| |
| |||||||
Log-Analyse und Auswertung: PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 1Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
03.06.2015, 09:58
| #1 |
 |  PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 1 Hallo liebe Experten, seit etwa 2 Wochen bootet mein PC sehr langsam. Auch Programme (Firefox, Thunderbird, Softmaker FreeOffice etc.) brauchen gefühlt dreimal so lang, bis sie geladen sind. Selbst der Windows-Explorer braucht eine Gedenkminute. Treiber habe ich soweit wie möglich aktualisiert. Die Windows-Updates sind auch aktuell. Ich habe Avast-AV installiert, dazu habe ich Malwarebytes und Emisoft mehrmals ausgeführt. Leider ohne Erfolg  Ich bin nun mit meinem Latein am EndeIch habe mich so gut es geht an die 8 goldenen Regeln des Forums gehalten (Defogger, FRST etc.) und poste nun alle erforderlichen log-Dateien. Vorab schon mal vielen Dank für Eure Unterstützung. P.S.: Leider ist die GMER Log sehr groß. Ich muß sie in drei Teile aufteilen. Es wird also vier Posts von mir geben. defogger_disable by jpshortstuff (23.02.10.1) Log created at 17:04 on 02/06/2015 (Eltern) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 29-05-2015 Ran by Eltern (administrator) on ELTERN-PC on 02-06-2015 17:10:07 Running from C:\Users\Eltern\Desktop Loaded Profiles: Eltern (Available Profiles: Eltern) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe (Avast Software s.r.o.) C:\Program Files (x86)\AVAST Software\Avast\AvastSvc.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Avast Software s.r.o.) C:\Program Files (x86)\AVAST Software\Avast\avastui.exe (Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Avast Software s.r.o.) C:\Program Files (x86)\AVAST Software\Avast\setup\instup.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files (x86)\AVAST Software\Avast\AvastUI.exe [5515496 2015-05-12] (Avast Software s.r.o.) HKLM-x32\...\Run: [emsisoft anti-malware] => c:\program files (x86)\emsisoft anti-malware\a2guard.exe [4923832 2015-05-26] (Emsisoft Ltd) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Bubbles.scr [899584 2010-11-20] (Microsoft Corporation) HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2013-10-17] (Microsoft Corporation) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files (x86)\AVAST Software\Avast\ashShA64.dll [2015-05-04] (Avast Software s.r.o.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/ HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files (x86)\AVAST Software\Avast\aswWebRepIE64.dll [2015-05-04] (Avast Software s.r.o.) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.) BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll [2009-02-06] (Zeon Corporation) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files (x86)\AVAST Software\Avast\aswWebRepIE.dll [2015-05-04] (Avast Software s.r.o.) BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.) Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-03-11] (Citrix Systems, Inc.) Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-03-11] (Citrix Systems, Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Eltern\AppData\Roaming\Mozilla\Firefox\Profiles\myv9y403.default-1432651667587 FF Homepage: https://www.google.de/ FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-13] () FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-13] () FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.) FF Extension: Adblock Plus - C:\Users\Eltern\AppData\Roaming\Mozilla\Firefox\Profiles\myv9y403.default-1432651667587\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-05-26] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files (x86)\AVAST Software\Avast\WebRep\FF FF Extension: Avast Online Security - C:\Program Files (x86)\AVAST Software\Avast\WebRep\FF [2015-04-26] Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files (x86)\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-26] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [5155576 2015-05-26] (Emsisoft Ltd) R2 avast! Antivirus; C:\Program Files (x86)\AVAST Software\Avast\AvastSvc.exe [343336 2015-05-04] (Avast Software s.r.o.) S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112 2013-09-25] (Brother Industries, Ltd.) [File not signed] S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation) S4 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [145256 2011-08-02] (Nuance Communications, Inc.) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-05-04] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-05-04] (Avast Software s.r.o.) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-05-04] (Avast Software s.r.o.) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-05-04] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-05-04] (Avast Software s.r.o.) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-05-04] (Avast Software s.r.o.) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-05-04] (Avast Software s.r.o.) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-05-04] () S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2011-07-29] () [File not signed] S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [14216 2011-07-29] () [File not signed] R1 epp64; C:\Windows\System32\DRIVERS\epp64.sys [135800 2015-03-24] (Emsisoft GmbH) S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2011-07-29] () [File not signed] S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [8456 2011-07-29] () [File not signed] R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation) R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] () U5 UnlockerDriver5; C:\Program Files (x86)\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] () S3 HWiNFO32; \??\C:\Users\Eltern\AppData\Local\Temp\HWiNFO64A.SYS [X] S3 SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP6\WNt500x64\Sandra.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-06-02 17:10 - 2015-06-02 17:10 - 00009672 _____ () C:\Users\Eltern\Desktop\FRST.txt 2015-06-02 17:09 - 2015-06-02 17:10 - 00000000 ____D () C:\FRST 2015-06-02 17:07 - 2015-06-02 17:07 - 02108928 _____ (Farbar) C:\Users\Eltern\Desktop\FRST64.exe 2015-06-02 17:04 - 2015-06-02 17:04 - 00000474 _____ () C:\Users\Eltern\Desktop\defogger_disable.log 2015-06-02 17:04 - 2015-06-02 17:04 - 00000000 _____ () C:\Users\Eltern\defogger_reenable 2015-06-02 17:02 - 2015-06-02 17:02 - 00050477 _____ () C:\Users\Eltern\Desktop\Defogger.exe 2015-06-02 14:26 - 2015-06-02 14:26 - 00000000 ____D () C:\Users\Eltern\AppData\Local\GWX 2015-06-01 19:21 - 2015-06-01 19:21 - 00000000 ____D () C:\Program Files (x86)\Realtek 2015-06-01 19:21 - 2009-08-18 11:44 - 00236544 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys 2015-06-01 19:21 - 2009-08-18 11:44 - 00067584 _____ () C:\Windows\system32\RtNicProp64.dll 2015-06-01 19:21 - 2009-07-22 18:24 - 00097792 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll 2015-06-01 16:49 - 2015-06-01 16:49 - 00000000 ____D () C:\Users\Eltern\Documents\hw64_462-1 2015-05-27 12:08 - 2015-05-28 17:09 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird 2015-05-27 11:25 - 2015-05-27 11:25 - 00001051 _____ () C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk 2015-05-27 11:25 - 2015-05-27 11:25 - 00001051 _____ () C:\ProgramData\Desktop\Revo Uninstaller Pro.lnk 2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D () C:\Users\Eltern\AppData\Local\VS Revo Group 2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D () C:\ProgramData\VS Revo Group 2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro 2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D () C:\Program Files\VS Revo Group 2015-05-27 11:25 - 2009-12-30 10:21 - 00031800 _____ (VS Revo Group) C:\Windows\system32\Drivers\revoflt.sys 2015-05-27 11:17 - 2015-05-27 11:18 - 10801480 _____ (VS Revo Group ) C:\Users\Eltern\Downloads\RevoUninProSetup-312.exe 2015-05-26 16:47 - 2015-05-26 16:47 - 00000000 ____D () C:\Users\Eltern\Desktop\Alte Firefox-Daten 2015-05-26 16:44 - 2015-05-26 16:44 - 00494857 _____ () C:\Users\Eltern\Desktop\bookmarks.html 2015-05-26 08:44 - 2015-05-26 08:44 - 00000000 ____D () C:\Program Files\avast software 2015-05-20 17:31 - 2015-01-31 05:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll 2015-05-20 17:31 - 2015-01-31 05:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll 2015-05-20 17:31 - 2015-01-31 01:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll 2015-05-20 17:30 - 2014-12-11 19:47 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe 2015-05-19 20:02 - 2014-09-05 03:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2015-05-19 20:01 - 2014-09-05 04:11 - 06584320 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2015-05-17 19:29 - 2015-05-17 19:29 - 00000000 ____D () C:\ProgramData\Emsisoft 2015-05-17 19:11 - 2015-06-02 16:26 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware 2015-05-17 19:11 - 2015-05-17 19:11 - 00001105 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk 2015-05-17 19:11 - 2015-05-17 19:11 - 00001105 _____ () C:\ProgramData\Desktop\Emsisoft Anti-Malware.lnk 2015-05-17 19:11 - 2015-05-17 19:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware 2015-05-17 19:11 - 2015-03-24 00:17 - 00135800 _____ (Emsisoft GmbH) C:\Windows\system32\Drivers\epp64.sys 2015-05-17 19:01 - 2015-05-17 19:10 - 161426392 _____ (Emsisoft Ltd. ) C:\Users\Eltern\Downloads\emsisoftantimalwaresetup.exe 2015-05-17 17:22 - 2015-05-17 17:22 - 21545848 _____ (Malwarebytes Corporation ) C:\Users\Eltern\Downloads\Anti-Malware.exe 2015-05-17 16:30 - 2015-05-17 16:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-05-17 15:56 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys 2015-05-17 15:56 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe 2015-05-17 15:56 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll 2015-05-17 15:56 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll 2015-05-17 15:56 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll 2015-05-17 15:56 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll 2015-05-17 15:56 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll 2015-05-17 15:56 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll 2015-05-17 15:56 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll 2015-05-17 15:56 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll 2015-05-17 15:56 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe 2015-05-17 15:56 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll 2015-05-17 15:56 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe 2015-05-17 15:56 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll 2015-05-17 15:56 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe 2015-05-17 15:55 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys 2015-05-17 15:55 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll 2015-05-17 15:55 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll 2015-05-17 15:54 - 2015-03-14 05:21 - 01632768 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll 2015-05-17 15:54 - 2015-03-14 05:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll 2015-05-17 15:54 - 2015-03-14 05:04 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll 2015-05-17 15:54 - 2015-03-14 05:04 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll 2015-05-17 13:56 - 2015-05-17 10:57 - 00008969 _____ () C:\Users\Eltern\Documents\Arbeitszeitreduzierung.tmd 2015-05-14 19:49 - 2015-05-14 19:49 - 02209792 _____ () C:\Users\Eltern\Downloads\adwcleaner_4.204.exe 2015-05-13 08:28 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll 2015-05-13 08:28 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll 2015-05-13 08:19 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-05-13 08:19 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2015-05-13 08:19 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-05-13 08:19 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-05-13 08:19 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-05-13 08:19 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-05-13 08:19 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2015-05-13 08:19 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2015-05-13 08:19 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-05-13 08:19 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2015-05-13 08:19 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2015-05-13 08:19 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-05-13 08:19 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-05-13 08:19 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-05-13 08:19 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2015-05-13 08:19 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-05-13 08:19 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-05-13 08:19 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-05-13 08:19 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2015-05-13 08:19 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2015-05-13 08:19 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-05-13 08:19 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2015-05-13 08:19 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2015-05-13 08:19 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-05-13 08:19 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-05-13 08:19 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2015-05-13 08:19 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-05-13 08:19 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2015-05-13 08:19 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2015-05-13 08:19 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2015-05-13 08:19 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2015-05-13 08:19 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-05-13 08:19 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2015-05-13 08:19 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-05-13 08:19 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-05-13 08:19 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2015-05-13 08:19 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2015-05-13 08:19 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2015-05-13 08:19 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2015-05-13 08:19 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2015-05-13 08:19 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2015-05-13 08:19 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-05-13 08:19 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-05-13 08:19 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-05-13 08:19 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2015-05-13 08:19 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-05-13 08:19 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2015-05-13 08:19 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-05-13 08:19 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2015-05-13 08:19 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2015-05-13 08:19 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2015-05-13 08:19 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-05-13 08:19 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-05-13 08:19 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-05-13 08:19 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-05-13 08:19 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2015-05-13 08:19 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-05-13 08:19 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-05-13 08:19 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-05-13 08:19 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-05-13 08:19 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-05-13 08:19 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-05-13 08:19 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll 2015-05-13 08:19 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll 2015-05-13 08:18 - 2015-04-27 21:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-05-13 08:18 - 2015-04-27 21:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-05-13 08:18 - 2015-04-27 21:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2015-05-13 08:18 - 2015-04-27 21:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll 2015-05-13 08:18 - 2015-04-27 21:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll 2015-05-13 08:18 - 2015-04-27 21:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe 2015-05-13 08:18 - 2015-04-27 21:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe 2015-05-13 08:18 - 2015-04-27 21:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-05-13 08:18 - 2015-04-27 21:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe 2015-05-13 08:18 - 2015-04-27 21:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe 2015-05-13 08:18 - 2015-04-27 21:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe 2015-05-13 08:18 - 2015-04-27 21:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe 2015-05-13 08:18 - 2015-04-27 21:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2015-05-13 08:18 - 2015-04-27 21:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe 2015-05-13 08:18 - 2015-04-27 21:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2015-05-13 08:18 - 2015-04-27 21:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2015-05-13 08:18 - 2015-04-27 21:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-05-13 08:18 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-05-13 08:18 - 2015-04-27 21:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2015-05-13 08:18 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll 2015-05-13 08:18 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2015-05-13 08:18 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2015-05-13 08:18 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2015-05-13 08:18 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll 2015-05-13 08:18 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2015-05-13 08:18 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-05-13 08:18 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2015-05-13 08:18 - 2015-04-27 21:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2015-05-13 08:18 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll 2015-05-13 08:18 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2015-05-13 08:18 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe 2015-05-13 08:18 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe 2015-05-13 08:18 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe 2015-05-13 08:18 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe 2015-05-13 08:18 - 2015-04-27 21:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2015-05-13 08:18 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2015-05-13 08:18 - 2015-04-27 21:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll 2015-05-13 08:18 - 2015-04-27 21:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2015-05-13 08:18 - 2015-04-27 21:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2015-05-13 08:18 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2015-05-13 08:18 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe 2015-05-13 08:18 - 2015-04-27 21:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2015-05-13 08:18 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2015-05-13 08:18 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 20:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll 2015-05-13 08:18 - 2015-04-27 19:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2015-05-13 08:18 - 2015-04-27 19:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2015-05-13 08:18 - 2015-04-27 19:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll 2015-05-13 08:18 - 2015-04-27 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll 2015-05-13 08:18 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe 2015-05-13 08:17 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll 2015-05-13 08:17 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll 2015-05-13 08:17 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2015-05-13 08:17 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-05-13 08:17 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll 2015-05-13 08:17 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll 2015-05-13 08:17 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll 2015-05-13 08:17 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll 2015-05-13 08:17 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll 2015-05-13 08:17 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe 2015-05-13 08:17 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll 2015-05-13 08:17 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll 2015-05-13 08:17 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll 2015-05-13 08:17 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe 2015-05-13 08:17 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe 2015-05-13 08:17 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe 2015-05-13 08:17 - 2015-01-29 05:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll 2015-05-13 08:17 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll 2015-05-10 16:11 - 2015-05-10 16:11 - 00001093 _____ () C:\Users\Public\Desktop\PDF24 Creator.lnk 2015-05-10 16:11 - 2015-05-10 16:11 - 00001093 _____ () C:\ProgramData\Desktop\PDF24 Creator.lnk 2015-05-10 16:11 - 2015-05-10 16:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24 2015-05-10 16:11 - 2015-05-10 16:11 - 00000000 ____D () C:\Program Files (x86)\PDF24 2015-05-10 16:08 - 2015-05-10 16:08 - 16342352 _____ (Geek Software GmbH ) C:\Program Files (x86)\pdf24-creator-6.9.2.exe 2015-05-10 15:30 - 2015-05-10 15:31 - 27837984 _____ (pdfforge ) C:\Users\Eltern\Downloads\PDFCreator-2_1_1-setup.exe 2015-05-10 15:06 - 2015-05-10 15:06 - 00000000 ____D () C:\Users\Eltern\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker 2015-05-10 14:47 - 2015-05-10 15:06 - 00000000 ____D () C:\Program Files (x86)\Unlocker 2015-05-10 13:14 - 2015-05-10 13:14 - 00001138 _____ () C:\Users\Eltern\Desktop\PK.vbs 2015-05-10 10:50 - 2015-05-10 10:50 - 00002562 _____ () C:\Windows\diagwrn.xml 2015-05-10 10:50 - 2015-05-10 10:50 - 00001908 _____ () C:\Windows\diagerr.xml 2015-05-09 14:08 - 2015-05-10 15:27 - 00000000 ____D () C:\Windows\pss 2015-05-04 18:51 - 2015-05-04 18:51 - 00001293 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inhaltsmanager-Assistent für PlayStation(R).lnk 2015-05-04 18:51 - 2015-05-04 18:51 - 00000000 ____D () C:\Program Files (x86)\Sony 2015-05-04 18:48 - 2015-05-04 18:49 - 10457912 _____ (Sony Computer Entertainment Inc. ) C:\Program Files (x86)\CMASetup.exe 2015-05-04 13:46 - 2015-05-04 13:46 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe 2015-05-04 13:45 - 2015-05-04 13:45 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-06-02 17:04 - 2013-10-14 21:31 - 00000000 ____D () C:\Users\Eltern 2015-06-02 16:29 - 2013-10-14 23:52 - 00000000 ____D () C:\Users\Eltern\AppData\Roaming\vlc 2015-06-02 15:14 - 2009-07-14 19:58 - 00699416 _____ () C:\Windows\system32\perfh007.dat 2015-06-02 15:14 - 2009-07-14 19:58 - 00149556 _____ () C:\Windows\system32\perfc007.dat 2015-06-02 15:14 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-06-02 14:35 - 2009-07-14 06:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-06-02 14:35 - 2009-07-14 06:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-06-02 14:30 - 2013-10-14 21:23 - 01782201 _____ () C:\Windows\WindowsUpdate.log 2015-06-02 14:25 - 2015-04-19 19:41 - 00004837 _____ () C:\Windows\setupact.log 2015-06-02 14:25 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-06-02 10:20 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration 2015-06-01 19:21 - 2014-06-25 19:42 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2015-05-30 19:17 - 2014-06-25 19:46 - 00007887 _____ () C:\Windows\BRRBCOM.INI 2015-05-30 18:44 - 2013-10-15 14:51 - 00000000 ____D () C:\Windows\rescache 2015-05-30 12:13 - 2015-04-26 16:08 - 00004194 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2015-05-28 18:10 - 2013-10-14 23:30 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-05-28 11:06 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF 2015-05-27 12:03 - 2013-10-17 00:31 - 01593956 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2015-05-20 18:32 - 2015-04-04 12:12 - 00000000 ___SD () C:\Windows\SysWOW64\GWX 2015-05-20 18:32 - 2015-04-04 12:12 - 00000000 ___SD () C:\Windows\system32\GWX 2015-05-17 17:54 - 2015-04-26 14:00 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-05-17 17:27 - 2015-04-26 14:00 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-05-17 16:04 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories 2015-05-17 16:01 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2015-05-16 09:18 - 2013-10-17 21:16 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2015-05-14 21:21 - 2015-04-26 13:57 - 00007504 _____ () C:\Windows\PFRO.log 2015-05-14 20:46 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources 2015-05-14 19:54 - 2015-04-26 13:54 - 00000000 ____D () C:\AdwCleaner 2015-05-13 14:17 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2015-05-13 10:45 - 2009-07-14 06:45 - 00287472 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-05-13 10:42 - 2013-11-15 19:52 - 00000000 ____D () C:\Program Files\Windows Journal 2015-05-13 10:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers 2015-05-13 08:35 - 2013-10-18 20:38 - 00000000 ____D () C:\Windows\system32\MRT 2015-05-13 08:32 - 2013-10-18 20:38 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-05-13 07:57 - 2015-02-04 19:56 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-05-13 07:57 - 2015-02-04 19:56 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-05-10 10:50 - 2015-04-19 19:41 - 00000000 _____ () C:\Windows\setuperr.log 2015-05-04 18:52 - 2014-08-04 15:18 - 00000000 ____D () C:\Users\Eltern\AppData\Roaming\Sony Corporation 2015-05-04 13:46 - 2015-04-26 16:08 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys 2015-05-04 13:46 - 2015-04-26 16:08 - 00272248 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2015-05-04 13:46 - 2015-04-26 16:08 - 00137288 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys 2015-05-04 13:46 - 2015-04-26 16:08 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys 2015-05-04 13:46 - 2015-04-26 16:08 - 00089944 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys 2015-05-04 13:46 - 2015-04-26 16:08 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2015-05-04 13:46 - 2015-04-26 16:08 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2015-05-04 13:45 - 2015-04-26 16:08 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys ==================== Files in the root of some directories ======= 2013-11-15 19:51 - 2013-10-15 01:28 - 3294168 _____ (Piriform Ltd) C:\Program Files\ccsetup406_slim.exe 2014-08-04 15:16 - 2014-08-04 15:16 - 10410712 _____ (Sony Computer Entertainment Inc. ) C:\Program Files\CMASetup.exe 2013-11-15 19:51 - 2012-10-11 22:21 - 11766024 _____ (EASEUS ) C:\Program Files\epm911.exe 2014-02-15 19:34 - 2014-02-15 19:34 - 0921000 _____ (Oracle Corporation) C:\Program Files\jxpiinstall.exe 2014-02-17 18:56 - 2014-02-17 18:56 - 0675988 _____ () C:\Program Files\Minecraft.exe 2014-02-17 20:22 - 2014-02-17 20:22 - 0774144 _____ () C:\Program Files\NBTExplorer-2.7.0.msi 2013-11-15 19:51 - 2013-10-15 16:49 - 0537818 _____ (IDG Magazine Media GmbH ) C:\Program Files\pcwFixMyRights.exe 2014-12-26 17:14 - 2014-12-26 17:14 - 0095662 _____ () C:\Program Files (x86)\7-zip.chm 2014-12-26 17:48 - 2014-12-26 17:48 - 0080384 _____ (Igor Pavlov) C:\Program Files (x86)\7-zip.dll 2014-12-26 17:48 - 2014-12-26 17:48 - 0050176 _____ (Igor Pavlov) C:\Program Files (x86)\7-zip32.dll 2014-12-26 18:00 - 2014-12-26 18:00 - 1508352 _____ (Igor Pavlov) C:\Program Files (x86)\7z.dll 2014-12-26 17:48 - 2014-12-26 17:48 - 0424960 _____ (Igor Pavlov) C:\Program Files (x86)\7z.exe 2014-12-26 18:06 - 2014-12-26 18:06 - 0181760 _____ (Igor Pavlov) C:\Program Files (x86)\7z.sfx 2014-12-26 18:06 - 2014-12-26 18:06 - 0166400 _____ (Igor Pavlov) C:\Program Files (x86)\7zCon.sfx 2014-12-26 17:50 - 2014-12-26 17:50 - 0803328 _____ (Igor Pavlov) C:\Program Files (x86)\7zFM.exe 2014-12-26 17:50 - 2014-12-26 17:50 - 0545792 _____ (Igor Pavlov) C:\Program Files (x86)\7zG.exe 2014-08-22 08:08 - 2014-08-22 08:11 - 149527616 _____ () C:\Program Files (x86)\avira_free_antivirus_de_14.0.6.570.exe 2014-05-29 15:25 - 2014-05-29 15:25 - 8697544 _____ (Georgy Berdyshev) C:\Program Files (x86)\CDex-win32-1.70-b4-2009.exe 2014-11-07 13:28 - 2014-11-07 13:28 - 12436848 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\CitrixOnlinePluginWeb.exe 2015-05-04 18:48 - 2015-05-04 18:49 - 10457912 _____ (Sony Computer Entertainment Inc. ) C:\Program Files (x86)\CMASetup.exe 2011-04-04 17:54 - 2011-04-04 17:54 - 0000366 _____ () C:\Program Files (x86)\descript.ion 2015-04-20 17:59 - 2015-04-20 18:03 - 190719264 _____ (Microsoft Corporation) C:\Program Files (x86)\DraftSight64.exe 2015-01-04 23:03 - 2015-01-04 23:03 - 3105553 _____ () C:\Program Files (x86)\forge-1.7.10-10.13.2.1230-installer-win.exe 2015-01-03 12:26 - 2015-01-03 12:29 - 91670064 _____ (The GIMP Team ) C:\Program Files (x86)\gimp-2.8.14-setup.exe 2014-12-26 18:06 - 2014-12-26 18:06 - 0040769 _____ () C:\Program Files (x86)\History.txt 2014-06-12 22:02 - 2014-06-12 22:02 - 0001927 _____ () C:\Program Files (x86)\License.txt 2015-04-26 13:19 - 2015-04-26 13:19 - 21546080 _____ (Malwarebytes Corporation ) C:\Program Files (x86)\mbam-setup-2.1.6.1022.exe 2015-05-10 16:08 - 2015-05-10 16:08 - 16342352 _____ (Geek Software GmbH ) C:\Program Files (x86)\pdf24-creator-6.9.2.exe 2014-12-26 17:24 - 2014-12-26 17:24 - 0001683 _____ () C:\Program Files (x86)\readme.txt 2015-01-07 21:39 - 2015-01-07 21:39 - 0001551 _____ () C:\Users\Eltern\AppData\Local\recently-used.xbel ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-05-24 11:44 ==================== End of log ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-05-2015 Ran by Eltern at 2015-06-02 17:11:16 Running from C:\Users\Eltern\Desktop Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-2127788250-3807647062-608468377-500 - Administrator - Disabled) Eltern (S-1-5-21-2127788250-3807647062-608468377-1000 - Administrator - Enabled) => C:\Users\Eltern Gast (S-1-5-21-2127788250-3807647062-608468377-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-2127788250-3807647062-608468377-1002 - Limited - Enabled) ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) 7-Zip 9.36 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0936-000001000000}) (Version: 9.36.00.0 - Igor Pavlov) Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated) Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated) Amazon Music (HKU\S-1-5-21-2127788250-3807647062-608468377-1000\...\Amazon Amazon Music) (Version: 3.7.1.698 - Amazon Services LLC) Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.2.2218 - AVAST Software) Brother MFL-Pro Suite MFC-J245 (HKLM-x32\...\{B742757A-7658-4E09-A51A-085CF0F7F4D3}) (Version: 1.0.0.0 - Brother Industries, Ltd.) CDex - Open Source Digital Audio CD Extractor (HKLM-x32\...\CDex) (Version: 1.70.4.2009 - Georgy Berdyshev) Citrix Online Plug-in - Web (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 12.0.0.6410 - Citrix Systems, Inc.) D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden DriveImage XML (Private Edition) (HKLM-x32\...\{F7E1CA14-B39D-452A-960B-39423DDDD933}) (Version: 2.44.000 - Runtime Software) EASEUS Partition Master 9.1.1 Home Edition (HKLM-x32\...\EASEUS Partition Master Home Edition_is1) (Version: - EASEUS) ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 16.0.20150211 - Landesfinanzdirektion Thüringen) Emsisoft Anti-Malware (HKLM-x32\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 10.0 - Emsisoft Ltd.) Free YouTube to MP3 Converter version 3.12.54.128 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.54.128 - DVDVideoSoft Ltd.) GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team) Inhaltsmanager-Assistent für PlayStation(R) (HKLM-x32\...\{961D5D7E-3DEC-4E3B-9065-EA8074923B18}) (Version: 3.31.7643.1 - Sony Computer Entertainment Inc.) Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation) Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation) Junk Mail filter update (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation) Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation) Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation) Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation) Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 37.0.2 - Mozilla) Mozilla Thunderbird 31.7.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.7.0 (x86 de)) (Version: 31.7.0 - Mozilla) MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation) MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation) NBTExplorer (HKLM-x32\...\{273D5BF1-EC9C-4549-880D-D8C293296A36}) (Version: 2.7.0.0 - Justin Aquadro) Nuance PaperPort 12 (HKLM-x32\...\{869FCC6C-5669-4B0B-827E-2BBAACD88A87}) (Version: 12.1.0006 - Nuance Communications, Inc.) Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc) PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 14.00.0000 - Nuance Communications, Inc.) PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org) Pusteblume Sachunterricht 3 (HKLM-x32\...\Pusteblume Sachunterricht 3) (Version: - Bildungshaus Schulbuchverlage Westermann Schroedel Diesterweg Schöningh Winklers GmbH) Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0008 - Realtek) Revo Uninstaller Pro 3.1.2 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.1.2 - VS Revo Group, Ltd.) Scansoft PDF Professional (x32 Version: - ) Hidden SoftMaker FreeOffice (HKLM-x32\...\{8EBB8452-274B-465D-8324-00B0832FBB02}) (Version: 1.0.3395 - SoftMaker Software GmbH) Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb) VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN) Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== Restore Points ========================= 01-06-2015 16:00:03 Revo Uninstaller Pro's restore point - SiSoftware Sandra Lite 2013.SP6 01-06-2015 16:01:03 SiSoftware Sandra Lite 01-06-2015 19:17:21 vor LAN-Treiber 01-06-2015 19:21:02 Installiert Realtek Ethernet Controller Driver 02-06-2015 10:12:14 Windows Update 02-06-2015 10:16:34 Wiederherstellungsvorgang ==================== Hosts content: =============================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {0051A1AD-0606-4209-BFFE-5DC7ED6C9B20} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-07] (Microsoft Corporation) Task: {1B1ED7BC-0022-40DF-881B-1F1DD17605C9} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation) Task: {1F16F3F8-0026-445B-AC17-E40EDFB35128} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation) Task: {31E02CA9-C51E-4460-BA97-B7E21A651C34} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated) Task: {50535350-84E1-4323-9DDE-0CD437D0DE7A} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation) Task: {645F6365-4A2D-4183-BB76-C828836618FD} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks Task: {C16F411F-5A38-4010-8311-B2469B0D6545} - System32\Tasks\avast! Emergency Update => C:\Program Files (x86)\AVAST Software\Avast\AvastEmUpdate.exe [2015-05-04] (Avast Software s.r.o.) ==================== Loaded Modules (Whitelisted) ============== 2015-05-04 13:45 - 2015-05-04 13:45 - 00104400 _____ () C:\Program Files (x86)\AVAST Software\Avast\log.dll 2015-05-04 13:45 - 2015-05-04 13:45 - 00081728 _____ () C:\Program Files (x86)\AVAST Software\Avast\JsonRpcServer.dll 2015-06-02 10:01 - 2015-06-02 10:01 - 02951680 _____ () C:\Program Files (x86)\AVAST Software\Avast\defs\15060200\algo.dll 2015-04-26 16:08 - 2015-04-26 16:08 - 40540672 _____ () C:\Program Files (x86)\AVAST Software\Avast\libcef.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Eltern\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg DNS Servers: 192.168.2.1 ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) MSCONFIG\Services: PDFProFiltSrvPP => 2 MSCONFIG\Services: wscsvc => 2 MSCONFIG\Services: WSearch => 2 MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Inhaltsmanager-Assistent für PlayStation(R).lnk => C:\Windows\pss\Inhaltsmanager-Assistent für PlayStation(R).lnk.CommonStartup MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" MSCONFIG\startupreg: Amazon Music => "C:\Users\Eltern\AppData\Local\Amazon Music\Amazon Music Helper.exe" MSCONFIG\startupreg: BrHelp => C:\Program Files (x86)\Brother\Brother Help\BrotherHelp.exe /AUTORUN MSCONFIG\startupreg: BrStsMon00 => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN MSCONFIG\startupreg: ConnectionCenter => "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup MSCONFIG\startupreg: ControlCenter4 => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe /autorun MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe MSCONFIG\startupreg: IndexSearch => "C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe" MSCONFIG\startupreg: ISUSPM => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler MSCONFIG\startupreg: PaperPort PTD => "C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe" MSCONFIG\startupreg: PDF5 Registry Controller => C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe MSCONFIG\startupreg: PDFHook => C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe MSCONFIG\startupreg: PDFPrint => C:\Program Files (x86)\PDF24\pdf24.exe MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [{1B5878FA-F799-4C68-A2DA-8E7A57B40EFB}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe FirewallRules: [{AF0730C6-8801-41FD-9979-03A14518E175}] => (Allow) LPort=2869 FirewallRules: [{639EFFE0-6DC2-43C2-A676-855C8FEF6F89}] => (Allow) LPort=1900 FirewallRules: [TCP Query User{7A9608B7-A0ED-423F-BE89-7991B131A01B}C:\program files\videolan\vlc\vlc.exe] => (Block) C:\program files\videolan\vlc\vlc.exe FirewallRules: [UDP Query User{BA917422-0A70-45A0-88FF-CEA25E4D4AA8}C:\program files\videolan\vlc\vlc.exe] => (Block) C:\program files\videolan\vlc\vlc.exe FirewallRules: [TCP Query User{074F9C1C-051B-4319-BF7A-A98FD2FDF065}C:\program files (x86)\java\jre1.8.0_31\bin\java.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\java.exe FirewallRules: [UDP Query User{55D30EF6-0A63-403F-900B-656D36616F2B}C:\program files (x86)\java\jre1.8.0_31\bin\java.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\java.exe FirewallRules: [TCP Query User{362F5215-85FC-421B-B914-ABE6EA456261}C:\program files\firefox.exe] => (Block) C:\program files\firefox.exe FirewallRules: [UDP Query User{BE7C41C2-E1AB-4E12-9414-4D0DA7F81B6F}C:\program files\firefox.exe] => (Block) C:\program files\firefox.exe FirewallRules: [{1023DE4E-B766-48DA-AAA2-EF53ED9DE278}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{4F66FC22-FD46-46BE-87E1-A8C2AD47AF02}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Faulty Device Manager Devices ============= Name: Microsoft PS/2-Maus Description: Microsoft PS/2-Maus Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: i8042prt Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. ==================== Event log errors: ========================= Application errors: ================== Error: (06/02/2015 10:23:14 AM) (Source: System Restore) (EventID: 8210) (User: ) Description: Unbekannter Fehler bei der Systemwiederherstellung: (vor LAN-Treiber). Zusätzliche Informationen: 0x80070003. Error: (06/01/2015 04:00:02 PM) (Source: VSS) (EventID: 8194) (User: ) Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert . Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess. Vorgang: Generatordaten werden gesammelt Kontext: Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220} Generatorname: System Writer Generatorinstanz-ID: {1ebb083b-1f10-42be-8023-f86a86c66225} Error: (06/01/2015 03:34:12 PM) (Source: ESENT) (EventID: 439) (User: ) Description: Windows (2388) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032. Error: (06/01/2015 03:34:12 PM) (Source: ESENT) (EventID: 490) (User: ) Description: Windows (2388) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien. Error: (05/30/2015 00:14:26 PM) (Source: ESENT) (EventID: 439) (User: ) Description: Windows (1376) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032. Error: (05/30/2015 00:14:26 PM) (Source: ESENT) (EventID: 490) (User: ) Description: Windows (1376) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien. Error: (05/30/2015 09:14:05 AM) (Source: ESENT) (EventID: 439) (User: ) Description: Windows (3048) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032. Error: (05/30/2015 09:14:05 AM) (Source: ESENT) (EventID: 490) (User: ) Description: Windows (3048) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien. Error: (05/28/2015 06:12:41 PM) (Source: ESENT) (EventID: 439) (User: ) Description: Windows (1936) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032. Error: (05/28/2015 06:12:41 PM) (Source: ESENT) (EventID: 490) (User: ) Description: Windows (1936) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien. System errors: ============= Error: (06/02/2015 02:27:16 PM) (Source: WMPNetworkSvc) (EventID: 14332) (User: ) Description: WMPNetworkSvc0x80004005 Error: (05/30/2015 09:55:12 AM) (Source: Service Control Manager) (EventID: 7043) (User: ) Description: Der Dienst Diagnostics Tracking Service konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden. Error: (05/30/2015 09:17:25 AM) (Source: Service Control Manager) (EventID: 7043) (User: ) Description: Der Dienst Windows Update konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden. Error: (05/29/2015 07:47:00 AM) (Source: Service Control Manager) (EventID: 7043) (User: ) Description: Der Dienst Diagnostics Tracking Service konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden. Error: (05/27/2015 05:30:02 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts. Error: (05/27/2015 05:30:02 PM) (Source: Service Control Manager) (EventID: 7024) (User: ) Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1073473535. Error: (05/24/2015 05:12:29 PM) (Source: DCOM) (EventID: 10010) (User: ) Description: {995C996E-D918-4A8C-A302-45719A6F4EA7} Error: (05/22/2015 05:56:33 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "MBAMService" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (05/22/2015 05:56:33 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst MBAMService erreicht. Error: (05/20/2015 05:14:04 PM) (Source: Service Control Manager) (EventID: 7022) (User: ) Description: Der Dienst "Windows Update" wurde nicht richtig gestartet. Microsoft Office: ========================= Error: (06/02/2015 10:23:14 AM) (Source: System Restore) (EventID: 8210) (User: ) Description: vor LAN-Treiber0x80070003 Error: (06/01/2015 04:00:02 PM) (Source: VSS) (EventID: 8194) (User: ) Description: 0x80070005, Zugriff verweigert Vorgang: Generatordaten werden gesammelt Kontext: Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220} Generatorname: System Writer Generatorinstanz-ID: {1ebb083b-1f10-42be-8023-f86a86c66225} Error: (06/01/2015 03:34:12 PM) (Source: ESENT) (EventID: 439) (User: ) Description: Windows2388Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 Error: (06/01/2015 03:34:12 PM) (Source: ESENT) (EventID: 490) (User: ) Description: Windows2388Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. Error: (05/30/2015 00:14:26 PM) (Source: ESENT) (EventID: 439) (User: ) Description: Windows1376Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 Error: (05/30/2015 00:14:26 PM) (Source: ESENT) (EventID: 490) (User: ) Description: Windows1376Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. Error: (05/30/2015 09:14:05 AM) (Source: ESENT) (EventID: 439) (User: ) Description: Windows3048Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 Error: (05/30/2015 09:14:05 AM) (Source: ESENT) (EventID: 490) (User: ) Description: Windows3048Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. Error: (05/28/2015 06:12:41 PM) (Source: ESENT) (EventID: 439) (User: ) Description: Windows1936Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 Error: (05/28/2015 06:12:41 PM) (Source: ESENT) (EventID: 490) (User: ) Description: Windows1936Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. ==================== Memory info =========================== Processor: Pentium(R) Dual-Core CPU E5200 @ 2.50GHz Percentage of memory in use: 47% Total physical RAM: 3062.18 MB Available physical RAM: 1609.4 MB Total Pagefile: 6122.57 MB Available Pagefile: 4143.49 MB Total Virtual: 8192 MB Available Virtual: 8191.83 MB ==================== Drives ================================ Drive c: (Eigene Dateien) (Fixed) (Total:58.64 GB) (Free:17.77 GB) NTFS Drive d: () (Fixed) (Total:43.95 GB) (Free:25.07 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive e: (Eigene Bilder Filme) (Fixed) (Total:39.21 GB) (Free:21.25 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: 102C102B) Partition 1: (Active) - (Size=43.9 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=39.2 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=58.6 GB) - (Type=OF Extended) ==================== End of log ============================ Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 26.04.2015 Suchlauf-Zeit: 14:02:35 Logdatei: MWBT_Scan_1.txt Administrator: Ja Version: 2.01.6.1022 Malware Datenbank: v2015.04.26.01 Rootkit Datenbank: v2015.04.21.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Eltern Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 335586 Verstrichene Zeit: 16 Min, 55 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 0 (Keine schädliche Elemente gefunden) Registrierungswerte: 0 (Keine schädliche Elemente gefunden) Registrierungsdaten: 0 (Keine schädliche Elemente gefunden) Ordner: 0 (Keine schädliche Elemente gefunden) Dateien: 1 PUP.Optional.Softonic.A, C:\Program Files\SoftonicDownloader_fuer_minecraft.exe, In Quarantäne, [fc2da4cd751570c67f3c89c853aee41c], Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 14.05.2015 Suchlauf-Zeit: 19:59:57 Logdatei: MWBT_Scan_2.txt Administrator: Ja Version: 2.01.6.1022 Malware Datenbank: v2015.05.14.04 Rootkit Datenbank: v2015.04.21.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Eltern Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 343786 Verstrichene Zeit: 25 Min, 8 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 0 (Keine schädliche Elemente gefunden) Registrierungswerte: 0 (Keine schädliche Elemente gefunden) Registrierungsdaten: 0 (Keine schädliche Elemente gefunden) Ordner: 0 (Keine schädliche Elemente gefunden) Dateien: 3 PUP.Optional.Babylon.A, C:\Program Files (x86)\Unlocker1.9.2.exe, In Quarantäne, [315b6231b5d5f145c1eafd3c9a67ff01], PUP.Optional.Babylon.A, C:\Users\Eltern\AppData\Local\Temp\DeltaTB.exe, In Quarantäne, [97f5662df09a78be6f3c54e5a45d59a7], PUP.Optional.Babylon.A, C:\Users\Eltern\AppData\Local\Temp\7F61D543-BAB0-7891-A3F4-F6F5DDBEF7A0\Latest\BExternal.dll, In Quarantäne, [a7e5444f8ffb2016182100255aa6916f], Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) Emsisoft Anti-Malware - Version 10.0 Scan-Protokoll Datum Scan Methode Gescannt Erkannt Dauer Typ 01.06.2015 11:39:35 Malware 69836 0 0:04:35 Manueller Scan 17.05.2015 19:24:14 Malware 69224 0 0:05:00 Manueller Scan Emsisoft Anti-Malware - Version 10.0 Scan-Protokoll Datum Scan Methode Gescannt Erkannt Dauer Typ 01.06.2015 11:39:35 Malware 69836 0 0:04:35 Manueller Scan 17.05.2015 19:24:14 Malware 69224 0 0:05:00 Manueller Scan C:\Users\Eltern\Downloads\FreeYouTubeToMP354Converter.exe Variante von Win32/OpenCandy.C potenziell unsichere Anwendung C:\Users\Eltern\Downloads\PDFCreator-1_7_1_setup.exe Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung C:\Users\Eltern\Downloads\PDFCreator-2_1_1-setup.exe Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung D:\Documents and Settings\Eltern\Downloads\FreeYouTubeToMP354Converter.exe Variante von Win32/OpenCandy.C potenziell unsichere Anwendung D:\Documents and Settings\Eltern\Downloads\PDFCreator-1_7_1_setup.exe Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung D:\Documents and Settings\Eltern\Downloads\PDFCreator-2_1_1-setup.exe Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SaveByclick\dfnfldhlfgmlpgfacmffbnonedjmpjag.crx Win32/Adware.MultiPlug.H Anwendung D:\RECYCLER\S-1-5-21-1606980848-1390067357-839522115-1003\Dc14.exe Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP171\A0038320.msi Variante von Win32/Systweak.L evtl. unerwünschte Anwendung D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP172\A0038322.msi Variante von Win32/Systweak.L evtl. unerwünschte Anwendung D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP175\A0039051.exe Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040097.dll Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040098.exe Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040099.exe Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP213\A0046627.exe Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung D:\Unser Kram\Erik\FreeYouTubeToMP3Converter3.12.44.908.exe Variante von Win32/OpenCandy.C potenziell unsichere Anwendung |
|
03.06.2015, 10:00
| #2 |
| | PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 2 Hier nun mein zweiter Post mit dem 1. Teil von Gmer.txt
__________________GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2015-06-02 17:31:45 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 ST3160813AS rev.CC2J 149,05GB Running: Gmer-19357.exe; Driver: C:\Users\Eltern\AppData\Local\Temp\uxdiypow.sys ---- User code sections - GMER 2.1 ---- .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000100040460 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000100040450 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000100040370 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000100040470 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000001000403e0 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000100040320 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000001000403b0 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000100040390 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000001000402e0 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000001000402d0 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000100040310 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000001000403c0 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000001000403f0 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000100040230 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000100040480 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000001000403a0 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000001000402f0 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000100040350 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000100040290 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000001000402b0 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000001000403d0 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000100040330 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000100040410 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000100040240 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000001000401e0 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000100040250 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000100040490 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000001000404a0 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000100040300 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000100040360 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000001000402a0 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000001000402c0 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000100040380 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000100040340 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000100040440 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000100040260 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000100040270 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000100040400 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000001000401f0 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000100040210 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000100040200 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000100040420 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000100040430 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000100040220 .text C:\Windows\system32\csrss.exe[412] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000100040280 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 000000014a650460 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 000000014a650450 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 000000014a650370 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 000000014a650470 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 000000014a6503e0 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 000000014a650320 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 000000014a6503b0 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 000000014a650390 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 000000014a6502e0 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 000000014a6502d0 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 000000014a650310 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 000000014a6503c0 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 000000014a6503f0 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 000000014a650230 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 000000014a650480 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 000000014a6503a0 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 000000014a6502f0 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 000000014a650350 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 000000014a650290 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 000000014a6502b0 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 000000014a6503d0 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 000000014a650330 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 000000014a650410 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 000000014a650240 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 000000014a6501e0 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 000000014a650250 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 000000014a650490 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 000000014a6504a0 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 000000014a650300 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 000000014a650360 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 000000014a6502a0 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 000000014a6502c0 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 000000014a650380 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 000000014a650340 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 000000014a650440 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 000000014a650260 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 000000014a650270 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 000000014a650400 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 000000014a6501f0 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 000000014a650210 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 000000014a650200 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 000000014a650420 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 000000014a650430 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 000000014a650220 .text C:\Windows\system32\csrss.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 000000014a650280 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\system32\winlogon.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000100070460 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000100070450 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000100070370 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000100070470 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000001000703e0 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000100070320 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000001000703b0 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000100070390 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000001000702e0 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000001000702d0 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000100070310 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000001000703c0 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000001000703f0 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000100070230 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000100070480 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000001000703a0 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000001000702f0 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000100070350 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000100070290 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000001000702b0 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000001000703d0 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000100070330 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000100070410 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000100070240 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000001000701e0 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000100070250 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000100070490 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000001000704a0 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000100070300 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000100070360 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000001000702a0 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000001000702c0 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000100070380 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000100070340 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000100070440 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000100070260 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000100070270 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000100070400 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000001000701f0 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000100070210 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000100070200 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000100070420 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000100070430 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000100070220 .text C:\Windows\system32\services.exe[572] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000100070280 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\system32\lsm.exe[616] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000100070460 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000100070450 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000100070370 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000100070470 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000001000703e0 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000100070320 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000001000703b0 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000100070390 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000001000702e0 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000001000702d0 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000100070310 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000001000703c0 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000001000703f0 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000100070230 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000100070480 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000001000703a0 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000001000702f0 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000100070350 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000100070290 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000001000702b0 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000001000703d0 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000100070330 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000100070410 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000100070240 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000001000701e0 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000100070250 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000100070490 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000001000704a0 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000100070300 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000100070360 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000001000702a0 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000001000702c0 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000100070380 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000100070340 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000100070440 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000100070260 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000100070270 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000100070400 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000001000701f0 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000100070210 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000100070200 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000100070420 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000100070430 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000100070220 .text C:\Windows\system32\svchost.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000100070280 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\system32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 |
|
03.06.2015, 10:02
| #3 |
| | PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 3 Hier der zweite Teil von Gmer.txt
__________________.text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\System32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\system32\svchost.exe[1016] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\system32\svchost.exe[344] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\SysWOW64\ntdll.dll!RtlFreeActivationContextStack + 271 00000000773e69e7 7 bytes JMP 000000010914883c .text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\kernel32.dll!FreeLibrary + 8 00000000750c3480 7 bytes JMP 000000010914866c .text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\kernel32.dll!GetFileInformationByHandle + 19 00000000750c5379 7 bytes JMP 00000001090f81b4 .text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 18 0000000076aa1402 1 byte [76] .text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 18 0000000076aa141a 1 byte [76] .text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 18 0000000076aa1432 1 byte [76] .text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 43 0000000076aa144b 1 byte [76] .text ... * 9 .text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 18 0000000076aa14de 1 byte [76] .text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 18 0000000076aa14f6 1 byte [76] .text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 18 0000000076aa150e 1 byte [76] .text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 18 0000000076aa1526 1 byte [76] .text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 18 0000000076aa153e 1 byte [76] .text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 18 0000000076aa1556 1 byte [76] .text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 18 0000000076aa156e 1 byte [76] .text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 18 0000000076aa1586 1 byte [76] .text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 18 0000000076aa159e 1 byte [76] .text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 18 0000000076aa15b6 1 byte [76] .text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 18 0000000076aa15ce 1 byte [76] .text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 21 0000000076aa16b3 1 byte [76] .text C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe[460] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 32 0000000076aa16be 1 byte [76] .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00000000771fde20 6 bytes {JMP QWORD [RIP+0x8f82210]} .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000771fdee0 6 bytes {JMP QWORD [RIP+0x8f62150]} .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00000000771fe100 6 bytes {JMP QWORD [RIP+0x8f41f30]} .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000771fe1b0 6 bytes {JMP QWORD [RIP+0x8f01e80]} .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00000000771fe740 6 bytes {JMP QWORD [RIP+0x8f218f0]} .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076fadbc0 6 bytes {JMP QWORD [RIP+0x91f2470]} .text C:\Windows\system32\Dwm.exe[1224] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd27a6f5 3 bytes [15, 59, 05] .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00000000771fde20 6 bytes JMP 101 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000771fdee0 6 bytes JMP 52001600 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00000000771fe100 6 bytes JMP 410041 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000771fe1b0 6 bytes JMP 8f015c0 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00000000771fe740 6 bytes {JMP QWORD [RIP+0x8f218f0]} .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\Explorer.EXE[1252] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076fadbc0 6 bytes {JMP QWORD [RIP+0x91f2470]} .text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd27a6f5 3 bytes [15, 59, 09] .text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\msi.dll!MsiSetInternalUI 000007fef9c65c70 6 bytes JMP 6c0061 .text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\msi.dll!MsiInstallProductA 000007fef9ce2ad4 2 bytes [FF, 25] .text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\msi.dll!MsiInstallProductA + 3 000007fef9ce2ad7 3 bytes [D5, 2B, 00] .text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\msi.dll!MsiInstallProductW 000007fef9cf167c 6 bytes JMP 0 .text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW 000007feff0d3030 6 bytes {JMP QWORD [RIP+0x47d000]} .text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\WS2_32.dll!connect + 1 000007feff0d45c1 5 bytes {JMP QWORD [RIP+0x41ba70]} .text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\WS2_32.dll!listen 000007feff0d8290 6 bytes {JMP QWORD [RIP+0x457da0]} .text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\WS2_32.dll!WSAConnect 000007feff0fe0f0 6 bytes JMP c1e9acd0 .text C:\Windows\Explorer.EXE[1252] C:\Windows\system32\RASAPI32.dll!RasDialW + 1 000007fef43896f5 5 bytes JMP 4d004d .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000100070460 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000100070450 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000100070370 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000100070470 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000001000703e0 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000100070320 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000001000703b0 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000100070390 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000001000702e0 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000001000702d0 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000100070310 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000001000703c0 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000001000703f0 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000100070230 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000100070480 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000001000703a0 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000001000702f0 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000100070350 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000100070290 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000001000702b0 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000001000703d0 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000100070330 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000100070410 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000100070240 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000001000701e0 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000100070250 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000100070490 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000001000704a0 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000100070300 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000100070360 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000001000702a0 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000001000702c0 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000100070380 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000100070340 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000100070440 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000100070260 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000100070270 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000100070400 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000001000701f0 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000100070210 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000100070200 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000100070420 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000100070430 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000100070220 .text C:\Windows\system32\svchost.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000100070280 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000100070460 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000100070450 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000100070370 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000100070470 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000001000703e0 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000100070320 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000001000703b0 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000100070390 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000001000702e0 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000001000702d0 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000100070310 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000001000703c0 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000001000703f0 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000100070230 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000100070480 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000001000703a0 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000001000702f0 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000100070350 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000100070290 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000001000702b0 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000001000703d0 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000100070330 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000100070410 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000100070240 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000001000701e0 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000100070250 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000100070490 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000001000704a0 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000100070300 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000100070360 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000001000702a0 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000001000702c0 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000100070380 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000100070340 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000100070440 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000100070260 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000100070270 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000100070400 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000001000701f0 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000100070210 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000100070200 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000100070420 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000100070430 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000100070220 .text C:\Windows\System32\spoolsv.exe[1600] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000100070280 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00000000771fde20 6 bytes {JMP QWORD [RIP+0x8f82210]} .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000771fdee0 6 bytes {JMP QWORD [RIP+0x8f62150]} .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00000000771fe100 6 bytes {JMP QWORD [RIP+0x8f41f30]} .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000771fe1b0 6 bytes {JMP QWORD [RIP+0x8f01e80]} .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00000000771fe740 6 bytes {JMP QWORD [RIP+0x8f218f0]} .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076fadbc0 6 bytes {JMP QWORD [RIP+0x91f2470]} .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd27a6f5 3 bytes CALL 3000025 .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 000007fefec55538 6 bytes {JMP QWORD [RIP+0xfaaf8]} .text C:\Windows\system32\taskhost.exe[1748] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 000007fefec6ba4c 6 bytes {JMP QWORD [RIP+0xc45e4]} .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread |
|
03.06.2015, 10:04
| #4 |
| | PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 4 Hier nun der letzte Abschnitt aus meiner Gmer.txt Vielen Dank nochmals für Euren Einsatz!! 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\System32\svchost.exe[1796] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00000000771fde20 6 bytes {JMP QWORD [RIP+0x8f82210]} .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000771fdee0 6 bytes {JMP QWORD [RIP+0x8f62150]} .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00000000771fe100 6 bytes {JMP QWORD [RIP+0x8f41f30]} .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000771fe1b0 6 bytes {JMP QWORD [RIP+0x8f01e80]} .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00000000771fe740 6 bytes {JMP QWORD [RIP+0x8f218f0]} .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076fadbc0 6 bytes {JMP QWORD [RIP+0x91f2470]} .text C:\Windows\System32\igfxtray.exe[2040] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd27a6f5 3 bytes [15, 59, 05] .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 00000000773afc6c 3 bytes [FF, 25, 1E] .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 00000000773afc70 2 bytes [01, 6F] .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile 00000000773afc84 3 bytes JMP 6ef9000a .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4 00000000773afc88 2 bytes JMP 6ef9000a .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 00000000773afdb0 3 bytes JMP 6efc000a .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 00000000773afdb4 2 bytes JMP 6efc000a .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 00000000773b0100 3 bytes JMP 6eff000a .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 00000000773b0104 2 bytes JMP 6eff000a .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 00000000773b0210 3 bytes [FF, 25, 1E] .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 00000000773b0214 2 bytes [7A, 71] .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 00000000773b0a90 3 bytes [FF, 25, 1E] .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 00000000773b0a94 2 bytes [04, 6F] .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000773b196c 3 bytes [FF, 25, 1E] .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 00000000773b1970 2 bytes [F5, 6E] .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 00000000750c8781 8 bytes [31, C0, C2, 04, 00, 90, 90, ...] .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 00000000750d3bab 3 bytes [FF, 25, 1E] .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 00000000750d3baf 2 bytes [F2, 6E] .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000074ec7154 6 bytes {JMP QWORD [RIP+0x717d001e]} .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000074ee342c 6 bytes {JMP QWORD [RIP+0x7180001e]} .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\syswow64\WS2_32.dll!WSALookupServiceBeginW 0000000074e1575a 6 bytes JMP 719c000a .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\syswow64\WS2_32.dll!connect 0000000074e16bdd 6 bytes JMP 71a5000a .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\syswow64\WS2_32.dll!listen 0000000074e1b001 6 bytes {JMP QWORD [RIP+0x719e001e]} .text C:\Program Files (x86)\AVAST Software\Avast\avastui.exe[1660] C:\Windows\syswow64\WS2_32.dll!WSAConnect 0000000074e1cc3f 6 bytes {JMP QWORD [RIP+0x71a1001e]} .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[1320] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\system32\SearchIndexer.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\System32\svchost.exe[3344] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\system32\DllHost.exe[3920] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 00000000771fde20 6 bytes {JMP QWORD [RIP+0x8f82210]} .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000771fdee0 6 bytes {JMP QWORD [RIP+0x8f62150]} .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 00000000771fe100 6 bytes {JMP QWORD [RIP+0x8f41f30]} .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000771fe1b0 6 bytes {JMP QWORD [RIP+0x8f01e80]} .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 00000000771fe740 6 bytes {JMP QWORD [RIP+0x8f218f0]} .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076fadbc0 6 bytes {JMP QWORD [RIP+0x91f2470]} .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd27a6f5 3 bytes [15, 59, 05] .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW 000007feff0d3030 6 bytes {JMP QWORD [RIP+0x1ed000]} .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\system32\WS2_32.dll!connect + 1 000007feff0d45c1 5 bytes {JMP QWORD [RIP+0x18ba70]} .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\system32\WS2_32.dll!listen 000007feff0d8290 6 bytes {JMP QWORD [RIP+0x1c7da0]} .text C:\Windows\system32\wbem\unsecapp.exe[2552] C:\Windows\system32\WS2_32.dll!WSAConnect 000007feff0fe0f0 6 bytes {JMP QWORD [RIP+0x181f40]} .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\System32\svchost.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 00000000771fdc60 5 bytes JMP 0000000077360460 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 00000000771fdcb0 5 bytes JMP 0000000077360450 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 00000000771fde10 5 bytes JMP 0000000077360370 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 00000000771fde60 5 bytes JMP 0000000077360470 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000771fde70 5 bytes JMP 00000000773603e0 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 00000000771fdf20 5 bytes JMP 0000000077360320 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000771fdf50 5 bytes JMP 00000000773603b0 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 00000000771fdf70 5 bytes JMP 0000000077360390 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 00000000771fdfb0 5 bytes JMP 00000000773602e0 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 00000000771fe030 5 bytes JMP 00000000773602d0 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 00000000771fe050 5 bytes JMP 0000000077360310 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 00000000771fe090 5 bytes JMP 00000000773603c0 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 00000000771fe0e0 5 bytes JMP 00000000773603f0 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 00000000771fe240 5 bytes JMP 0000000077360230 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 00000000771fe400 5 bytes JMP 0000000077360480 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 00000000771fe430 5 bytes JMP 00000000773603a0 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 00000000771fe510 5 bytes JMP 00000000773602f0 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 00000000771fe520 5 bytes JMP 0000000077360350 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 00000000771fe580 5 bytes JMP 0000000077360290 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 00000000771fe610 5 bytes JMP 00000000773602b0 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000771fe630 5 bytes JMP 00000000773603d0 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 00000000771fe640 5 bytes JMP 0000000077360330 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 00000000771fe6b0 5 bytes JMP 0000000077360410 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 00000000771fe6e0 5 bytes JMP 0000000077360240 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 00000000771fe9a0 5 bytes JMP 00000000773601e0 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 00000000771fea60 5 bytes JMP 0000000077360250 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 00000000771fea90 5 bytes JMP 0000000077360490 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 00000000771feaa0 5 bytes JMP 00000000773604a0 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 00000000771fead0 5 bytes JMP 0000000077360300 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 00000000771feae0 5 bytes JMP 0000000077360360 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 00000000771feb40 5 bytes JMP 00000000773602a0 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 00000000771feb90 5 bytes JMP 00000000773602c0 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 00000000771febc0 5 bytes JMP 0000000077360380 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 00000000771febd0 5 bytes JMP 0000000077360340 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 00000000771feec0 5 bytes JMP 0000000077360440 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 00000000771ff0c0 5 bytes JMP 0000000077360260 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 00000000771ff0d0 5 bytes JMP 0000000077360270 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771ff0e0 5 bytes JMP 0000000077360400 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 00000000771ff2a0 5 bytes JMP 00000000773601f0 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 00000000771ff2b0 5 bytes JMP 0000000077360210 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 00000000771ff320 5 bytes JMP 0000000077360200 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 00000000771ff380 5 bytes JMP 0000000077360420 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 00000000771ff390 5 bytes JMP 0000000077360430 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 00000000771ff3a0 5 bytes JMP 0000000077360220 .text C:\Windows\system32\AUDIODG.EXE[1336] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 00000000771ff480 5 bytes JMP 0000000077360280 .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 00000000773afc6c 3 bytes JMP 718a000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 00000000773afc70 2 bytes JMP 718a000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile 00000000773afc84 3 bytes JMP 7181000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4 00000000773afc88 2 bytes JMP 7181000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 00000000773afdb0 3 bytes JMP 7184000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 00000000773afdb4 2 bytes JMP 7184000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 00000000773b0100 3 bytes JMP 7187000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 00000000773b0104 2 bytes JMP 7187000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 00000000773b0210 3 bytes JMP 7190000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 00000000773b0214 2 bytes JMP 7190000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 00000000773b0a90 3 bytes JMP 718d000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 00000000773b0a94 2 bytes JMP 718d000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000773b196c 3 bytes JMP 717e000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 00000000773b1970 2 bytes JMP 717e000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 00000000750d3bab 3 bytes JMP 717b000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 00000000750d3baf 2 bytes JMP 717b000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076bc2c9e 4 bytes CALL 71af0000 .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076429679 6 bytes JMP 719f000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\USER32.dll!PostMessageW 00000000764312a5 6 bytes JMP 7199000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076433baa 6 bytes JMP 719c000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\USER32.dll!SendMessageA 000000007643612e 6 bytes JMP 71a2000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\USER32.dll!SendInput 000000007644ff4a 3 bytes JMP 71a5000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\USER32.dll!SendInput + 4 000000007644ff4e 2 bytes JMP 71a5000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\USER32.dll!mouse_event 000000007648027b 6 bytes JMP 71ab000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\USER32.dll!keybd_event 00000000764802bf 6 bytes JMP 71a8000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000074ec7154 6 bytes JMP 7193000a .text C:\Users\Eltern\Desktop\Gmer-19357.exe[2584] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000074ee342c 6 bytes JMP 7196000a ---- EOF - GMER 2.1 ---- |
|
03.06.2015, 18:02
| #5 |
| /// the machine /// TB-Ausbilder    | PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 1 hi,  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers Downloade dir bitte  TDSSKiller.exe und speichere diese Datei auf dem Desktop
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.06.2015, 08:37
| #6 |
| | PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 1 Hallo Schrauber, hier die txt zu mbar Code:
ATTFilter ---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.09.1.1004
(c) Malwarebytes Corporation 2011-2012
OS version: 6.1.7601 Windows 7 Service Pack 1 x64
Account is Administrative
Internet Explorer version: 11.0.9600.17801
File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, E:\ DRIVE_FIXED
CPU speed: 2.500000 GHz
Memory total: 3210928128, free: 1537445888
Downloaded database version: v2015.06.05.01
Downloaded database version: v2015.06.02.01
Downloaded database version: v2015.05.13.01
Initializing...
======================
------------ Kernel report ------------
06/05/2015 08:37:04
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\intelide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\System32\Drivers\aswVmm.sys
\SystemRoot\System32\Drivers\aswRvrt.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\drivers\aswSnx.sys
\SystemRoot\system32\DRIVERS\epp64.sys
\SystemRoot\system32\drivers\aswSP.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\drivers\aswRdr2.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\ctxusbm.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\igdkmd64.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\drivers\HDAudBus.sys
\SystemRoot\system32\DRIVERS\Rt64win7.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\fdc.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\DRIVERS\ASACPI.sys
\SystemRoot\system32\drivers\i8042prt.sys
\SystemRoot\system32\drivers\kbdclass.sys
\SystemRoot\system32\drivers\mouclass.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\drivers\CompositeBus.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\drivers\swenum.sys
\SystemRoot\system32\drivers\ks.sys
\SystemRoot\system32\drivers\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\system32\DRIVERS\flpydisk.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\HdAudio.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\usbprint.sys
\SystemRoot\system32\DRIVERS\usbscan.sys
\SystemRoot\system32\DRIVERS\BrUsbSIb.sys
\SystemRoot\system32\DRIVERS\BrSerIb.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\system32\drivers\hidusb.sys
\SystemRoot\system32\drivers\HIDCLASS.SYS
\SystemRoot\system32\drivers\HIDPARSE.SYS
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\drivers\aswMonFlt.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\drivers\aswStm.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\aswHwid.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\asyncmac.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\imagehlp.dll
\Windows\System32\wininet.dll
\Windows\System32\imm32.dll
\Windows\System32\shell32.dll
\Windows\System32\clbcatq.dll
\Windows\System32\Wldap32.dll
\Windows\System32\comdlg32.dll
\Windows\System32\nsi.dll
\Windows\System32\lpk.dll
\Windows\System32\rpcrt4.dll
\Windows\System32\usp10.dll
\Windows\System32\msctf.dll
\Windows\System32\advapi32.dll
\Windows\System32\difxapi.dll
\Windows\System32\sechost.dll
\Windows\System32\kernel32.dll
\Windows\System32\oleaut32.dll
\Windows\System32\shlwapi.dll
\Windows\System32\urlmon.dll
\Windows\System32\setupapi.dll
\Windows\System32\ws2_32.dll
\Windows\System32\user32.dll
\Windows\System32\normaliz.dll
\Windows\System32\gdi32.dll
\Windows\System32\ole32.dll
\Windows\System32\msvcrt.dll
\Windows\System32\iertutil.dll
\Windows\System32\psapi.dll
\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
\Windows\System32\userenv.dll
\Windows\System32\wintrust.dll
\Windows\System32\cfgmgr32.dll
\Windows\System32\comctl32.dll
\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
\Windows\System32\devobj.dll
\Windows\System32\crypt32.dll
\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
\Windows\System32\KernelBase.dll
\Windows\System32\msasn1.dll
\Windows\System32\profapi.dll
----------- End -----------
Done!
Scan started
Database versions:
main: v2015.06.05.01
rootkit: v2015.06.02.01
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa80033ed140, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa80033ee040, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80033ed140, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa80032c8520, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa800316d060, DeviceName: \Device\Ide\IdeDeviceP2T0L0-2\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Drive 0
This is a System drive
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 102C102B
Partition information:
Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 63 Numsec = 92164842
Partition file system is NTFS
Partition is bootable
Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 230339969 Numsec = 82236736
Partition 2 type is Extended with LBA (0xf)
Partition is NOT ACTIVE.
Partition starts at LBA: 92164905 Numsec = 122977575
Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Disk Size: 160041885696 bytes
Sector size: 512 bytes
Done!
File "C:\ProgramData\AVAST Software\Avast\log\AvastSvc.log" is compressed (flags = 1)
File "C:\ProgramData\AVAST Software\Avast\log\AvastUI.log" is compressed (flags = 1)
File "C:\ProgramData\AVAST Software\Avast\log\CommChannel.Protocol.log" is compressed (flags = 1)
File "C:\ProgramData\AVAST Software\Avast\log\Grimefighter.log" is compressed (flags = 1)
File "C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-D45F552B0A7EA2BE16DE83DACAABBE99F1AAAF0B.bin.VE1" is compressed (flags = 1)
File "C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-D45F552B0A7EA2BE16DE83DACAABBE99F1AAAF0B.bin.VF" is compressed (flags = 1)
Scan finished
=======================================
Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-63-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removal finished
Code:
ATTFilter 09:28:08.0529 0x0bf0 TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
09:28:10.0698 0x0bf0 ============================================================
09:28:10.0698 0x0bf0 Current date / time: 2015/06/05 09:28:10.0698
09:28:10.0698 0x0bf0 SystemInfo:
09:28:10.0698 0x0bf0
09:28:10.0698 0x0bf0 OS Version: 6.1.7601 ServicePack: 1.0
09:28:10.0698 0x0bf0 Product type: Workstation
09:28:10.0698 0x0bf0 ComputerName: ELTERN-PC
09:28:10.0698 0x0bf0 UserName: Eltern
09:28:10.0698 0x0bf0 Windows directory: C:\Windows
09:28:10.0698 0x0bf0 System windows directory: C:\Windows
09:28:10.0698 0x0bf0 Running under WOW64
09:28:10.0698 0x0bf0 Processor architecture: Intel x64
09:28:10.0698 0x0bf0 Number of processors: 2
09:28:10.0698 0x0bf0 Page size: 0x1000
09:28:10.0698 0x0bf0 Boot type: Normal boot
09:28:10.0698 0x0bf0 ============================================================
09:28:12.0694 0x0bf0 KLMD registered as C:\Windows\system32\drivers\68402580.sys
09:28:12.0944 0x0bf0 System UUID: {DC0E9369-626B-8836-9C44-FBEA2EEB311E}
09:28:13.0443 0x0bf0 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 ( 149.05 Gb ), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
09:28:13.0443 0x0bf0 ============================================================
09:28:13.0443 0x0bf0 \Device\Harddisk0\DR0:
09:28:13.0443 0x0bf0 MBR partitions:
09:28:13.0443 0x0bf0 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x57E52EA
09:28:13.0443 0x0bf0 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0xDBAB581, BlocksNum 0x4E6D540
09:28:13.0459 0x0bf0 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x57E5368, BlocksNum 0x7547CE8
09:28:13.0459 0x0bf0 ============================================================
09:28:13.0490 0x0bf0 E: <-> \Device\Harddisk0\DR0\Partition2
09:28:13.0521 0x0bf0 D: <-> \Device\Harddisk0\DR0\Partition1
09:28:13.0537 0x0bf0 C: <-> \Device\Harddisk0\DR0\Partition3
09:28:13.0537 0x0bf0 ============================================================
09:28:13.0537 0x0bf0 Initialize success
09:28:13.0537 0x0bf0 ============================================================
09:28:40.0854 0x0c38 ============================================================
09:28:40.0854 0x0c38 Scan started
09:28:40.0854 0x0c38 Mode: Manual; SigCheck; TDLFS;
09:28:40.0854 0x0c38 ============================================================
09:28:40.0854 0x0c38 KSN ping started
09:28:43.0365 0x0c38 KSN ping finished: true
09:28:44.0286 0x0c38 ================ Scan system memory ========================
09:28:44.0286 0x0c38 System memory - ok
09:28:44.0286 0x0c38 ================ Scan services =============================
09:28:44.0442 0x0c38 [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
09:28:44.0729 0x0c38 1394ohci - ok
09:28:45.0093 0x0c38 [ BBFD6BC7E79989B69F0998D0FEF4E6B8, 2283EC51F26AE34C79679741A220F0FF45703EB5F83823DF64F7AEA24A1966BA ] a2AntiMalware C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
09:28:45.0259 0x0c38 a2AntiMalware - ok
09:28:45.0310 0x0c38 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI C:\Windows\system32\drivers\ACPI.sys
09:28:45.0347 0x0c38 ACPI - ok
09:28:45.0378 0x0c38 [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
09:28:45.0437 0x0c38 AcpiPmi - ok
09:28:45.0512 0x0c38 [ FC5B75CA6A1DA31EDD4F8D53F5540B98, CDC445F2790ADFC4C5568C40D4DA8BB95CD71991665B38AEC3D84571C99C3520 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
09:28:45.0556 0x0c38 AdobeARMservice - ok
09:28:45.0611 0x0c38 [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys
09:28:45.0653 0x0c38 adp94xx - ok
09:28:45.0693 0x0c38 [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys
09:28:45.0732 0x0c38 adpahci - ok
09:28:45.0785 0x0c38 [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys
09:28:45.0822 0x0c38 adpu320 - ok
09:28:45.0858 0x0c38 [ 83BFCCAC53795E8A5055A93672D0C46C, B2B03473D950A5BA9DE59D81E7B14C1FAFF17B2A4D8A5808588F5CC21D63B291 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
09:28:45.0903 0x0c38 AeLookupSvc - ok
09:28:45.0969 0x0c38 [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD C:\Windows\system32\drivers\afd.sys
09:28:46.0055 0x0c38 AFD - ok
09:28:46.0124 0x0c38 [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440 C:\Windows\system32\drivers\agp440.sys
09:28:46.0172 0x0c38 agp440 - ok
09:28:46.0214 0x0c38 [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG C:\Windows\System32\alg.exe
09:28:46.0267 0x0c38 ALG - ok
09:28:46.0310 0x0c38 [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide C:\Windows\system32\drivers\aliide.sys
09:28:46.0340 0x0c38 aliide - ok
09:28:46.0357 0x0c38 [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide C:\Windows\system32\drivers\amdide.sys
09:28:46.0386 0x0c38 amdide - ok
09:28:46.0421 0x0c38 [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
09:28:46.0464 0x0c38 AmdK8 - ok
09:28:46.0476 0x0c38 [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys
09:28:46.0521 0x0c38 AmdPPM - ok
09:28:46.0555 0x0c38 [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata C:\Windows\system32\drivers\amdsata.sys
09:28:46.0588 0x0c38 amdsata - ok
09:28:46.0610 0x0c38 [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys
09:28:46.0643 0x0c38 amdsbs - ok
09:28:46.0656 0x0c38 [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata C:\Windows\system32\drivers\amdxata.sys
09:28:46.0685 0x0c38 amdxata - ok
09:28:46.0737 0x0c38 [ 90C53BD47979FB8814F465A08B885102, 5EDFC1909FC1FF9133A534DFCC5408CF3A777AC41FB21FAD375436E3D86C02EC ] AppID C:\Windows\system32\drivers\appid.sys
09:28:46.0786 0x0c38 AppID - ok
09:28:46.0799 0x0c38 [ 72D4757510FDA69D729169C00AFC211E, FB9686D0D94EE7C19A3994C29E8331A6EC3020B2980B2CC75F72F3AB25512C15 ] AppIDSvc C:\Windows\System32\appidsvc.dll
09:28:46.0859 0x0c38 AppIDSvc - ok
09:28:46.0900 0x0c38 [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo C:\Windows\System32\appinfo.dll
09:28:46.0952 0x0c38 Appinfo - ok
09:28:46.0989 0x0c38 [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc C:\Windows\system32\DRIVERS\arc.sys
09:28:47.0020 0x0c38 arc - ok
09:28:47.0037 0x0c38 [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys
09:28:47.0068 0x0c38 arcsas - ok
09:28:47.0165 0x0c38 [ F15AB80B867D3332D5DDFB0A05B9CE04, 5A16577106246AB5DCC04FE0A0B00B7C5702557B75F958721E4C00383AB99809 ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
09:28:47.0227 0x0c38 aspnet_state - ok
09:28:47.0272 0x0c38 [ B5B4C90E9F52DA8586F1E5461AD90A5D, D1EAA34E6AEB014E942D22F8CB5FB19BF1E2EADE5B5357274C001F44FDC25F05 ] aswHwid C:\Windows\system32\drivers\aswHwid.sys
09:28:47.0339 0x0c38 aswHwid - ok
09:28:47.0370 0x0c38 [ 300CB8E510855189CAD0B72FFB5590CB, EB50DC553FA8FD9DE3F60AAFED20702EAFBB1498EBD3220A39CC52A12F694246 ] aswMonFlt C:\Windows\system32\drivers\aswMonFlt.sys
09:28:47.0451 0x0c38 aswMonFlt - ok
09:28:47.0476 0x0c38 [ 6D37D8DB30D086739507C5F6E542656A, 746D9E32E729138EA19062F4E6B6C98B6833504020A296E3E2A9CD92E0FED0B9 ] aswRdr C:\Windows\system32\drivers\aswRdr2.sys
09:28:47.0507 0x0c38 aswRdr - ok
09:28:47.0542 0x0c38 [ 07E32DFCA422A2920482D762D01957EC, A6502D26266D708E55EB2883897673AD3087C41D9EA0B41CD6BF6BD923EBDCB8 ] aswRvrt C:\Windows\system32\drivers\aswRvrt.sys
09:28:47.0672 0x0c38 aswRvrt - ok
09:28:47.0769 0x0c38 [ 3B4AC2DBFC86F7247C1FF1FAF2860530, A54A693D01C02AAE2B78BFE9B3900B5A6DD0C2C37C8FA58B14B5F57107032FF5 ] aswSnx C:\Windows\system32\drivers\aswSnx.sys
09:28:47.0891 0x0c38 aswSnx - ok
09:28:47.0973 0x0c38 [ B1368BE5F6BA529E0886F4DA2361BD2D, B95F430B4E4EFE9D257870722AA8F0507FB96FBE3AAB12068C662CCB6A180FE2 ] aswSP C:\Windows\system32\drivers\aswSP.sys
09:28:48.0060 0x0c38 aswSP - ok
09:28:48.0102 0x0c38 [ 6E53278ECCFFBC2ACC2A5006745ED4BB, 392170073A8933DB43CD1D64AD087F972F1971BF83BCAFE5B8FA1273C02026CE ] aswStm C:\Windows\system32\drivers\aswStm.sys
09:28:48.0140 0x0c38 aswStm - ok
09:28:48.0186 0x0c38 [ 91782404718C6352C26B3242BAC3F0F1, 84B1CDD1EBC83FAEBDCC8F67B13CA405C6CF0C518FC016603889EBE48FC91AB9 ] aswVmm C:\Windows\system32\drivers\aswVmm.sys
09:28:48.0247 0x0c38 aswVmm - ok
09:28:48.0292 0x0c38 [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
09:28:48.0395 0x0c38 AsyncMac - ok
09:28:48.0434 0x0c38 [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi C:\Windows\system32\drivers\atapi.sys
09:28:48.0471 0x0c38 atapi - ok
09:28:48.0522 0x0c38 [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
09:28:48.0600 0x0c38 AudioEndpointBuilder - ok
09:28:48.0673 0x0c38 [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioSrv C:\Windows\System32\Audiosrv.dll
09:28:48.0747 0x0c38 AudioSrv - ok
09:28:49.0002 0x0c38 [ 54236E79A44F909612391C8A2D70D512, B0DF5BCC4F90AF087D0306F8D81F90B2CAE0176813E3AA6A7D5460F7878677CD ] avast! Antivirus C:\Program Files (x86)\AVAST Software\Avast\AvastSvc.exe
09:28:49.0048 0x0c38 avast! Antivirus - ok
09:28:49.0098 0x0c38 [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV C:\Windows\System32\AxInstSV.dll
09:28:49.0173 0x0c38 AxInstSV - ok
09:28:49.0261 0x0c38 [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv C:\Windows\system32\DRIVERS\bxvbda.sys
09:28:49.0353 0x0c38 b06bdrv - ok
09:28:49.0450 0x0c38 [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
09:28:49.0518 0x0c38 b57nd60a - ok
09:28:49.0587 0x0c38 [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC C:\Windows\System32\bdesvc.dll
09:28:49.0702 0x0c38 BDESVC - ok
09:28:49.0746 0x0c38 [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep C:\Windows\system32\drivers\Beep.sys
09:28:49.0826 0x0c38 Beep - ok
09:28:49.0918 0x0c38 [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE C:\Windows\System32\bfe.dll
09:28:50.0035 0x0c38 BFE - ok
09:28:50.0080 0x0c38 [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS C:\Windows\System32\qmgr.dll
09:28:50.0181 0x0c38 BITS - ok
09:28:50.0208 0x0c38 [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
09:28:50.0256 0x0c38 blbdrive - ok
09:28:50.0296 0x0c38 [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
09:28:50.0342 0x0c38 bowser - ok
09:28:50.0375 0x0c38 [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys
09:28:50.0427 0x0c38 BrFiltLo - ok
09:28:50.0443 0x0c38 [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys
09:28:50.0485 0x0c38 BrFiltUp - ok
09:28:50.0514 0x0c38 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser C:\Windows\System32\browser.dll
09:28:50.0566 0x0c38 Browser - ok
09:28:50.0610 0x0c38 [ 63A00CDBEB300522C49EC7CA77324060, 99CB6D37C7D898982A192AAA8DE5CE255E6FA482E19FE9032BAA7069E652F6F5 ] BrSerIb C:\Windows\system32\DRIVERS\BrSerIb.sys
09:28:50.0639 0x0c38 BrSerIb - ok
09:28:50.0673 0x0c38 [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid C:\Windows\System32\Drivers\Brserid.sys
09:28:50.0734 0x0c38 Brserid - ok
09:28:50.0750 0x0c38 [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
09:28:50.0797 0x0c38 BrSerWdm - ok
09:28:50.0843 0x0c38 [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
09:28:50.0887 0x0c38 BrUsbMdm - ok
09:28:50.0893 0x0c38 [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
09:28:50.0934 0x0c38 BrUsbSer - ok
09:28:50.0959 0x0c38 [ BBCFD6C6EF66449F55AF1BFDB08C9B12, D6D5D408FCFFF9ED69D095948E786C08EEECD5F55905A3D8FE2BB08944C5E1F2 ] BrUsbSIb C:\Windows\system32\DRIVERS\BrUsbSIb.sys
09:28:50.0986 0x0c38 BrUsbSIb - ok
09:28:51.0091 0x0c38 [ 0471D5669F18C50E552B2BC0CB15E7B3, 472F471FF9E5A1FDD5610BAC2F5E727AB284B7B5A71C4E515D549667F0B5EB86 ] BrYNSvc C:\Program Files (x86)\Browny02\BrYNSvc.exe
09:28:51.0156 0x0c38 BrYNSvc - detected UnsignedFile.Multi.Generic ( 1 )
09:28:53.0545 0x0c38 Detect skipped due to KSN trusted
09:28:53.0545 0x0c38 BrYNSvc - ok
09:28:53.0577 0x0c38 [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys
09:28:53.0629 0x0c38 BTHMODEM - ok
09:28:53.0664 0x0c38 [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv C:\Windows\system32\bthserv.dll
09:28:53.0730 0x0c38 bthserv - ok
09:28:53.0769 0x0c38 [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
09:28:53.0838 0x0c38 cdfs - ok
09:28:53.0885 0x0c38 [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
09:28:53.0934 0x0c38 cdrom - ok
09:28:53.0974 0x0c38 [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc C:\Windows\System32\certprop.dll
09:28:54.0044 0x0c38 CertPropSvc - ok
09:28:54.0077 0x0c38 [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass C:\Windows\system32\DRIVERS\circlass.sys
09:28:54.0123 0x0c38 circlass - ok
09:28:54.0163 0x0c38 [ 404B7DF9CA4D1CB675045AF220FF3285, 91FFADE2ABE5C48849E63134D5FFD20671FE0D1720F7D486F904391B3D142C96 ] CLFS C:\Windows\system32\CLFS.sys
09:28:54.0203 0x0c38 CLFS - ok
09:28:54.0256 0x0c38 [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
09:28:54.0381 0x0c38 clr_optimization_v2.0.50727_32 - ok
09:28:54.0447 0x0c38 [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
09:28:54.0536 0x0c38 clr_optimization_v2.0.50727_64 - ok
09:28:54.0606 0x0c38 [ F5AB4D2E36625F355E81539239765107, 48E6AD65EEFD6C54F938F5753EF58377CDA77ADBB41CD8635F0040D61EFB92A4 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
09:28:54.0656 0x0c38 clr_optimization_v4.0.30319_32 - ok
09:28:54.0683 0x0c38 [ 9ACBE5EC13C2CC95833BFB7636CA8B1A, 6224DA9FB335D2A8374C60B8DEA539DD3A0E43230DB888B137B71A56EC57D6AF ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
09:28:54.0719 0x0c38 clr_optimization_v4.0.30319_64 - ok
09:28:54.0753 0x0c38 [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
09:28:54.0794 0x0c38 CmBatt - ok
09:28:54.0810 0x0c38 [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide C:\Windows\system32\drivers\cmdide.sys
09:28:54.0839 0x0c38 cmdide - ok
09:28:54.0878 0x0c38 [ 27667A788130A7F7A5858DE27572E6D7, 5501D80BCCB7A811ECCED3828DFD0A5D948BBED8504E9BCC4A3BFB840DD41CBC ] CNG C:\Windows\system32\Drivers\cng.sys
09:28:54.0922 0x0c38 CNG - ok
09:28:54.0947 0x0c38 [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
09:28:54.0976 0x0c38 Compbatt - ok
09:28:55.0010 0x0c38 [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys
09:28:55.0097 0x0c38 CompositeBus - ok
09:28:55.0120 0x0c38 COMSysApp - ok
09:28:55.0159 0x0c38 [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys
09:28:55.0194 0x0c38 crcdisk - ok
09:28:55.0230 0x0c38 [ 1CD76A83B9E8E9A5A3519B39E28354D9, F9931743B99820FFBFB13136DFFD92F86802D543F9D8478648CDC554FB38899D ] CryptSvc C:\Windows\system32\cryptsvc.dll
09:28:55.0282 0x0c38 CryptSvc - ok
09:28:55.0354 0x0c38 [ BA8E5B2291C01EF71CA80E25F0C79D55, 913C85EC00752AEEE2E29C6664085865DA45A091789C0F8CB015208D69F1915A ] ctxusbm C:\Windows\system32\DRIVERS\ctxusbm.sys
09:28:55.0394 0x0c38 ctxusbm - ok
09:28:55.0443 0x0c38 [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch C:\Windows\system32\rpcss.dll
09:28:55.0526 0x0c38 DcomLaunch - ok
09:28:55.0571 0x0c38 [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc C:\Windows\System32\defragsvc.dll
09:28:55.0642 0x0c38 defragsvc - ok
09:28:55.0676 0x0c38 [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC C:\Windows\system32\Drivers\dfsc.sys
09:28:55.0744 0x0c38 DfsC - ok
09:28:55.0782 0x0c38 [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp C:\Windows\system32\dhcpcore.dll
09:28:55.0837 0x0c38 Dhcp - ok
09:28:55.0918 0x0c38 [ EA8A3E8C674B03CB4AFA1D344DBD7BC1, 564D9370AE4D12973647997684B9637B2A5A7480F66B87018F789CE4E43C8191 ] DiagTrack C:\Windows\system32\diagtrack.dll
09:28:56.0009 0x0c38 DiagTrack - ok
09:28:56.0044 0x0c38 [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache C:\Windows\system32\drivers\discache.sys
09:28:56.0115 0x0c38 discache - ok
09:28:56.0157 0x0c38 [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk C:\Windows\system32\DRIVERS\disk.sys
09:28:56.0187 0x0c38 Disk - ok
09:28:56.0216 0x0c38 [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache C:\Windows\System32\dnsrslvr.dll
09:28:56.0268 0x0c38 Dnscache - ok
09:28:56.0315 0x0c38 [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc C:\Windows\System32\dot3svc.dll
09:28:56.0396 0x0c38 dot3svc - ok
09:28:56.0438 0x0c38 [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS C:\Windows\system32\dps.dll
09:28:56.0517 0x0c38 DPS - ok
09:28:56.0567 0x0c38 [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
09:28:56.0612 0x0c38 drmkaud - ok
09:28:56.0676 0x0c38 [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
09:28:56.0730 0x0c38 DXGKrnl - ok
09:28:56.0769 0x0c38 [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost C:\Windows\System32\eapsvc.dll
09:28:56.0835 0x0c38 EapHost - ok
09:28:56.0955 0x0c38 [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv C:\Windows\system32\DRIVERS\evbda.sys
09:28:57.0107 0x0c38 ebdrv - ok
09:28:57.0143 0x0c38 [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] EFS C:\Windows\System32\lsass.exe
09:28:57.0188 0x0c38 EFS - ok
09:28:57.0277 0x0c38 [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
09:28:57.0348 0x0c38 ehRecvr - ok
09:28:57.0377 0x0c38 [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched C:\Windows\ehome\ehsched.exe
09:28:57.0423 0x0c38 ehSched - ok
09:28:57.0476 0x0c38 [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys
09:28:57.0518 0x0c38 elxstor - ok
09:28:57.0563 0x0c38 [ 9EAFB3B3B60B8AD958985152A9309ACA, EC58F487D50A125DA3F747670282EA2104580CCAAF709EA494B61C7549576AE6 ] epmntdrv C:\Windows\system32\epmntdrv.sys
09:28:57.0598 0x0c38 epmntdrv - detected UnsignedFile.Multi.Generic ( 1 )
09:29:00.0103 0x0c38 Detect skipped due to KSN trusted
09:29:00.0103 0x0c38 epmntdrv - ok
09:29:00.0166 0x0c38 [ CA4ADE6C3929B70317BFDDF9ABBFE0CE, 824F3D26FDFBA38A5191C78E68379D48C915FB6F82BD353A1D5416537F8A0A42 ] epp64 C:\Windows\system32\DRIVERS\epp64.sys
09:29:00.0212 0x0c38 epp64 - ok
09:29:00.0244 0x0c38 [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev C:\Windows\system32\drivers\errdev.sys
09:29:00.0275 0x0c38 ErrDev - ok
09:29:00.0337 0x0c38 [ FB949ED2C93C878A189039F3D7730942, 857AFB9965F14C80C21948C05A44D37948BD206961101DFF087735D6A7CCAA8A ] EuGdiDrv C:\Windows\system32\EuGdiDrv.sys
09:29:00.0368 0x0c38 EuGdiDrv - detected UnsignedFile.Multi.Generic ( 1 )
09:29:02.0989 0x0c38 Detect skipped due to KSN trusted
09:29:02.0989 0x0c38 EuGdiDrv - ok
09:29:03.0052 0x0c38 [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem C:\Windows\system32\es.dll
09:29:03.0145 0x0c38 EventSystem - ok
09:29:03.0161 0x0c38 [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat C:\Windows\system32\drivers\exfat.sys
09:29:03.0223 0x0c38 exfat - ok
09:29:03.0255 0x0c38 [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat C:\Windows\system32\drivers\fastfat.sys
09:29:03.0317 0x0c38 fastfat - ok
09:29:03.0379 0x0c38 [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax C:\Windows\system32\fxssvc.exe
09:29:03.0442 0x0c38 Fax - ok
09:29:03.0473 0x0c38 [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc C:\Windows\system32\DRIVERS\fdc.sys
09:29:03.0520 0x0c38 fdc - ok
09:29:03.0551 0x0c38 [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost C:\Windows\system32\fdPHost.dll
09:29:03.0613 0x0c38 fdPHost - ok
09:29:03.0613 0x0c38 [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub C:\Windows\system32\fdrespub.dll
09:29:03.0676 0x0c38 FDResPub - ok
09:29:03.0691 0x0c38 [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
09:29:03.0723 0x0c38 FileInfo - ok
09:29:03.0738 0x0c38 [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
09:29:03.0816 0x0c38 Filetrace - ok
09:29:03.0816 0x0c38 [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
09:29:03.0863 0x0c38 flpydisk - ok
09:29:03.0894 0x0c38 [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
09:29:03.0941 0x0c38 FltMgr - ok
09:29:04.0003 0x0c38 [ E612E86FA15EA1EF9A52433A2743C447, 8A66164541D2EE2334B6DE3995C31138EA85E3A06BC7FD901E60D345E4E1E8A8 ] FontCache C:\Windows\system32\FntCache.dll
09:29:04.0081 0x0c38 FontCache - ok
09:29:04.0144 0x0c38 [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
09:29:04.0175 0x0c38 FontCache3.0.0.0 - ok
09:29:04.0206 0x0c38 [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
09:29:04.0237 0x0c38 FsDepends - ok
09:29:04.0269 0x0c38 [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
09:29:04.0300 0x0c38 Fs_Rec - ok
09:29:04.0331 0x0c38 [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
09:29:04.0378 0x0c38 fvevol - ok
09:29:04.0409 0x0c38 [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys
09:29:04.0440 0x0c38 gagp30kx - ok
09:29:04.0503 0x0c38 [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc C:\Windows\System32\gpsvc.dll
09:29:04.0581 0x0c38 gpsvc - ok
09:29:04.0612 0x0c38 [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
09:29:04.0659 0x0c38 hcw85cir - ok
09:29:04.0690 0x0c38 [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
09:29:04.0737 0x0c38 HdAudAddService - ok
09:29:04.0768 0x0c38 [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys
09:29:04.0815 0x0c38 HDAudBus - ok
09:29:04.0846 0x0c38 [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys
09:29:04.0893 0x0c38 HidBatt - ok
09:29:04.0924 0x0c38 [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys
09:29:04.0971 0x0c38 HidBth - ok
09:29:04.0986 0x0c38 [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
09:29:05.0033 0x0c38 HidIr - ok
09:29:05.0049 0x0c38 [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv C:\Windows\system32\hidserv.dll
09:29:05.0127 0x0c38 hidserv - ok
09:29:05.0158 0x0c38 [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb C:\Windows\system32\drivers\hidusb.sys
09:29:05.0189 0x0c38 HidUsb - ok
09:29:05.0220 0x0c38 [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc C:\Windows\system32\kmsvc.dll
09:29:05.0283 0x0c38 hkmsvc - ok
09:29:05.0314 0x0c38 [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
09:29:05.0376 0x0c38 HomeGroupListener - ok
09:29:05.0423 0x0c38 [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
09:29:05.0470 0x0c38 HomeGroupProvider - ok
09:29:05.0517 0x0c38 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
09:29:05.0548 0x0c38 HpSAMD - ok
09:29:05.0595 0x0c38 [ F61634BEC53F73702A10DE69F6DCAF57, BBA7344CF3AB96A46D1A6F1D50F2758EA8D097FE558C38B4EF45C8C334AF96E1 ] HTTP C:\Windows\system32\drivers\HTTP.sys
09:29:05.0673 0x0c38 HTTP - ok
09:29:05.0751 0x0c38 HWiNFO32 - ok
09:29:05.0782 0x0c38 [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
09:29:05.0813 0x0c38 hwpolicy - ok
09:29:05.0844 0x0c38 [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt C:\Windows\system32\drivers\i8042prt.sys
09:29:05.0888 0x0c38 i8042prt - ok
09:29:05.0973 0x0c38 [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
09:29:06.0059 0x0c38 iaStorV - ok
09:29:06.0223 0x0c38 [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
09:29:06.0325 0x0c38 idsvc - ok
09:29:06.0392 0x0c38 IEEtwCollectorService - ok
09:29:06.0600 0x0c38 [ 24CC43ECDEEFD4C19FBBEE4951B647F1, 416799965E6602F8F03E2A92E8BB42B1D5643C65EF09815FC5A56A2FA73E6773 ] igfx C:\Windows\system32\DRIVERS\igdkmd64.sys
09:29:06.0783 0x0c38 igfx - ok
09:29:06.0847 0x0c38 [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys
09:29:06.0876 0x0c38 iirsp - ok
09:29:06.0923 0x0c38 [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT C:\Windows\System32\ikeext.dll
09:29:06.0996 0x0c38 IKEEXT - ok
09:29:07.0037 0x0c38 [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide C:\Windows\system32\drivers\intelide.sys
09:29:07.0065 0x0c38 intelide - ok
09:29:07.0098 0x0c38 [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
09:29:07.0148 0x0c38 intelppm - ok
09:29:07.0179 0x0c38 [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum C:\Windows\system32\ipbusenum.dll
09:29:07.0252 0x0c38 IPBusEnum - ok
09:29:07.0296 0x0c38 [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
09:29:07.0349 0x0c38 IpFilterDriver - ok
09:29:07.0396 0x0c38 [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
09:29:07.0454 0x0c38 iphlpsvc - ok
09:29:07.0497 0x0c38 [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
09:29:07.0546 0x0c38 IPMIDRV - ok
09:29:07.0582 0x0c38 [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT C:\Windows\system32\drivers\ipnat.sys
09:29:07.0643 0x0c38 IPNAT - ok
09:29:07.0666 0x0c38 [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM C:\Windows\system32\drivers\irenum.sys
09:29:07.0718 0x0c38 IRENUM - ok
09:29:07.0754 0x0c38 [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp C:\Windows\system32\drivers\isapnp.sys
09:29:07.0783 0x0c38 isapnp - ok
09:29:07.0823 0x0c38 [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
09:29:07.0858 0x0c38 iScsiPrt - ok
09:29:07.0897 0x0c38 [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass C:\Windows\system32\drivers\kbdclass.sys
09:29:07.0928 0x0c38 kbdclass - ok
09:29:07.0966 0x0c38 [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid C:\Windows\system32\drivers\kbdhid.sys
09:29:08.0065 0x0c38 kbdhid - ok
09:29:08.0094 0x0c38 [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] KeyIso C:\Windows\system32\lsass.exe
09:29:08.0153 0x0c38 KeyIso - ok
09:29:08.0193 0x0c38 [ F7DFAE6040AC910B7C64EE208A34157D, AEF1100F12391692D9DB78519D843A90C97E199A80DDC4D43E3AF1919A9E8E56 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
09:29:08.0255 0x0c38 KSecDD - ok
09:29:08.0293 0x0c38 [ 8FE94F2EF9BF444E93E35D87E210D02F, 78E8F6FD7C1EA3556194947707BE6893538A9E25A550C22045866C5B30251D14 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
09:29:08.0335 0x0c38 KSecPkg - ok
09:29:08.0385 0x0c38 [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
09:29:08.0466 0x0c38 ksthunk - ok
09:29:08.0508 0x0c38 [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm C:\Windows\system32\msdtckrm.dll
09:29:08.0580 0x0c38 KtmRm - ok
09:29:08.0626 0x0c38 [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer C:\Windows\system32\srvsvc.dll
09:29:08.0696 0x0c38 LanmanServer - ok
09:29:08.0722 0x0c38 [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
09:29:08.0779 0x0c38 LanmanWorkstation - ok
09:29:08.0811 0x0c38 [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
09:29:08.0876 0x0c38 lltdio - ok
09:29:08.0924 0x0c38 [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc C:\Windows\System32\lltdsvc.dll
09:29:09.0004 0x0c38 lltdsvc - ok
09:29:09.0029 0x0c38 [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts C:\Windows\System32\lmhsvc.dll
09:29:09.0100 0x0c38 lmhosts - ok
09:29:09.0141 0x0c38 [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys
09:29:09.0172 0x0c38 LSI_FC - ok
09:29:09.0208 0x0c38 [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys
09:29:09.0240 0x0c38 LSI_SAS - ok
09:29:09.0265 0x0c38 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys
09:29:09.0297 0x0c38 LSI_SAS2 - ok
09:29:09.0321 0x0c38 [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys
09:29:09.0353 0x0c38 LSI_SCSI - ok
09:29:09.0380 0x0c38 [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv C:\Windows\system32\drivers\luafv.sys
09:29:09.0448 0x0c38 luafv - ok
09:29:09.0489 0x0c38 [ 1E9E32AEC3E1EB1B31B8169F33168B56, 39114585E1FDBBA31E1F781C6A627281907183F94626EB347B08D1F78992ED2A ] MBAMProtector C:\Windows\system32\drivers\mbam.sys
09:29:09.0517 0x0c38 MBAMProtector - ok
09:29:09.0605 0x0c38 [ 2B983F067AEE3F9EB4DF5E97F45D21D1, 0B9ED0E91FF01A5445927650113E320C3C0EA16F1401AA55A509DDBF704DF22F ] MBAMService C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
09:29:09.0670 0x0c38 MBAMService - ok
09:29:09.0734 0x0c38 [ F49FB3C88E263AE9A246593B0BB29294, FB53D6FA4A98B98334DCFF81E40712265256D31A9E9FF36022887BABD50F39EB ] MBAMWebAccessControl C:\Windows\system32\drivers\mwac.sys
09:29:09.0765 0x0c38 MBAMWebAccessControl - ok
09:29:09.0797 0x0c38 [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
09:29:09.0833 0x0c38 Mcx2Svc - ok
09:29:09.0883 0x0c38 [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas C:\Windows\system32\DRIVERS\megasas.sys
09:29:09.0929 0x0c38 megasas - ok
09:29:10.0023 0x0c38 [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys
09:29:10.0096 0x0c38 MegaSR - ok
09:29:10.0139 0x0c38 [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS C:\Windows\system32\mmcss.dll
09:29:10.0209 0x0c38 MMCSS - ok
09:29:10.0229 0x0c38 [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem C:\Windows\system32\drivers\modem.sys
09:29:10.0293 0x0c38 Modem - ok
09:29:10.0335 0x0c38 [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
09:29:10.0382 0x0c38 monitor - ok
09:29:10.0417 0x0c38 [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass C:\Windows\system32\drivers\mouclass.sys
09:29:10.0448 0x0c38 mouclass - ok
09:29:10.0481 0x0c38 [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
09:29:10.0530 0x0c38 mouhid - ok
09:29:10.0567 0x0c38 [ 87BCD1034CBF33537D4D4C251D39BA26, CB9DD235B62B79383F99873D75E26EEA5EE7914CA89E4B75992207F83420437F ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
09:29:10.0597 0x0c38 mountmgr - ok
09:29:10.0649 0x0c38 [ 9FC679D10A7377BB04ECC3D0E2E26B53, 24ACD4EC1618A052C29E4463138B28F62C8B78D442DB82F4925E64FC5849A096 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
09:29:10.0680 0x0c38 MozillaMaintenance - ok
09:29:10.0713 0x0c38 [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio C:\Windows\system32\drivers\mpio.sys
09:29:10.0745 0x0c38 mpio - ok
09:29:10.0780 0x0c38 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
09:29:10.0835 0x0c38 mpsdrv - ok
09:29:10.0876 0x0c38 [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc C:\Windows\system32\mpssvc.dll
09:29:10.0968 0x0c38 MpsSvc - ok
09:29:11.0009 0x0c38 [ AE3334958D8F631FF14A0AEB3D7EFB3A, F5FD6B61F896104C20DFC43FEE2FCE6930B73F78DF876BD19A333EABB9139C6D ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
09:29:11.0055 0x0c38 MRxDAV - ok
09:29:11.0092 0x0c38 [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
09:29:11.0140 0x0c38 mrxsmb - ok
09:29:11.0167 0x0c38 [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
09:29:11.0218 0x0c38 mrxsmb10 - ok
09:29:11.0247 0x0c38 [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
09:29:11.0297 0x0c38 mrxsmb20 - ok
09:29:11.0335 0x0c38 [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci C:\Windows\system32\drivers\msahci.sys
09:29:11.0365 0x0c38 msahci - ok
09:29:11.0407 0x0c38 [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm C:\Windows\system32\drivers\msdsm.sys
09:29:11.0450 0x0c38 msdsm - ok
09:29:11.0480 0x0c38 [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC C:\Windows\System32\msdtc.exe
09:29:11.0529 0x0c38 MSDTC - ok
09:29:11.0579 0x0c38 [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs C:\Windows\system32\drivers\Msfs.sys
09:29:11.0643 0x0c38 Msfs - ok
09:29:11.0664 0x0c38 [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
09:29:11.0727 0x0c38 mshidkmdf - ok
09:29:11.0760 0x0c38 [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
09:29:11.0789 0x0c38 msisadrv - ok
09:29:11.0837 0x0c38 [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
09:29:11.0908 0x0c38 MSiSCSI - ok
09:29:11.0918 0x0c38 msiserver - ok
09:29:11.0966 0x0c38 [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
09:29:12.0017 0x0c38 MSKSSRV - ok
09:29:12.0039 0x0c38 [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
09:29:12.0103 0x0c38 MSPCLOCK - ok
09:29:12.0143 0x0c38 [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
09:29:12.0203 0x0c38 MSPQM - ok
09:29:12.0257 0x0c38 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
09:29:12.0311 0x0c38 MsRPC - ok
09:29:12.0345 0x0c38 [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys
09:29:12.0374 0x0c38 mssmbios - ok
09:29:12.0405 0x0c38 [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
09:29:12.0468 0x0c38 MSTEE - ok
09:29:12.0490 0x0c38 [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys
09:29:12.0534 0x0c38 MTConfig - ok
09:29:12.0585 0x0c38 [ 03B7145C889603537E9FFEABB1AD1089, B3CD93B893D4A2370CBF382366C6F596372857F8711EF6FFF83BFE2B449F424E ] MTsensor C:\Windows\system32\DRIVERS\ASACPI.sys
09:29:12.0629 0x0c38 MTsensor - ok
09:29:12.0662 0x0c38 [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup C:\Windows\system32\Drivers\mup.sys
09:29:12.0693 0x0c38 Mup - ok
09:29:12.0737 0x0c38 [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent C:\Windows\system32\qagentRT.dll
09:29:12.0816 0x0c38 napagent - ok
09:29:12.0864 0x0c38 [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
09:29:12.0920 0x0c38 NativeWifiP - ok
09:29:12.0980 0x0c38 [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS C:\Windows\system32\drivers\ndis.sys
09:29:13.0034 0x0c38 NDIS - ok
09:29:13.0068 0x0c38 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
09:29:13.0137 0x0c38 NdisCap - ok
09:29:13.0170 0x0c38 [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
09:29:13.0233 0x0c38 NdisTapi - ok
09:29:13.0283 0x0c38 [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
09:29:13.0348 0x0c38 Ndisuio - ok
09:29:13.0380 0x0c38 [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
09:29:13.0446 0x0c38 NdisWan - ok
09:29:13.0476 0x0c38 [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
09:29:13.0544 0x0c38 NDProxy - ok
09:29:13.0587 0x0c38 [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
09:29:13.0652 0x0c38 NetBIOS - ok
09:29:13.0684 0x0c38 [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
09:29:13.0756 0x0c38 NetBT - ok
09:29:13.0774 0x0c38 [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] Netlogon C:\Windows\system32\lsass.exe
09:29:13.0806 0x0c38 Netlogon - ok
09:29:13.0843 0x0c38 [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman C:\Windows\System32\netman.dll
09:29:13.0921 0x0c38 Netman - ok
09:29:13.0969 0x0c38 [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
09:29:14.0000 0x0c38 NetMsmqActivator - ok
09:29:14.0015 0x0c38 [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
09:29:14.0047 0x0c38 NetPipeActivator - ok
09:29:14.0093 0x0c38 [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm C:\Windows\System32\netprofm.dll
09:29:14.0187 0x0c38 netprofm - ok
09:29:14.0218 0x0c38 [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
09:29:14.0249 0x0c38 NetTcpActivator - ok
09:29:14.0265 0x0c38 [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
09:29:14.0296 0x0c38 NetTcpPortSharing - ok
09:29:14.0343 0x0c38 [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys
09:29:14.0374 0x0c38 nfrd960 - ok
09:29:14.0405 0x0c38 [ 8B301D474B478E9A92823BAB50A7BC49, 8181816035F41B1DABEC05E65E4F67BCD785F56760A61F1049E91BA39D42F01D ] NlaSvc C:\Windows\System32\nlasvc.dll
09:29:14.0468 0x0c38 NlaSvc - ok
09:29:14.0483 0x0c38 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs C:\Windows\system32\drivers\Npfs.sys
09:29:14.0546 0x0c38 Npfs - ok
09:29:14.0561 0x0c38 [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi C:\Windows\system32\nsisvc.dll
09:29:14.0624 0x0c38 nsi - ok
09:29:14.0639 0x0c38 [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
09:29:14.0702 0x0c38 nsiproxy - ok
09:29:14.0795 0x0c38 [ 1A29A59A4C5BA6F8C85062A613B7E2B2, CC137F499A12C724D4166C2D85E9F447413419A0683DAC6F1A802B7F210C77F1 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
09:29:14.0889 0x0c38 Ntfs - ok
09:29:14.0920 0x0c38 [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null C:\Windows\system32\drivers\Null.sys
09:29:14.0998 0x0c38 Null - ok
09:29:15.0029 0x0c38 [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid C:\Windows\system32\drivers\nvraid.sys
09:29:15.0061 0x0c38 nvraid - ok
09:29:15.0092 0x0c38 [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor C:\Windows\system32\drivers\nvstor.sys
09:29:15.0123 0x0c38 nvstor - ok
09:29:15.0185 0x0c38 [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
09:29:15.0248 0x0c38 nv_agp - ok
09:29:15.0279 0x0c38 [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
09:29:15.0310 0x0c38 ohci1394 - ok
09:29:15.0357 0x0c38 [ 7A56CF3E3F12E8AF599963B16F50FB6A, 882C82BAE96D263138D4C0D6C425458B770B7B9C8E9C1D28AC918BF6BE94A5C2 ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
09:29:15.0388 0x0c38 ose - ok
09:29:15.0435 0x0c38 [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
09:29:15.0482 0x0c38 p2pimsvc - ok
09:29:15.0513 0x0c38 [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc C:\Windows\system32\p2psvc.dll
09:29:15.0575 0x0c38 p2psvc - ok
09:29:15.0607 0x0c38 [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport C:\Windows\system32\DRIVERS\parport.sys
09:29:15.0653 0x0c38 Parport - ok
09:29:15.0685 0x0c38 [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr C:\Windows\system32\drivers\partmgr.sys
09:29:15.0716 0x0c38 partmgr - ok
09:29:15.0747 0x0c38 [ DB2D62AA2DF6B1F3D690A9EC9701AA2C, BEAC55E1AA0494565F1547DF5E6FE20FCEA66461764C016FCB68D8BFF0F0C375 ] PcaSvc C:\Windows\System32\pcasvc.dll
09:29:15.0794 0x0c38 PcaSvc - ok
09:29:15.0841 0x0c38 [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci C:\Windows\system32\drivers\pci.sys
09:29:15.0887 0x0c38 pci - ok
09:29:15.0919 0x0c38 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide C:\Windows\system32\drivers\pciide.sys
09:29:15.0950 0x0c38 pciide - ok
09:29:15.0997 0x0c38 [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys
09:29:16.0028 0x0c38 pcmcia - ok
09:29:16.0059 0x0c38 [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw C:\Windows\system32\drivers\pcw.sys
09:29:16.0090 0x0c38 pcw - ok
09:29:16.0153 0x0c38 [ 7CADB4ABAE72390951886CF259791F5F, 9A0F4113F4E09911A44843F31E8C7047EEA39611AB490A4CF16FAE9D95310076 ] PDFProFiltSrvPP C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
09:29:16.0231 0x0c38 PDFProFiltSrvPP - ok
09:29:16.0277 0x0c38 [ ED6E75158D28D33A2E2A020AC5B2B59D, 0F364D9A88304C45F31318605C417A70A9D0E4CF087D73E949B42C12CC76CD6C ] PEAUTH C:\Windows\system32\drivers\peauth.sys
09:29:16.0340 0x0c38 PEAUTH - ok
09:29:16.0402 0x0c38 [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost C:\Windows\SysWow64\perfhost.exe
09:29:16.0465 0x0c38 PerfHost - ok
09:29:16.0589 0x0c38 [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla C:\Windows\system32\pla.dll
09:29:16.0683 0x0c38 pla - ok
09:29:16.0745 0x0c38 [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
09:29:16.0792 0x0c38 PlugPlay - ok
09:29:16.0823 0x0c38 [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
09:29:16.0870 0x0c38 PNRPAutoReg - ok
09:29:16.0901 0x0c38 [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
09:29:16.0948 0x0c38 PNRPsvc - ok
09:29:16.0979 0x0c38 [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
09:29:17.0057 0x0c38 PolicyAgent - ok
09:29:17.0104 0x0c38 [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power C:\Windows\system32\umpo.dll
09:29:17.0182 0x0c38 Power - ok
09:29:17.0213 0x0c38 [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
09:29:17.0260 0x0c38 PptpMiniport - ok
09:29:17.0291 0x0c38 [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor C:\Windows\system32\DRIVERS\processr.sys
09:29:17.0338 0x0c38 Processor - ok
09:29:17.0401 0x0c38 [ B6A58491307B4CADA572583D863DC602, 5C44936605E52C9533E4CE22F18FAB8211475877F71EFD88DA4D02FD608C90A3 ] ProfSvc C:\Windows\system32\profsvc.dll
09:29:17.0432 0x0c38 ProfSvc - ok
09:29:17.0463 0x0c38 [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] ProtectedStorage C:\Windows\system32\lsass.exe
09:29:17.0494 0x0c38 ProtectedStorage - ok
09:29:17.0525 0x0c38 [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched C:\Windows\system32\DRIVERS\pacer.sys
09:29:17.0588 0x0c38 Psched - ok
09:29:17.0650 0x0c38 [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys
09:29:17.0728 0x0c38 ql2300 - ok
09:29:17.0775 0x0c38 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys
09:29:17.0806 0x0c38 ql40xx - ok
09:29:17.0837 0x0c38 [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE C:\Windows\system32\qwave.dll
09:29:17.0884 0x0c38 QWAVE - ok
09:29:17.0900 0x0c38 [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
09:29:17.0947 0x0c38 QWAVEdrv - ok
09:29:17.0993 0x0c38 [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
09:29:18.0056 0x0c38 RasAcd - ok
09:29:18.0087 0x0c38 [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
09:29:18.0149 0x0c38 RasAgileVpn - ok
09:29:18.0165 0x0c38 [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto C:\Windows\System32\rasauto.dll
09:29:18.0243 0x0c38 RasAuto - ok
09:29:18.0290 0x0c38 [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
09:29:18.0352 0x0c38 Rasl2tp - ok
09:29:18.0415 0x0c38 [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan C:\Windows\System32\rasmans.dll
09:29:18.0461 0x0c38 RasMan - ok
09:29:18.0524 0x0c38 [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
09:29:18.0586 0x0c38 RasPppoe - ok
09:29:18.0617 0x0c38 [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
09:29:18.0680 0x0c38 RasSstp - ok
09:29:18.0711 0x0c38 [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
09:29:18.0789 0x0c38 rdbss - ok
09:29:18.0836 0x0c38 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
09:29:18.0898 0x0c38 rdpbus - ok
09:29:18.0929 0x0c38 [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
09:29:18.0992 0x0c38 RDPCDD - ok
09:29:19.0023 0x0c38 [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
09:29:19.0101 0x0c38 RDPENCDD - ok
09:29:19.0132 0x0c38 [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
09:29:19.0179 0x0c38 RDPREFMP - ok
09:29:19.0273 0x0c38 [ 313F68E1A3E6345A4F47A36B07062F34, B8318A0AE06BDE278931CA52F960B9FE226FD9894B076858DDB755AE26E1E66F ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
09:29:19.0351 0x0c38 RdpVideoMiniport - ok
09:29:19.0382 0x0c38 [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
09:29:19.0444 0x0c38 RDPWD - ok
09:29:19.0491 0x0c38 [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
09:29:19.0522 0x0c38 rdyboost - ok
09:29:19.0553 0x0c38 [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess C:\Windows\System32\mprdim.dll
09:29:19.0616 0x0c38 RemoteAccess - ok
09:29:19.0663 0x0c38 [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry C:\Windows\system32\regsvc.dll
09:29:19.0725 0x0c38 RemoteRegistry - ok
09:29:19.0772 0x0c38 [ 9C3AC71A9934B884FAC567A8807E9C4D, 0B6B2970098E3C21E1E54A25785544903E8CD415B527FCEF86ABC7B33BEC83E7 ] Revoflt C:\Windows\system32\DRIVERS\revoflt.sys
09:29:19.0803 0x0c38 Revoflt - ok
09:29:19.0850 0x0c38 [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
09:29:19.0897 0x0c38 RpcEptMapper - ok
09:29:19.0928 0x0c38 [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator C:\Windows\system32\locator.exe
09:29:19.0959 0x0c38 RpcLocator - ok
09:29:20.0006 0x0c38 [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs C:\Windows\system32\rpcss.dll
09:29:20.0068 0x0c38 RpcSs - ok
09:29:20.0115 0x0c38 [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
09:29:20.0177 0x0c38 rspndr - ok
09:29:20.0240 0x0c38 [ F65F171165FBB613F7AA3CC78E8CAB42, 9F1503372D2D1225DD057FA0C442B76DAC17007556D8C8AF70ED9BA0B4F45556 ] RTL8167 C:\Windows\system32\DRIVERS\Rt64win7.sys
09:29:20.0287 0x0c38 RTL8167 - ok
09:29:20.0302 0x0c38 [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] SamSs C:\Windows\system32\lsass.exe
09:29:20.0333 0x0c38 SamSs - ok
09:29:20.0380 0x0c38 SANDRA - ok
09:29:20.0411 0x0c38 [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
09:29:20.0443 0x0c38 sbp2port - ok
09:29:20.0489 0x0c38 [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr C:\Windows\System32\SCardSvr.dll
09:29:20.0552 0x0c38 SCardSvr - ok
09:29:20.0583 0x0c38 [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
09:29:20.0645 0x0c38 scfilter - ok
09:29:20.0708 0x0c38 [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule C:\Windows\system32\schedsvc.dll
09:29:20.0817 0x0c38 Schedule - ok
09:29:20.0848 0x0c38 [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc C:\Windows\System32\certprop.dll
09:29:20.0895 0x0c38 SCPolicySvc - ok
09:29:20.0942 0x0c38 [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC C:\Windows\System32\SDRSVC.dll
09:29:20.0973 0x0c38 SDRSVC - ok
09:29:21.0020 0x0c38 [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv C:\Windows\system32\drivers\secdrv.sys
09:29:21.0098 0x0c38 secdrv - ok
09:29:21.0129 0x0c38 [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon C:\Windows\system32\seclogon.dll
09:29:21.0176 0x0c38 seclogon - ok
09:29:21.0207 0x0c38 [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS C:\Windows\System32\sens.dll
09:29:21.0285 0x0c38 SENS - ok
09:29:21.0316 0x0c38 [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc C:\Windows\system32\sensrsvc.dll
09:29:21.0347 0x0c38 SensrSvc - ok
09:29:21.0379 0x0c38 [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
09:29:21.0410 0x0c38 Serenum - ok
09:29:21.0441 0x0c38 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial C:\Windows\system32\DRIVERS\serial.sys
09:29:21.0488 0x0c38 Serial - ok
09:29:21.0519 0x0c38 [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys
09:29:21.0550 0x0c38 sermouse - ok
09:29:21.0613 0x0c38 [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv C:\Windows\system32\sessenv.dll
09:29:21.0659 0x0c38 SessionEnv - ok
09:29:21.0706 0x0c38 [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
09:29:21.0737 0x0c38 sffdisk - ok
09:29:21.0753 0x0c38 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
09:29:21.0800 0x0c38 sffp_mmc - ok
09:29:21.0815 0x0c38 [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
09:29:21.0862 0x0c38 sffp_sd - ok
09:29:21.0909 0x0c38 [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys
09:29:21.0940 0x0c38 sfloppy - ok
09:29:21.0987 0x0c38 [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess C:\Windows\System32\ipnathlp.dll
09:29:22.0065 0x0c38 SharedAccess - ok
09:29:22.0112 0x0c38 [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
09:29:22.0174 0x0c38 ShellHWDetection - ok
09:29:22.0205 0x0c38 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys
09:29:22.0237 0x0c38 SiSRaid2 - ok
09:29:22.0268 0x0c38 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys
09:29:22.0299 0x0c38 SiSRaid4 - ok
09:29:22.0346 0x0c38 [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb C:\Windows\system32\DRIVERS\smb.sys
09:29:22.0393 0x0c38 Smb - ok
09:29:22.0471 0x0c38 [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
09:29:22.0517 0x0c38 SNMPTRAP - ok
09:29:22.0564 0x0c38 [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr C:\Windows\system32\drivers\spldr.sys
09:29:22.0595 0x0c38 spldr - ok
09:29:22.0627 0x0c38 [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler C:\Windows\System32\spoolsv.exe
09:29:22.0689 0x0c38 Spooler - ok
09:29:22.0829 0x0c38 [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc C:\Windows\system32\sppsvc.exe
09:29:23.0032 0x0c38 sppsvc - ok
09:29:23.0079 0x0c38 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify C:\Windows\system32\sppuinotify.dll
09:29:23.0157 0x0c38 sppuinotify - ok
09:29:23.0204 0x0c38 [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv C:\Windows\system32\DRIVERS\srv.sys
09:29:23.0251 0x0c38 srv - ok
09:29:23.0297 0x0c38 [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
09:29:23.0344 0x0c38 srv2 - ok
09:29:23.0375 0x0c38 [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
09:29:23.0422 0x0c38 srvnet - ok
09:29:23.0485 0x0c38 [ 8F8324ED1DE63FFC7B1A02CD2D963C72, E58603F81DEAFF1D45CB83FB6E625E6A13868741B833B1C9E60D672179D18EE0 ] ssadbus C:\Windows\system32\DRIVERS\ssadbus.sys
09:29:23.0531 0x0c38 ssadbus - ok
09:29:23.0578 0x0c38 [ 58221EFCB74167B73667F0024C661CE0, D9B67A8897B4DC3E4729187F17ABEB4710CF57440D718E17ED828439198D34DB ] ssadmdfl C:\Windows\system32\DRIVERS\ssadmdfl.sys
09:29:23.0625 0x0c38 ssadmdfl - ok
09:29:23.0656 0x0c38 [ 4DA7C71BFAC5AD71255B7E4CAB980163, 4CC0F9C8E96ECEF36EEB021E448A9734B63512D030516DC38B1A2EEAA1043AEC ] ssadmdm C:\Windows\system32\DRIVERS\ssadmdm.sys
09:29:23.0719 0x0c38 ssadmdm - ok
09:29:23.0765 0x0c38 [ D33D1BD3EC0E766211A234F56A12726D, 53EEAA94865554F8422D111D717B548DF553B5B8647D2A45F3718BF4AEEBEC27 ] ssadserd C:\Windows\system32\DRIVERS\ssadserd.sys
09:29:23.0812 0x0c38 ssadserd - ok
09:29:23.0859 0x0c38 [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
09:29:23.0921 0x0c38 SSDPSRV - ok
09:29:23.0953 0x0c38 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc C:\Windows\system32\sstpsvc.dll
09:29:24.0015 0x0c38 SstpSvc - ok
09:29:24.0046 0x0c38 [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys
09:29:24.0077 0x0c38 stexstor - ok
09:29:24.0140 0x0c38 [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc C:\Windows\System32\wiaservc.dll
09:29:24.0202 0x0c38 stisvc - ok
09:29:24.0249 0x0c38 [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum C:\Windows\system32\drivers\swenum.sys
09:29:24.0265 0x0c38 swenum - ok
09:29:24.0311 0x0c38 [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv C:\Windows\System32\swprv.dll
09:29:24.0374 0x0c38 swprv - ok
09:29:24.0452 0x0c38 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain C:\Windows\system32\sysmain.dll
09:29:24.0577 0x0c38 SysMain - ok
09:29:24.0623 0x0c38 [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
09:29:24.0670 0x0c38 TabletInputService - ok
09:29:24.0701 0x0c38 [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv C:\Windows\System32\tapisrv.dll
09:29:24.0779 0x0c38 TapiSrv - ok
09:29:24.0811 0x0c38 [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS C:\Windows\System32\tbssvc.dll
09:29:24.0889 0x0c38 TBS - ok
09:29:24.0982 0x0c38 [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
09:29:25.0076 0x0c38 Tcpip - ok
09:29:25.0169 0x0c38 [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
09:29:25.0247 0x0c38 TCPIP6 - ok
09:29:25.0279 0x0c38 [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
09:29:25.0325 0x0c38 tcpipreg - ok
09:29:25.0372 0x0c38 [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
09:29:25.0403 0x0c38 TDPIPE - ok
09:29:25.0435 0x0c38 [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
09:29:25.0466 0x0c38 TDTCP - ok
09:29:25.0513 0x0c38 [ 70988118145F5F10EF24720B97F35F65, F80C806417A68047FFB3D63214BC4AE5445315219AC594E043293006B704A63D ] tdx C:\Windows\system32\DRIVERS\tdx.sys
09:29:25.0559 0x0c38 tdx - ok
09:29:25.0591 0x0c38 [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD C:\Windows\system32\drivers\termdd.sys
09:29:25.0622 0x0c38 TermDD - ok
09:29:25.0669 0x0c38 [ 008CD4EBFABCF78D0F19B3778492648C, 9050490EEE0AD86E73F0A82D83E4FC29DF84F6B6FDB389AE135FD712B5F425BE ] TermService C:\Windows\System32\termsrv.dll
09:29:25.0731 0x0c38 TermService - ok
09:29:25.0762 0x0c38 [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes C:\Windows\system32\themeservice.dll
09:29:25.0809 0x0c38 Themes - ok
09:29:25.0840 0x0c38 [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER C:\Windows\system32\mmcss.dll
09:29:25.0903 0x0c38 THREADORDER - ok
09:29:25.0918 0x0c38 [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks C:\Windows\System32\trkwks.dll
09:29:25.0965 0x0c38 TrkWks - ok
09:29:26.0012 0x0c38 [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
09:29:26.0090 0x0c38 TrustedInstaller - ok
09:29:26.0152 0x0c38 [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
09:29:26.0183 0x0c38 tssecsrv - ok
09:29:26.0215 0x0c38 [ E9981ECE8D894CEF7038FD1D040EB426, DCDDCE933CAECE8180A3447199B07F2F0413704EEC1A09606EE357901A84A7CF ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
09:29:26.0261 0x0c38 TsUsbFlt - ok
09:29:26.0324 0x0c38 [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
09:29:26.0371 0x0c38 tunnel - ok
09:29:26.0402 0x0c38 [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys
09:29:26.0433 0x0c38 uagp35 - ok
09:29:26.0480 0x0c38 [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
09:29:26.0542 0x0c38 udfs - ok
09:29:26.0605 0x0c38 [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect C:\Windows\system32\UI0Detect.exe
09:29:26.0651 0x0c38 UI0Detect - ok
09:29:26.0698 0x0c38 [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
09:29:26.0729 0x0c38 uliagpkx - ok
09:29:26.0776 0x0c38 [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus C:\Windows\system32\drivers\umbus.sys
09:29:26.0807 0x0c38 umbus - ok
09:29:26.0839 0x0c38 [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass C:\Windows\system32\DRIVERS\umpass.sys
09:29:26.0885 0x0c38 UmPass - ok
09:29:26.0932 0x0c38 [ 9DC07E73A4ABB9ACF692113B36A5009F, CA7176FC219515D58DCFA66EC61880ECE5617275C9B83701BB74D8B60E733D34 ] UnlockerDriver5 C:\Program Files (x86)\Unlocker\UnlockerDriver5.sys
09:29:26.0963 0x0c38 UnlockerDriver5 - ok
09:29:27.0010 0x0c38 [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost C:\Windows\System32\upnphost.dll
09:29:27.0073 0x0c38 upnphost - ok
09:29:27.0104 0x0c38 [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
09:29:27.0151 0x0c38 usbccgp - ok
09:29:27.0197 0x0c38 [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir C:\Windows\system32\drivers\usbcir.sys
09:29:27.0244 0x0c38 usbcir - ok
09:29:27.0291 0x0c38 [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
09:29:27.0338 0x0c38 usbehci - ok
09:29:27.0385 0x0c38 [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
09:29:27.0431 0x0c38 usbhub - ok
09:29:27.0478 0x0c38 [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci C:\Windows\system32\drivers\usbohci.sys
09:29:27.0525 0x0c38 usbohci - ok
09:29:27.0572 0x0c38 [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
09:29:27.0619 0x0c38 usbprint - ok
09:29:27.0665 0x0c38 [ 9661DA76B4531B2DA272ECCE25A8AF24, FEA93254A21E71A7EB8AD35FCCAD2C1E41F7329EC33B1734F5B41307A34D8637 ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
09:29:27.0712 0x0c38 usbscan - ok
09:29:27.0743 0x0c38 [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
09:29:27.0790 0x0c38 USBSTOR - ok
09:29:27.0837 0x0c38 [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys
09:29:27.0868 0x0c38 usbuhci - ok
09:29:27.0884 0x0c38 [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms C:\Windows\System32\uxsms.dll
09:29:27.0946 0x0c38 UxSms - ok
09:29:27.0977 0x0c38 [ 9262D6E2C239EDD6D87B080F2BCCEC9F, 4947F2C3DD9D2D08CBB03FCA822C78B24F841464FF52FDBFF7D34AC7EB484104 ] VaultSvc C:\Windows\system32\lsass.exe
09:29:28.0009 0x0c38 VaultSvc - ok
09:29:28.0055 0x0c38 [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
09:29:28.0071 0x0c38 vdrvroot - ok
09:29:28.0133 0x0c38 [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds C:\Windows\System32\vds.exe
09:29:28.0211 0x0c38 vds - ok
09:29:28.0258 0x0c38 [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
09:29:28.0305 0x0c38 vga - ok
09:29:28.0336 0x0c38 [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave C:\Windows\System32\drivers\vga.sys
09:29:28.0383 0x0c38 VgaSave - ok
09:29:28.0430 0x0c38 [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
09:29:28.0461 0x0c38 vhdmp - ok
09:29:28.0508 0x0c38 [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide C:\Windows\system32\drivers\viaide.sys
09:29:28.0539 0x0c38 viaide - ok
09:29:28.0570 0x0c38 [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr C:\Windows\system32\drivers\volmgr.sys
09:29:28.0601 0x0c38 volmgr - ok
09:29:28.0648 0x0c38 [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
09:29:28.0679 0x0c38 volmgrx - ok
09:29:28.0726 0x0c38 [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap C:\Windows\system32\drivers\volsnap.sys
09:29:28.0757 0x0c38 volsnap - ok
09:29:28.0804 0x0c38 [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys
09:29:28.0851 0x0c38 vsmraid - ok
09:29:28.0929 0x0c38 [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS C:\Windows\system32\vssvc.exe
09:29:29.0023 0x0c38 VSS - ok
09:29:29.0069 0x0c38 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus C:\Windows\System32\drivers\vwifibus.sys
09:29:29.0116 0x0c38 vwifibus - ok
09:29:29.0163 0x0c38 [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time C:\Windows\system32\w32time.dll
09:29:29.0241 0x0c38 W32Time - ok
09:29:29.0288 0x0c38 [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys
09:29:29.0319 0x0c38 WacomPen - ok
09:29:29.0366 0x0c38 [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
09:29:29.0444 0x0c38 WANARP - ok
09:29:29.0475 0x0c38 [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
09:29:29.0522 0x0c38 Wanarpv6 - ok
09:29:29.0615 0x0c38 [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine C:\Windows\system32\wbengine.exe
09:29:29.0709 0x0c38 wbengine - ok
09:29:29.0771 0x0c38 [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
09:29:29.0803 0x0c38 WbioSrvc - ok
09:29:29.0849 0x0c38 [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc C:\Windows\System32\wcncsvc.dll
09:29:29.0912 0x0c38 wcncsvc - ok
09:29:29.0959 0x0c38 [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
09:29:30.0005 0x0c38 WcsPlugInService - ok
09:29:30.0052 0x0c38 [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd C:\Windows\system32\DRIVERS\wd.sys
09:29:30.0083 0x0c38 Wd - ok
09:29:30.0130 0x0c38 [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
09:29:30.0177 0x0c38 Wdf01000 - ok
09:29:30.0224 0x0c38 [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiServiceHost C:\Windows\system32\wdi.dll
09:29:30.0271 0x0c38 WdiServiceHost - ok
09:29:30.0302 0x0c38 [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiSystemHost C:\Windows\system32\wdi.dll
09:29:30.0333 0x0c38 WdiSystemHost - ok
09:29:30.0364 0x0c38 [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient C:\Windows\System32\webclnt.dll
09:29:30.0427 0x0c38 WebClient - ok
09:29:30.0458 0x0c38 [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc C:\Windows\system32\wecsvc.dll
09:29:30.0520 0x0c38 Wecsvc - ok
09:29:30.0551 0x0c38 [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport C:\Windows\System32\wercplsupport.dll
09:29:30.0614 0x0c38 wercplsupport - ok
09:29:30.0676 0x0c38 [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc C:\Windows\System32\WerSvc.dll
09:29:30.0754 0x0c38 WerSvc - ok
09:29:30.0785 0x0c38 [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
09:29:30.0832 0x0c38 WfpLwf - ok
09:29:30.0879 0x0c38 [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount C:\Windows\system32\drivers\wimmount.sys
09:29:30.0895 0x0c38 WIMMount - ok
09:29:30.0941 0x0c38 WinDefend - ok
09:29:30.0973 0x0c38 WinHttpAutoProxySvc - ok
09:29:31.0051 0x0c38 [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
09:29:31.0129 0x0c38 Winmgmt - ok
09:29:31.0207 0x0c38 [ D929ABD465A2DED963DA8B30946A8D5C, DE8DBFB01C11D2AE903CBD6A974D6F995E9813CE2D6484B7DA06EAE4C545842A ] WinRM C:\Windows\system32\WsmSvc.dll
09:29:31.0331 0x0c38 WinRM - ok
09:29:31.0441 0x0c38 [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb C:\Windows\system32\drivers\WinUsb.sys
09:29:31.0503 0x0c38 WinUsb - ok
09:29:31.0565 0x0c38 [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc C:\Windows\System32\wlansvc.dll
09:29:31.0643 0x0c38 Wlansvc - ok
09:29:31.0799 0x0c38 [ 357CABBF155AFD1D3926E62539D2A3A7, C43CFF84E7D930B4999DC061AB0766B57AAD7540B3E6EE54605B10ECE90825F5 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
09:29:31.0877 0x0c38 wlidsvc - ok
09:29:31.0924 0x0c38 [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
09:29:31.0955 0x0c38 WmiAcpi - ok
09:29:32.0002 0x0c38 [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
09:29:32.0065 0x0c38 wmiApSrv - ok
09:29:32.0096 0x0c38 WMPNetworkSvc - ok
09:29:32.0127 0x0c38 [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc C:\Windows\System32\wpcsvc.dll
09:29:32.0174 0x0c38 WPCSvc - ok
09:29:32.0221 0x0c38 [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
09:29:32.0267 0x0c38 WPDBusEnum - ok
09:29:32.0299 0x0c38 [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
09:29:32.0361 0x0c38 ws2ifsl - ok
09:29:32.0408 0x0c38 [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc C:\Windows\System32\wscsvc.dll
09:29:32.0439 0x0c38 wscsvc - ok
09:29:32.0455 0x0c38 WSearch - ok
09:29:32.0579 0x0c38 [ 0814A74C853F50B354F08F83DDA9F7FB, 0A63BAA8DE451B8C2C71FEF961718E769B9BAC305C76D24048C664CB27D0DF28 ] wuauserv C:\Windows\system32\wuaueng.dll
09:29:32.0735 0x0c38 wuauserv - ok
09:29:32.0798 0x0c38 [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
09:29:32.0845 0x0c38 WudfPf - ok
09:29:32.0907 0x0c38 [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd C:\Windows\system32\drivers\WUDFRd.sys
09:29:32.0954 0x0c38 WUDFRd - ok
09:29:32.0985 0x0c38 [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
09:29:33.0032 0x0c38 wudfsvc - ok
09:29:33.0094 0x0c38 [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc C:\Windows\System32\wwansvc.dll
09:29:33.0141 0x0c38 WwanSvc - ok
09:29:33.0172 0x0c38 ================ Scan global ===============================
09:29:33.0203 0x0c38 [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
09:29:33.0235 0x0c38 [ D17DD01601460F5899E5C154B3FD0BFA, B2FCFDE4B6F87634EA1F6D8AEA6D9B3C641D41D999C68B76F95491539B19D422 ] C:\Windows\system32\winsrv.dll
09:29:33.0250 0x0c38 [ D17DD01601460F5899E5C154B3FD0BFA, B2FCFDE4B6F87634EA1F6D8AEA6D9B3C641D41D999C68B76F95491539B19D422 ] C:\Windows\system32\winsrv.dll
09:29:33.0297 0x0c38 [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
09:29:33.0328 0x0c38 [ 71C85477DF9347FE8E7BC55768473FCA, A86D6A6D1F5A0EFCD649792A06F3AE9B37158D48493D2ECA7F52DCC1CB9B6536 ] C:\Windows\system32\services.exe
09:29:33.0328 0x0c38 [ Global ] - ok
09:29:33.0328 0x0c38 ================ Scan MBR ==================================
09:29:33.0359 0x0c38 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
09:29:33.0671 0x0c38 \Device\Harddisk0\DR0 - ok
09:29:33.0671 0x0c38 ================ Scan VBR ==================================
09:29:33.0671 0x0c38 [ 5E62F87F964BE1122AAF274369093795 ] \Device\Harddisk0\DR0\Partition1
09:29:33.0671 0x0c38 \Device\Harddisk0\DR0\Partition1 - ok
09:29:33.0703 0x0c38 [ 59184C30F3060DD278B0A37D89A295B6 ] \Device\Harddisk0\DR0\Partition2
09:29:33.0703 0x0c38 \Device\Harddisk0\DR0\Partition2 - ok
09:29:33.0703 0x0c38 [ B686D8C73A8F7D765DF9E1C3B3772B21 ] \Device\Harddisk0\DR0\Partition3
09:29:33.0749 0x0c38 \Device\Harddisk0\DR0\Partition3 - ok
09:29:33.0749 0x0c38 ================ Scan generic autorun ======================
09:29:33.0781 0x0c38 [ 92FDB0658CA16974B4AE80E248A5B118, 9E0CF6A9C845C5F9E4B80B9105DBECE15ACC27984FCBFD8774C00EBE20DB652F ] C:\Windows\system32\igfxtray.exe
09:29:33.0827 0x0c38 IgfxTray - ok
09:29:34.0155 0x0c38 [ 65C6AA484AD2287D20541C7735989437, 1842787640391F4A4CD9ED0A531298A61F4B2FB09BEC98FEE256313AFB458EDB ] C:\Program Files (x86)\AVAST Software\Avast\AvastUI.exe
09:29:34.0311 0x0c38 AvastUI.exe - ok
09:29:34.0576 0x0c38 [ 8FB1A3AB319F21CC8DB34198CB4A88E7, 2009DF76EF8356BCC1CA530CE8E1687B02C779CA51BCFDDFD7372E2E4CD19470 ] c:\program files (x86)\emsisoft anti-malware\a2guard.exe
09:29:34.0717 0x0c38 emsisoft anti-malware - ok
09:29:34.0795 0x0c38 [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
09:29:34.0857 0x0c38 Sidebar - ok
09:29:34.0904 0x0c38 [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
09:29:34.0951 0x0c38 mctadmin - ok
09:29:34.0997 0x0c38 [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
09:29:35.0060 0x0c38 Sidebar - ok
09:29:35.0060 0x0c38 [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
09:29:35.0107 0x0c38 mctadmin - ok
09:29:35.0107 0x0c38 Waiting for KSN requests completion. In queue: 306
09:29:36.0121 0x0c38 Waiting for KSN requests completion. In queue: 306
09:29:37.0135 0x0c38 Waiting for KSN requests completion. In queue: 306
09:29:38.0258 0x0c38 AV detected via SS2: avast! Antivirus, C:\Program Files (x86)\AVAST Software\Avast\VisthAux.exe ( 10.2.2218.942 ), 0x41000 ( enabled : updated )
09:29:38.0305 0x0c38 Win FW state via NFP2: enabled
09:29:40.0785 0x0c38 ============================================================
09:29:40.0785 0x0c38 Scan finished
09:29:40.0785 0x0c38 ============================================================
09:29:40.0801 0x00b0 Detected object count: 0
09:29:40.0801 0x00b0 Actual detected object count: 0
der PC Knecht |
|
05.06.2015, 19:44
| #7 |
| /// the machine /// TB-Ausbilder | PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 1 hi, Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
06.06.2015, 11:35
| #8 |
| | PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 1 Hallo, hier der log-file vom ComboFix Beim Start von ComboFix wurde angemeckert, dass AVIRA noch aktiviert wäre, obwohl ich alle Funktionen vorher deaktiviert habe. Also bin ich nochmal in AVIRA rein und hab alles abgeschaltet, was abzuschalten geht. Ich hoffe, das Ergebnis ist nun nicht zu sehr verfälscht. Code:
ATTFilter ComboFix 15-05-31.01 - Eltern 06.06.2015 12:07:38.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3062.1195 [GMT 2:00]
ausgeführt von:: c:\users\Eltern\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Enabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\7z.exe
c:\program files (x86)\CDex-win32-1.70-b4-2009.exe
c:\program files (x86)\forge-1.7.10-10.13.2.1230-installer-win.exe
c:\program files (x86)\mbam-setup-2.1.6.1022.exe
c:\program files (x86)\readme.txt
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-05-06 bis 2015-06-06 ))))))))))))))))))))))))))))))
.
.
2015-06-06 10:20 . 2015-06-06 10:20 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-06-06 10:11 . 2015-06-06 10:11 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0FF0215B-981F-41A8-A1AE-832EE26D0475}\offreg.3600.dll
2015-06-05 11:59 . 2015-05-03 03:16 12214312 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0FF0215B-981F-41A8-A1AE-832EE26D0475}\mpengine.dll
2015-06-05 06:37 . 2015-06-05 07:23 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2015-06-02 17:06 . 2015-06-02 17:06 -------- d-----w- c:\program files (x86)\ESET
2015-06-02 15:09 . 2015-06-02 15:12 -------- d-----w- C:\FRST
2015-06-02 12:26 . 2015-06-02 12:26 -------- d-----w- c:\users\Eltern\AppData\Local\GWX
2015-06-01 17:21 . 2009-08-18 09:44 67584 ----a-w- c:\windows\system32\RtNicProp64.dll
2015-06-01 17:21 . 2009-08-18 09:44 236544 ----a-w- c:\windows\system32\drivers\Rt64win7.sys
2015-06-01 17:21 . 2009-07-22 16:24 97792 ----a-w- c:\windows\system32\RTNUninst64.dll
2015-06-01 17:21 . 2015-06-01 17:21 -------- d-----w- c:\program files (x86)\Realtek
2015-05-27 10:08 . 2015-05-28 15:09 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird
2015-05-27 09:25 . 2015-05-27 09:25 -------- d-----w- c:\users\Eltern\AppData\Local\VS Revo Group
2015-05-27 09:25 . 2015-05-27 09:25 -------- d-----w- c:\programdata\VS Revo Group
2015-05-27 09:25 . 2009-12-30 08:21 31800 ----a-w- c:\windows\system32\drivers\revoflt.sys
2015-05-27 09:25 . 2015-05-27 09:25 -------- d-----w- c:\program files\VS Revo Group
2015-05-26 06:44 . 2015-05-26 06:44 -------- d-----w- c:\program files\avast software
2015-05-20 15:31 . 2015-01-31 03:48 3179520 ----a-w- c:\windows\system32\rdpcorets.dll
2015-05-20 15:31 . 2015-01-31 03:48 16384 ----a-w- c:\windows\system32\RdpGroupPolicyExtension.dll
2015-05-20 15:31 . 2015-01-30 23:56 243200 ----a-w- c:\windows\system32\rdpudd.dll
2015-05-20 15:30 . 2014-12-11 17:47 87040 ----a-w- c:\windows\system32\TSWbPrxy.exe
2015-05-19 18:02 . 2014-09-05 01:52 5703168 ----a-w- c:\windows\SysWow64\mstscax.dll
2015-05-19 18:01 . 2014-09-05 02:11 6584320 ----a-w- c:\windows\system32\mstscax.dll
2015-05-17 17:29 . 2015-05-17 17:29 -------- d-----w- c:\programdata\Emsisoft
2015-05-17 17:11 . 2015-03-23 22:17 135800 ----a-w- c:\windows\system32\drivers\epp64.sys
2015-05-17 17:11 . 2015-06-06 09:59 -------- d-----w- c:\program files (x86)\Emsisoft Anti-Malware
2015-05-17 13:55 . 2012-08-23 14:10 19456 ----a-w- c:\windows\system32\drivers\rdpvideominiport.sys
2015-05-17 13:55 . 2012-08-23 11:12 192000 ----a-w- c:\windows\SysWow64\rdpendp_winip.dll
2015-05-17 13:55 . 2012-08-23 10:51 228864 ----a-w- c:\windows\system32\rdpendp_winip.dll
2015-05-17 13:54 . 2015-03-14 03:21 82944 ----a-w- c:\windows\system32\dwmapi.dll
2015-05-17 13:54 . 2015-03-14 03:21 1632768 ----a-w- c:\windows\system32\dwmcore.dll
2015-05-17 13:54 . 2015-03-14 03:04 67584 ----a-w- c:\windows\SysWow64\dwmapi.dll
2015-05-17 13:54 . 2015-03-14 03:04 1372160 ----a-w- c:\windows\SysWow64\dwmcore.dll
2015-05-13 06:28 . 2015-05-01 13:17 124112 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 06:28 . 2015-05-01 13:16 102608 ----a-w- c:\windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 06:18 . 2015-04-13 03:28 328704 ----a-w- c:\windows\system32\services.exe
2015-05-13 06:17 . 2015-04-20 03:17 1647104 ----a-w- c:\windows\system32\DWrite.dll
2015-05-10 14:11 . 2015-05-10 14:11 -------- d-----w- c:\program files (x86)\PDF24
2015-05-10 14:08 . 2015-05-10 14:08 16342352 ----a-w- c:\program files (x86)\pdf24-creator-6.9.2.exe
2015-05-10 14:06 . 2015-05-10 14:06 -------- d-----w- c:\program files (x86)\Common Files\PDF Architect
2015-05-10 12:47 . 2015-05-10 13:06 -------- d-----w- c:\program files (x86)\Unlocker
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-06-06 09:54 . 2015-04-26 12:00 136408 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-06-05 06:34 . 2015-04-26 12:00 107736 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-05-13 06:32 . 2013-10-18 18:38 140425016 ----a-w- c:\windows\system32\MRT.exe
2015-05-13 05:57 . 2015-02-04 17:56 778416 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-05-13 05:57 . 2015-02-04 17:56 142512 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-05-04 16:49 . 2015-05-04 16:48 10457912 ----a-w- c:\program files (x86)\CMASetup.exe
2015-05-04 11:46 . 2015-04-26 14:08 137288 ----a-w- c:\windows\system32\drivers\aswStm.sys
2015-05-04 11:46 . 2015-04-26 14:08 272248 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2015-05-04 11:46 . 2015-05-04 11:46 364472 ----a-w- c:\windows\system32\aswBoot.exe
2015-05-04 11:46 . 2015-04-26 14:08 89944 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2015-05-04 11:46 . 2015-04-26 14:08 65736 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2015-05-04 11:46 . 2015-04-26 14:08 442264 ----a-w- c:\windows\system32\drivers\aswSP.sys
2015-05-04 11:46 . 2015-04-26 14:08 29168 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2015-05-04 11:46 . 2015-04-26 14:08 93528 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2015-05-04 11:45 . 2015-05-04 11:45 43112 ----a-w- c:\windows\avastSS.scr
2015-05-04 11:45 . 2015-04-26 14:08 1047320 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2015-04-27 19:04 . 2015-05-13 06:18 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2015-04-20 16:03 . 2015-04-20 15:59 190719264 ----a-w- c:\program files (x86)\DraftSight64.exe
2015-04-19 17:39 . 2015-04-19 17:39 35344 ----a-w- c:\windows\cc_20150419_193841_reg_datei.reg
2015-04-14 07:37 . 2015-04-26 12:00 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-04-14 07:37 . 2015-04-26 12:00 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-03-25 03:24 . 2015-04-15 14:54 98304 ----a-w- c:\windows\system32\wudriver.dll
2015-03-25 03:24 . 2015-04-15 14:54 37376 ----a-w- c:\windows\system32\wups2.dll
2015-03-25 03:24 . 2015-04-15 14:54 35328 ----a-w- c:\windows\system32\wups.dll
2015-03-25 03:24 . 2015-04-15 14:54 3298816 ----a-w- c:\windows\system32\wucltux.dll
2015-03-25 03:24 . 2015-04-15 14:54 2553856 ----a-w- c:\windows\system32\wuaueng.dll
2015-03-25 03:24 . 2015-04-15 14:54 191488 ----a-w- c:\windows\system32\wuwebv.dll
2015-03-25 03:24 . 2015-04-15 14:54 696320 ----a-w- c:\windows\system32\wuapi.dll
2015-03-25 03:24 . 2015-04-15 14:54 60416 ----a-w- c:\windows\system32\WinSetupUI.dll
2015-03-25 03:23 . 2015-04-15 14:54 12288 ----a-w- c:\windows\system32\wu.upgrade.ps.dll
2015-03-25 03:23 . 2015-04-15 14:54 36864 ----a-w- c:\windows\system32\wuapp.exe
2015-03-25 03:23 . 2015-04-15 14:54 135168 ----a-w- c:\windows\system32\wuauclt.exe
2015-03-25 03:00 . 2015-04-15 14:54 92672 ----a-w- c:\windows\SysWow64\wudriver.dll
2015-03-25 03:00 . 2015-04-15 14:54 566784 ----a-w- c:\windows\SysWow64\wuapi.dll
2015-03-25 03:00 . 2015-04-15 14:54 29696 ----a-w- c:\windows\SysWow64\wups.dll
2015-03-25 03:00 . 2015-04-15 14:54 173056 ----a-w- c:\windows\SysWow64\wuwebv.dll
2015-03-25 03:00 . 2015-04-15 14:54 33792 ----a-w- c:\windows\SysWow64\wuapp.exe
2015-03-23 03:25 . 2015-04-15 14:54 726528 ----a-w- c:\windows\system32\generaltel.dll
2015-03-23 03:25 . 2015-04-15 14:54 769536 ----a-w- c:\windows\system32\invagent.dll
2015-03-23 03:24 . 2015-04-15 14:54 419840 ----a-w- c:\windows\system32\devinv.dll
2015-03-23 03:24 . 2015-04-15 14:54 957952 ----a-w- c:\windows\system32\appraiser.dll
2015-03-23 03:24 . 2015-04-15 14:54 30720 ----a-w- c:\windows\system32\acmigration.dll
2015-03-23 03:24 . 2015-04-15 14:54 227328 ----a-w- c:\windows\system32\aepdu.dll
2015-03-23 03:24 . 2015-04-15 14:54 192000 ----a-w- c:\windows\system32\aepic.dll
2015-03-23 03:17 . 2015-04-15 14:54 1111552 ----a-w- c:\windows\system32\aeinv.dll
2015-03-10 03:25 . 2015-04-15 14:54 1882624 ----a-w- c:\windows\system32\msxml3.dll
2015-03-10 03:21 . 2015-04-15 14:54 2048 ----a-w- c:\windows\system32\msxml3r.dll
2015-03-10 03:08 . 2015-04-15 14:54 1237504 ----a-w- c:\windows\SysWow64\msxml3.dll
2015-03-10 03:05 . 2015-04-15 14:54 2048 ----a-w- c:\windows\SysWow64\msxml3r.dll
2015-01-03 10:29 . 2015-01-03 10:26 91670064 ----a-w- c:\program files (x86)\gimp-2.8.14-setup.exe
2014-12-26 16:06 . 2014-12-26 16:06 181760 ----a-w- c:\program files (x86)\7z.sfx
2014-12-26 16:06 . 2014-12-26 16:06 166400 ----a-w- c:\program files (x86)\7zCon.sfx
2014-12-26 16:00 . 2014-12-26 16:00 1508352 ----a-w- c:\program files (x86)\7z.dll
2014-12-26 15:50 . 2014-12-26 15:50 545792 ----a-w- c:\program files (x86)\7zG.exe
2014-12-26 15:50 . 2014-12-26 15:50 803328 ----a-w- c:\program files (x86)\7zFM.exe
2014-12-26 15:48 . 2014-12-26 15:48 80384 ----a-w- c:\program files (x86)\7-zip.dll
2014-12-26 15:48 . 2014-12-26 15:48 50176 ----a-w- c:\program files (x86)\7-zip32.dll
2014-11-07 11:28 . 2014-11-07 11:28 12436848 ----a-w- c:\program files (x86)\CitrixOnlinePluginWeb.exe
2014-08-22 06:11 . 2014-08-22 06:08 149527616 ----a-w- c:\program files (x86)\avira_free_antivirus_de_14.0.6.570.exe
2014-08-04 13:16 . 2014-08-04 13:16 10410712 ----a-w- c:\program files\CMASetup.exe
2014-02-17 18:22 . 2014-02-17 18:22 774144 ----a-w- c:\program files\NBTExplorer-2.7.0.msi
2014-02-17 16:56 . 2014-02-17 16:56 675988 ----a-w- c:\program files\Minecraft.exe
2014-02-15 17:34 . 2014-02-15 17:34 921000 ----a-w- c:\program files\jxpiinstall.exe
2013-10-15 14:49 . 2013-11-15 17:51 537818 ----a-w- c:\program files\pcwFixMyRights.exe
2013-10-14 23:28 . 2013-11-15 17:51 3294168 ----a-w- c:\program files\ccsetup406_slim.exe
2012-10-11 20:21 . 2013-11-15 17:51 11766024 ----a-w- c:\program files\epm911.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"="c:\program files (x86)\AVAST Software\Avast\AvastUI.exe" [2015-05-12 5515496]
"emsisoft anti-malware"="c:\program files (x86)\emsisoft anti-malware\a2guard.exe" [2015-05-26 4923832]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [x]
R3 BrYNSvc;BrYNSvc;c:\program files (x86)\Browny02\BrYNSvc.exe;c:\program files (x86)\Browny02\BrYNSvc.exe [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys;c:\windows\SYSNATIVE\epmntdrv.sys [x]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys;c:\windows\SYSNATIVE\EuGdiDrv.sys [x]
R3 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\users\Eltern\AppData\Local\Temp\HWiNFO64A.SYS;c:\users\Eltern\AppData\Local\Temp\HWiNFO64A.SYS [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys;c:\windows\SYSNATIVE\DRIVERS\revoflt.sys [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys;c:\windows\SYSNATIVE\DRIVERS\ssadserd.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R4 PDFProFiltSrvPP;PDFProFiltSrvPP;c:\program files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe;c:\program files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys;c:\windows\SYSNATIVE\DRIVERS\ctxusbm.sys [x]
S1 epp64;epp64;c:\windows\system32\DRIVERS\epp64.sys;c:\windows\SYSNATIVE\DRIVERS\epp64.sys [x]
S2 a2AntiMalware;Emsisoft Protection Service;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe [x]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S3 BrSerIb;Brother Serial Interface Driver(WDM);c:\windows\system32\DRIVERS\BrSerIb.sys;c:\windows\SYSNATIVE\DRIVERS\BrSerIb.sys [x]
S3 BrUsbSIb;Brother Serial USB Driver(WDM);c:\windows\system32\DRIVERS\BrUsbSIb.sys;c:\windows\SYSNATIVE\DRIVERS\BrUsbSIb.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2015-05-04 11:46 722400 ----a-w- c:\program files (x86)\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 165912]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://www.google.de/
mDefault_Search_URL = about:blank
mDefault_Page_URL = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = about:blank
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Eltern\AppData\Roaming\Mozilla\Firefox\Profiles\myv9y403.default-1432651667587\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2127788250-3807647062-608468377-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (S-1-5-21-2127788250-3807647062-608468377-1000)
@Denied: (2) (LocalSystem)
"Progid"="ThunderbirdEML"
.
[HKEY_USERS\S-1-5-21-2127788250-3807647062-608468377-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-06-06 12:24:47
ComboFix-quarantined-files.txt 2015-06-06 10:24
.
Vor Suchlauf: 13 Verzeichnis(se), 19.671.588.864 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 19.627.470.848 Bytes frei
.
- - End Of File - - 249AB5817D8ACA67F3184C7E852D3EA7
A36C5E4F47E84449FF07ED3517B43A31
PC Knecht |
|
07.06.2015, 09:25
| #9 |
| /// the machine /// TB-Ausbilder | PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 1 Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.06.2015, 12:49
| #10 |
| | PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 1 Hallo Schrauber, hier die mbam.txt Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 07.06.2015 Suchlauf-Zeit: 12:08:55 Logdatei: MBAM_07062015.txt Administrator: Ja Version: 2.01.6.1022 Malware Datenbank: v2015.06.07.02 Rootkit Datenbank: v2015.06.02.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Eltern Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 362498 Verstrichene Zeit: 31 Min, 12 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 0 (Keine schädliche Elemente gefunden) Registrierungswerte: 0 (Keine schädliche Elemente gefunden) Registrierungsdaten: 0 (Keine schädliche Elemente gefunden) Ordner: 0 (Keine schädliche Elemente gefunden) Dateien: 0 (Keine schädliche Elemente gefunden) Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) Code:
ATTFilter # AdwCleaner v4.206 - Bericht erstellt 07/06/2015 um 12:47:59
# Aktualisiert 01/06/2015 von Xplode
# Datenbank : 2015-06-05.1 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : Eltern - ELTERN-PC
# Gestarted von : C:\Users\Eltern\Downloads\AdwCleaner_4.206.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17801
-\\ Mozilla Firefox v38.0.5 (x86 de)
*************************
AdwCleaner[R0].txt - [1764 Bytes] - [26/04/2015 13:54:48]
AdwCleaner[R1].txt - [913 Bytes] - [26/04/2015 13:59:04]
AdwCleaner[R2].txt - [1185 Bytes] - [14/05/2015 19:50:06]
AdwCleaner[R3].txt - [1092 Bytes] - [07/06/2015 12:46:14]
AdwCleaner[S0].txt - [1645 Bytes] - [26/04/2015 13:56:30]
AdwCleaner[S1].txt - [1245 Bytes] - [14/05/2015 19:54:40]
AdwCleaner[S2].txt - [1013 Bytes] - [07/06/2015 12:47:59]
########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1072 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.8.9 (06.06.2015:1)
OS: Windows 7 Home Premium x64
Ran by Eltern on 07.06.2015 at 13:21:46,01
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Folder] C:\Users\Eltern\appdata\local\crashrpt
~~~ FireFox
Emptied folder: C:\Users\Eltern\AppData\Roaming\mozilla\firefox\profiles\myv9y403.default-1432651667587\minidumps [1 files]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 07.06.2015 at 13:30:27,99
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:06-06-2015
Ran by Eltern (administrator) on ELTERN-PC on 07-06-2015 13:41:57
Running from C:\Users\Eltern\Desktop
Loaded Profiles: Eltern (Available Profiles: Eltern)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Emsisoft Ltd) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(Avast Software s.r.o.) C:\Program Files (x86)\AVAST Software\Avast\AvastSvc.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files (x86)\AVAST Software\Avast\AvastUI.exe [5515496 2015-05-12] (Avast Software s.r.o.)
HKLM-x32\...\Run: [emsisoft anti-malware] => c:\program files (x86)\emsisoft anti-malware\a2guard.exe [4923832 2015-05-26] (Emsisoft Ltd)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files (x86)\AVAST Software\Avast\ashShA64.dll [2015-05-04] (Avast Software s.r.o.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-2127788250-3807647062-608468377-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files (x86)\AVAST Software\Avast\aswWebRepIE64.dll [2015-05-04] (Avast Software s.r.o.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll [2009-02-06] (Zeon Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files (x86)\AVAST Software\Avast\aswWebRepIE.dll [2015-05-04] (Avast Software s.r.o.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-03-11] (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-03-11] (Citrix Systems, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Eltern\AppData\Roaming\Mozilla\Firefox\Profiles\myv9y403.default-1432651667587
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-13] ()
FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-13] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Extension: Adblock Plus - C:\Users\Eltern\AppData\Roaming\Mozilla\Firefox\Profiles\myv9y403.default-1432651667587\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-05-26]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files (x86)\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files (x86)\AVAST Software\Avast\WebRep\FF [2015-04-26]
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files (x86)\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-26]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [5155576 2015-05-26] (Emsisoft Ltd)
R2 avast! Antivirus; C:\Program Files (x86)\AVAST Software\Avast\AvastSvc.exe [343336 2015-05-04] (Avast Software s.r.o.)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112 2013-09-25] (Brother Industries, Ltd.) [File not signed]
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S4 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [145256 2011-08-02] (Nuance Communications, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-05-04] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-05-04] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-05-04] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-05-04] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-05-04] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-05-04] (Avast Software s.r.o.)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-05-04] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-05-04] ()
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2011-07-29] () [File not signed]
S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [14216 2011-07-29] () [File not signed]
R1 epp64; C:\Windows\System32\DRIVERS\epp64.sys [135800 2015-03-24] (Emsisoft GmbH)
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2011-07-29] () [File not signed]
S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [8456 2011-07-29] () [File not signed]
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 HWiNFO32; \??\C:\Users\Eltern\AppData\Local\Temp\HWiNFO64A.SYS [X]
S3 SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP6\WNt500x64\Sandra.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-07 13:41 - 2015-06-07 13:42 - 00009239 _____ C:\Users\Eltern\Desktop\FRST.txt
2015-06-07 13:38 - 2015-06-07 13:38 - 02108928 _____ (Farbar) C:\Users\Eltern\Desktop\FRST64.exe
2015-06-07 13:37 - 2015-06-07 13:37 - 00000000 ____D C:\Users\Eltern\Desktop\Virenreiniung
2015-06-07 13:30 - 2015-06-07 13:30 - 00000820 _____ C:\Users\Eltern\Desktop\JRT.txt
2015-06-07 13:21 - 2015-06-07 13:21 - 00000207 _____ C:\Windows\tweaking.com-regbackup-ELTERN-PC-Windows-7-Home-Premium-(64-bit).dat
2015-06-07 13:21 - 2015-06-07 13:21 - 00000000 ____D C:\RegBackup
2015-06-07 12:58 - 2015-06-07 12:58 - 02942406 _____ (Thisisu) C:\Users\Eltern\Desktop\JRT.exe
2015-06-07 12:52 - 2015-06-07 12:52 - 00001152 _____ C:\Users\Eltern\Desktop\AdwCleaner[S2].txt
2015-06-07 12:44 - 2015-06-07 12:45 - 02231296 _____ C:\Users\Eltern\Downloads\AdwCleaner_4.206.exe
2015-06-07 12:42 - 2015-06-07 12:42 - 00001219 _____ C:\Users\Eltern\Desktop\MBAM_07062015.txt
2015-06-06 12:24 - 2015-06-06 12:24 - 00017628 _____ C:\ComboFix.txt
2015-06-06 12:05 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2015-06-06 12:05 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2015-06-06 12:05 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-06-06 12:05 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-06-06 12:05 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-06-06 12:05 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2015-06-06 12:05 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2015-06-06 12:05 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2015-06-06 12:01 - 2015-06-06 12:24 - 00000000 ____D C:\Qoobox
2015-06-06 12:01 - 2015-06-06 12:22 - 00000000 ____D C:\Windows\erdnt
2015-06-06 11:33 - 2015-06-06 11:33 - 05628238 ____R (Swearware) C:\Users\Eltern\Desktop\ComboFix.exe
2015-06-05 08:37 - 2015-06-05 09:23 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-06-05 08:32 - 2015-06-05 08:32 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Eltern\Downloads\mbar-1.09.1.1004.exe
2015-06-03 11:26 - 2015-06-03 16:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-06-02 19:06 - 2015-06-02 19:06 - 00000000 ____D C:\Program Files (x86)\ESET
2015-06-02 19:05 - 2015-06-02 19:05 - 02870984 _____ (ESET) C:\Users\Eltern\Downloads\esetsmartinstaller_deu.exe
2015-06-02 17:09 - 2015-06-07 13:41 - 00000000 ____D C:\FRST
2015-06-02 17:04 - 2015-06-02 17:04 - 00000000 _____ C:\Users\Eltern\defogger_reenable
2015-06-02 14:26 - 2015-06-02 14:26 - 00000000 ____D C:\Users\Eltern\AppData\Local\GWX
2015-06-01 19:21 - 2015-06-01 19:21 - 00000000 ____D C:\Program Files (x86)\Realtek
2015-06-01 19:21 - 2009-08-18 11:44 - 00236544 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys
2015-06-01 19:21 - 2009-08-18 11:44 - 00067584 _____ C:\Windows\system32\RtNicProp64.dll
2015-06-01 19:21 - 2009-07-22 18:24 - 00097792 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll
2015-06-01 16:49 - 2015-06-01 16:49 - 00000000 ____D C:\Users\Eltern\Documents\hw64_462-1
2015-05-27 12:08 - 2015-05-28 17:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2015-05-27 11:25 - 2015-05-27 11:25 - 00001051 _____ C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
2015-05-27 11:25 - 2015-05-27 11:25 - 00001051 _____ C:\ProgramData\Desktop\Revo Uninstaller Pro.lnk
2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D C:\Users\Eltern\AppData\Local\VS Revo Group
2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D C:\ProgramData\VS Revo Group
2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D C:\Program Files\VS Revo Group
2015-05-27 11:25 - 2009-12-30 10:21 - 00031800 _____ (VS Revo Group) C:\Windows\system32\Drivers\revoflt.sys
2015-05-27 11:17 - 2015-05-27 11:18 - 10801480 _____ (VS Revo Group ) C:\Users\Eltern\Downloads\RevoUninProSetup-312.exe
2015-05-26 16:47 - 2015-05-26 16:47 - 00000000 ____D C:\Users\Eltern\Desktop\Alte Firefox-Daten
2015-05-26 16:44 - 2015-05-26 16:44 - 00494857 _____ C:\Users\Eltern\Desktop\bookmarks.html
2015-05-26 08:44 - 2015-05-26 08:44 - 00000000 ____D C:\Program Files\avast software
2015-05-20 17:31 - 2015-01-31 05:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-05-20 17:31 - 2015-01-31 05:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-05-20 17:31 - 2015-01-31 01:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-05-20 17:30 - 2014-12-11 19:47 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-05-19 20:02 - 2014-09-05 03:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-05-19 20:01 - 2014-09-05 04:11 - 06584320 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-05-17 19:29 - 2015-05-17 19:29 - 00000000 ____D C:\ProgramData\Emsisoft
2015-05-17 19:11 - 2015-06-07 13:30 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware
2015-05-17 19:11 - 2015-05-17 19:11 - 00001105 _____ C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2015-05-17 19:11 - 2015-05-17 19:11 - 00001105 _____ C:\ProgramData\Desktop\Emsisoft Anti-Malware.lnk
2015-05-17 19:11 - 2015-05-17 19:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2015-05-17 19:11 - 2015-03-24 00:17 - 00135800 _____ (Emsisoft GmbH) C:\Windows\system32\Drivers\epp64.sys
2015-05-17 19:01 - 2015-05-17 19:10 - 161426392 _____ (Emsisoft Ltd. ) C:\Users\Eltern\Downloads\emsisoftantimalwaresetup.exe
2015-05-17 17:22 - 2015-05-17 17:22 - 21545848 _____ (Malwarebytes Corporation ) C:\Users\Eltern\Downloads\Anti-Malware.exe
2015-05-17 15:56 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2015-05-17 15:56 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2015-05-17 15:56 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2015-05-17 15:56 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2015-05-17 15:56 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2015-05-17 15:56 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2015-05-17 15:56 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2015-05-17 15:56 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2015-05-17 15:56 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2015-05-17 15:56 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2015-05-17 15:56 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2015-05-17 15:56 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2015-05-17 15:56 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2015-05-17 15:56 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2015-05-17 15:56 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2015-05-17 15:55 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2015-05-17 15:55 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2015-05-17 15:55 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2015-05-17 15:54 - 2015-03-14 05:21 - 01632768 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-05-17 15:54 - 2015-03-14 05:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-05-17 15:54 - 2015-03-14 05:04 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-05-17 15:54 - 2015-03-14 05:04 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-05-17 13:56 - 2015-05-17 10:57 - 00008969 _____ C:\Users\Eltern\Documents\Arbeitszeitreduzierung.tmd
2015-05-14 19:49 - 2015-05-14 19:49 - 02209792 _____ C:\Users\Eltern\Downloads\adwcleaner_4.204.exe
2015-05-13 08:28 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 08:28 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 08:19 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 08:19 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-13 08:19 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 08:19 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-13 08:19 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 08:19 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 08:19 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 08:19 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 08:19 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 08:19 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 08:19 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 08:19 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 08:19 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 08:19 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 08:19 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 08:19 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 08:19 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 08:19 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 08:19 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 08:19 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 08:19 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 08:19 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 08:19 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-13 08:19 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-13 08:19 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 08:19 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 08:19 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-13 08:19 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-13 08:19 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-13 08:19 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-13 08:19 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 08:19 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 08:19 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-13 08:19 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 08:19 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-13 08:19 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-13 08:19 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-13 08:19 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-13 08:19 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-13 08:19 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-13 08:19 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-13 08:19 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 08:19 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 08:19 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-13 08:19 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 08:19 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 08:19 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-13 08:19 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 08:19 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-13 08:19 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-13 08:19 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-13 08:19 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-13 08:19 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 08:19 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-13 08:19 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-13 08:19 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-13 08:19 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-13 08:19 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 08:19 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 08:19 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-13 08:19 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-13 08:19 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-13 08:19 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 08:19 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-13 08:18 - 2015-04-27 21:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-13 08:18 - 2015-04-27 21:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 08:18 - 2015-04-27 21:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 08:18 - 2015-04-27 21:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-05-13 08:18 - 2015-04-27 21:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-13 08:18 - 2015-04-27 21:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 08:18 - 2015-04-27 21:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 08:18 - 2015-04-27 21:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-05-13 08:18 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-05-13 08:18 - 2015-04-27 21:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-05-13 08:18 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-05-13 08:18 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-13 08:18 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-05-13 08:18 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-05-13 08:18 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-05-13 08:18 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-05-13 08:18 - 2015-04-27 21:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-05-13 08:18 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-13 08:18 - 2015-04-27 21:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-05-13 08:18 - 2015-04-27 21:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-05-13 08:18 - 2015-04-27 21:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-13 08:18 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-13 08:18 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-05-13 08:18 - 2015-04-27 21:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-05-13 08:18 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-13 08:18 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-13 08:18 - 2015-04-27 19:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-05-13 08:18 - 2015-04-27 19:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-05-13 08:18 - 2015-04-27 19:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-05-13 08:18 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 08:17 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 08:17 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 08:17 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-13 08:17 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 08:17 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 08:17 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 08:17 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-13 08:17 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-13 08:17 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-13 08:17 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-13 08:17 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-13 08:17 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-05-13 08:17 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-05-13 08:17 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-13 08:17 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-13 08:17 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 08:17 - 2015-01-29 05:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-13 08:17 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-10 16:11 - 2015-05-10 16:11 - 00001093 _____ C:\Users\Public\Desktop\PDF24 Creator.lnk
2015-05-10 16:11 - 2015-05-10 16:11 - 00001093 _____ C:\ProgramData\Desktop\PDF24 Creator.lnk
2015-05-10 16:11 - 2015-05-10 16:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
2015-05-10 16:11 - 2015-05-10 16:11 - 00000000 ____D C:\Program Files (x86)\PDF24
2015-05-10 16:08 - 2015-05-10 16:08 - 16342352 _____ (Geek Software GmbH ) C:\Program Files (x86)\pdf24-creator-6.9.2.exe
2015-05-10 15:30 - 2015-05-10 15:31 - 27837984 _____ (pdfforge ) C:\Users\Eltern\Downloads\PDFCreator-2_1_1-setup.exe
2015-05-10 15:06 - 2015-05-10 15:06 - 00000000 ____D C:\Users\Eltern\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker
2015-05-10 14:47 - 2015-05-10 15:06 - 00000000 ____D C:\Program Files (x86)\Unlocker
2015-05-10 13:14 - 2015-05-10 13:14 - 00001138 _____ C:\Users\Eltern\Desktop\PK.vbs
2015-05-10 10:50 - 2015-05-10 10:50 - 00002562 _____ C:\Windows\diagwrn.xml
2015-05-10 10:50 - 2015-05-10 10:50 - 00001908 _____ C:\Windows\diagerr.xml
2015-05-09 14:08 - 2015-05-10 15:27 - 00000000 ____D C:\Windows\pss
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-07 13:20 - 2015-04-26 14:00 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-07 13:00 - 2009-07-14 06:45 - 00023168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-07 13:00 - 2009-07-14 06:45 - 00023168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-07 12:55 - 2013-10-14 21:23 - 01949560 _____ C:\Windows\WindowsUpdate.log
2015-06-07 12:50 - 2015-04-19 19:41 - 00005509 _____ C:\Windows\setupact.log
2015-06-07 12:50 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-07 12:48 - 2015-04-26 13:54 - 00000000 ____D C:\AdwCleaner
2015-06-06 17:57 - 2015-04-26 16:08 - 00004194 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2015-06-06 17:55 - 2015-04-26 13:57 - 00010678 _____ C:\Windows\PFRO.log
2015-06-06 12:59 - 2013-10-14 21:31 - 00000000 ____D C:\Users\Eltern
2015-06-06 12:20 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2015-06-05 08:34 - 2015-04-26 14:00 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-03 16:27 - 2013-10-14 23:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-06-02 16:29 - 2013-10-14 23:52 - 00000000 ____D C:\Users\Eltern\AppData\Roaming\vlc
2015-06-02 15:14 - 2009-07-14 19:58 - 00699416 _____ C:\Windows\system32\perfh007.dat
2015-06-02 15:14 - 2009-07-14 19:58 - 00149556 _____ C:\Windows\system32\perfc007.dat
2015-06-02 15:14 - 2009-07-14 07:13 - 01620612 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-02 10:20 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2015-06-01 19:21 - 2014-06-25 19:42 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-05-30 19:17 - 2014-06-25 19:46 - 00007887 _____ C:\Windows\BRRBCOM.INI
2015-05-30 18:44 - 2013-10-15 14:51 - 00000000 ____D C:\Windows\rescache
2015-05-28 11:06 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2015-05-27 12:03 - 2013-10-17 00:31 - 01593956 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-05-20 18:32 - 2015-04-04 12:12 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-05-20 18:32 - 2015-04-04 12:12 - 00000000 ___SD C:\Windows\system32\GWX
2015-05-17 17:54 - 2015-04-26 14:00 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-05-17 16:04 - 2009-07-14 05:20 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-05-17 16:01 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-05-16 09:18 - 2013-10-17 21:16 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-14 20:46 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\Resources
2015-05-13 14:17 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-05-13 10:45 - 2009-07-14 06:45 - 00287472 _____ C:\Windows\system32\FNTCACHE.DAT
2015-05-13 10:42 - 2013-11-15 19:52 - 00000000 ____D C:\Program Files\Windows Journal
2015-05-13 10:42 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2015-05-13 08:35 - 2013-10-18 20:38 - 00000000 ____D C:\Windows\system32\MRT
2015-05-13 08:32 - 2013-10-18 20:38 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-13 07:57 - 2015-02-04 19:56 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-13 07:57 - 2015-02-04 19:56 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-10 10:50 - 2015-04-19 19:41 - 00000000 _____ C:\Windows\setuperr.log
==================== Files in the root of some directories =======
2013-11-15 19:51 - 2013-10-15 01:28 - 3294168 _____ (Piriform Ltd) C:\Program Files\ccsetup406_slim.exe
2014-08-04 15:16 - 2014-08-04 15:16 - 10410712 _____ (Sony Computer Entertainment Inc. ) C:\Program Files\CMASetup.exe
2013-11-15 19:51 - 2012-10-11 22:21 - 11766024 _____ (EASEUS ) C:\Program Files\epm911.exe
2014-02-15 19:34 - 2014-02-15 19:34 - 0921000 _____ (Oracle Corporation) C:\Program Files\jxpiinstall.exe
2014-02-17 18:56 - 2014-02-17 18:56 - 0675988 _____ () C:\Program Files\Minecraft.exe
2014-02-17 20:22 - 2014-02-17 20:22 - 0774144 _____ () C:\Program Files\NBTExplorer-2.7.0.msi
2013-11-15 19:51 - 2013-10-15 16:49 - 0537818 _____ (IDG Magazine Media GmbH ) C:\Program Files\pcwFixMyRights.exe
2014-12-26 17:14 - 2014-12-26 17:14 - 0095662 _____ () C:\Program Files (x86)\7-zip.chm
2014-12-26 17:48 - 2014-12-26 17:48 - 0080384 _____ (Igor Pavlov) C:\Program Files (x86)\7-zip.dll
2014-12-26 17:48 - 2014-12-26 17:48 - 0050176 _____ (Igor Pavlov) C:\Program Files (x86)\7-zip32.dll
2014-12-26 18:00 - 2014-12-26 18:00 - 1508352 _____ (Igor Pavlov) C:\Program Files (x86)\7z.dll
2014-12-26 18:06 - 2014-12-26 18:06 - 0181760 _____ (Igor Pavlov) C:\Program Files (x86)\7z.sfx
2014-12-26 18:06 - 2014-12-26 18:06 - 0166400 _____ (Igor Pavlov) C:\Program Files (x86)\7zCon.sfx
2014-12-26 17:50 - 2014-12-26 17:50 - 0803328 _____ (Igor Pavlov) C:\Program Files (x86)\7zFM.exe
2014-12-26 17:50 - 2014-12-26 17:50 - 0545792 _____ (Igor Pavlov) C:\Program Files (x86)\7zG.exe
2014-08-22 08:08 - 2014-08-22 08:11 - 149527616 _____ () C:\Program Files (x86)\avira_free_antivirus_de_14.0.6.570.exe
2014-11-07 13:28 - 2014-11-07 13:28 - 12436848 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\CitrixOnlinePluginWeb.exe
2015-05-04 18:48 - 2015-05-04 18:49 - 10457912 _____ (Sony Computer Entertainment Inc. ) C:\Program Files (x86)\CMASetup.exe
2011-04-04 17:54 - 2011-04-04 17:54 - 0000366 _____ () C:\Program Files (x86)\descript.ion
2015-04-20 17:59 - 2015-04-20 18:03 - 190719264 _____ (Microsoft Corporation) C:\Program Files (x86)\DraftSight64.exe
2015-01-03 12:26 - 2015-01-03 12:29 - 91670064 _____ (The GIMP Team ) C:\Program Files (x86)\gimp-2.8.14-setup.exe
2014-12-26 18:06 - 2014-12-26 18:06 - 0040769 _____ () C:\Program Files (x86)\History.txt
2014-06-12 22:02 - 2014-06-12 22:02 - 0001927 _____ () C:\Program Files (x86)\License.txt
2015-05-10 16:08 - 2015-05-10 16:08 - 16342352 _____ (Geek Software GmbH ) C:\Program Files (x86)\pdf24-creator-6.9.2.exe
2015-01-07 21:39 - 2015-01-07 21:39 - 0001551 _____ () C:\Users\Eltern\AppData\Local\recently-used.xbel
Some files in TEMP:
====================
C:\Users\Eltern\AppData\Local\Temp\Quarantine.exe
C:\Users\Eltern\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-06-05 15:47
==================== End of log ============================
[CODE]Additional FRST Logfile: Code:
ATTFilter scan result of Farbar Recovery Scan Tool (x64) Version:06-06-2015
Ran by Eltern at 2015-06-07 13:42:55
Running from C:\Users\Eltern\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-2127788250-3807647062-608468377-500 - Administrator - Disabled)
Eltern (S-1-5-21-2127788250-3807647062-608468377-1000 - Administrator - Enabled) => C:\Users\Eltern
Gast (S-1-5-21-2127788250-3807647062-608468377-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2127788250-3807647062-608468377-1002 - Limited - Enabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AV: Emsisoft Anti-Malware (Disabled - Up to date) {2F44E1F9-850B-1C7A-0E56-EB2E0A3E20C9}
AS: Emsisoft Anti-Malware (Disabled - Up to date) {9425001D-A331-13F4-34E6-D05C71B96A74}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.36 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0936-000001000000}) (Version: 9.36.00.0 - Igor Pavlov)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
Amazon Music (HKU\S-1-5-21-2127788250-3807647062-608468377-1000\...\Amazon Amazon Music) (Version: 3.7.1.698 - Amazon Services LLC)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.2.2218 - AVAST Software)
Brother MFL-Pro Suite MFC-J245 (HKLM-x32\...\{B742757A-7658-4E09-A51A-085CF0F7F4D3}) (Version: 1.0.0.0 - Brother Industries, Ltd.)
CDex - Open Source Digital Audio CD Extractor (HKLM-x32\...\CDex) (Version: 1.70.4.2009 - Georgy Berdyshev)
Citrix Online Plug-in - Web (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 12.0.0.6410 - Citrix Systems, Inc.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DriveImage XML (Private Edition) (HKLM-x32\...\{F7E1CA14-B39D-452A-960B-39423DDDD933}) (Version: 2.44.000 - Runtime Software)
EASEUS Partition Master 9.1.1 Home Edition (HKLM-x32\...\EASEUS Partition Master Home Edition_is1) (Version: - EASEUS)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 16.0.20150211 - Landesfinanzdirektion Thüringen)
Emsisoft Anti-Malware (HKLM-x32\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 10.0 - Emsisoft Ltd.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
Free YouTube to MP3 Converter version 3.12.54.128 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.54.128 - DVDVideoSoft Ltd.)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Inhaltsmanager-Assistent für PlayStation(R) (HKLM-x32\...\{961D5D7E-3DEC-4E3B-9065-EA8074923B18}) (Version: 3.31.7643.1 - Sony Computer Entertainment Inc.)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mozilla Firefox 38.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.5 (x86 de)) (Version: 38.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 37.0.2 - Mozilla)
Mozilla Thunderbird 31.7.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.7.0 (x86 de)) (Version: 31.7.0 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
NBTExplorer (HKLM-x32\...\{273D5BF1-EC9C-4549-880D-D8C293296A36}) (Version: 2.7.0.0 - Justin Aquadro)
Nuance PaperPort 12 (HKLM-x32\...\{869FCC6C-5669-4B0B-827E-2BBAACD88A87}) (Version: 12.1.0006 - Nuance Communications, Inc.)
Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc)
PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 14.00.0000 - Nuance Communications, Inc.)
PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
Pusteblume Sachunterricht 3 (HKLM-x32\...\Pusteblume Sachunterricht 3) (Version: - Bildungshaus Schulbuchverlage Westermann Schroedel Diesterweg Schöningh Winklers GmbH)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0008 - Realtek)
Revo Uninstaller Pro 3.1.2 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.1.2 - VS Revo Group, Ltd.)
Scansoft PDF Professional (x32 Version: - ) Hidden
SoftMaker FreeOffice (HKLM-x32\...\{8EBB8452-274B-465D-8324-00B0832FBB02}) (Version: 1.0.3395 - SoftMaker Software GmbH)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Restore Points =========================
05-06-2015 13:58:00 Windows Update
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2015-06-06 12:20 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0051A1AD-0606-4209-BFFE-5DC7ED6C9B20} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-07] (Microsoft Corporation)
Task: {2A8DE333-7E1A-413D-A3F3-B61EDE484B8C} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: {2F1A7095-145D-4C60-A610-DAACD9B595A9} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {31E02CA9-C51E-4460-BA97-B7E21A651C34} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {50535350-84E1-4323-9DDE-0CD437D0DE7A} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {C16F411F-5A38-4010-8311-B2469B0D6545} - System32\Tasks\avast! Emergency Update => C:\Program Files (x86)\AVAST Software\Avast\AvastEmUpdate.exe [2015-05-04] (Avast Software s.r.o.)
Task: {FE44BCD0-794F-4565-A45A-58A9B824A0F2} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
==================== Loaded Modules (Whitelisted) ==============
2015-05-04 13:45 - 2015-05-04 13:45 - 00104400 _____ () C:\Program Files (x86)\AVAST Software\Avast\log.dll
2015-05-04 13:45 - 2015-05-04 13:45 - 00081728 _____ () C:\Program Files (x86)\AVAST Software\Avast\JsonRpcServer.dll
2015-06-07 11:31 - 2015-06-07 11:31 - 02952192 _____ () C:\Program Files (x86)\AVAST Software\Avast\defs\15060700\algo.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Eltern\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\Services: PDFProFiltSrvPP => 2
MSCONFIG\Services: wscsvc => 2
MSCONFIG\Services: WSearch => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Inhaltsmanager-Assistent für PlayStation(R).lnk => C:\Windows\pss\Inhaltsmanager-Assistent für PlayStation(R).lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Amazon Music => "C:\Users\Eltern\AppData\Local\Amazon Music\Amazon Music Helper.exe"
MSCONFIG\startupreg: BrHelp => C:\Program Files (x86)\Brother\Brother Help\BrotherHelp.exe /AUTORUN
MSCONFIG\startupreg: BrStsMon00 => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN
MSCONFIG\startupreg: ConnectionCenter => "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup
MSCONFIG\startupreg: ControlCenter4 => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe /autorun
MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe
MSCONFIG\startupreg: IndexSearch => "C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe"
MSCONFIG\startupreg: ISUSPM => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
MSCONFIG\startupreg: PaperPort PTD => "C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe"
MSCONFIG\startupreg: PDF5 Registry Controller => C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe
MSCONFIG\startupreg: PDFHook => C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe
MSCONFIG\startupreg: PDFPrint => C:\Program Files (x86)\PDF24\pdf24.exe
MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{1B5878FA-F799-4C68-A2DA-8E7A57B40EFB}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{AF0730C6-8801-41FD-9979-03A14518E175}] => (Allow) LPort=2869
FirewallRules: [{639EFFE0-6DC2-43C2-A676-855C8FEF6F89}] => (Allow) LPort=1900
FirewallRules: [TCP Query User{7A9608B7-A0ED-423F-BE89-7991B131A01B}C:\program files\videolan\vlc\vlc.exe] => (Block) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [UDP Query User{BA917422-0A70-45A0-88FF-CEA25E4D4AA8}C:\program files\videolan\vlc\vlc.exe] => (Block) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [TCP Query User{074F9C1C-051B-4319-BF7A-A98FD2FDF065}C:\program files (x86)\java\jre1.8.0_31\bin\java.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\java.exe
FirewallRules: [UDP Query User{55D30EF6-0A63-403F-900B-656D36616F2B}C:\program files (x86)\java\jre1.8.0_31\bin\java.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\java.exe
FirewallRules: [TCP Query User{362F5215-85FC-421B-B914-ABE6EA456261}C:\program files\firefox.exe] => (Block) C:\program files\firefox.exe
FirewallRules: [UDP Query User{BE7C41C2-E1AB-4E12-9414-4D0DA7F81B6F}C:\program files\firefox.exe] => (Block) C:\program files\firefox.exe
FirewallRules: [{1023DE4E-B766-48DA-AAA2-EF53ED9DE278}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4F66FC22-FD46-46BE-87E1-A8C2AD47AF02}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Faulty Device Manager Devices =============
Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (06/07/2015 00:58:28 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Error: (06/07/2015 00:52:54 PM) (Source: ESENT) (EventID: 439) (User: )
Description: Windows (3064) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032.
Error: (06/07/2015 00:52:54 PM) (Source: ESENT) (EventID: 490) (User: )
Description: Windows (3064) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
Error: (06/06/2015 00:12:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: PEV.exe, Version: 0.0.0.0, Zeitstempel: 0x4e06cfe8
Name des fehlerhaften Moduls: PEV.exe, Version: 0.0.0.0, Zeitstempel: 0x4e06cfe8
Ausnahmecode: 0x40000015
Fehleroffset: 0x0008d1c0
ID des fehlerhaften Prozesses: 0x978
Startzeit der fehlerhaften Anwendung: 0xPEV.exe0
Pfad der fehlerhaften Anwendung: PEV.exe1
Pfad des fehlerhaften Moduls: PEV.exe2
Berichtskennung: PEV.exe3
Error: (06/06/2015 11:33:43 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Error: (06/06/2015 10:20:39 AM) (Source: ESENT) (EventID: 439) (User: )
Description: Windows (2924) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032.
Error: (06/06/2015 10:20:39 AM) (Source: ESENT) (EventID: 490) (User: )
Description: Windows (2924) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
Error: (06/05/2015 03:47:59 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Error: (06/05/2015 08:33:13 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Error: (06/03/2015 09:33:32 AM) (Source: ESENT) (EventID: 439) (User: )
Description: Windows (2720) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032.
System errors:
=============
Error: (06/07/2015 01:23:18 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (06/07/2015 01:23:18 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Adobe Acrobat Update Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (06/07/2015 01:23:18 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Druckwarteschlange" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (06/07/2015 01:23:18 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avast Antivirus" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (06/07/2015 01:23:17 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Emsisoft Protection Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.
Error: (06/07/2015 00:48:00 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (06/07/2015 00:47:59 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (06/07/2015 00:47:59 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (06/07/2015 00:47:58 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Druckwarteschlange" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (06/07/2015 00:47:58 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Live ID Sign-in Assistant" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
Microsoft Office:
=========================
Error: (06/07/2015 00:58:28 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Users\Eltern\Downloads\esetsmartinstaller_deu.exe
Error: (06/07/2015 00:52:54 PM) (Source: ESENT) (EventID: 439) (User: )
Description: Windows3064Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032
Error: (06/07/2015 00:52:54 PM) (Source: ESENT) (EventID: 490) (User: )
Description: Windows3064Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
Error: (06/06/2015 00:12:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: PEV.exe0.0.0.04e06cfe8PEV.exe0.0.0.04e06cfe8400000150008d1c097801d0a0414730849fC:\ComboFix\PEV.exeC:\ComboFix\PEV.exe85e7a99e-0c34-11e5-a6ee-002618b7a239
Error: (06/06/2015 11:33:43 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Users\Eltern\Downloads\esetsmartinstaller_deu.exe
Error: (06/06/2015 10:20:39 AM) (Source: ESENT) (EventID: 439) (User: )
Description: Windows2924Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032
Error: (06/06/2015 10:20:39 AM) (Source: ESENT) (EventID: 490) (User: )
Description: Windows2924Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
Error: (06/05/2015 03:47:59 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe
Error: (06/05/2015 08:33:13 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Users\Eltern\Downloads\esetsmartinstaller_deu.exe
Error: (06/03/2015 09:33:32 AM) (Source: ESENT) (EventID: 439) (User: )
Description: Windows2720Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032
CodeIntegrity Errors:
===================================
Date: 2015-06-06 12:19:46.478
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2015-06-06 12:19:46.415
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: Pentium(R) Dual-Core CPU E5200 @ 2.50GHz
Percentage of memory in use: 44%
Total physical RAM: 3062.18 MB
Available physical RAM: 1701.97 MB
Total Pagefile: 6122.57 MB
Available Pagefile: 4272.17 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: (Eigene Dateien) (Fixed) (Total:58.64 GB) (Free:17.97 GB) NTFS
Drive d: () (Fixed) (Total:43.95 GB) (Free:25.15 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (Eigene Bilder Filme) (Fixed) (Total:39.21 GB) (Free:21.26 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: 102C102B)
Partition 1: (Active) - (Size=43.9 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=39.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=58.6 GB) - (Type=OF Extended)
==================== End of log ============================
Danke und Gruß, PC Knecht |
|
08.06.2015, 06:13
| #11 |
| /// the machine /// TB-Ausbilder | PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 1ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
08.06.2015, 11:55
| #12 |
| | PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 1 Hallo Schrauber, hier der ESET-log Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=244c790ca5aef84b9561031e19287d2d
# end=init
# utc_time=2015-06-02 05:06:16
# local_time=2015-06-02 07:06:16 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 24137
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=244c790ca5aef84b9561031e19287d2d
# end=updated
# utc_time=2015-06-02 05:08:56
# local_time=2015-06-02 07:08:56 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=244c790ca5aef84b9561031e19287d2d
# engine=24137
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2015-06-02 07:15:38
# local_time=2015-06-02 09:15:38 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 71 91 1775998 3215262 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 39284 184902388 0 0
# scanned=248785
# found=16
# cleaned=0
# scan_time=7602
sh=A39B69896808E15089E263A59E4EA37AC4DF24E4 ft=1 fh=38ecfff37c8e3154 vn="Variante von Win32/OpenCandy.C potenziell unsichere Anwendung" ac=I fn="C:\Users\Eltern\Downloads\FreeYouTubeToMP354Converter.exe"
sh=9434866971DD357600C9F2B1E31B7893C3A070F0 ft=1 fh=4f14aeb246e47811 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Eltern\Downloads\PDFCreator-1_7_1_setup.exe"
sh=F218CB4810038F0B9E1DAA6A8E73FA258D620A8C ft=1 fh=719afe2b4494447f vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Eltern\Downloads\PDFCreator-2_1_1-setup.exe"
sh=A39B69896808E15089E263A59E4EA37AC4DF24E4 ft=1 fh=38ecfff37c8e3154 vn="Variante von Win32/OpenCandy.C potenziell unsichere Anwendung" ac=I fn="D:\Documents and Settings\Eltern\Downloads\FreeYouTubeToMP354Converter.exe"
sh=9434866971DD357600C9F2B1E31B7893C3A070F0 ft=1 fh=4f14aeb246e47811 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="D:\Documents and Settings\Eltern\Downloads\PDFCreator-1_7_1_setup.exe"
sh=F218CB4810038F0B9E1DAA6A8E73FA258D620A8C ft=1 fh=719afe2b4494447f vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="D:\Documents and Settings\Eltern\Downloads\PDFCreator-2_1_1-setup.exe"
sh=B056F41A0C3F1E000172372AED6837CE29D99F0F ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H Anwendung" ac=I fn="D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SaveByclick\dfnfldhlfgmlpgfacmffbnonedjmpjag.crx"
sh=9ED22B17AF956934B73F176C0AEB87AFA2F2B5B3 ft=1 fh=f57fa58ae860c262 vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="D:\RECYCLER\S-1-5-21-1606980848-1390067357-839522115-1003\Dc14.exe"
sh=EECD91D95BF7D5D30F5965414066CA6243280D8C ft=0 fh=0000000000000000 vn="Variante von Win32/Systweak.L evtl. unerwünschte Anwendung" ac=I fn="D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP171\A0038320.msi"
sh=EECD91D95BF7D5D30F5965414066CA6243280D8C ft=0 fh=0000000000000000 vn="Variante von Win32/Systweak.L evtl. unerwünschte Anwendung" ac=I fn="D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP172\A0038322.msi"
sh=FB778E2059BA0B1EA0A817CB1407F48FBECC9A3A ft=1 fh=99106c1b10a40924 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP175\A0039051.exe"
sh=C89865B729E1F6027A461E7B48CFA68A54590A2D ft=1 fh=30a236b0a4800cbe vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040097.dll"
sh=FDC2005CED8ACF86C68FE1B86B0698D0539E8CE0 ft=1 fh=1aa6a68885750335 vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040098.exe"
sh=085E2EFA6A258EEC88044241035A37DFF3DE3AE9 ft=1 fh=561b7be0126badba vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040099.exe"
sh=7D7C7305298E11EE810078A7FA0640B484A1EA10 ft=1 fh=6ce22f5640248296 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP213\A0046627.exe"
sh=70DAA6E8A3B51AAE267238F9FFD2EB4398ABBEFB ft=1 fh=c46134338f638506 vn="Variante von Win32/OpenCandy.C potenziell unsichere Anwendung" ac=I fn="D:\Unser Kram\Erik\FreeYouTubeToMP3Converter3.12.44.908.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=244c790ca5aef84b9561031e19287d2d
# end=init
# utc_time=2015-06-08 08:16:09
# local_time=2015-06-08 10:16:09 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 24218
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=244c790ca5aef84b9561031e19287d2d
# end=updated
# utc_time=2015-06-08 08:17:38
# local_time=2015-06-08 10:17:38 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=244c790ca5aef84b9561031e19287d2d
# engine=24218
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-06-08 10:17:53
# local_time=2015-06-08 12:17:53 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 71 91 2262133 3701397 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 82681 185388523 0 0
# scanned=291287
# found=10
# cleaned=0
# scan_time=7214
sh=9434866971DD357600C9F2B1E31B7893C3A070F0 ft=1 fh=4f14aeb246e47811 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Eltern\Downloads\PDFCreator-1_7_1_setup.exe"
sh=F218CB4810038F0B9E1DAA6A8E73FA258D620A8C ft=1 fh=719afe2b4494447f vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Eltern\Downloads\PDFCreator-2_1_1-setup.exe"
sh=9434866971DD357600C9F2B1E31B7893C3A070F0 ft=1 fh=4f14aeb246e47811 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="D:\Documents and Settings\Eltern\Downloads\PDFCreator-1_7_1_setup.exe"
sh=F218CB4810038F0B9E1DAA6A8E73FA258D620A8C ft=1 fh=719afe2b4494447f vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="D:\Documents and Settings\Eltern\Downloads\PDFCreator-2_1_1-setup.exe"
sh=B056F41A0C3F1E000172372AED6837CE29D99F0F ft=0 fh=0000000000000000 vn="Win32/Adware.MultiPlug.H Anwendung" ac=I fn="D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SaveByclick\dfnfldhlfgmlpgfacmffbnonedjmpjag.crx"
sh=EECD91D95BF7D5D30F5965414066CA6243280D8C ft=0 fh=0000000000000000 vn="Variante von Win32/Systweak.L evtl. unerwünschte Anwendung" ac=I fn="D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP171\A0038320.msi"
sh=EECD91D95BF7D5D30F5965414066CA6243280D8C ft=0 fh=0000000000000000 vn="Variante von Win32/Systweak.L evtl. unerwünschte Anwendung" ac=I fn="D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP172\A0038322.msi"
sh=FB778E2059BA0B1EA0A817CB1407F48FBECC9A3A ft=1 fh=99106c1b10a40924 vn="Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung" ac=I fn="D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP175\A0039051.exe"
sh=B01F17C4FA8997A4BB6005B7F58440E4F19E712F ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="H:\Daten PC Stube\LW D\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\41\cb37ca9-1225f21c"
sh=861B8C5750DDE6A54C0265426CAFF61F45259B34 ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.ONO Trojaner" ac=I fn="H:\Daten PC Stube\LW D\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\56\2fdd1af8-783131e5"
Code:
ATTFilter Results of screen317's Security Check version 1.002
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
avast! Antivirus
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Java 8 Update 31
Java version 32-bit out of Date!
Adobe Flash Player 17.0.0.188
Adobe Reader XI
Mozilla Firefox (38.0.5)
Mozilla Thunderbird (31.7.0)
````````Process Check: objlist.exe by Laurent````````
AVAST Software Avast AvastSvc.exe
AVAST Software Avast avastui.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:06-06-2015
Ran by Eltern (administrator) on ELTERN-PC on 08-06-2015 12:36:50
Running from C:\Users\Eltern\Desktop
Loaded Profiles: Eltern (Available Profiles: Eltern)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avast Software s.r.o.) C:\Program Files (x86)\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Avast Software s.r.o.) C:\Program Files (x86)\AVAST Software\Avast\avastui.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files (x86)\AVAST Software\Avast\AvastUI.exe [5515496 2015-05-12] (Avast Software s.r.o.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files (x86)\AVAST Software\Avast\ashShA64.dll [2015-05-04] (Avast Software s.r.o.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-2127788250-3807647062-608468377-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files (x86)\AVAST Software\Avast\aswWebRepIE64.dll [2015-05-04] (Avast Software s.r.o.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll [2009-02-06] (Zeon Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files (x86)\AVAST Software\Avast\aswWebRepIE.dll [2015-05-04] (Avast Software s.r.o.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-03-11] (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-03-11] (Citrix Systems, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Eltern\AppData\Roaming\Mozilla\Firefox\Profiles\myv9y403.default-1432651667587
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-13] ()
FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-13] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Extension: Adblock Plus - C:\Users\Eltern\AppData\Roaming\Mozilla\Firefox\Profiles\myv9y403.default-1432651667587\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-05-26]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files (x86)\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files (x86)\AVAST Software\Avast\WebRep\FF [2015-04-26]
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files (x86)\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-26]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files (x86)\AVAST Software\Avast\AvastSvc.exe [343336 2015-05-04] (Avast Software s.r.o.)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112 2013-09-25] (Brother Industries, Ltd.) [File not signed]
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S4 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [145256 2011-08-02] (Nuance Communications, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-05-04] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-05-04] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-05-04] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-05-04] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-05-04] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-05-04] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-05-04] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-05-04] ()
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2011-07-29] () [File not signed]
S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [14216 2011-07-29] () [File not signed]
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2011-07-29] () [File not signed]
S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [8456 2011-07-29] () [File not signed]
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 HWiNFO32; \??\C:\Users\Eltern\AppData\Local\Temp\HWiNFO64A.SYS [X]
S3 SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP6\WNt500x64\Sandra.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-08 12:36 - 2015-06-08 12:37 - 00009021 _____ C:\Users\Eltern\Desktop\FRST.txt
2015-06-08 12:36 - 2015-06-08 12:36 - 00000874 _____ C:\Users\Eltern\Desktop\checkup.txt
2015-06-08 12:33 - 2015-06-08 12:33 - 00852639 _____ C:\Users\Eltern\Downloads\SecurityCheck.exe
2015-06-08 10:15 - 2015-06-08 10:15 - 02870984 _____ (ESET) C:\Users\Eltern\Downloads\esetsmartinstaller_deu(1).exe
2015-06-07 13:38 - 2015-06-07 13:38 - 02108928 _____ (Farbar) C:\Users\Eltern\Desktop\FRST64.exe
2015-06-07 13:37 - 2015-06-08 10:00 - 00000000 ____D C:\Users\Eltern\Desktop\Virenreiniung
2015-06-07 13:21 - 2015-06-07 13:21 - 00000207 _____ C:\Windows\tweaking.com-regbackup-ELTERN-PC-Windows-7-Home-Premium-(64-bit).dat
2015-06-07 13:21 - 2015-06-07 13:21 - 00000000 ____D C:\RegBackup
2015-06-07 12:44 - 2015-06-07 12:45 - 02231296 _____ C:\Users\Eltern\Downloads\AdwCleaner_4.206.exe
2015-06-06 12:24 - 2015-06-06 12:24 - 00017628 _____ C:\ComboFix.txt
2015-06-06 12:05 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2015-06-06 12:05 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2015-06-06 12:05 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-06-06 12:05 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-06-06 12:05 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-06-06 12:05 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2015-06-06 12:05 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2015-06-06 12:05 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2015-06-06 12:01 - 2015-06-06 12:24 - 00000000 ____D C:\Qoobox
2015-06-06 12:01 - 2015-06-06 12:22 - 00000000 ____D C:\Windows\erdnt
2015-06-05 08:37 - 2015-06-05 09:23 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-06-05 08:32 - 2015-06-05 08:32 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Eltern\Downloads\mbar-1.09.1.1004.exe
2015-06-03 11:26 - 2015-06-03 16:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-06-02 19:06 - 2015-06-02 19:06 - 00000000 ____D C:\Program Files (x86)\ESET
2015-06-02 19:05 - 2015-06-02 19:05 - 02870984 _____ (ESET) C:\Users\Eltern\Downloads\esetsmartinstaller_deu.exe
2015-06-02 17:09 - 2015-06-08 12:36 - 00000000 ____D C:\FRST
2015-06-02 17:04 - 2015-06-02 17:04 - 00000000 _____ C:\Users\Eltern\defogger_reenable
2015-06-02 14:26 - 2015-06-02 14:26 - 00000000 ____D C:\Users\Eltern\AppData\Local\GWX
2015-06-01 19:21 - 2015-06-01 19:21 - 00000000 ____D C:\Program Files (x86)\Realtek
2015-06-01 19:21 - 2009-08-18 11:44 - 00236544 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys
2015-06-01 19:21 - 2009-08-18 11:44 - 00067584 _____ C:\Windows\system32\RtNicProp64.dll
2015-06-01 19:21 - 2009-07-22 18:24 - 00097792 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll
2015-06-01 16:49 - 2015-06-01 16:49 - 00000000 ____D C:\Users\Eltern\Documents\hw64_462-1
2015-05-27 12:08 - 2015-05-28 17:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2015-05-27 11:25 - 2015-05-27 11:25 - 00001051 _____ C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
2015-05-27 11:25 - 2015-05-27 11:25 - 00001051 _____ C:\ProgramData\Desktop\Revo Uninstaller Pro.lnk
2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D C:\Users\Eltern\AppData\Local\VS Revo Group
2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D C:\ProgramData\VS Revo Group
2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
2015-05-27 11:25 - 2015-05-27 11:25 - 00000000 ____D C:\Program Files\VS Revo Group
2015-05-27 11:25 - 2009-12-30 10:21 - 00031800 _____ (VS Revo Group) C:\Windows\system32\Drivers\revoflt.sys
2015-05-27 11:17 - 2015-05-27 11:18 - 10801480 _____ (VS Revo Group ) C:\Users\Eltern\Downloads\RevoUninProSetup-312.exe
2015-05-26 16:47 - 2015-05-26 16:47 - 00000000 ____D C:\Users\Eltern\Desktop\Alte Firefox-Daten
2015-05-26 16:44 - 2015-05-26 16:44 - 00494857 _____ C:\Users\Eltern\Desktop\bookmarks.html
2015-05-26 08:44 - 2015-05-26 08:44 - 00000000 ____D C:\Program Files\avast software
2015-05-20 17:31 - 2015-01-31 05:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-05-20 17:31 - 2015-01-31 05:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-05-20 17:31 - 2015-01-31 01:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-05-20 17:30 - 2014-12-11 19:47 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-05-19 20:02 - 2014-09-05 03:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-05-19 20:01 - 2014-09-05 04:11 - 06584320 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-05-17 19:29 - 2015-05-17 19:29 - 00000000 ____D C:\ProgramData\Emsisoft
2015-05-17 19:01 - 2015-05-17 19:10 - 161426392 _____ (Emsisoft Ltd. ) C:\Users\Eltern\Downloads\emsisoftantimalwaresetup.exe
2015-05-17 17:22 - 2015-05-17 17:22 - 21545848 _____ (Malwarebytes Corporation ) C:\Users\Eltern\Downloads\Anti-Malware.exe
2015-05-17 15:56 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2015-05-17 15:56 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2015-05-17 15:56 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2015-05-17 15:56 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2015-05-17 15:56 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2015-05-17 15:56 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2015-05-17 15:56 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2015-05-17 15:56 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2015-05-17 15:56 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2015-05-17 15:56 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2015-05-17 15:56 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2015-05-17 15:56 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2015-05-17 15:56 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2015-05-17 15:56 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2015-05-17 15:56 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2015-05-17 15:55 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2015-05-17 15:55 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2015-05-17 15:55 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2015-05-17 15:54 - 2015-03-14 05:21 - 01632768 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-05-17 15:54 - 2015-03-14 05:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-05-17 15:54 - 2015-03-14 05:04 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-05-17 15:54 - 2015-03-14 05:04 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-05-17 13:56 - 2015-05-17 10:57 - 00008969 _____ C:\Users\Eltern\Documents\Arbeitszeitreduzierung.tmd
2015-05-14 19:49 - 2015-05-14 19:49 - 02209792 _____ C:\Users\Eltern\Downloads\adwcleaner_4.204.exe
2015-05-13 08:28 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 08:28 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 08:19 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 08:19 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-13 08:19 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 08:19 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-13 08:19 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 08:19 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 08:19 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 08:19 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 08:19 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 08:19 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 08:19 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 08:19 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 08:19 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 08:19 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 08:19 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 08:19 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 08:19 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 08:19 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 08:19 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 08:19 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 08:19 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 08:19 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 08:19 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-13 08:19 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-13 08:19 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 08:19 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 08:19 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-13 08:19 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-13 08:19 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-13 08:19 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-13 08:19 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 08:19 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 08:19 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-13 08:19 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 08:19 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-13 08:19 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-13 08:19 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-13 08:19 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-13 08:19 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-13 08:19 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-13 08:19 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-13 08:19 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 08:19 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 08:19 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-13 08:19 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 08:19 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 08:19 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-13 08:19 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 08:19 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-13 08:19 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-13 08:19 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-13 08:19 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-13 08:19 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 08:19 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-13 08:19 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-13 08:19 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-13 08:19 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-13 08:19 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 08:19 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 08:19 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-13 08:19 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-13 08:19 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-13 08:19 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 08:19 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-13 08:18 - 2015-04-27 21:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-13 08:18 - 2015-04-27 21:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 08:18 - 2015-04-27 21:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 08:18 - 2015-04-27 21:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-05-13 08:18 - 2015-04-27 21:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-05-13 08:18 - 2015-04-27 21:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 08:18 - 2015-04-27 21:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-13 08:18 - 2015-04-27 21:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 08:18 - 2015-04-27 21:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 08:18 - 2015-04-27 21:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-05-13 08:18 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-05-13 08:18 - 2015-04-27 21:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-13 08:18 - 2015-04-27 21:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-05-13 08:18 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-05-13 08:18 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-13 08:18 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-05-13 08:18 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-05-13 08:18 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-05-13 08:18 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-05-13 08:18 - 2015-04-27 21:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-05-13 08:18 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-13 08:18 - 2015-04-27 21:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-05-13 08:18 - 2015-04-27 21:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-05-13 08:18 - 2015-04-27 21:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-13 08:18 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-13 08:18 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-05-13 08:18 - 2015-04-27 21:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-05-13 08:18 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-13 08:18 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 20:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-13 08:18 - 2015-04-27 19:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-05-13 08:18 - 2015-04-27 19:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-05-13 08:18 - 2015-04-27 19:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 08:18 - 2015-04-27 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-05-13 08:18 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 08:17 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 08:17 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 08:17 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-13 08:17 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 08:17 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 08:17 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 08:17 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-13 08:17 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-13 08:17 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-13 08:17 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-13 08:17 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-13 08:17 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-05-13 08:17 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-05-13 08:17 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-13 08:17 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-13 08:17 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 08:17 - 2015-01-29 05:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-13 08:17 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-10 16:11 - 2015-05-10 16:11 - 00001093 _____ C:\Users\Public\Desktop\PDF24 Creator.lnk
2015-05-10 16:11 - 2015-05-10 16:11 - 00001093 _____ C:\ProgramData\Desktop\PDF24 Creator.lnk
2015-05-10 16:11 - 2015-05-10 16:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
2015-05-10 16:11 - 2015-05-10 16:11 - 00000000 ____D C:\Program Files (x86)\PDF24
2015-05-10 16:08 - 2015-05-10 16:08 - 16342352 _____ (Geek Software GmbH ) C:\Program Files (x86)\pdf24-creator-6.9.2.exe
2015-05-10 15:30 - 2015-05-10 15:31 - 27837984 _____ (pdfforge ) C:\Users\Eltern\Downloads\PDFCreator-2_1_1-setup.exe
2015-05-10 15:06 - 2015-05-10 15:06 - 00000000 ____D C:\Users\Eltern\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker
2015-05-10 14:47 - 2015-05-10 15:06 - 00000000 ____D C:\Program Files (x86)\Unlocker
2015-05-10 13:14 - 2015-05-10 13:14 - 00001138 _____ C:\Users\Eltern\Desktop\PK.vbs
2015-05-10 10:50 - 2015-05-10 10:50 - 00002562 _____ C:\Windows\diagwrn.xml
2015-05-10 10:50 - 2015-05-10 10:50 - 00001908 _____ C:\Windows\diagerr.xml
2015-05-09 14:08 - 2015-05-10 15:27 - 00000000 ____D C:\Windows\pss
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-08 11:33 - 2013-10-14 21:23 - 01986729 _____ C:\Windows\WindowsUpdate.log
2015-06-08 10:15 - 2009-07-14 06:45 - 00023168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-08 10:15 - 2009-07-14 06:45 - 00023168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-08 10:07 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-08 10:06 - 2015-04-19 19:41 - 00005677 _____ C:\Windows\setupact.log
2015-06-07 17:37 - 2015-04-26 13:57 - 00011822 _____ C:\Windows\PFRO.log
2015-06-07 13:20 - 2015-04-26 14:00 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-07 12:48 - 2015-04-26 13:54 - 00000000 ____D C:\AdwCleaner
2015-06-06 17:57 - 2015-04-26 16:08 - 00004194 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2015-06-06 12:59 - 2013-10-14 21:31 - 00000000 ____D C:\Users\Eltern
2015-06-06 12:20 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2015-06-05 08:34 - 2015-04-26 14:00 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-03 16:27 - 2013-10-14 23:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-06-02 16:29 - 2013-10-14 23:52 - 00000000 ____D C:\Users\Eltern\AppData\Roaming\vlc
2015-06-02 15:14 - 2009-07-14 19:58 - 00699416 _____ C:\Windows\system32\perfh007.dat
2015-06-02 15:14 - 2009-07-14 19:58 - 00149556 _____ C:\Windows\system32\perfc007.dat
2015-06-02 15:14 - 2009-07-14 07:13 - 01620612 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-02 10:20 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2015-06-01 19:21 - 2014-06-25 19:42 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-05-30 19:17 - 2014-06-25 19:46 - 00007887 _____ C:\Windows\BRRBCOM.INI
2015-05-30 18:44 - 2013-10-15 14:51 - 00000000 ____D C:\Windows\rescache
2015-05-28 11:06 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2015-05-27 12:03 - 2013-10-17 00:31 - 01593956 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-05-20 18:32 - 2015-04-04 12:12 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-05-20 18:32 - 2015-04-04 12:12 - 00000000 ___SD C:\Windows\system32\GWX
2015-05-17 17:54 - 2015-04-26 14:00 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-05-17 16:04 - 2009-07-14 05:20 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-05-17 16:01 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-05-16 09:18 - 2013-10-17 21:16 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-14 20:46 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\Resources
2015-05-13 14:17 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-05-13 10:45 - 2009-07-14 06:45 - 00287472 _____ C:\Windows\system32\FNTCACHE.DAT
2015-05-13 10:42 - 2013-11-15 19:52 - 00000000 ____D C:\Program Files\Windows Journal
2015-05-13 10:42 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2015-05-13 08:35 - 2013-10-18 20:38 - 00000000 ____D C:\Windows\system32\MRT
2015-05-13 08:32 - 2013-10-18 20:38 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-13 07:57 - 2015-02-04 19:56 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-13 07:57 - 2015-02-04 19:56 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-10 10:50 - 2015-04-19 19:41 - 00000000 _____ C:\Windows\setuperr.log
==================== Files in the root of some directories =======
2013-11-15 19:51 - 2013-10-15 01:28 - 3294168 _____ (Piriform Ltd) C:\Program Files\ccsetup406_slim.exe
2014-08-04 15:16 - 2014-08-04 15:16 - 10410712 _____ (Sony Computer Entertainment Inc. ) C:\Program Files\CMASetup.exe
2013-11-15 19:51 - 2012-10-11 22:21 - 11766024 _____ (EASEUS ) C:\Program Files\epm911.exe
2014-02-15 19:34 - 2014-02-15 19:34 - 0921000 _____ (Oracle Corporation) C:\Program Files\jxpiinstall.exe
2014-02-17 18:56 - 2014-02-17 18:56 - 0675988 _____ () C:\Program Files\Minecraft.exe
2014-02-17 20:22 - 2014-02-17 20:22 - 0774144 _____ () C:\Program Files\NBTExplorer-2.7.0.msi
2013-11-15 19:51 - 2013-10-15 16:49 - 0537818 _____ (IDG Magazine Media GmbH ) C:\Program Files\pcwFixMyRights.exe
2014-12-26 17:14 - 2014-12-26 17:14 - 0095662 _____ () C:\Program Files (x86)\7-zip.chm
2014-12-26 17:48 - 2014-12-26 17:48 - 0080384 _____ (Igor Pavlov) C:\Program Files (x86)\7-zip.dll
2014-12-26 17:48 - 2014-12-26 17:48 - 0050176 _____ (Igor Pavlov) C:\Program Files (x86)\7-zip32.dll
2014-12-26 18:00 - 2014-12-26 18:00 - 1508352 _____ (Igor Pavlov) C:\Program Files (x86)\7z.dll
2014-12-26 18:06 - 2014-12-26 18:06 - 0181760 _____ (Igor Pavlov) C:\Program Files (x86)\7z.sfx
2014-12-26 18:06 - 2014-12-26 18:06 - 0166400 _____ (Igor Pavlov) C:\Program Files (x86)\7zCon.sfx
2014-12-26 17:50 - 2014-12-26 17:50 - 0803328 _____ (Igor Pavlov) C:\Program Files (x86)\7zFM.exe
2014-12-26 17:50 - 2014-12-26 17:50 - 0545792 _____ (Igor Pavlov) C:\Program Files (x86)\7zG.exe
2014-08-22 08:08 - 2014-08-22 08:11 - 149527616 _____ () C:\Program Files (x86)\avira_free_antivirus_de_14.0.6.570.exe
2014-11-07 13:28 - 2014-11-07 13:28 - 12436848 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\CitrixOnlinePluginWeb.exe
2015-05-04 18:48 - 2015-05-04 18:49 - 10457912 _____ (Sony Computer Entertainment Inc. ) C:\Program Files (x86)\CMASetup.exe
2011-04-04 17:54 - 2011-04-04 17:54 - 0000366 _____ () C:\Program Files (x86)\descript.ion
2015-04-20 17:59 - 2015-04-20 18:03 - 190719264 _____ (Microsoft Corporation) C:\Program Files (x86)\DraftSight64.exe
2015-01-03 12:26 - 2015-01-03 12:29 - 91670064 _____ (The GIMP Team ) C:\Program Files (x86)\gimp-2.8.14-setup.exe
2014-12-26 18:06 - 2014-12-26 18:06 - 0040769 _____ () C:\Program Files (x86)\History.txt
2014-06-12 22:02 - 2014-06-12 22:02 - 0001927 _____ () C:\Program Files (x86)\License.txt
2015-05-10 16:08 - 2015-05-10 16:08 - 16342352 _____ (Geek Software GmbH ) C:\Program Files (x86)\pdf24-creator-6.9.2.exe
2015-01-07 21:39 - 2015-01-07 21:39 - 0001551 _____ () C:\Users\Eltern\AppData\Local\recently-used.xbel
Some files in TEMP:
====================
C:\Users\Eltern\AppData\Local\Temp\Quarantine.exe
C:\Users\Eltern\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-06-05 15:47
==================== End of log ============================
[CODE]Additional FRST Logfile: Code:
ATTFilter scan result of Farbar Recovery Scan Tool (x64) Version:06-06-2015
Ran by Eltern at 2015-06-08 12:38:08
Running from C:\Users\Eltern\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-2127788250-3807647062-608468377-500 - Administrator - Disabled)
Eltern (S-1-5-21-2127788250-3807647062-608468377-1000 - Administrator - Enabled) => C:\Users\Eltern
Gast (S-1-5-21-2127788250-3807647062-608468377-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2127788250-3807647062-608468377-1002 - Limited - Enabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.36 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0936-000001000000}) (Version: 9.36.00.0 - Igor Pavlov)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
Amazon Music (HKU\S-1-5-21-2127788250-3807647062-608468377-1000\...\Amazon Amazon Music) (Version: 3.7.1.698 - Amazon Services LLC)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.2.2218 - AVAST Software)
Brother MFL-Pro Suite MFC-J245 (HKLM-x32\...\{B742757A-7658-4E09-A51A-085CF0F7F4D3}) (Version: 1.0.0.0 - Brother Industries, Ltd.)
CDex - Open Source Digital Audio CD Extractor (HKLM-x32\...\CDex) (Version: 1.70.4.2009 - Georgy Berdyshev)
Citrix Online Plug-in - Web (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 12.0.0.6410 - Citrix Systems, Inc.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DriveImage XML (Private Edition) (HKLM-x32\...\{F7E1CA14-B39D-452A-960B-39423DDDD933}) (Version: 2.44.000 - Runtime Software)
EASEUS Partition Master 9.1.1 Home Edition (HKLM-x32\...\EASEUS Partition Master Home Edition_is1) (Version: - EASEUS)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 16.0.20150211 - Landesfinanzdirektion Thüringen)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
Free YouTube to MP3 Converter version 3.12.54.128 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.54.128 - DVDVideoSoft Ltd.)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Inhaltsmanager-Assistent für PlayStation(R) (HKLM-x32\...\{961D5D7E-3DEC-4E3B-9065-EA8074923B18}) (Version: 3.31.7643.1 - Sony Computer Entertainment Inc.)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mozilla Firefox 38.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.5 (x86 de)) (Version: 38.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 37.0.2 - Mozilla)
Mozilla Thunderbird 31.7.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.7.0 (x86 de)) (Version: 31.7.0 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
NBTExplorer (HKLM-x32\...\{273D5BF1-EC9C-4549-880D-D8C293296A36}) (Version: 2.7.0.0 - Justin Aquadro)
Nuance PaperPort 12 (HKLM-x32\...\{869FCC6C-5669-4B0B-827E-2BBAACD88A87}) (Version: 12.1.0006 - Nuance Communications, Inc.)
Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc)
PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 14.00.0000 - Nuance Communications, Inc.)
PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
Pusteblume Sachunterricht 3 (HKLM-x32\...\Pusteblume Sachunterricht 3) (Version: - Bildungshaus Schulbuchverlage Westermann Schroedel Diesterweg Schöningh Winklers GmbH)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0008 - Realtek)
Revo Uninstaller Pro 3.1.2 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.1.2 - VS Revo Group, Ltd.)
Scansoft PDF Professional (x32 Version: - ) Hidden
SoftMaker FreeOffice (HKLM-x32\...\{8EBB8452-274B-465D-8324-00B0832FBB02}) (Version: 1.0.3395 - SoftMaker Software GmbH)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Restore Points =========================
05-06-2015 13:58:00 Windows Update
08-06-2015 10:02:33 Revo Uninstaller Pro's restore point - Emsisoft Anti-Malware
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2015-06-06 12:20 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0051A1AD-0606-4209-BFFE-5DC7ED6C9B20} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-07] (Microsoft Corporation)
Task: {23F31262-F54E-4455-9D7F-0B5E1EAA016E} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {31E02CA9-C51E-4460-BA97-B7E21A651C34} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {50535350-84E1-4323-9DDE-0CD437D0DE7A} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {75E4A4DD-0A3B-429A-B31B-D27696231BBB} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: {AE7B86A3-5C9A-4947-9E30-BCABB5CE2FE1} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {C16F411F-5A38-4010-8311-B2469B0D6545} - System32\Tasks\avast! Emergency Update => C:\Program Files (x86)\AVAST Software\Avast\AvastEmUpdate.exe [2015-05-04] (Avast Software s.r.o.)
==================== Loaded Modules (Whitelisted) ==============
2015-05-04 13:45 - 2015-05-04 13:45 - 00104400 _____ () C:\Program Files (x86)\AVAST Software\Avast\log.dll
2015-05-04 13:45 - 2015-05-04 13:45 - 00081728 _____ () C:\Program Files (x86)\AVAST Software\Avast\JsonRpcServer.dll
2015-06-07 11:31 - 2015-06-07 11:31 - 02952192 _____ () C:\Program Files (x86)\AVAST Software\Avast\defs\15060700\algo.dll
2015-04-26 16:08 - 2015-04-26 16:08 - 40540672 _____ () C:\Program Files (x86)\AVAST Software\Avast\libcef.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2127788250-3807647062-608468377-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Eltern\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\Services: PDFProFiltSrvPP => 2
MSCONFIG\Services: wscsvc => 2
MSCONFIG\Services: WSearch => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Inhaltsmanager-Assistent für PlayStation(R).lnk => C:\Windows\pss\Inhaltsmanager-Assistent für PlayStation(R).lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Amazon Music => "C:\Users\Eltern\AppData\Local\Amazon Music\Amazon Music Helper.exe"
MSCONFIG\startupreg: BrHelp => C:\Program Files (x86)\Brother\Brother Help\BrotherHelp.exe /AUTORUN
MSCONFIG\startupreg: BrStsMon00 => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN
MSCONFIG\startupreg: ConnectionCenter => "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup
MSCONFIG\startupreg: ControlCenter4 => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe /autorun
MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe
MSCONFIG\startupreg: IndexSearch => "C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe"
MSCONFIG\startupreg: ISUSPM => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
MSCONFIG\startupreg: PaperPort PTD => "C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe"
MSCONFIG\startupreg: PDF5 Registry Controller => C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe
MSCONFIG\startupreg: PDFHook => C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe
MSCONFIG\startupreg: PDFPrint => C:\Program Files (x86)\PDF24\pdf24.exe
MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{1B5878FA-F799-4C68-A2DA-8E7A57B40EFB}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{AF0730C6-8801-41FD-9979-03A14518E175}] => (Allow) LPort=2869
FirewallRules: [{639EFFE0-6DC2-43C2-A676-855C8FEF6F89}] => (Allow) LPort=1900
FirewallRules: [TCP Query User{7A9608B7-A0ED-423F-BE89-7991B131A01B}C:\program files\videolan\vlc\vlc.exe] => (Block) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [UDP Query User{BA917422-0A70-45A0-88FF-CEA25E4D4AA8}C:\program files\videolan\vlc\vlc.exe] => (Block) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [TCP Query User{074F9C1C-051B-4319-BF7A-A98FD2FDF065}C:\program files (x86)\java\jre1.8.0_31\bin\java.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\java.exe
FirewallRules: [UDP Query User{55D30EF6-0A63-403F-900B-656D36616F2B}C:\program files (x86)\java\jre1.8.0_31\bin\java.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\java.exe
FirewallRules: [TCP Query User{362F5215-85FC-421B-B914-ABE6EA456261}C:\program files\firefox.exe] => (Block) C:\program files\firefox.exe
FirewallRules: [UDP Query User{BE7C41C2-E1AB-4E12-9414-4D0DA7F81B6F}C:\program files\firefox.exe] => (Block) C:\program files\firefox.exe
FirewallRules: [{1023DE4E-B766-48DA-AAA2-EF53ED9DE278}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4F66FC22-FD46-46BE-87E1-A8C2AD47AF02}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Faulty Device Manager Devices =============
Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (06/08/2015 00:23:12 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Error: (06/08/2015 10:15:58 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Error: (06/08/2015 10:15:51 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Error: (06/08/2015 10:02:33 AM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {9e649322-fc6c-412c-96cc-90ab128553c6}
Error: (06/07/2015 00:58:28 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Error: (06/07/2015 00:52:54 PM) (Source: ESENT) (EventID: 439) (User: )
Description: Windows (3064) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032.
Error: (06/07/2015 00:52:54 PM) (Source: ESENT) (EventID: 490) (User: )
Description: Windows (3064) Windows: Versuch, Datei "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
Error: (06/06/2015 00:12:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: PEV.exe, Version: 0.0.0.0, Zeitstempel: 0x4e06cfe8
Name des fehlerhaften Moduls: PEV.exe, Version: 0.0.0.0, Zeitstempel: 0x4e06cfe8
Ausnahmecode: 0x40000015
Fehleroffset: 0x0008d1c0
ID des fehlerhaften Prozesses: 0x978
Startzeit der fehlerhaften Anwendung: 0xPEV.exe0
Pfad der fehlerhaften Anwendung: PEV.exe1
Pfad des fehlerhaften Moduls: PEV.exe2
Berichtskennung: PEV.exe3
Error: (06/06/2015 11:33:43 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Error: (06/06/2015 10:20:39 AM) (Source: ESENT) (EventID: 439) (User: )
Description: Windows (2924) Windows: Die Shadowkopfzeile für Datei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk konnte nicht geschrieben werden. Fehler -1032.
System errors:
=============
Error: (06/08/2015 10:17:35 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (06/08/2015 10:17:35 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Users\Eltern\AppData\Local\Temp\ehdrv.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (06/08/2015 10:17:34 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (06/08/2015 10:17:34 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Users\Eltern\AppData\Local\Temp\ehdrv.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (06/08/2015 10:17:34 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (06/08/2015 10:17:34 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Users\Eltern\AppData\Local\Temp\ehdrv.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (06/08/2015 10:17:06 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (06/08/2015 10:17:06 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Users\Eltern\AppData\Local\Temp\ehdrv.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (06/08/2015 10:17:05 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "eapihdrv" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (06/08/2015 10:17:05 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Users\Eltern\AppData\Local\Temp\ehdrv.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Microsoft Office:
=========================
Error: (06/08/2015 00:23:12 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
Error: (06/08/2015 10:15:58 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Users\Eltern\Downloads\esetsmartinstaller_deu(1).exe
Error: (06/08/2015 10:15:51 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Users\Eltern\Downloads\esetsmartinstaller_deu(1).exe
Error: (06/08/2015 10:02:33 AM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {9e649322-fc6c-412c-96cc-90ab128553c6}
Error: (06/07/2015 00:58:28 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Users\Eltern\Downloads\esetsmartinstaller_deu.exe
Error: (06/07/2015 00:52:54 PM) (Source: ESENT) (EventID: 439) (User: )
Description: Windows3064Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032
Error: (06/07/2015 00:52:54 PM) (Source: ESENT) (EventID: 490) (User: )
Description: Windows3064Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032 (0xfffffbf8)32 (0x00000020)Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
Error: (06/06/2015 00:12:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: PEV.exe0.0.0.04e06cfe8PEV.exe0.0.0.04e06cfe8400000150008d1c097801d0a0414730849fC:\ComboFix\PEV.exeC:\ComboFix\PEV.exe85e7a99e-0c34-11e5-a6ee-002618b7a239
Error: (06/06/2015 11:33:43 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Users\Eltern\Downloads\esetsmartinstaller_deu.exe
Error: (06/06/2015 10:20:39 AM) (Source: ESENT) (EventID: 439) (User: )
Description: Windows2924Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk-1032
CodeIntegrity Errors:
===================================
Date: 2015-06-06 12:19:46.478
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2015-06-06 12:19:46.415
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: Pentium(R) Dual-Core CPU E5200 @ 2.50GHz
Percentage of memory in use: 51%
Total physical RAM: 3062.18 MB
Available physical RAM: 1496.37 MB
Total Pagefile: 6122.57 MB
Available Pagefile: 4485.25 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: (Eigene Dateien) (Fixed) (Total:58.64 GB) (Free:17.35 GB) NTFS
Drive d: () (Fixed) (Total:43.95 GB) (Free:25.15 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (Eigene Bilder Filme) (Fixed) (Total:39.21 GB) (Free:21.26 GB) NTFS
Drive h: (TOSHIBA EXT) (Fixed) (Total:465.76 GB) (Free:352.05 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: 102C102B)
Partition 1: (Active) - (Size=43.9 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=39.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=58.6 GB) - (Type=OF Extended)
========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 5BBE54C7)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)
==================== End of log ============================
Win-Explorer und Firefox starten nun schneller, der Thunderbird leider noch nicht. Zudem ist es so, dass beim Start des Firefox manchmal ein leerer TAB geladen wird, statt der Startseite (bei mir Google). Außerdem sieht es im Firefox manchmal so aus, als würde für den Bruchteil einer Sekunde ein Fenster öffnen und sich gleich wieder schließen bzw. unsichtbar im Hintergrund bleiben. Im Task-Man. ist aber nichts zu sehen. Ist da immer noch irgendein penetranter Schädling am Werke? Danke und Gruß, PC Knecht |
|
08.06.2015, 20:33
| #13 |
| /// the machine /// TB-Ausbilder | PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 1 Logs sind sauber. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Users\Eltern\Downloads\FreeYouTubeToMP354Converter.exe
C:\Users\Eltern\Downloads\PDFCreator-1_7_1_setup.exe
C:\Users\Eltern\Downloads\PDFCreator-2_1_1-setup.exe
D:\Documents and Settings\Eltern\Downloads\FreeYouTubeToMP354Converter.exe
D:\Documents and Settings\Eltern\Downloads\PDFCreator-1_7_1_setup.exe
D:\Documents and Settings\Eltern\Downloads\PDFCreator-2_1_1-setup.exe
D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SaveByclick\dfnfldhlfgmlpgfacmffbnonedjmpjag.crx
D:\RECYCLER\S-1-5-21-1606980848-1390067357-839522115-1003\Dc14.exe
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP171\A0038320.msi
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP172\A0038322.msi
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP175\A0039051.exe
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040097.dll
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040098.exe
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040099.exe
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP213\A0046627.exe
D:\Unser Kram\Erik\FreeYouTubeToMP3Converter3.12.44.908.exe
H:\Daten PC Stube\LW D\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\41\cb37ca9-1225f21c
H:\Daten PC Stube\LW D\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\56\2fdd1af8-783131e5
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Revo Uninstaller - Download - Filepony damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.mozilla.org/de/kb/fi...einfach-loesen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.06.2015, 07:38
| #14 |
| | PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 1 Hallo Schrauber, hier der Fixlog Code:
ATTFilter Fix result of Farbar Recovery Scan Tool (x64) Version:06-06-2015
Ran by Eltern at 2015-06-09 08:00:50 Run:1
Running from C:\Users\Eltern\Desktop
Loaded Profiles: Eltern (Available Profiles: Eltern)
Boot Mode: Normal
==============================================
fixlist content:
*****************
C:\Users\Eltern\Downloads\FreeYouTubeToMP354Converter.exe
C:\Users\Eltern\Downloads\PDFCreator-1_7_1_setup.exe
C:\Users\Eltern\Downloads\PDFCreator-2_1_1-setup.exe
D:\Documents and Settings\Eltern\Downloads\FreeYouTubeToMP354Converter.exe
D:\Documents and Settings\Eltern\Downloads\PDFCreator-1_7_1_setup.exe
D:\Documents and Settings\Eltern\Downloads\PDFCreator-2_1_1-setup.exe
D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SaveByclick\dfnfldhlfgmlpgfacmffbnonedjmpjag.crx
D:\RECYCLER\S-1-5-21-1606980848-1390067357-839522115-1003\Dc14.exe
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP171\A0038320.msi
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP172\A0038322.msi
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP175\A0039051.exe
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040097.dll
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040098.exe
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040099.exe
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP213\A0046627.exe
D:\Unser Kram\Erik\FreeYouTubeToMP3Converter3.12.44.908.exe
H:\Daten PC Stube\LW D\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\41\cb37ca9-1225f21c
H:\Daten PC Stube\LW D\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\56\2fdd1af8-783131e5
Emptytemp:
*****************
C:\Users\Eltern\Downloads\FreeYouTubeToMP354Converter.exe => moved successfully.
C:\Users\Eltern\Downloads\PDFCreator-1_7_1_setup.exe => moved successfully.
C:\Users\Eltern\Downloads\PDFCreator-2_1_1-setup.exe => moved successfully.
"D:\Documents and Settings\Eltern\Downloads\FreeYouTubeToMP354Converter.exe" => File/Folder not found.
"D:\Documents and Settings\Eltern\Downloads\PDFCreator-1_7_1_setup.exe" => File/Folder not found.
"D:\Documents and Settings\Eltern\Downloads\PDFCreator-2_1_1-setup.exe" => File/Folder not found.
D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SaveByclick\dfnfldhlfgmlpgfacmffbnonedjmpjag.crx => moved successfully.
"D:\RECYCLER\S-1-5-21-1606980848-1390067357-839522115-1003\Dc14.exe" => File/Folder not found.
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP171\A0038320.msi => moved successfully.
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP172\A0038322.msi => moved successfully.
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP175\A0039051.exe => moved successfully.
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040097.dll => moved successfully.
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040098.exe => moved successfully.
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP180\A0040099.exe => moved successfully.
D:\System Volume Information\_restore{B8DFB016-729A-48FD-B1D7-1D15D65ED622}\RP213\A0046627.exe => moved successfully.
D:\Unser Kram\Erik\FreeYouTubeToMP3Converter3.12.44.908.exe => moved successfully.
H:\Daten PC Stube\LW D\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\41\cb37ca9-1225f21c => moved successfully.
H:\Daten PC Stube\LW D\Dokumente und Einstellungen\Besitzer\Lokale Einstellungen\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\56\2fdd1af8-783131e5 => moved successfully.
Allerdings stürzte FF nun einmal ab, was vorher noch nie der Fall war. Ich habe den Absturzbericht als txt auf meinem Desktop. Wäre dieser für Dich von Interesse? Vielen Dank und Gruß, PC_Knecht |
|
09.06.2015, 20:25
| #15 |
| /// the machine /// TB-Ausbilder | PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 1 Ja, poste mal, ich schau mal rein
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu PC mit Win7 64: Booten dauert lang / Programme starten auffällig langsam Teil 1 |
| anti-malware, antivirus, ccsetup, computer, converter, csrss.exe, explorer.exe, flash player, formation, harddisk, helper.exe, homepage, installation, launch, lsass.exe, microsoft, programme, registry, revo uninstaller, security, service.exe, services.exe, software, spoolsv.exe, svchost.exe, system32, windows live, winlogon.exe |
Linear-Darstellung
