\Windows\system32\drivers\amdide64.sys [10632 2007-10-12] (Advanced Micro Devices)
R3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2013-06-02] (Wondershare)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [88480 2013-07-09] ()
S3 FLxHCIh; C:\Windows\system32\drivers\FLxHCIh.sys [44544 2010-04-17] (Fresco Logic)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-10-30] () [File not signed]
S3 ISASerial; C:\Windows\system32\drivers\ISASerial.sys [72192 2008-02-20] (Windows (R) Codename Longhorn DDK provider)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [141320 2014-12-03] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [793800 2014-12-03] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [46400 2013-07-09] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-06-02] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
S3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-07-16] ()
S3 MtsHID; C:\Windows\system32\drivers\MtsHID.sys [27664 2009-07-15] (TechniSat Provide)
S3 nvamacpi; C:\Windows\system32\drivers\NVAMACPI.sys [28192 2009-07-17] (NVIDIA Corporation)
S3 nvrd64; C:\Windows\system32\drivers\nvrd64.sys [175648 2009-08-04] (NVIDIA Corporation)
S3 PciIsaSerial; C:\Windows\system32\drivers\PciIsaSerial.sys [72192 2008-05-22] (Windows (R) Codename Longhorn DDK provider)
S3 PciPPorts; C:\Windows\system32\drivers\PciPPorts.sys [95744 2008-05-22] ()
S3 PciSPorts; C:\Windows\system32\drivers\PciSPorts.sys [126464 2008-05-22] ()
S3 PPorts; C:\Windows\system32\drivers\PPorts.sys [95744 2008-02-20] ()
S3 Si3124r5; C:\Windows\system32\drivers\Si3124r5.sys [340008 2010-04-13] (Silicon Image, Inc)
R0 SiFilter; C:\Windows\System32\drivers\SiWinAcc.sys [22568 2010-04-13] (Silicon Image, Inc.)
R0 SiRemFil; C:\Windows\System32\drivers\SiRemFil.sys [16936 2010-04-13] (Silicon Image, Inc.)
S3 SPorts; C:\Windows\system32\drivers\SPorts.sys [124416 2008-02-20] ()
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [52736 2012-04-25] (Apple, Inc.) [File not signed]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 NmPar; \SystemRoot\system32\drivers\NmPar.sys [X]
S3 nmserial; \SystemRoot\system32\drivers\nmserial.sys [X]

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\drivers\adp3132.sys 132190688D8E51D61F88A150D7DF9FB4
C:\Windows\system32\drivers\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys FA886682CFC5D36718D3E436AACF10B9
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\ahcix64s.sys AF53917D9741A84627FA689EA622558A
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide64.sys D52A2E98C5EEFF88CED28793B6B04D84
C:\Windows\system32\drivers\amdk8.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\atikmdag.sys DCC8177244FE79C61C4E73C65E63922A
C:\Windows\System32\DRIVERS\atikmpag.sys 7FE67D107329DC2CF89136A8E19BCEB7
C:\Windows\System32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49
C:\Windows\System32\drivers\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048
C:\Windows\system32\drivers\amd_sata.sys 80A508D0C7A21BC13C01D4C671541203
C:\Windows\System32\drivers\amd_xata.sys 2BE940F3A632A1A301B22B096BF221F1
C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys C65A3C67630A67A97AD26C21173BA61E
C:\Windows\system32\drivers\appid.sys 90C53BD47979FB8814F465A08B885102
C:\Windows\system32\drivers\arc.sys D73AAD4946051D074909FDFD34D94C7B
C:\Windows\system32\drivers\arcsas.sys 46E8C3EB03224A1E55C6F0C100A9D2CC
C:\Windows\system32\drivers\asmthub3.sys E3B9C89D2ED4A538AB2FC6EC76FA2B17
C:\Windows\system32\drivers\asmtxhci.sys 88CE83BE5176020BE39194A6369AF2C2
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\atksgt.sys B4BDE3F758A34658A37DFED3D9783CD8
C:\Windows\system32\drivers\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bridge.sys 5C2F352A4E961D72518261257AAE204B
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\drivers\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\drivers\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys 404B7DF9CA4D1CB675045AF220FF3285
C:\Windows\system32\drivers\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 27667A788130A7F7A5858DE27572E6D7
C:\Windows\system32\drivers\compbatt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ssudbus.sys E428DFFA96FAD07D8CA3C9082563A225
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\drivers\disk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Dot4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Dot4Prt.sys E9F5969233C5D89F3C35E3A66A52A361
C:\Windows\System32\DRIVERS\dot4usb.sys ==> MD5 is legit
C:\Windows\system32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys 87CE5C8965E101CCCED1F4675557E868
C:\Windows\system32\drivers\evbda.sys ==> MD5 is legit
C:\Windows\system32\drivers\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\drivers\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\drivers\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\system32\drivers\FLxHCIc.sys E35F19855192D025DA41E8DFA318206A
C:\Windows\system32\drivers\FLxHCIh.sys BBBD5D42D8CB3AD0F43F7BC4DB92EB5E
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\fssfltr.sys 07DA62C960DDCCC2D35836AEAB4FC578
C:\Windows\SysWOW64\FsUsbExDisk.SYS DDEE99DC54EFA20BD5A442CD733C4462
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0
C:\Windows\system32\drivers\gagp30kx.sys ==> MD5 is legit
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\System32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A
C:\Windows\System32\DRIVERS\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidbth.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys F61634BEC53F73702A10DE69F6DCAF57
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\i8042prt.sys ==> MD5 is legit
C:\Windows\system32\drivers\iaStor.sys D7921D5A870B11CC1ADAB198A519D50A
C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366
C:\Windows\system32\drivers\iirsp.sys ==> MD5 is legit
C:\Windows\system32\drivers\Impcd.sys DD587A55390ED2295BCE6D36AD567DA9
C:\Windows\System32\drivers\RTKVHD64.sys 9297BC7FB61F58670EE176DD18F4DD92
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\system32\drivers\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ISASerial.sys AC45D94185CF67267D06BF2F45E9E31E
C:\Windows\system32\drivers\msiscsi.sys 96BB922A0981BC7432C8CF52B5410FE6
C:\Windows\system32\drivers\jraid.sys 50DE7DD7EDB1B512B13666588AEFBF6F
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kl1.sys 67D1F7FA1DF9502DE12027D7C7782863
C:\Windows\System32\DRIVERS\klflt.sys 2A88EFE87B5F23BA47FF7AF2DEAEB98F
C:\Windows\System32\DRIVERS\klhk.sys 7ED6B6805B3E1BC9DC2418F1C5C920B4
C:\Windows\System32\DRIVERS\klif.sys CD81447AB991F3E7F1FCF59CEA07D1E0
C:\Windows\System32\DRIVERS\klim6.sys FEAD1F401CBE9383A642877A6EA1398F
C:\Windows\System32\DRIVERS\klkbdflt.sys 3FAE739F2AFEA18BCBB9C5E7DC6E889D
C:\Windows\System32\DRIVERS\klmouflt.sys 72CF64FBF38CD681FA7F37176047E967
C:\Windows\System32\DRIVERS\klpd.sys 8C0EC95AD65A0DE3D6C040591D02BF02
C:\Windows\System32\DRIVERS\kltdi.sys 5BB9E329FE48904108BBBF9C73073920
C:\Windows\System32\DRIVERS\kneps.sys D043624FE4AE0A4894A785097C02EF09
C:\Windows\System32\Drivers\ksecdd.sys F7DFAE6040AC910B7C64EE208A34157D
C:\Windows\System32\Drivers\ksecpkg.sys 8FE94F2EF9BF444E93E35D87E210D02F
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\lirsgt.sys 955982BF4421B77722196552B62E8DC2
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\lvrs64.sys 0C85B2B6FB74B36A251792D45E0EF860
C:\Windows\system32\drivers\mbam.sys 1E9E32AEC3E1EB1B31B8169F33168B56
C:\Windows\system32\drivers\MBAMSwissArmy.sys E9CD058C79EA15B4AA93E259FA713B07
C:\Windows\system32\drivers\mwac.sys F49FB3C88E263AE9A246593B0BB29294
C:\Windows\system32\drivers\megasas.sys ==> MD5 is legit
C:\Windows\system32\drivers\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys 87BCD1034CBF33537D4D4C251D39BA26
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys AE3334958D8F631FF14A0AEB3D7EFB3A
C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC
C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163
C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C
C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\drivers\MTConfig.sys ==> MD5 is legit
C:\Windows\system32\drivers\ASACPI.sys 19B006B181E3875FD254F7B67ACF1E7C
C:\Windows\system32\drivers\MtsHID.sys 07AD6825D5C658595CAB7F8F5849401C
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\system32\drivers\mv91cons.sys 049F1ED7F1B5DBB9D6C8767E7DE02741
C:\Windows\system32\drivers\mv91xx.sys 4FAD606C7AEB336E5AA4A005DE09CA80
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 760E38053BF56E501D562B70AD796B88
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\system32\drivers\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys 1A29A59A4C5BA6F8C85062A613B7E2B2
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nusb3hub.sys 158AD24745BD85BA9BE3C51C38F48C32
C:\Windows\system32\drivers\nusb3xhc.sys D40A13B2C0891E218F9523B376955DB6
C:\Windows\system32\drivers\NVAMACPI.sys 7FD5C060CB907489A5702F628226F54A
C:\Windows\System32\DRIVERS\nvlddmkm.sys 8E6247F418B4C8AE9EEB0B532CABCC21
C:\Windows\System32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD
C:\Windows\system32\drivers\nvrd64.sys 694F5E9D9D624D47F432F5B2E66A0528
C:\Windows\system32\drivers\nvsmu.sys E58D81FB8616D0CB55C1E36AA0B213C9
C:\Windows\System32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A
C:\Windows\System32\drivers\nvstor64.sys 05DE5DC43AFE6CAB78F9C7CA044CBCBE
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\DRIVERS\pccsmcfdx64.sys 81B5E63131090879AD6EF9F32109B88D
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\System32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\drivers\PciIsaSerial.sys D7C203015E2C2A2EAC8DACEF156D8DC3
C:\Windows\system32\drivers\PciPPorts.sys 088B509B2F35A3CEE00AC0E0BC4C5BED
C:\Windows\system32\drivers\PciSPorts.sys 7F97CDD5E91FC73DA2B01344957AA058
C:\Windows\system32\drivers\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ED6E75158D28D33A2E2A020AC5B2B59D
C:\Windows\system32\drivers\PPorts.sys 14C04684A25C221EBE2105D169B4B6FF
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\drivers\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql2300.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\drivers\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpvideominiport.sys 313F68E1A3E6345A4F47A36B07062F34
C:\Windows\System32\Drivers\RDPWD.sys FE571E088C2D83619D2D48D4E961BF41
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Rt64win7.sys AFC12DFA4C7B089673AD67402CA19EDB
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\drivers\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\drivers\sfloppy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Sftfslh.sys 21AB491BBCC8C1B26FDC402A374AB196
C:\Windows\System32\DRIVERS\Sftplaylh.sys 3B8D43FEEFF7A187534DDDFD675FE123
C:\Windows\System32\DRIVERS\Sftredirlh.sys F1D1B1DC7A8765A09D7640FBF8D20970
C:\Windows\System32\DRIVERS\Sftvollh.sys B3B9ADE7F8C4AF0C20E712E040588543
C:\Windows\system32\drivers\Si3124r5.sys DA492C8305434EC6F9BDD60C8B83B10E
C:\Windows\System32\drivers\SiWinAcc.sys 8D10887A1699CF61E74467694B929B09
C:\Windows\System32\drivers\SiRemFil.sys 94E1EDA9A0B305A67EE1BBD0A68CE21A
C:\Windows\system32\drivers\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\system32\drivers\SPorts.sys 739C2571867F351167D1D958990E9D84
C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B
C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28
C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3
C:\Windows\System32\DRIVERS\ssudmdm.sys AAF6F247F1DC370C593B4430974EAD9C
C:\Windows\system32\drivers\stexstor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\swenum.sys ==> MD5 is legit
C:\Windows\System32\drivers\tcpip.sys 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E
C:\Windows\System32\DRIVERS\tcpip.sys 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E
C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\tdx.sys 70988118145F5F10EF24720B97F35F65
C:\Windows\System32\DRIVERS\termdd.sys ==> MD5 is legit
C:\Windows\SysWOW64\Drivers\TFsExDisk.sys CE4B6956E4E12492715A53076E58761F
C:\Windows\System32\DRIVERS\tssecsrv.sys E232A3B43A894BB327FC161529BD9ED1
C:\Windows\System32\drivers\tsusbflt.sys E9981ECE8D894CEF7038FD1D040EB426
C:\Windows\system32\drivers\TsUsbGD.sys AD64450A4ABE076F5CB34CC08EEACB07
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\drivers\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\umpass.sys ==> MD5 is legit
C:\Windows\System32\Drivers\usbaapl64.sys FB251567F41BC61988B26731DEC19E4B
C:\Windows\System32\drivers\usbaudio.sys B0435098C81D04CAFFF80DDB746CD3A2
C:\Windows\System32\DRIVERS\usbccgp.sys DCA68B0943D6FA415F0C56C92158A83A
C:\Windows\system32\drivers\usbcir.sys 80B0F7D5CCF86CEB5D402EAAF61FEC31
C:\Windows\System32\DRIVERS\usbehci.sys 18A85013A3E0F7E1755365D287443965
C:\Windows\System32\DRIVERS\usbhub.sys 8D1196CFBB223621F2C67D45710F25BA
C:\Windows\System32\DRIVERS\usbohci.sys 765A92D428A8DB88B960DA5A8D6089DC
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbscan.sys 9661DA76B4531B2DA272ECCE25A8AF24
C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6
C:\Windows\system32\drivers\usbuhci.sys DD253AFC3BC6CBA412342DE60C3647F3
C:\Windows\System32\Drivers\usbvideo.sys 1F775DA4CF1A3A1834207E975A72E9D7
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\drivers\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\drivers\vwifibus.sys ==> MD5 is legit
C:\Windows\system32\drivers\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\drivers\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys E2C933EDBC389386EBE6D2BA953F43D8
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWOW64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\system32\drivers\WinUsb.sys FE88B288356E7B47B74B13372ADD906D
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F
C:\Windows\system32\drivers\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659

FRST.txt - Teil 2

Code:

ATTFilter

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Three Months Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-02 22:25 - 2015-06-02 22:28 - 00000866 _____ () C:\Users\Sou\Desktop\JRT.txt
2015-06-02 22:18 - 2015-06-02 22:18 - 02947766 _____ (Thisisu) C:\Users\Sou\Desktop\JRT.exe
2015-06-02 22:18 - 2015-06-02 22:18 - 00001614 _____ () C:\Users\Sou\Desktop\AdwCleaner[S2].txt
2015-06-02 22:10 - 2015-06-02 22:10 - 02231296 _____ () C:\Users\Sou\Desktop\AdwCleaner_4.206.exe
2015-05-27 21:12 - 2015-05-27 21:12 - 00033309 ____C () C:\ComboFix.txt
2015-05-27 20:32 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-05-27 20:32 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-05-27 20:32 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-05-27 20:32 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-05-27 20:32 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-05-27 20:32 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-05-27 20:32 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-05-27 20:32 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-05-27 20:30 - 2015-05-27 21:13 - 00000000 ___DC () C:\Qoobox
2015-05-27 20:30 - 2015-05-27 21:05 - 00000000 ____D () C:\Windows\erdnt
2015-05-26 22:00 - 2015-06-02 22:13 - 00002114 _____ () C:\Windows\PFRO.log
2015-05-26 21:13 - 2015-05-27 06:11 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-05-26 21:10 - 2015-05-26 23:06 - 00000000 ____D () C:\Users\Sou\Desktop\mbar
2015-05-25 21:21 - 2015-05-25 21:21 - 01182149 _____ () C:\Users\Sou\Downloads\7z936.exe
2015-05-25 21:21 - 2015-05-25 21:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2015-05-25 18:13 - 2015-06-02 22:29 - 00000000 ___DC () C:\FRST
2015-05-25 18:11 - 2015-05-25 18:11 - 00000000 _____ () C:\Users\Sou\defogger_reenable
2015-05-21 18:12 - 2015-05-21 18:12 - 00000000 ____D () C:\Users\Sou\AppData\Roaming\EurekaLab s.a.s
2015-05-21 12:35 - 2015-05-21 12:35 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-SOU-ARLT-Windows-7-Home-Premium-(64-bit).dat
2015-05-21 12:35 - 2015-05-21 12:35 - 00000000 ___DC () C:\RegBackup
2015-05-21 11:46 - 2015-06-02 22:29 - 00000000 ____D () C:\Users\Sou\Desktop\Anti-Malware
2015-05-20 09:57 - 2015-05-20 09:57 - 51789024 _____ (Microsoft Corporation) C:\Users\Sou\Downloads\Windows-KB890830-x64-v5.24.exe
2015-05-19 22:10 - 2015-06-02 22:14 - 00001176 _____ () C:\Windows\setupact.log
2015-05-19 22:10 - 2015-05-19 22:10 - 00000000 _____ () C:\Windows\setuperr.log
2015-05-19 22:02 - 2015-05-19 22:02 - 00274782 _____ () C:\Users\Sou\Documents\cc_20150519_220207.reg
2015-05-19 03:02 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-19 03:02 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-19 00:16 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-19 00:16 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-19 00:16 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-19 00:16 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-19 00:16 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-19 00:16 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-19 00:16 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-19 00:16 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-19 00:16 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-19 00:16 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-19 00:16 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-19 00:16 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-19 00:16 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-19 00:16 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-19 00:16 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-19 00:16 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-19 00:16 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-19 00:16 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-19 00:16 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-19 00:16 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-19 00:16 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-19 00:16 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-19 00:16 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-19 00:16 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-19 00:16 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-19 00:16 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-19 00:16 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-19 00:16 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-19 00:16 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-19 00:16 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-19 00:16 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-19 00:16 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-19 00:16 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-19 00:16 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-19 00:16 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-19 00:16 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-19 00:16 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-19 00:16 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-19 00:16 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-19 00:16 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-19 00:16 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-19 00:16 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-19 00:16 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-19 00:16 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-19 00:16 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-19 00:16 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-19 00:16 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-19 00:16 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-19 00:16 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-19 00:16 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-19 00:16 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-19 00:16 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-19 00:16 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-19 00:16 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-19 00:16 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-19 00:16 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-19 00:16 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-19 00:16 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-19 00:16 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-19 00:16 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-19 00:16 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-19 00:16 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-19 00:16 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-19 00:16 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-19 00:16 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-19 00:16 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-19 00:16 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-19 00:13 - 2015-04-27 21:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-19 00:13 - 2015-04-27 21:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-19 00:13 - 2015-04-27 21:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-19 00:13 - 2015-04-27 21:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-05-19 00:13 - 2015-04-27 21:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-19 00:13 - 2015-04-27 21:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-19 00:13 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-05-19 00:13 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-05-19 00:13 - 2015-04-27 21:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-05-19 00:13 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-05-19 00:13 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-19 00:13 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-05-19 00:13 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-05-19 00:13 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-05-19 00:13 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-05-19 00:13 - 2015-04-27 21:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-05-19 00:13 - 2015-04-27 21:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-05-19 00:13 - 2015-04-27 21:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-05-19 00:13 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-19 00:13 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-05-19 00:13 - 2015-04-27 20:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-19 00:12 - 2015-04-27 21:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-19 00:12 - 2015-04-27 21:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-19 00:12 - 2015-04-27 21:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-05-19 00:12 - 2015-04-27 21:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-19 00:12 - 2015-04-27 21:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-19 00:12 - 2015-04-27 21:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-19 00:12 - 2015-04-27 21:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-05-19 00:12 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-19 00:12 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 19:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-05-19 00:12 - 2015-04-27 19:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-05-19 00:12 - 2015-04-27 19:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-05-19 00:10 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-19 00:10 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-19 00:10 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-19 00:10 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-19 00:10 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-19 00:10 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-19 00:10 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-19 00:10 - 2015-01-29 05:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-19 00:10 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-19 00:07 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-19 00:07 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-19 00:07 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-19 00:07 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-19 00:07 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-05-19 00:07 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-05-19 00:07 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-04-21 18:35 - 2015-04-21 18:35 - 00038400 _____ () C:\Users\Sou\Desktop\Seitenplan Viva 100 - VORLÄUFIG-20.04.15.xls
2015-04-21 18:33 - 2015-04-21 18:33 - 00000000 ____D () C:\Users\Sou\Documents\Benutzerdefinierte Office-Vorlagen
2015-04-20 03:13 - 2015-04-20 03:13 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-04-20 03:13 - 2015-04-20 03:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-04-19 17:48 - 2015-04-19 17:48 - 00002174 _____ () C:\Users\Sou\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-04-19 17:48 - 2015-04-19 17:48 - 00002124 _____ () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-04-19 17:48 - 2015-04-19 17:48 - 00002124 _____ () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-04-19 17:48 - 2015-04-19 17:48 - 00000000 ___RD () C:\Users\Sou\OneDrive
2015-04-19 17:48 - 2015-04-19 17:48 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
2015-04-19 17:48 - 2015-04-19 17:48 - 00000000 ____D () C:\Program Files (x86)\Microsoft OneDrive
2015-04-19 17:35 - 2015-04-19 17:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-04-19 17:34 - 2015-05-19 19:37 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2015-04-19 17:34 - 2015-04-19 17:34 - 01079992 _____ (Microsoft Corporation) C:\Users\Sou\Downloads\Setup.X86.de-DE_O365HomePremRetail_5a3c63fc-113b-45fc-9a2a-f5d67dc7799e_TX_DB_.exe
2015-04-19 17:25 - 2015-04-19 17:26 - 00000000 ____D () C:\ProgramData\mquadr.at
2015-04-19 17:25 - 2015-04-19 17:25 - 00000000 ____D () C:\Users\Sou\AppData\Local\TGE
2015-04-19 17:24 - 2015-04-20 00:00 - 00000000 ____D () C:\Users\Sou\AppData\Local\mquadr.at
2015-04-19 17:24 - 2015-04-19 17:25 - 00000000 __HDC () C:\ProgramData\{CD3330DC-8B86-4AE3-B2E4-09E56CB3E702}
2015-04-19 17:24 - 2015-04-19 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\o2
2015-04-19 17:24 - 2015-04-19 17:24 - 00000000 ____D () C:\Program Files (x86)\DSL Soforthilfe
2015-04-19 17:24 - 2013-11-21 22:56 - 03748800 ____N (mquadr.at software engineering und consulting GmbH) C:\Windows\SysWOW64\M2ElevatedCalls.dll
2015-04-19 17:24 - 2013-11-21 22:56 - 03490272 ____N (mquadr.at software engineering & consulting GmbH) C:\Windows\SysWOW64\m2network64helper.exe
2015-04-19 17:24 - 2013-11-21 22:56 - 00962528 ____N (mquadr.at software engineering) C:\Windows\SysWOW64\M2ElevatedNetworkAdapters.dll
2015-04-19 17:24 - 2012-12-03 15:58 - 00279040 ____N (Nicomsoft Ltd.) C:\Windows\system32\WiFiMan.dll
2015-04-19 17:24 - 2012-12-03 15:57 - 00238592 ____N (Nicomsoft Ltd.) C:\Windows\SysWOW64\WiFiMan.dll
2015-04-19 17:23 - 2015-04-19 17:23 - 44631824 _____ (Telefónica Germany GmbH & Co. OHG ) C:\Users\Sou\Downloads\dsl_soforthilfe.exe
2015-04-19 16:49 - 2015-03-25 05:24 - 03298816 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-04-19 16:49 - 2015-03-25 05:24 - 02553856 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-04-19 16:49 - 2015-03-25 05:24 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-04-19 16:49 - 2015-03-25 05:24 - 00191488 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-04-19 16:49 - 2015-03-25 05:24 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-04-19 16:49 - 2015-03-25 05:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-04-19 16:49 - 2015-03-25 05:24 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-04-19 16:49 - 2015-03-25 05:24 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-04-19 16:49 - 2015-03-25 05:23 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-04-19 16:49 - 2015-03-25 05:23 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-04-19 16:49 - 2015-03-25 05:23 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-04-19 16:49 - 2015-03-25 05:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-04-19 16:49 - 2015-03-25 05:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-04-19 16:49 - 2015-03-25 05:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-04-19 16:49 - 2015-03-25 05:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-04-19 16:49 - 2015-03-25 05:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-04-19 16:48 - 2015-03-23 05:25 - 00769536 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-04-19 16:48 - 2015-03-23 05:25 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-04-19 16:48 - 2015-03-23 05:24 - 00957952 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-04-19 16:48 - 2015-03-23 05:24 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-04-19 16:48 - 2015-03-23 05:24 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-04-19 16:48 - 2015-03-23 05:24 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-04-19 16:48 - 2015-03-23 05:24 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-04-19 16:48 - 2015-03-23 05:17 - 01111552 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-04-19 16:48 - 2015-03-10 05:25 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-04-19 16:48 - 2015-03-10 05:21 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-04-19 16:48 - 2015-03-10 05:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-04-19 16:48 - 2015-03-10 05:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-04-19 16:48 - 2015-03-05 07:12 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-04-19 16:48 - 2015-03-05 06:05 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-04-19 16:44 - 2015-02-25 05:18 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-04-19 16:43 - 2015-03-04 06:55 - 00367552 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-04-19 16:43 - 2015-03-04 06:41 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-19 16:43 - 2015-03-04 06:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-04-07 23:53 - 2015-05-22 00:38 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-04-07 23:53 - 2015-05-22 00:38 - 00000000 ___SD () C:\Windows\system32\GWX
2015-03-26 23:12 - 2015-03-26 23:12 - 00000000 __SHD () C:\Users\Sou\AppData\Local\EmieBrowserModeList
2015-03-23 21:17 - 2015-03-23 21:18 - 00000000 ____D () C:\Users\Sou\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ConEdit - Deus Ex Conversation Editor
2015-03-23 21:17 - 2015-03-23 21:18 - 00000000 ____D () C:\Program Files (x86)\ConEdit
2015-03-23 21:17 - 2015-03-23 21:17 - 00286720 ____N (Microsoft Corporation) C:\Windows\Setup1.exe
2015-03-23 21:17 - 2015-03-23 21:17 - 00073216 _____ (Microsoft Corporation) C:\Windows\ST6UNST.EXE
2015-03-23 21:17 - 2015-03-23 21:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deus Ex SDK
2015-03-23 21:06 - 2015-03-23 21:09 - 06541824 _____ () C:\Users\Sou\Downloads\DeusExSDK1112f.exe
2015-03-23 20:19 - 2015-03-23 20:23 - 304783476 _____ ( ) C:\Users\Sou\Downloads\2027_1.2.1.exe
2015-03-23 19:57 - 2015-03-23 19:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deus Ex
2015-03-23 19:52 - 2015-03-23 19:54 - 37399552 _____ () C:\Users\Sou\Downloads\deusexmppatch1112fm.exe
2015-03-19 23:20 - 2015-03-19 23:20 - 00000000 ____D () C:\Users\Sou\AppData\Local\238010
2015-03-19 23:20 - 2015-03-19 23:20 - 00000000 ____D () C:\ProgramData\Intel
2015-03-19 17:19 - 2015-03-19 17:21 - 00000000 ____D () C:\Users\Sou\Documents\Deus Ex - Invisible War
2015-03-15 21:48 - 2015-03-15 21:50 - 150069838 _____ () C:\Users\Sou\Downloads\Unofficial_Oblivion_Patch-3.5.1.7z
2015-03-15 11:28 - 2015-03-15 11:28 - 01422613 _____ () C:\Users\Sou\Downloads\alba-20237.7z
2015-03-14 21:45 - 2015-03-14 21:47 - 01662426 _____ () C:\Users\Sou\Downloads\obse_0021.zip
2015-03-14 21:34 - 2015-03-14 21:34 - 03868883 _____ () C:\Users\Sou\Downloads\AlternativeBeginningsDV_121(1).zip
2015-03-14 21:20 - 2015-03-14 21:20 - 00017051 _____ () C:\Users\Sou\Downloads\Alternative_Anfaenge.7z
2015-03-14 20:38 - 2015-03-14 20:38 - 03868883 _____ () C:\Users\Sou\Downloads\AlternativeBeginningsDV_121.zip
2015-03-14 20:32 - 2015-03-14 20:32 - 00202074 _____ () C:\Users\Sou\Downloads\Burg_Ehrenfels_v1_2.7z
2015-03-14 20:31 - 2015-03-14 20:31 - 00166215 _____ () C:\Users\Sou\Downloads\Kaiserstadtschuppen_1_0.7z
2015-03-14 20:29 - 2015-03-14 20:29 - 14641399 _____ () C:\Users\Sou\Downloads\AnswesenSilberhufv1.3.7z
2015-03-14 20:27 - 2015-03-14 20:27 - 34433441 _____ () C:\Users\Sou\Downloads\DasHausInCheydinhalV1.0.7z
2015-03-14 20:26 - 2015-03-14 20:26 - 11468111 _____ () C:\Users\Sou\Downloads\mde_Unterirdische_Wohnanlage.7z
2015-03-14 20:19 - 2015-03-14 20:19 - 26174888 _____ () C:\Users\Sou\Downloads\Stadtpaket Tamriels - Plugins 1.3.8.7z
2015-03-14 20:17 - 2015-03-14 20:17 - 00034438 _____ () C:\Users\Sou\Downloads\p1d_keychain_v2_1_ger.7z
2015-03-14 20:15 - 2015-03-14 20:15 - 00079499 _____ () C:\Users\Sou\Downloads\BagofHolding1.1.rar
2015-03-14 20:13 - 2015-03-14 20:14 - 00630047 _____ () C:\Users\Sou\Downloads\Bedrolls_and_Tents_Anyone_DV.zip
2015-03-14 20:02 - 2015-03-14 20:02 - 00093008 _____ () C:\Users\Sou\Downloads\einsame_Insel_v1.0(1).7z
2015-03-14 19:55 - 2015-03-14 19:55 - 01513472 _____ () C:\Users\Sou\Downloads\7z938-x64(2).msi
2015-03-14 19:54 - 2015-03-14 19:55 - 01513472 _____ () C:\Users\Sou\Downloads\7z938-x64(1).msi
2015-03-14 19:47 - 2015-03-14 19:47 - 01513472 _____ () C:\Users\Sou\Downloads\7z938-x64.msi
2015-03-14 19:45 - 2015-03-14 19:45 - 01376768 _____ () C:\Users\Sou\Downloads\7z920-x64.msi
2015-03-14 19:35 - 2015-03-14 19:35 - 01203488 _____ () C:\Users\Sou\Downloads\7 Zip 64 Bit - CHIP-Installer.exe
2015-03-14 19:34 - 2015-03-14 19:34 - 00093008 _____ () C:\Users\Sou\Downloads\einsame_Insel_v1.0.7z
2015-03-14 19:26 - 2015-03-14 19:26 - 10891028 _____ () C:\Users\Sou\Downloads\Natural_Environments(1).7z
2015-03-14 19:19 - 2015-03-14 19:19 - 10891028 _____ () C:\Users\Sou\Downloads\Natural_Environments.7z
2015-03-14 19:11 - 2015-03-14 19:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oblivion Mod Manager
2015-03-14 19:07 - 2015-03-14 19:10 - 155106314 _____ () C:\Users\Sou\Downloads\Unofficial Oblivion Patch-5296-3-5-2b.7z
2015-03-14 18:45 - 2015-03-14 18:45 - 00001303 _____ () C:\Users\Sou\Downloads\real_water.rar
2015-03-11 21:30 - 2015-03-11 21:30 - 00005253 _____ () C:\Users\Sou\AppData\Local\recently-used.xbel
2015-03-11 11:01 - 2015-02-20 06:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-11 11:01 - 2015-02-20 06:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-11 11:01 - 2015-02-20 06:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-11 11:01 - 2015-02-20 06:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-11 11:01 - 2015-02-20 06:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-11 11:01 - 2015-02-20 06:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-11 11:01 - 2015-02-20 06:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-11 11:01 - 2015-02-20 06:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-11 11:01 - 2015-02-20 05:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-11 11:01 - 2015-02-20 05:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-11 11:01 - 2015-02-03 05:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-03-11 11:01 - 2015-02-03 05:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-03-11 11:01 - 2015-02-03 05:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-03-11 11:01 - 2015-02-03 05:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-03-11 11:01 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-03-11 11:01 - 2015-02-03 05:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-03-11 11:01 - 2015-02-03 05:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-03-11 11:01 - 2015-02-03 05:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-03-11 11:01 - 2015-02-03 05:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-03-11 11:01 - 2015-02-03 05:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-03-11 11:01 - 2015-02-03 05:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-03-11 11:01 - 2015-02-03 05:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-03-11 11:01 - 2015-02-03 05:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-03-11 11:01 - 2015-02-03 05:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-03-11 11:01 - 2015-02-03 05:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-03-11 11:01 - 2015-02-03 05:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-03-11 11:01 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-03-11 11:01 - 2015-02-03 05:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-03-11 11:01 - 2015-02-03 05:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-03-11 11:01 - 2015-02-03 05:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-03-11 11:01 - 2015-02-03 05:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-03-11 11:01 - 2015-02-03 04:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-03-11 11:01 - 2014-11-01 00:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-03-11 11:01 - 2014-06-28 02:21 - 00532176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2015-03-11 11:01 - 2014-06-28 02:21 - 00457400 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2015-03-11 11:00 - 2015-02-03 05:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-11 11:00 - 2015-02-03 05:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-11 11:00 - 2015-01-31 05:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-03-11 11:00 - 2015-01-31 05:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-03-11 11:00 - 2015-01-31 01:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-03-11 10:59 - 2015-02-13 07:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-11 10:59 - 2015-02-13 07:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-11 10:59 - 2015-02-04 05:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-11 10:59 - 2015-02-04 04:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-11 10:59 - 2015-02-03 05:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-11 10:59 - 2015-02-03 05:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-11 10:59 - 2015-01-31 01:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-11 10:59 - 2015-01-17 04:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-11 10:59 - 2015-01-17 04:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-10 18:12 - 2015-03-10 18:12 - 00410589 _____ () C:\Users\Sou\Downloads\watch.htm

==================== Three Months Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-02 22:29 - 2009-07-14 06:45 - 00028944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-02 22:29 - 2009-07-14 06:45 - 00028944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-02 22:21 - 2013-12-14 19:13 - 01795996 _____ () C:\Windows\WindowsUpdate.log
2015-06-02 22:16 - 2011-11-25 22:12 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-06-02 22:15 - 2014-12-03 13:12 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-02 22:14 - 2014-06-03 12:28 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-06-02 22:14 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-06-02 22:13 - 2014-12-03 12:52 - 00000000 ___DC () C:\AdwCleaner
2015-06-02 22:13 - 2012-05-04 08:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-06-02 22:09 - 2012-04-02 18:45 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-02 22:07 - 2012-02-02 21:01 - 00000000 ___RD () C:\Users\Sou\Desktop\KLEINKUNST - LITERARISCHES
2015-06-02 22:06 - 2014-02-15 01:25 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-27 23:15 - 2011-06-01 19:46 - 00000000 ____D () C:\Users\Sou\AppData\Roaming\TS3Client
2015-05-27 21:13 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2015-05-27 20:49 - 2009-07-14 04:34 - 00000215 ____C () C:\Windows\system.ini
2015-05-27 09:12 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-05-26 23:05 - 2010-11-21 08:50 - 00715336 _____ () C:\Windows\system32\perfh007.dat
2015-05-26 23:05 - 2010-11-21 08:50 - 00157212 _____ () C:\Windows\system32\perfc007.dat
2015-05-26 23:05 - 2009-07-14 07:13 - 01665440 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-26 23:03 - 2012-02-02 21:02 - 00000000 ___RD () C:\Users\Sou\Desktop\Dissertation
2015-05-26 22:03 - 2014-12-03 13:12 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-26 22:00 - 2012-06-24 22:23 - 00000000 ____D () C:\Windows\de
2015-05-26 09:13 - 2013-08-17 22:54 - 05091840 ___SH () C:\Users\Sou\Desktop\Thumbs.db
2015-05-25 21:21 - 2011-06-03 23:49 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2015-05-25 18:11 - 2011-06-01 11:45 - 00000000 ____D () C:\Users\Sou
2015-05-22 16:08 - 2011-07-20 20:14 - 00000000 ____D () C:\Users\Sou\AppData\Roaming\SoftGrid Client
2015-05-22 12:28 - 2012-11-27 01:02 - 00000000 ___RD () C:\Users\Sou\Desktop\mfm
2015-05-21 11:52 - 2014-12-03 13:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-05-21 11:52 - 2014-12-03 13:12 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-05-19 21:52 - 2012-08-13 19:50 - 00000000 ___RD () C:\Users\Sou\Desktop\Bilder
2015-05-19 21:52 - 2012-02-02 21:01 - 00000000 ___RD () C:\Users\Sou\Desktop\Komponistinnen
2015-05-19 20:32 - 2014-09-03 00:11 - 00000000 ____D () C:\Users\Sou\AppData\Local\Adobe
2015-05-19 20:31 - 2012-04-02 18:45 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-19 20:31 - 2012-04-02 18:45 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-19 20:31 - 2011-06-02 13:49 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-19 13:46 - 2012-09-13 20:19 - 00000000 ____D () C:\Users\Sou\AppData\Local\Turbine
2015-05-19 04:27 - 2014-04-11 09:17 - 00000000 ____D () C:\Windows\rescache
2015-05-19 03:38 - 2009-07-14 06:45 - 00555696 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-19 03:37 - 2012-05-18 02:14 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-19 03:37 - 2012-05-18 02:14 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-05-19 03:34 - 2010-11-21 09:00 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-19 03:34 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-19 03:16 - 2011-07-20 20:14 - 01692058 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-05-19 03:16 - 2011-07-20 20:13 - 00000000 ____D () C:\Program Files (x86)\Microsoft Application Virtualization Client
2015-05-19 03:14 - 2013-08-08 03:09 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-19 03:02 - 2012-05-18 02:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-19 01:17 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2015-05-19 00:27 - 2014-05-23 14:00 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

==================== Files in the root of some directories =======

2014-11-29 12:32 - 2014-11-29 12:32 - 0000093 _____ () C:\Users\Sou\AppData\Roaming\ARCompanion.log
2012-09-01 09:49 - 2012-09-01 09:51 - 0000198 _____ () C:\Users\Sou\AppData\Roaming\burnaware.ini
2012-08-31 18:32 - 2012-08-31 18:32 - 0003584 _____ () C:\Users\Sou\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-09-13 20:17 - 2012-09-13 20:17 - 0000091 _____ () C:\Users\Sou\AppData\Local\fusioncache.dat
2015-03-11 21:30 - 2015-03-11 21:30 - 0005253 _____ () C:\Users\Sou\AppData\Local\recently-used.xbel
2011-11-11 18:37 - 2011-11-11 18:37 - 0000017 _____ () C:\Users\Sou\AppData\Local\resmon.resmoncfg
2011-11-25 22:14 - 2011-11-25 22:14 - 0017408 _____ () C:\Users\Sou\AppData\Local\WebpageIcons.db
2012-06-10 19:51 - 2012-06-10 20:23 - 0001396 _____ () C:\ProgramData\hpzinstall.log

Some files in TEMP:
====================
C:\Users\Sou\AppData\Local\Temp\Quarantine.exe
C:\Users\Sou\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

==================== BCD ================================

Windows-Start-Manager
---------------------
Bezeichner              {bootmgr}
device                  partition=C:
description             Windows Boot Manager
locale                  de-DE
inherit                 {globalsettings}
default                 {current}
resumeobject            {328061e9-3e79-11e0-8a42-6c626d92265d}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 30

Windows-Startladeprogramm
-------------------------
Bezeichner              {current}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 7
locale                  de-DE
inherit                 {bootloadersettings}
recoverysequence        {328061eb-3e79-11e0-8a42-6c626d92265d}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {328061e9-3e79-11e0-8a42-6c626d92265d}
nx                      OptIn

Windows-Startladeprogramm
-------------------------
Bezeichner              {328061eb-3e79-11e0-8a42-6c626d92265d}
device                  ramdisk=[C:]\Recovery\328061eb-3e79-11e0-8a42-6c626d92265d\Winre.wim,{328061ec-3e79-11e0-8a42-6c626d92265d}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
inherit                 {bootloadersettings}
osdevice                ramdisk=[C:]\Recovery\328061eb-3e79-11e0-8a42-6c626d92265d\Winre.wim,{328061ec-3e79-11e0-8a42-6c626d92265d}
systemroot              \windows
nx                      OptIn
winpe                   Yes

Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner              {328061e9-3e79-11e0-8a42-6c626d92265d}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description             Windows Resume Application
locale                  de-DE
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No

Windows-Speichertestprogramm
----------------------------
Bezeichner              {memdiag}
device                  partition=C:
path                    \boot\memtest.exe
description             Windows-Speicherdiagnose
locale                  de-DE
inherit                 {globalsettings}
badmemoryaccess         Yes

EMS-Einstellungen
-----------------
Bezeichner              {emssettings}
bootems                 Yes

Debuggereinstellungen
---------------------
Bezeichner              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200

RAM-Defekte
-----------
Bezeichner              {badmemory}

Globale Einstellungen
---------------------
Bezeichner              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Startladeprogramm-Einstellungen
-------------------------------
Bezeichner              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Hypervisoreinstellungen
-------------------
Bezeichner              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner              {resumeloadersettings}
inherit                 {globalsettings}

Ger„teoptionen
--------------
Bezeichner              {328061ec-3e79-11e0-8a42-6c626d92265d}
description             Ramdisk Options
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\328061eb-3e79-11e0-8a42-6c626d92265d\boot.sdi



LastRegBack: 2015-05-19 01:05

==================== End of log ============================

schrauber · 03.06.2015, 19:35

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Argiel · 04.06.2015, 07:26

*fasziniert-alles-verfolgt*

Code:

ATTFilter

C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\DVDVideoSoft\TB\ConduitInstaller.exe.vir Win32/Toolbar.Conduit evtl. unerwünschte Anwendung
C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll.vir Variante von Win32/Adware.Yontoo.B Anwendung
C:\Users\Sou\Desktop\Anti-Malware\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer(1).exe Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung
C:\Users\Sou\Downloads\7 Zip 64 Bit - CHIP-Installer.exe Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung
C:\Users\Sou\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SkywalkerSetup[1].exe Variante von Win32/Toolbar.Perion.P evtl. unerwünschte Anwendung
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SkywalkerSetup[2].exe Variante von Win32/Toolbar.Perion.P evtl. unerwünschte Anwendung
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SkywalkerSetup[3].exe Variante von Win32/Toolbar.Perion.P evtl. unerwünschte Anwendung
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WSSetup[1].exe Variante von Win64/Toolbar.Perion.D evtl. unerwünschte Anwendung
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WSSetup[2].exe Variante von Win64/Toolbar.Perion.D evtl. unerwünschte Anwendung
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\update[10] Variante von Win32/Toolbar.Perion.A evtl. unerwünschte Anwendung
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\update[2] Variante von Win32/Toolbar.Perion.A evtl. unerwünschte Anwendung
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\update[9] Variante von Win32/Toolbar.Perion.A evtl. unerwünschte Anwendung
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\update[1] Variante von Win32/Toolbar.Perion.A evtl. unerwünschte Anwendung
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIXMVQOA\update[1] Variante von Win64/Toolbar.Perion.D evtl. unerwünschte Anwendung
F:\ALTES NOTEBOOK\Eigene Dateien\Downloads\DownloadManagerSetup.exe Variante von Win32/InstallCore.BY evtl. unerwünschte Anwendung
F:\ALTES NOTEBOOK\Eigene Dateien\Downloads\SoftonicDownloader_fuer_curse-client.exe Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung

Code:

ATTFilter

Results of screen317's Security Check version 1.002  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Kaspersky Internet Security   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Java 8 Update 31  
 Java version 32-bit out of Date! 
 Adobe Flash Player 17.0.0.188  
 Adobe Reader XI  
 Mozilla Firefox (38.0.5) 
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Malwarebytes Anti-Malware mbamscheduler.exe   
 Kaspersky Lab Kaspersky Internet Security 15.0.0 avp.exe  
 Kaspersky Lab Kaspersky Internet Security 15.0.0 avpui.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

FRST.txt - Teil 1

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 29-05-2015
Ran by Sou (administrator) on SOU-ARLT on 04-06-2015 08:20:12
Running from C:\Users\Sou\Desktop\Anti-Malware
Loaded Profiles: Sou & UpdatusUser (Available Profiles: Sou & UpdatusUser)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Akamai Technologies, Inc.) C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Akamai Technologies, Inc.) C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe
() C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [DSL Soforthilfe] => C:\Program Files (x86)\DSL Soforthilfe\DSL_Soforthilfe.exe [20585888 2013-11-21] ()
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Sou\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-30] (Akamai Technologies, Inc.)
HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2892992 2015-06-02] (Valve Corporation)
HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
ShellIconOverlayIdentifiers: [  00BitrixShellExt] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506B} => C:\Program Files (x86)\Bitrix24\64\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers: [  00BitrixShellExt_C] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506E} => C:\Program Files (x86)\Bitrix24\64\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers: [  00BitrixShellExt_E] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506D} => C:\Program Files (x86)\Bitrix24\64\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers: [  00BitrixShellExt_S] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506C} => C:\Program Files (x86)\Bitrix24\64\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\amd64\FileSyncShell64.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: [  00BitrixShellExt] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506B} => C:\Program Files (x86)\Bitrix24\32\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers-x32: [  00BitrixShellExt_C] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506E} => C:\Program Files (x86)\Bitrix24\32\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers-x32: [  00BitrixShellExt_E] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506D} => C:\Program Files (x86)\Bitrix24\32\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers-x32: [  00BitrixShellExt_S] -> {A11A1EE5-F9F8-4BE0-907F-D74A49CC506C} => C:\Program Files (x86)\Bitrix24\32\BitrixShellExt.dll [2014-11-11] (Bitrix Inc.)
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll [2015-04-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Sou\AppData\Local\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll [2015-04-19] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1564645244-1967886891-1609600129-1005 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll [2013-12-14] (IObit)
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-04-19] (Microsoft Corporation)
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-12-03] (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-04-14] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-09-20] (Hewlett-Packard Co.)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-12-03] (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-24] (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2012-03-08] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-04-14] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-24] (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-09-20] (Hewlett-Packard Co.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-04-19] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174
FF Homepage: hxxp://www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-19] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-19] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-24] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-24] (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-12-03] ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-12-03] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-12-03] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-04-19] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2012-09-13] (Pando Networks)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1564645244-1967886891-1609600129-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin1017325.dll [2012-10-04] (Amazon.com, Inc.)
FF Plugin HKU\S-1-5-21-1564645244-1967886891-1609600129-1000: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2012-09-13] (Pando Networks)
FF Plugin HKU\S-1-5-21-1564645244-1967886891-1609600129-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2015-03-12] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Extension: FoxyDeal - C:\Users\Sou\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{F58A62EB-38DC-43C4-A539-DC52E135208D} [2013-05-08]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\Extensions\adblockpopups@jessehakanen.net.xpi [2014-09-08]
FF Extension: Element Hiding Helper for Adblock Plus - C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\Extensions\elemhidehelper@adblockplus.org.xpi [2014-09-08]
FF Extension: Bitrix Intranet Integration - C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\Extensions\ff_bx_integration@bitrixsoft.com.xpi [2014-11-07]
FF Extension: Ghostery - C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\Extensions\firefox@ghostery.com.xpi [2014-09-08]
FF Extension: Facebook Secret Emoticons - C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\Extensions\jid0-XZn6pYCdV3ANrfYigxlyyGDrxAM@jetpack.xpi [2014-09-14]
FF Extension: Adblock Plus - C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-09-08]
FF Extension: Adblock Edge - C:\Users\Sou\AppData\Roaming\Mozilla\Firefox\Profiles\8rhavx4s.default-1409726291174\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-09-08]
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak [2014-02-15]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak [2014-02-15]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-02-15]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-06-10]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-12-03]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-12-03]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-12-03]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-12-03]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-12-03]
FF HKU\S-1-5-21-1564645244-1967886891-1609600129-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [icmijdhkcgeclpfjmibnginbbkfcbpep] - C:\Program Files\SearchGBY\Extensions\Chrome\searchgby.chrome.v0.9.55.crx [2012-07-06]
CHR HKLM-x32\...\Chrome\Extension: [pnbbffeddnekkhjmokkhdebbfbibbflc] - C:\Program Files (x86)\LyricsPal\128.crx [Not Found]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
S4 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2736824 2015-04-07] (Microsoft Corporation)
S3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]
S4 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2151744 2013-12-14] (IObit)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
S4 ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [430592 2008-04-07] (Nokia.) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 adp3132; C:\Windows\system32\drivers\adp3132.sys [385072 2010-01-28] (Adaptec, Inc.)
S3 amdide64; C:\Windows\system32\drivers\amdide64.sys [10632 2007-10-12] (Advanced Micro Devices)
R3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2013-06-02] (Wondershare)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [88480 2013-07-09] ()
S3 FLxHCIh; C:\Windows\system32\drivers\FLxHCIh.sys [44544 2010-04-17] (Fresco Logic)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-10-30] () [File not signed]
S3 ISASerial; C:\Windows\system32\drivers\ISASerial.sys [72192 2008-02-20] (Windows (R) Codename Longhorn DDK provider)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [141320 2014-12-03] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [793800 2014-12-03] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [46400 2013-07-09] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-06-04] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
S3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15416 2009-07-16] ()
S3 MtsHID; C:\Windows\system32\drivers\MtsHID.sys [27664 2009-07-15] (TechniSat Provide)
S3 nvamacpi; C:\Windows\system32\drivers\NVAMACPI.sys [28192 2009-07-17] (NVIDIA Corporation)
S3 nvrd64; C:\Windows\system32\drivers\nvrd64.sys [175648 2009-08-04] (NVIDIA Corporation)
S3 PciIsaSerial; C:\Windows\system32\drivers\PciIsaSerial.sys [72192 2008-05-22] (Windows (R) Codename Longhorn DDK provider)
S3 PciPPorts; C:\Windows\system32\drivers\PciPPorts.sys [95744 2008-05-22] ()
S3 PciSPorts; C:\Windows\system32\drivers\PciSPorts.sys [126464 2008-05-22] ()
S3 PPorts; C:\Windows\system32\drivers\PPorts.sys [95744 2008-02-20] ()
S3 Si3124r5; C:\Windows\system32\drivers\Si3124r5.sys [340008 2010-04-13] (Silicon Image, Inc)
R0 SiFilter; C:\Windows\System32\drivers\SiWinAcc.sys [22568 2010-04-13] (Silicon Image, Inc.)
R0 SiRemFil; C:\Windows\System32\drivers\SiRemFil.sys [16936 2010-04-13] (Silicon Image, Inc.)
S3 SPorts; C:\Windows\system32\drivers\SPorts.sys [124416 2008-02-20] ()
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [52736 2012-04-25] (Apple, Inc.) [File not signed]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 NmPar; \SystemRoot\system32\drivers\NmPar.sys [X]
S3 nmserial; \SystemRoot\system32\drivers\nmserial.sys [X]

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\drivers\adp3132.sys 132190688D8E51D61F88A150D7DF9FB4
C:\Windows\system32\drivers\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys FA886682CFC5D36718D3E436AACF10B9
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\ahcix64s.sys AF53917D9741A84627FA689EA622558A
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide64.sys D52A2E98C5EEFF88CED28793B6B04D84
C:\Windows\system32\drivers\amdk8.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\atikmdag.sys DCC8177244FE79C61C4E73C65E63922A
C:\Windows\System32\DRIVERS\atikmpag.sys 7FE67D107329DC2CF89136A8E19BCEB7
C:\Windows\System32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49
C:\Windows\System32\drivers\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048
C:\Windows\system32\drivers\amd_sata.sys 80A508D0C7A21BC13C01D4C671541203
C:\Windows\System32\drivers\amd_xata.sys 2BE940F3A632A1A301B22B096BF221F1
C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys C65A3C67630A67A97AD26C21173BA61E
C:\Windows\system32\drivers\appid.sys 90C53BD47979FB8814F465A08B885102
C:\Windows\system32\drivers\arc.sys D73AAD4946051D074909FDFD34D94C7B
C:\Windows\system32\drivers\arcsas.sys 46E8C3EB03224A1E55C6F0C100A9D2CC
C:\Windows\system32\drivers\asmthub3.sys E3B9C89D2ED4A538AB2FC6EC76FA2B17
C:\Windows\system32\drivers\asmtxhci.sys 88CE83BE5176020BE39194A6369AF2C2
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\atksgt.sys B4BDE3F758A34658A37DFED3D9783CD8
C:\Windows\system32\drivers\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bridge.sys 5C2F352A4E961D72518261257AAE204B
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\drivers\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\drivers\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys 404B7DF9CA4D1CB675045AF220FF3285
C:\Windows\system32\drivers\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 27667A788130A7F7A5858DE27572E6D7
C:\Windows\system32\drivers\compbatt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ssudbus.sys E428DFFA96FAD07D8CA3C9082563A225
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\drivers\disk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Dot4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Dot4Prt.sys E9F5969233C5D89F3C35E3A66A52A361
C:\Windows\System32\DRIVERS\dot4usb.sys ==> MD5 is legit
C:\Windows\system32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys 87CE5C8965E101CCCED1F4675557E868
C:\Windows\system32\drivers\evbda.sys ==> MD5 is legit
C:\Windows\system32\drivers\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\drivers\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\drivers\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\system32\drivers\FLxHCIc.sys E35F19855192D025DA41E8DFA318206A
C:\Windows\system32\drivers\FLxHCIh.sys BBBD5D42D8CB3AD0F43F7BC4DB92EB5E
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\fssfltr.sys 07DA62C960DDCCC2D35836AEAB4FC578
C:\Windows\SysWOW64\FsUsbExDisk.SYS DDEE99DC54EFA20BD5A442CD733C4462
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0
C:\Windows\system32\drivers\gagp30kx.sys ==> MD5 is legit
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\System32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A
C:\Windows\System32\DRIVERS\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidbth.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys F61634BEC53F73702A10DE69F6DCAF57
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\i8042prt.sys ==> MD5 is legit
C:\Windows\system32\drivers\iaStor.sys D7921D5A870B11CC1ADAB198A519D50A
C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366
C:\Windows\system32\drivers\iirsp.sys ==> MD5 is legit
C:\Windows\system32\drivers\Impcd.sys DD587A55390ED2295BCE6D36AD567DA9
C:\Windows\System32\drivers\RTKVHD64.sys 9297BC7FB61F58670EE176DD18F4DD92
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\system32\drivers\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ISASerial.sys AC45D94185CF67267D06BF2F45E9E31E
C:\Windows\system32\drivers\msiscsi.sys 96BB922A0981BC7432C8CF52B5410FE6
C:\Windows\system32\drivers\jraid.sys 50DE7DD7EDB1B512B13666588AEFBF6F
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kl1.sys 67D1F7FA1DF9502DE12027D7C7782863
C:\Windows\System32\DRIVERS\klflt.sys 2A88EFE87B5F23BA47FF7AF2DEAEB98F
C:\Windows\System32\DRIVERS\klhk.sys 7ED6B6805B3E1BC9DC2418F1C5C920B4
C:\Windows\System32\DRIVERS\klif.sys CD81447AB991F3E7F1FCF59CEA07D1E0
C:\Windows\System32\DRIVERS\klim6.sys FEAD1F401CBE9383A642877A6EA1398F
C:\Windows\System32\DRIVERS\klkbdflt.sys 3FAE739F2AFEA18BCBB9C5E7DC6E889D
C:\Windows\System32\DRIVERS\klmouflt.sys 72CF64FBF38CD681FA7F37176047E967
C:\Windows\System32\DRIVERS\klpd.sys 8C0EC95AD65A0DE3D6C040591D02BF02
C:\Windows\System32\DRIVERS\kltdi.sys 5BB9E329FE48904108BBBF9C73073920
C:\Windows\System32\DRIVERS\kneps.sys D043624FE4AE0A4894A785097C02EF09
C:\Windows\System32\Drivers\ksecdd.sys F7DFAE6040AC910B7C64EE208A34157D
C:\Windows\System32\Drivers\ksecpkg.sys 8FE94F2EF9BF444E93E35D87E210D02F
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\lirsgt.sys 955982BF4421B77722196552B62E8DC2
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\lvrs64.sys 0C85B2B6FB74B36A251792D45E0EF860
C:\Windows\system32\drivers\mbam.sys 1E9E32AEC3E1EB1B31B8169F33168B56
C:\Windows\system32\drivers\MBAMSwissArmy.sys E9CD058C79EA15B4AA93E259FA713B07
C:\Windows\system32\drivers\mwac.sys F49FB3C88E263AE9A246593B0BB29294
C:\Windows\system32\drivers\megasas.sys ==> MD5 is legit
C:\Windows\system32\drivers\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys 87BCD1034CBF33537D4D4C251D39BA26
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys AE3334958D8F631FF14A0AEB3D7EFB3A
C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC
C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163
C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C
C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\drivers\MTConfig.sys ==> MD5 is legit
C:\Windows\system32\drivers\ASACPI.sys 19B006B181E3875FD254F7B67ACF1E7C
C:\Windows\system32\drivers\MtsHID.sys 07AD6825D5C658595CAB7F8F5849401C
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\system32\drivers\mv91cons.sys 049F1ED7F1B5DBB9D6C8767E7DE02741
C:\Windows\system32\drivers\mv91xx.sys 4FAD606C7AEB336E5AA4A005DE09CA80
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 760E38053BF56E501D562B70AD796B88
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\system32\drivers\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys 1A29A59A4C5BA6F8C85062A613B7E2B2
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nusb3hub.sys 158AD24745BD85BA9BE3C51C38F48C32
C:\Windows\system32\drivers\nusb3xhc.sys D40A13B2C0891E218F9523B376955DB6
C:\Windows\system32\drivers\NVAMACPI.sys 7FD5C060CB907489A5702F628226F54A
C:\Windows\System32\DRIVERS\nvlddmkm.sys 8E6247F418B4C8AE9EEB0B532CABCC21
C:\Windows\System32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD
C:\Windows\system32\drivers\nvrd64.sys 694F5E9D9D624D47F432F5B2E66A0528
C:\Windows\system32\drivers\nvsmu.sys E58D81FB8616D0CB55C1E36AA0B213C9
C:\Windows\System32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A
C:\Windows\System32\drivers\nvstor64.sys 05DE5DC43AFE6CAB78F9C7CA044CBCBE
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\DRIVERS\pccsmcfdx64.sys 81B5E63131090879AD6EF9F32109B88D
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\System32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\drivers\PciIsaSerial.sys D7C203015E2C2A2EAC8DACEF156D8DC3
C:\Windows\system32\drivers\PciPPorts.sys 088B509B2F35A3CEE00AC0E0BC4C5BED
C:\Windows\system32\drivers\PciSPorts.sys 7F97CDD5E91FC73DA2B01344957AA058
C:\Windows\system32\drivers\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ED6E75158D28D33A2E2A020AC5B2B59D
C:\Windows\system32\drivers\PPorts.sys 14C04684A25C221EBE2105D169B4B6FF
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\drivers\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql2300.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\drivers\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpvideominiport.sys 313F68E1A3E6345A4F47A36B07062F34
C:\Windows\System32\Drivers\RDPWD.sys FE571E088C2D83619D2D48D4E961BF41
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Rt64win7.sys AFC12DFA4C7B089673AD67402CA19EDB
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\drivers\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\drivers\sfloppy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Sftfslh.sys 21AB491BBCC8C1B26FDC402A374AB196
C:\Windows\System32\DRIVERS\Sftplaylh.sys 3B8D43FEEFF7A187534DDDFD675FE123
C:\Windows\System32\DRIVERS\Sftredirlh.sys F1D1B1DC7A8765A09D7640FBF8D20970
C:\Windows\System32\DRIVERS\Sftvollh.sys B3B9ADE7F8C4AF0C20E712E040588543
C:\Windows\system32\drivers\Si3124r5.sys DA492C8305434EC6F9BDD60C8B83B10E
C:\Windows\System32\drivers\SiWinAcc.sys 8D10887A1699CF61E74467694B929B09
C:\Windows\System32\drivers\SiRemFil.sys 94E1EDA9A0B305A67EE1BBD0A68CE21A
C:\Windows\system32\drivers\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\system32\drivers\SPorts.sys 739C2571867F351167D1D958990E9D84
C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B
C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28
C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3
C:\Windows\System32\DRIVERS\ssudmdm.sys AAF6F247F1DC370C593B4430974EAD9C
C:\Windows\system32\drivers\stexstor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\swenum.sys ==> MD5 is legit
C:\Windows\System32\drivers\tcpip.sys 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E
C:\Windows\System32\DRIVERS\tcpip.sys 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E
C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\tdx.sys 70988118145F5F10EF24720B97F35F65
C:\Windows\System32\DRIVERS\termdd.sys ==> MD5 is legit
C:\Windows\SysWOW64\Drivers\TFsExDisk.sys CE4B6956E4E12492715A53076E58761F
C:\Windows\System32\DRIVERS\tssecsrv.sys E232A3B43A894BB327FC161529BD9ED1
C:\Windows\System32\drivers\tsusbflt.sys E9981ECE8D894CEF7038FD1D040EB426
C:\Windows\system32\drivers\TsUsbGD.sys AD64450A4ABE076F5CB34CC08EEACB07
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\drivers\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\umpass.sys ==> MD5 is legit
C:\Windows\System32\Drivers\usbaapl64.sys FB251567F41BC61988B26731DEC19E4B
C:\Windows\System32\drivers\usbaudio.sys B0435098C81D04CAFFF80DDB746CD3A2
C:\Windows\System32\DRIVERS\usbccgp.sys DCA68B0943D6FA415F0C56C92158A83A
C:\Windows\system32\drivers\usbcir.sys 80B0F7D5CCF86CEB5D402EAAF61FEC31
C:\Windows\System32\DRIVERS\usbehci.sys 18A85013A3E0F7E1755365D287443965
C:\Windows\System32\DRIVERS\usbhub.sys 8D1196CFBB223621F2C67D45710F25BA
C:\Windows\System32\DRIVERS\usbohci.sys 765A92D428A8DB88B960DA5A8D6089DC
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbscan.sys 9661DA76B4531B2DA272ECCE25A8AF24
C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6
C:\Windows\system32\drivers\usbuhci.sys DD253AFC3BC6CBA412342DE60C3647F3
C:\Windows\System32\Drivers\usbvideo.sys 1F775DA4CF1A3A1834207E975A72E9D7
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\drivers\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\drivers\vwifibus.sys ==> MD5 is legit
C:\Windows\system32\drivers\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\drivers\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys E2C933EDBC389386EBE6D2BA953F43D8
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWOW64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\system32\drivers\WinUsb.sys FE88B288356E7B47B74B13372ADD906D
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F
C:\Windows\system32\drivers\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659

FRST.txt - Teil 2

Code:

ATTFilter

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Three Months Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-04 08:19 - 2015-06-04 08:19 - 00001035 _____ () C:\Users\Sou\Desktop\checkup.txt
2015-06-04 08:16 - 2015-06-04 08:16 - 00852639 _____ () C:\Users\Sou\Desktop\SecurityCheck.exe
2015-06-04 00:49 - 2015-06-04 00:49 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-05-27 21:12 - 2015-05-27 21:12 - 00033309 ____C () C:\ComboFix.txt
2015-05-27 20:32 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-05-27 20:32 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-05-27 20:32 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-05-27 20:32 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-05-27 20:32 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-05-27 20:32 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-05-27 20:32 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-05-27 20:32 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-05-27 20:30 - 2015-05-27 21:13 - 00000000 ___DC () C:\Qoobox
2015-05-27 20:30 - 2015-05-27 21:05 - 00000000 ____D () C:\Windows\erdnt
2015-05-26 22:00 - 2015-06-02 22:13 - 00002114 _____ () C:\Windows\PFRO.log
2015-05-26 21:13 - 2015-05-27 06:11 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-05-26 21:10 - 2015-05-26 23:06 - 00000000 ____D () C:\Users\Sou\Desktop\mbar
2015-05-25 21:21 - 2015-05-25 21:21 - 01182149 _____ () C:\Users\Sou\Downloads\7z936.exe
2015-05-25 21:21 - 2015-05-25 21:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2015-05-25 18:13 - 2015-06-04 08:20 - 00000000 ___DC () C:\FRST
2015-05-25 18:11 - 2015-05-25 18:11 - 00000000 _____ () C:\Users\Sou\defogger_reenable
2015-05-21 18:12 - 2015-05-21 18:12 - 00000000 ____D () C:\Users\Sou\AppData\Roaming\EurekaLab s.a.s
2015-05-21 12:35 - 2015-05-21 12:35 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-SOU-ARLT-Windows-7-Home-Premium-(64-bit).dat
2015-05-21 12:35 - 2015-05-21 12:35 - 00000000 ___DC () C:\RegBackup
2015-05-21 11:46 - 2015-06-04 08:16 - 00000000 ____D () C:\Users\Sou\Desktop\Anti-Malware
2015-05-20 09:57 - 2015-05-20 09:57 - 51789024 _____ (Microsoft Corporation) C:\Users\Sou\Downloads\Windows-KB890830-x64-v5.24.exe
2015-05-19 22:10 - 2015-06-04 00:13 - 00001288 _____ () C:\Windows\setupact.log
2015-05-19 22:10 - 2015-05-19 22:10 - 00000000 _____ () C:\Windows\setuperr.log
2015-05-19 22:02 - 2015-05-19 22:02 - 00274782 _____ () C:\Users\Sou\Documents\cc_20150519_220207.reg
2015-05-19 03:02 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-19 03:02 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-19 00:16 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-19 00:16 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-19 00:16 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-19 00:16 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-19 00:16 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-19 00:16 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-19 00:16 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-19 00:16 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-19 00:16 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-19 00:16 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-19 00:16 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-19 00:16 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-19 00:16 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-19 00:16 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-19 00:16 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-19 00:16 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-19 00:16 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-19 00:16 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-19 00:16 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-19 00:16 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-19 00:16 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-19 00:16 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-19 00:16 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-19 00:16 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-19 00:16 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-19 00:16 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-19 00:16 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-19 00:16 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-19 00:16 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-19 00:16 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-19 00:16 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-19 00:16 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-19 00:16 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-19 00:16 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-19 00:16 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-19 00:16 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-19 00:16 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-19 00:16 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-19 00:16 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-19 00:16 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-19 00:16 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-19 00:16 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-19 00:16 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-19 00:16 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-19 00:16 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-19 00:16 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-19 00:16 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-19 00:16 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-19 00:16 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-19 00:16 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-19 00:16 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-19 00:16 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-19 00:16 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-19 00:16 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-19 00:16 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-19 00:16 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-19 00:16 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-19 00:16 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-19 00:16 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-19 00:16 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-19 00:16 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-19 00:16 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-19 00:16 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-19 00:16 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-19 00:16 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-19 00:16 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-19 00:16 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-19 00:13 - 2015-04-27 21:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-19 00:13 - 2015-04-27 21:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-19 00:13 - 2015-04-27 21:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-19 00:13 - 2015-04-27 21:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-19 00:13 - 2015-04-27 21:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-05-19 00:13 - 2015-04-27 21:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-19 00:13 - 2015-04-27 21:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-19 00:13 - 2015-04-27 21:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-19 00:13 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-05-19 00:13 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-05-19 00:13 - 2015-04-27 21:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-19 00:13 - 2015-04-27 21:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-05-19 00:13 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-05-19 00:13 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-19 00:13 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-05-19 00:13 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-05-19 00:13 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-05-19 00:13 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-05-19 00:13 - 2015-04-27 21:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-05-19 00:13 - 2015-04-27 21:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-05-19 00:13 - 2015-04-27 21:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-05-19 00:13 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-19 00:13 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-05-19 00:13 - 2015-04-27 20:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-19 00:12 - 2015-04-27 21:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-19 00:12 - 2015-04-27 21:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-19 00:12 - 2015-04-27 21:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-05-19 00:12 - 2015-04-27 21:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-19 00:12 - 2015-04-27 21:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-19 00:12 - 2015-04-27 21:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-19 00:12 - 2015-04-27 21:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-05-19 00:12 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-19 00:12 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 19:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-05-19 00:12 - 2015-04-27 19:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-05-19 00:12 - 2015-04-27 19:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-05-19 00:12 - 2015-04-27 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-05-19 00:10 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-19 00:10 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-19 00:10 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-19 00:10 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-19 00:10 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-19 00:10 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-19 00:10 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-19 00:10 - 2015-01-29 05:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-19 00:10 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-19 00:07 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-19 00:07 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-19 00:07 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-19 00:07 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-19 00:07 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-05-19 00:07 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-05-19 00:07 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-04-21 18:35 - 2015-04-21 18:35 - 00038400 _____ () C:\Users\Sou\Desktop\Seitenplan Viva 100 - VORLÄUFIG-20.04.15.xls
2015-04-21 18:33 - 2015-04-21 18:33 - 00000000 ____D () C:\Users\Sou\Documents\Benutzerdefinierte Office-Vorlagen
2015-04-20 03:13 - 2015-04-20 03:13 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-04-20 03:13 - 2015-04-20 03:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-04-19 17:48 - 2015-04-19 17:48 - 00002174 _____ () C:\Users\Sou\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-04-19 17:48 - 2015-04-19 17:48 - 00002124 _____ () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-04-19 17:48 - 2015-04-19 17:48 - 00002124 _____ () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-04-19 17:48 - 2015-04-19 17:48 - 00000000 ___RD () C:\Users\Sou\OneDrive
2015-04-19 17:48 - 2015-04-19 17:48 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
2015-04-19 17:48 - 2015-04-19 17:48 - 00000000 ____D () C:\Program Files (x86)\Microsoft OneDrive
2015-04-19 17:35 - 2015-04-19 17:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-04-19 17:34 - 2015-05-19 19:37 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2015-04-19 17:34 - 2015-04-19 17:34 - 01079992 _____ (Microsoft Corporation) C:\Users\Sou\Downloads\Setup.X86.de-DE_O365HomePremRetail_5a3c63fc-113b-45fc-9a2a-f5d67dc7799e_TX_DB_.exe
2015-04-19 17:25 - 2015-04-19 17:26 - 00000000 ____D () C:\ProgramData\mquadr.at
2015-04-19 17:25 - 2015-04-19 17:25 - 00000000 ____D () C:\Users\Sou\AppData\Local\TGE
2015-04-19 17:24 - 2015-04-20 00:00 - 00000000 ____D () C:\Users\Sou\AppData\Local\mquadr.at
2015-04-19 17:24 - 2015-04-19 17:25 - 00000000 __HDC () C:\ProgramData\{CD3330DC-8B86-4AE3-B2E4-09E56CB3E702}
2015-04-19 17:24 - 2015-04-19 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\o2
2015-04-19 17:24 - 2015-04-19 17:24 - 00000000 ____D () C:\Program Files (x86)\DSL Soforthilfe
2015-04-19 17:24 - 2013-11-21 22:56 - 03748800 ____N (mquadr.at software engineering und consulting GmbH) C:\Windows\SysWOW64\M2ElevatedCalls.dll
2015-04-19 17:24 - 2013-11-21 22:56 - 03490272 ____N (mquadr.at software engineering & consulting GmbH) C:\Windows\SysWOW64\m2network64helper.exe
2015-04-19 17:24 - 2013-11-21 22:56 - 00962528 ____N (mquadr.at software engineering) C:\Windows\SysWOW64\M2ElevatedNetworkAdapters.dll
2015-04-19 17:24 - 2012-12-03 15:58 - 00279040 ____N (Nicomsoft Ltd.) C:\Windows\system32\WiFiMan.dll
2015-04-19 17:24 - 2012-12-03 15:57 - 00238592 ____N (Nicomsoft Ltd.) C:\Windows\SysWOW64\WiFiMan.dll
2015-04-19 17:23 - 2015-04-19 17:23 - 44631824 _____ (Telefónica Germany GmbH & Co. OHG ) C:\Users\Sou\Downloads\dsl_soforthilfe.exe
2015-04-19 16:49 - 2015-03-25 05:24 - 03298816 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-04-19 16:49 - 2015-03-25 05:24 - 02553856 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-04-19 16:49 - 2015-03-25 05:24 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-04-19 16:49 - 2015-03-25 05:24 - 00191488 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-04-19 16:49 - 2015-03-25 05:24 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-04-19 16:49 - 2015-03-25 05:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-04-19 16:49 - 2015-03-25 05:24 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-04-19 16:49 - 2015-03-25 05:24 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-04-19 16:49 - 2015-03-25 05:23 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-04-19 16:49 - 2015-03-25 05:23 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-04-19 16:49 - 2015-03-25 05:23 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-04-19 16:49 - 2015-03-25 05:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-04-19 16:49 - 2015-03-25 05:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-04-19 16:49 - 2015-03-25 05:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-04-19 16:49 - 2015-03-25 05:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-04-19 16:49 - 2015-03-25 05:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-04-19 16:48 - 2015-03-23 05:25 - 00769536 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-04-19 16:48 - 2015-03-23 05:25 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-04-19 16:48 - 2015-03-23 05:24 - 00957952 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-04-19 16:48 - 2015-03-23 05:24 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-04-19 16:48 - 2015-03-23 05:24 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-04-19 16:48 - 2015-03-23 05:24 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-04-19 16:48 - 2015-03-23 05:24 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-04-19 16:48 - 2015-03-23 05:17 - 01111552 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-04-19 16:48 - 2015-03-10 05:25 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-04-19 16:48 - 2015-03-10 05:21 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-04-19 16:48 - 2015-03-10 05:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-04-19 16:48 - 2015-03-10 05:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-04-19 16:48 - 2015-03-05 07:12 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-04-19 16:48 - 2015-03-05 06:05 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-04-19 16:44 - 2015-02-25 05:18 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-04-19 16:43 - 2015-03-04 06:55 - 00367552 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-04-19 16:43 - 2015-03-04 06:41 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-19 16:43 - 2015-03-04 06:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-04-07 23:53 - 2015-05-22 00:38 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-04-07 23:53 - 2015-05-22 00:38 - 00000000 ___SD () C:\Windows\system32\GWX
2015-03-26 23:12 - 2015-03-26 23:12 - 00000000 __SHD () C:\Users\Sou\AppData\Local\EmieBrowserModeList
2015-03-23 21:17 - 2015-03-23 21:18 - 00000000 ____D () C:\Users\Sou\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ConEdit - Deus Ex Conversation Editor
2015-03-23 21:17 - 2015-03-23 21:18 - 00000000 ____D () C:\Program Files (x86)\ConEdit
2015-03-23 21:17 - 2015-03-23 21:17 - 00286720 ____N (Microsoft Corporation) C:\Windows\Setup1.exe
2015-03-23 21:17 - 2015-03-23 21:17 - 00073216 _____ (Microsoft Corporation) C:\Windows\ST6UNST.EXE
2015-03-23 21:17 - 2015-03-23 21:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deus Ex SDK
2015-03-23 21:06 - 2015-03-23 21:09 - 06541824 _____ () C:\Users\Sou\Downloads\DeusExSDK1112f.exe
2015-03-23 20:19 - 2015-03-23 20:23 - 304783476 _____ ( ) C:\Users\Sou\Downloads\2027_1.2.1.exe
2015-03-23 19:57 - 2015-03-23 19:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deus Ex
2015-03-23 19:52 - 2015-03-23 19:54 - 37399552 _____ () C:\Users\Sou\Downloads\deusexmppatch1112fm.exe
2015-03-19 23:20 - 2015-03-19 23:20 - 00000000 ____D () C:\Users\Sou\AppData\Local\238010
2015-03-19 23:20 - 2015-03-19 23:20 - 00000000 ____D () C:\ProgramData\Intel
2015-03-19 17:19 - 2015-03-19 17:21 - 00000000 ____D () C:\Users\Sou\Documents\Deus Ex - Invisible War
2015-03-15 21:48 - 2015-03-15 21:50 - 150069838 _____ () C:\Users\Sou\Downloads\Unofficial_Oblivion_Patch-3.5.1.7z
2015-03-15 11:28 - 2015-03-15 11:28 - 01422613 _____ () C:\Users\Sou\Downloads\alba-20237.7z
2015-03-14 21:45 - 2015-03-14 21:47 - 01662426 _____ () C:\Users\Sou\Downloads\obse_0021.zip
2015-03-14 21:34 - 2015-03-14 21:34 - 03868883 _____ () C:\Users\Sou\Downloads\AlternativeBeginningsDV_121(1).zip
2015-03-14 21:20 - 2015-03-14 21:20 - 00017051 _____ () C:\Users\Sou\Downloads\Alternative_Anfaenge.7z
2015-03-14 20:38 - 2015-03-14 20:38 - 03868883 _____ () C:\Users\Sou\Downloads\AlternativeBeginningsDV_121.zip
2015-03-14 20:32 - 2015-03-14 20:32 - 00202074 _____ () C:\Users\Sou\Downloads\Burg_Ehrenfels_v1_2.7z
2015-03-14 20:31 - 2015-03-14 20:31 - 00166215 _____ () C:\Users\Sou\Downloads\Kaiserstadtschuppen_1_0.7z
2015-03-14 20:29 - 2015-03-14 20:29 - 14641399 _____ () C:\Users\Sou\Downloads\AnswesenSilberhufv1.3.7z
2015-03-14 20:27 - 2015-03-14 20:27 - 34433441 _____ () C:\Users\Sou\Downloads\DasHausInCheydinhalV1.0.7z
2015-03-14 20:26 - 2015-03-14 20:26 - 11468111 _____ () C:\Users\Sou\Downloads\mde_Unterirdische_Wohnanlage.7z
2015-03-14 20:19 - 2015-03-14 20:19 - 26174888 _____ () C:\Users\Sou\Downloads\Stadtpaket Tamriels - Plugins 1.3.8.7z
2015-03-14 20:17 - 2015-03-14 20:17 - 00034438 _____ () C:\Users\Sou\Downloads\p1d_keychain_v2_1_ger.7z
2015-03-14 20:15 - 2015-03-14 20:15 - 00079499 _____ () C:\Users\Sou\Downloads\BagofHolding1.1.rar
2015-03-14 20:13 - 2015-03-14 20:14 - 00630047 _____ () C:\Users\Sou\Downloads\Bedrolls_and_Tents_Anyone_DV.zip
2015-03-14 20:02 - 2015-03-14 20:02 - 00093008 _____ () C:\Users\Sou\Downloads\einsame_Insel_v1.0(1).7z
2015-03-14 19:55 - 2015-03-14 19:55 - 01513472 _____ () C:\Users\Sou\Downloads\7z938-x64(2).msi
2015-03-14 19:54 - 2015-03-14 19:55 - 01513472 _____ () C:\Users\Sou\Downloads\7z938-x64(1).msi
2015-03-14 19:47 - 2015-03-14 19:47 - 01513472 _____ () C:\Users\Sou\Downloads\7z938-x64.msi
2015-03-14 19:45 - 2015-03-14 19:45 - 01376768 _____ () C:\Users\Sou\Downloads\7z920-x64.msi
2015-03-14 19:35 - 2015-03-14 19:35 - 01203488 _____ () C:\Users\Sou\Downloads\7 Zip 64 Bit - CHIP-Installer.exe
2015-03-14 19:34 - 2015-03-14 19:34 - 00093008 _____ () C:\Users\Sou\Downloads\einsame_Insel_v1.0.7z
2015-03-14 19:26 - 2015-03-14 19:26 - 10891028 _____ () C:\Users\Sou\Downloads\Natural_Environments(1).7z
2015-03-14 19:19 - 2015-03-14 19:19 - 10891028 _____ () C:\Users\Sou\Downloads\Natural_Environments.7z
2015-03-14 19:11 - 2015-03-14 19:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oblivion Mod Manager
2015-03-14 19:07 - 2015-03-14 19:10 - 155106314 _____ () C:\Users\Sou\Downloads\Unofficial Oblivion Patch-5296-3-5-2b.7z
2015-03-14 18:45 - 2015-03-14 18:45 - 00001303 _____ () C:\Users\Sou\Downloads\real_water.rar
2015-03-11 21:30 - 2015-03-11 21:30 - 00005253 _____ () C:\Users\Sou\AppData\Local\recently-used.xbel
2015-03-11 11:01 - 2015-02-20 06:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-11 11:01 - 2015-02-20 06:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-11 11:01 - 2015-02-20 06:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-11 11:01 - 2015-02-20 06:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-11 11:01 - 2015-02-20 06:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-11 11:01 - 2015-02-20 06:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-11 11:01 - 2015-02-20 06:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-11 11:01 - 2015-02-20 06:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-11 11:01 - 2015-02-20 05:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-11 11:01 - 2015-02-20 05:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-11 11:01 - 2015-02-03 05:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-03-11 11:01 - 2015-02-03 05:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-03-11 11:01 - 2015-02-03 05:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-03-11 11:01 - 2015-02-03 05:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-03-11 11:01 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-03-11 11:01 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-03-11 11:01 - 2015-02-03 05:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-03-11 11:01 - 2015-02-03 05:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-03-11 11:01 - 2015-02-03 05:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-03-11 11:01 - 2015-02-03 05:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-03-11 11:01 - 2015-02-03 05:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-03-11 11:01 - 2015-02-03 05:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-03-11 11:01 - 2015-02-03 05:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-03-11 11:01 - 2015-02-03 05:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-03-11 11:01 - 2015-02-03 05:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-03-11 11:01 - 2015-02-03 05:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-03-11 11:01 - 2015-02-03 05:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-03-11 11:01 - 2015-02-03 05:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-03-11 11:01 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-03-11 11:01 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-03-11 11:01 - 2015-02-03 05:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-03-11 11:01 - 2015-02-03 05:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-03-11 11:01 - 2015-02-03 05:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-03-11 11:01 - 2015-02-03 05:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-03-11 11:01 - 2015-02-03 04:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-03-11 11:01 - 2014-11-01 00:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-03-11 11:01 - 2014-06-28 02:21 - 00532176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2015-03-11 11:01 - 2014-06-28 02:21 - 00457400 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2015-03-11 11:00 - 2015-02-03 05:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-11 11:00 - 2015-02-03 05:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-11 11:00 - 2015-01-31 05:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-03-11 11:00 - 2015-01-31 05:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-03-11 11:00 - 2015-01-31 01:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-03-11 10:59 - 2015-02-13 07:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-11 10:59 - 2015-02-13 07:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-11 10:59 - 2015-02-04 05:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-11 10:59 - 2015-02-04 04:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-11 10:59 - 2015-02-03 05:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-11 10:59 - 2015-02-03 05:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-11 10:59 - 2015-01-31 01:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-11 10:59 - 2015-01-17 04:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-11 10:59 - 2015-01-17 04:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-10 18:12 - 2015-03-10 18:12 - 00410589 _____ () C:\Users\Sou\Downloads\watch.htm

==================== Three Months Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-04 08:09 - 2012-04-02 18:45 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-04 07:46 - 2013-12-14 19:13 - 01860889 _____ () C:\Windows\WindowsUpdate.log
2015-06-04 06:35 - 2011-11-25 22:12 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-06-04 02:57 - 2014-12-03 13:12 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-04 01:08 - 2012-09-13 20:19 - 00000000 ____D () C:\Users\Sou\AppData\Local\Turbine
2015-06-04 01:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-06-04 00:26 - 2009-07-14 06:45 - 00028944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-04 00:26 - 2009-07-14 06:45 - 00028944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-04 00:22 - 2010-11-21 08:50 - 00715336 _____ () C:\Windows\system32\perfh007.dat
2015-06-04 00:22 - 2010-11-21 08:50 - 00157212 _____ () C:\Windows\system32\perfc007.dat
2015-06-04 00:22 - 2009-07-14 07:13 - 01665440 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-06-04 00:13 - 2014-06-03 12:28 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-06-04 00:13 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-06-03 11:21 - 2012-09-13 21:29 - 00000000 ____D () C:\Users\Sou\Documents\The Lord of the Rings Online
2015-06-02 22:13 - 2014-12-03 12:52 - 00000000 ___DC () C:\AdwCleaner
2015-06-02 22:13 - 2012-05-04 08:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-06-02 22:07 - 2012-02-02 21:01 - 00000000 ___RD () C:\Users\Sou\Desktop\KLEINKUNST - LITERARISCHES
2015-06-02 22:06 - 2014-02-15 01:25 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-27 23:15 - 2011-06-01 19:46 - 00000000 ____D () C:\Users\Sou\AppData\Roaming\TS3Client
2015-05-27 21:13 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2015-05-27 20:49 - 2009-07-14 04:34 - 00000215 ____C () C:\Windows\system.ini
2015-05-26 23:03 - 2012-02-02 21:02 - 00000000 ___RD () C:\Users\Sou\Desktop\Dissertation
2015-05-26 22:03 - 2014-12-03 13:12 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-26 22:00 - 2012-06-24 22:23 - 00000000 ____D () C:\Windows\de
2015-05-26 09:13 - 2013-08-17 22:54 - 05091840 ___SH () C:\Users\Sou\Desktop\Thumbs.db
2015-05-25 21:21 - 2011-06-03 23:49 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2015-05-25 18:11 - 2011-06-01 11:45 - 00000000 ____D () C:\Users\Sou
2015-05-22 16:08 - 2011-07-20 20:14 - 00000000 ____D () C:\Users\Sou\AppData\Roaming\SoftGrid Client
2015-05-22 12:28 - 2012-11-27 01:02 - 00000000 ___RD () C:\Users\Sou\Desktop\mfm
2015-05-21 11:52 - 2014-12-03 13:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-05-21 11:52 - 2014-12-03 13:12 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-05-19 21:52 - 2012-08-13 19:50 - 00000000 ___RD () C:\Users\Sou\Desktop\Bilder
2015-05-19 21:52 - 2012-02-02 21:01 - 00000000 ___RD () C:\Users\Sou\Desktop\Komponistinnen
2015-05-19 20:32 - 2014-09-03 00:11 - 00000000 ____D () C:\Users\Sou\AppData\Local\Adobe
2015-05-19 20:31 - 2012-04-02 18:45 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-19 20:31 - 2012-04-02 18:45 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-19 20:31 - 2011-06-02 13:49 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-19 04:27 - 2014-04-11 09:17 - 00000000 ____D () C:\Windows\rescache
2015-05-19 03:38 - 2009-07-14 06:45 - 00555696 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-19 03:37 - 2012-05-18 02:14 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-19 03:37 - 2012-05-18 02:14 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-05-19 03:34 - 2010-11-21 09:00 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-19 03:34 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-19 03:16 - 2011-07-20 20:14 - 01692058 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-05-19 03:16 - 2011-07-20 20:13 - 00000000 ____D () C:\Program Files (x86)\Microsoft Application Virtualization Client
2015-05-19 03:14 - 2013-08-08 03:09 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-19 03:02 - 2012-05-18 02:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-19 01:17 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2015-05-19 00:27 - 2014-05-23 14:00 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

==================== Files in the root of some directories =======

2014-11-29 12:32 - 2014-11-29 12:32 - 0000093 _____ () C:\Users\Sou\AppData\Roaming\ARCompanion.log
2012-09-01 09:49 - 2012-09-01 09:51 - 0000198 _____ () C:\Users\Sou\AppData\Roaming\burnaware.ini
2012-08-31 18:32 - 2012-08-31 18:32 - 0003584 _____ () C:\Users\Sou\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-09-13 20:17 - 2012-09-13 20:17 - 0000091 _____ () C:\Users\Sou\AppData\Local\fusioncache.dat
2015-03-11 21:30 - 2015-03-11 21:30 - 0005253 _____ () C:\Users\Sou\AppData\Local\recently-used.xbel
2011-11-11 18:37 - 2011-11-11 18:37 - 0000017 _____ () C:\Users\Sou\AppData\Local\resmon.resmoncfg
2011-11-25 22:14 - 2011-11-25 22:14 - 0017408 _____ () C:\Users\Sou\AppData\Local\WebpageIcons.db
2012-06-10 19:51 - 2012-06-10 20:23 - 0001396 _____ () C:\ProgramData\hpzinstall.log

Some files in TEMP:
====================
C:\Users\Sou\AppData\Local\Temp\Quarantine.exe
C:\Users\Sou\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

==================== BCD ================================

Windows-Start-Manager
---------------------
Bezeichner              {bootmgr}
device                  partition=C:
description             Windows Boot Manager
locale                  de-DE
inherit                 {globalsettings}
default                 {current}
resumeobject            {328061e9-3e79-11e0-8a42-6c626d92265d}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 30

Windows-Startladeprogramm
-------------------------
Bezeichner              {current}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 7
locale                  de-DE
inherit                 {bootloadersettings}
recoverysequence        {328061eb-3e79-11e0-8a42-6c626d92265d}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {328061e9-3e79-11e0-8a42-6c626d92265d}
nx                      OptIn

Windows-Startladeprogramm
-------------------------
Bezeichner              {328061eb-3e79-11e0-8a42-6c626d92265d}
device                  ramdisk=[C:]\Recovery\328061eb-3e79-11e0-8a42-6c626d92265d\Winre.wim,{328061ec-3e79-11e0-8a42-6c626d92265d}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
inherit                 {bootloadersettings}
osdevice                ramdisk=[C:]\Recovery\328061eb-3e79-11e0-8a42-6c626d92265d\Winre.wim,{328061ec-3e79-11e0-8a42-6c626d92265d}
systemroot              \windows
nx                      OptIn
winpe                   Yes

Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner              {328061e9-3e79-11e0-8a42-6c626d92265d}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description             Windows Resume Application
locale                  de-DE
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No

Windows-Speichertestprogramm
----------------------------
Bezeichner              {memdiag}
device                  partition=C:
path                    \boot\memtest.exe
description             Windows-Speicherdiagnose
locale                  de-DE
inherit                 {globalsettings}
badmemoryaccess         Yes

EMS-Einstellungen
-----------------
Bezeichner              {emssettings}
bootems                 Yes

Debuggereinstellungen
---------------------
Bezeichner              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200

RAM-Defekte
-----------
Bezeichner              {badmemory}

Globale Einstellungen
---------------------
Bezeichner              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Startladeprogramm-Einstellungen
-------------------------------
Bezeichner              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Hypervisoreinstellungen
-------------------
Bezeichner              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner              {resumeloadersettings}
inherit                 {globalsettings}

Ger„teoptionen
--------------
Bezeichner              {328061ec-3e79-11e0-8a42-6c626d92265d}
description             Ramdisk Options
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\328061eb-3e79-11e0-8a42-6c626d92265d\boot.sdi



LastRegBack: 2015-06-04 04:36

==================== End of log ============================

--- --- ---

schrauber · 04.06.2015, 20:28

Java updaten.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKLM-x32\...\Run: [] => [X]
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
Combofix deinstallieren

Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
Drücke bitte die + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
Klicke auf OK.
Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte

DelFix herunter.

Schließe alle offenen Programme.
Starte die delfix.exe mit einem Doppelklick.
Setze vor jede Funktion ein Häkchen.
Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...

und/oder das Forum mit einer kleinen Spende unterstützen.

Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank.
Meine Empfehlung:

Emsisoft

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:

NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.

Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.

Lade Software von einem sauberen Portal wie

.
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .

Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

Argiel · 04.06.2015, 21:24

Code:

ATTFilter

Fix result of Farbar Recovery Scan Tool (x64) Version: 29-05-2015
Ran by Sou at 2015-06-04 21:34:19 Run:1
Running from C:\Users\Sou\Desktop\Anti-Malware
Loaded Profiles: Sou & UpdatusUser (Available Profiles: Sou & UpdatusUser)
Boot Mode: Normal
==============================================

fixlist content:
*****************
HKLM-x32\...\Run: [] => [X]
Emptytemp:
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value Removed successfully
EmptyTemp: => Removed 484.4 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 21:36:16 ====

Ok, restliche Sachen gedownloaded (downgeloaded?), alles befolgt, alles notiert, Lesezeichen gesetzt für das Wichtigste...& die Seite wärmstens weiterempfohlen