Hallo habe ein Problem. Ein Brief von der Telekom in dem steht mein PC ist mit dem Virus befallen...

Habe mein OnlineBanking Konto sofort gesperrt...

Nutze nur Antivier und die Windos Firewall....,lasse immer automatisch alle paar tage einen Suchlauf machen.Am 10.02 war das Sytem noch sauber laut AV.

habe Antiviren scan durchlaufen lassen und der hat auch was gefungen...

meine frage nun kann ich das so in den griff kriegen , oder muss ich alles Formatieren...

auszug aus Antivir:
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Montag, 18. Februar 2013 20:18


Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer : Avira Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 Home Premium
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : Alienware
Computername : ALIENWARE-PC

Versionsinformationen:
BUILD.DAT : 13.0.0.3185 47702 Bytes 30.01.2013 10:05:00
AVSCAN.EXE : 13.6.0.584 640224 Bytes 12.02.2013 14:53:00
AVSCANRC.DLL : 13.4.0.360 64800 Bytes 11.12.2012 17:48:56
LUKE.DLL : 13.6.0.602 67808 Bytes 12.02.2013 14:53:41
AVSCPLR.DLL : 13.6.0.628 94432 Bytes 06.02.2013 15:58:24
AVREG.DLL : 13.6.0.600 250592 Bytes 06.02.2013 15:58:24
avlode.dll : 13.6.2.624 434912 Bytes 06.02.2013 15:58:24
avlode.rdf : 13.0.0.38 15231 Bytes 14.02.2013 14:57:26
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 14:50:29
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 14:50:31
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 14:50:34
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 14:50:36
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 14:50:37
VBASE005.VDF : 7.11.34.116 4034048 Bytes 29.06.2012 14:42:40
VBASE006.VDF : 7.11.41.250 4902400 Bytes 06.09.2012 14:42:40
VBASE007.VDF : 7.11.50.230 3904512 Bytes 22.11.2012 16:35:00
VBASE008.VDF : 7.11.60.10 6627328 Bytes 07.02.2013 15:35:26
VBASE009.VDF : 7.11.60.11 2048 Bytes 07.02.2013 15:35:28
VBASE010.VDF : 7.11.60.12 2048 Bytes 07.02.2013 15:35:28
VBASE011.VDF : 7.11.60.13 2048 Bytes 07.02.2013 15:35:28
VBASE012.VDF : 7.11.60.14 2048 Bytes 07.02.2013 15:35:28
VBASE013.VDF : 7.11.60.62 351232 Bytes 08.02.2013 15:55:00
VBASE014.VDF : 7.11.60.115 190976 Bytes 09.02.2013 15:55:00
VBASE015.VDF : 7.11.60.177 282624 Bytes 11.02.2013 14:52:48
VBASE016.VDF : 7.11.60.249 215552 Bytes 13.02.2013 14:57:24
VBASE017.VDF : 7.11.61.65 151040 Bytes 15.02.2013 19:17:09
VBASE018.VDF : 7.11.61.135 159232 Bytes 18.02.2013 19:17:10
VBASE019.VDF : 7.11.61.136 2048 Bytes 18.02.2013 19:17:10
VBASE020.VDF : 7.11.61.137 2048 Bytes 18.02.2013 19:17:10
VBASE021.VDF : 7.11.61.138 2048 Bytes 18.02.2013 19:17:10
VBASE022.VDF : 7.11.61.139 2048 Bytes 18.02.2013 19:17:10
VBASE023.VDF : 7.11.61.140 2048 Bytes 18.02.2013 19:17:10
VBASE024.VDF : 7.11.61.141 2048 Bytes 18.02.2013 19:17:10
VBASE025.VDF : 7.11.61.142 2048 Bytes 18.02.2013 19:17:10
VBASE026.VDF : 7.11.61.143 2048 Bytes 18.02.2013 19:17:10
VBASE027.VDF : 7.11.61.144 2048 Bytes 18.02.2013 19:17:10
VBASE028.VDF : 7.11.61.145 2048 Bytes 18.02.2013 19:17:10
VBASE029.VDF : 7.11.61.146 2048 Bytes 18.02.2013 19:17:10
VBASE030.VDF : 7.11.61.147 2048 Bytes 18.02.2013 19:17:10
VBASE031.VDF : 7.11.61.160 129536 Bytes 18.02.2013 19:17:11
Engineversion : 8.2.12.2
AEVDF.DLL : 8.1.2.10 102772 Bytes 19.09.2012 14:42:55
AESCRIPT.DLL : 8.1.4.92 471418 Bytes 18.02.2013 19:17:15
AESCN.DLL : 8.1.10.0 131445 Bytes 13.12.2012 15:17:14
AESBX.DLL : 8.2.5.12 606578 Bytes 28.08.2012 16:58:06
AERDL.DLL : 8.2.0.88 643444 Bytes 10.01.2013 15:40:17
AEPACK.DLL : 8.3.1.2 819574 Bytes 20.12.2012 14:07:32
AEOFFICE.DLL : 8.1.2.50 201084 Bytes 09.11.2012 16:22:32
AEHEUR.DLL : 8.1.4.206 5747064 Bytes 18.02.2013 19:17:14
AEHELP.DLL : 8.1.25.2 258423 Bytes 12.10.2012 15:52:32
AEGEN.DLL : 8.1.6.16 434549 Bytes 25.01.2013 14:50:50
AEEXP.DLL : 8.4.0.0 188788 Bytes 18.02.2013 19:17:15
AEEMU.DLL : 8.1.3.2 393587 Bytes 19.09.2012 14:42:55
AECORE.DLL : 8.1.31.0 201079 Bytes 18.02.2013 19:17:11
AEBB.DLL : 8.1.1.4 53619 Bytes 09.11.2012 16:22:23
AVWINLL.DLL : 13.6.0.480 26480 Bytes 12.02.2013 14:52:46
AVPREF.DLL : 13.6.0.480 51056 Bytes 12.02.2013 14:53:00
AVREP.DLL : 13.6.0.480 178544 Bytes 06.02.2013 15:58:24
AVARKT.DLL : 13.6.0.624 260832 Bytes 12.02.2013 14:52:51
AVEVTLOG.DLL : 13.6.0.600 167648 Bytes 12.02.2013 14:52:58
SQLITE3.DLL : 3.7.0.1 397088 Bytes 19.09.2012 18:17:40
AVSMTP.DLL : 13.6.0.480 62832 Bytes 12.02.2013 14:53:00
NETNT.DLL : 13.6.0.480 16240 Bytes 12.02.2013 14:53:42
RCIMAGE.DLL : 13.4.0.360 4780832 Bytes 11.12.2012 17:48:38
RCTEXT.DLL : 13.6.0.480 68976 Bytes 12.02.2013 14:52:46

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Lokale Laufwerke
Konfigurationsdatei...................: C:\program files (x86)\avira\antivir desktop\alldrives.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert

Beginn des Suchlaufs: Montag, 18. Februar 2013 20:18

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvSCPAPISvr.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '99' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '119' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '151' Modul(e) wurden durchsucht
Durchsuche Prozess 'STacSV64.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'TrustedInstaller.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLANExt.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'AESTSr64.exe' - '8' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'mDNSResponder.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'btwdins.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'sftservice.EXE' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'mscorsvw.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'mscorsvw.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvxdsync.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '157' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleCrashHandler.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleCrashHandler64.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'STService.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'vds.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPEnh.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'sttray64.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'netsession_win.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'keabi.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'BTTray.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAStorIcon.exe' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'AlienwareOn-ScreenDisplay.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'reader_sl.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'WebcamInt.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'PDVD9Serv.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'brs.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'RoxioBurnLauncher.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'Updater.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvtray.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'netsession_win.exe' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'AWCCServiceController.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPHelper.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'iPodService.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'BtStackServer.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchFilterHost.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'RunDll32.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'BluetoothHeadsetProxy.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '112' Modul(e) wurden durchsucht
Durchsuche Prozess 'AlienwareAlienFXController.exe' - '96' Modul(e) wurden durchsucht
Durchsuche Prozess 'AWCCApplicationWatcher32.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'AWCCApplicationWatcher64.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '15' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '15' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '119' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'AlienFusionService.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAStorDataMgrSvc.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMS.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'AlienFusionController.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'daemonu.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'sppsvc.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'UNS.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '106' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '1449' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <Festplatte>
C:\Users\Alienware\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\59MY6Z8T\defined_regulations-frequently[1].htm
[FUND] Enthält Erkennungsmuster des Java-Scriptvirus JS/BlacoleRef.W.240
C:\Users\Alienware\AppData\Local\Temp\jar_cache6916628264291175772.tmp
[0] Archivtyp: ZIP
--> hw.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2012-0507.AW
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> mac.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Dermit.GC
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> test.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2013-0422.R
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\Alienware\AppData\Local\Temp\jar_cache7723917053210125407.tmp
[0] Archivtyp: ZIP
--> hw.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2012-0507.AW
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> mac.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Dermit.GC
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> test.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2013-0422.R
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\Alienware\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\77faaadf-11e9f0f9
[FUND] Ist das Trojanische Pferd TR/Crypt.ZPACK.Gen8
[0] Archivtyp: Runtime Packed
--> C:\Users\Alienware\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\77faaadf-31ddb91e
[1] Archivtyp: ZIP
--> hw.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2012-0507.AW
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> mac.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Dermit.GC
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> test.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2013-0422.R
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\Alienware\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\77faaadf-31ddb91e
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2013-0422.R
--> C:\Users\Alienware\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\77faaadf-43fb6c91
[1] Archivtyp: ZIP
--> hw.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2012-0507.AW
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> mac.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Dermit.GC
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> test.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2013-0422.R
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\Alienware\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\77faaadf-43fb6c91
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2013-0422.R
--> C:\Users\Alienware\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\77faaadf-487d2093
[1] Archivtyp: ZIP
--> hw.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2012-0507.AW
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> mac.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Dermit.GC
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> test.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2013-0422.R
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\Alienware\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\77faaadf-487d2093
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2013-0422.R
C:\Users\Alienware\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\77faaadf-77c37f78
[FUND] Ist das Trojanische Pferd TR/Crypt.ZPACK.Gen8
Beginne mit der Suche in 'D:\'
Der zu durchsuchende Pfad D:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.

Beginne mit der Desinfektion:
C:\Users\Alienware\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\77faaadf-77c37f78
[FUND] Ist das Trojanische Pferd TR/Crypt.ZPACK.Gen8
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5c9628cd.qua' verschoben!
C:\Users\Alienware\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\77faaadf-487d2093
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2013-0422.R
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4401076a.qua' verschoben!
C:\Users\Alienware\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\77faaadf-43fb6c91
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2013-0422.R
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '165e5d82.qua' verschoben!
C:\Users\Alienware\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\77faaadf-31ddb91e
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2013-0422.R
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '70691240.qua' verschoben!
C:\Users\Alienware\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\77faaadf-11e9f0f9
[FUND] Ist das Trojanische Pferd TR/Crypt.ZPACK.Gen8
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '35ed3f7e.qua' verschoben!
C:\Users\Alienware\AppData\Local\Temp\jar_cache7723917053210125407.tmp
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2013-0422.R
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4aea0d71.qua' verschoben!
C:\Users\Alienware\AppData\Local\Temp\jar_cache6916628264291175772.tmp
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2013-0422.R
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0652213b.qua' verschoben!
C:\Users\Alienware\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\59MY6Z8T\defined_regulations-frequently[1].htm
[FUND] Enthält Erkennungsmuster des Java-Scriptvirus JS/BlacoleRef.W.240
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7a566157.qua' verschoben!


Ende des Suchlaufs: Montag, 18. Februar 2013 20:54
Benötigte Zeit: 34:41 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

21405 Verzeichnisse wurden überprüft
508503 Dateien wurden geprüft
21 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
8 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
508482 Dateien ohne Befall
5559 Archive wurden durchsucht
15 Warnungen
8 Hinweise

Eventuel kann jemand dazu was sagen...Danke!

Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.


Bitte beachte folgende Hinweise:

• Eine Bereinigung ist mitunter mit viel Arbeit für dich verbunden. Es können mehrere Analyse- und Bereinigungsschritte erforderlich sein.
  Abschließend entfernen wir wieder alle verwendeten Programme und ich gebe dir ein paar Tipps für die Zukunft mit auf den Weg.
• Bei Anzeichen von illegaler Software wird der Support ohne Diskussion eingestellt.
• Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab.
• Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
• Führe nur Scans durch, zu denen du von mir oder einem anderen Helfer aufgefordert wirst.
• Bitte kein Crossposting (posten in mehreren Foren).
• Installiere oder deinstalliere während der Bereinigung keine Software außer du wirst dazu aufgefordert.
• Solltest du mir nicht innerhalb von 5 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo.
• Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort zu starten!
  Ich kann Dir niemals eine Garantie geben, dass auch ich alles finde. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.
  Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Wir schauen uns deinen Rechner etwas genauer an, dann kann ich dir mehr sagen.




Schritt 1
Downloade dir bitte DDS ( von sUBs ) von einem der folgenden Downloadspiegel und speichere die Datei auf deinem Desktop.

dds.com
dds.exe

• Starte bitte dds mit einem Doppelklick.
• Der Desktop wird verschwinden, das ist normal.
• Setze bitte einen Haken bei
  • dds.txt ( Sollte angehakt sein )
  • attach.txt
  Ändere keine Einstellungen ohne Anweisung
• Wenn der Scan beendet ist, wird DDS 2 Logfiles auf deinem Desktop erstellen:
  • dds.txt
  • attach.txt

Bitte poste beide Logfiles in deiner nächsten Antwort.





Schritt 2
Downloade Dir bitte defogger von jpshortstuff auf Deinem Desktop.

• Starte das Tool mit Doppelklick.
• Klicke nun auf den Disable Button, um die Treiber gewisser Emulatoren zu deaktivieren.
• Defogger wird dich fragen "Defogger will forcefully terminate and disable all CD Emulator related drivers and processes... Continue?" bestätige diese Sicherheitsabfrage mit Ja.
• Wenn der Scan beendet wurde (Finished), klicke auf OK.
• Defogger fordert gegebenfalls zum Neustart auf. Bestätige dies mit OK.
• Defogger erstellt auf dem Desktop eine Logdatei mit dem Namen defogger_disable.txt. Poste deren Inhalt mit deiner nächsten Antwort.

Klicke den Re-enable Button nicht ohne Anweisung!





Schritt 3
Bitte

• alle anderen Scanner gegen Viren, Spyware, usw. deaktivieren,
• keine bestehende Verbindung zu einem Netzwerk/Internet (WLAN nicht vergessen),
• nichts am Rechner arbeiten,
• nach jedem Scan der Rechner neu gestarten.

Gmer scannen lassen

• Lade Dir Gmer von dieser Seite herunter
  (auf den Button Download EXE drücken) und das Programm auf dem Desktop speichern.
• Alle anderen Programme sollen geschlossen sein.
• Starte gmer.exe (Programm hat einen willkürlichen Programm-Namen).
  Vista und Win7 User mit Rechtsklick und als Administrator starten.
• Sollte sich ein Fenster mit folgender Warnung öffnen:

  WARNING !!!
  GMER has found system modification, which might have been caused by ROOTKIT activity.
  Do you want to fully scan your system ?

  Unbedingt auf "No" klicken.
• Entferne rechts den Haken bei:

  • IAT/EAT
  • Alle Festplatten ausser die Systemplatte (normalerweise ist nur C:\ angehackt)
  • Show all (sollte abgehackt sein)

• Starte den Scan mit "Scan". Mache nichts am Computer während der Scan läuft.
• Wenn der Scan fertig ist klicke auf Save und speichere die Logfile unter Gmer.txt[/B] auf deinem Desktop. Mit "Ok" wird GMER beendet.

Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!





Bitte poste mit deiner nächsten Antwort

• die beiden Logdateien von DDS,
• die Logdatei von DeFogger,
• die Logdatei GMER.

Hallo , erst mal danke für die schnelle Hilfe , echt super!
Ich hoffe ich habe alles richtig gemacht...
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.DDS Logfile:

DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium 
Boot Device: \Device\HarddiskVolume2
Install Date: 07.11.2012 19:33:00
System Uptime: 19.02.2013 15:24:12 (0 hours ago)
.
Motherboard: Alienware |  | M17xR3
Processor: Intel(R) Core(TM) i7-2630QM CPU @ 2.00GHz | CPU1 | 2001/1333mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 689 GiB total, 623,207 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft-ISATAP-Adapter
Device ID: ROOT\*ISATAP\0000
Manufacturer: Microsoft
Name: Microsoft-ISATAP-Adapter
PNP Device ID: ROOT\*ISATAP\0000
Service: tunnel
.
==== System Restore Points ===================
.
RP33: 09.01.2013 19:32:02 - Windows Update
RP34: 14.01.2013 16:59:06 - Windows-Sicherung
RP35: 25.01.2013 15:55:44 - Windows-Sicherung
RP36: 28.01.2013 16:06:39 - Windows-Sicherung
RP37: 04.02.2013 15:43:27 - Windows-Sicherung
RP38: 12.02.2013 15:57:15 - Windows-Sicherung
RP39: 14.02.2013 17:31:50 - Windows Update
RP40: 18.02.2013 20:25:22 - Windows-Sicherung
.
==== Installed Programs ======================
.
Adobe Flash Player 11 ActiveX
Adobe Reader 9.1.2 - Deutsch
Advanced Audio FX Engine
Akamai NetSession Interface
AlienRespawn
AlienRespawn - Support Software
Alienware Command Center
Alienware M17x Manual
Alienware On-Screen Display
Alienware Product Registration
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Ask Toolbar
Ask Toolbar Updater
Avira Free Antivirus
Bonjour
CyberLink PowerDVD 9.6
Dell System Detect
Diablo III
DirectX 9 Runtime
EMSC
Google Chrome
Google Update Helper
IDT Audio
Integrated Webcam Live! Central
Intel(R) Management Engine Components
Intel(R) Rapid Storage Technology
iTunes
Java Auto Updater
Java(TM) 6 Update 24 (64-bit)
Java(TM) 6 Update 37
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NVIDIA 3D Vision Controller-Treiber 310.70
NVIDIA 3D Vision Treiber 310.70
NVIDIA Grafiktreiber 310.70
NVIDIA HD-Audiotreiber 1.3.18.0
NVIDIA Install Application
NVIDIA PhysX
NVIDIA PhysX-Systemsoftware 9.12.1031
NVIDIA Stereoscopic 3D Driver
NVIDIA Systemsteuerung 310.70
NVIDIA Update 1.11.3
NVIDIA Update Components
PhotoShowExpress
RBVirtualFolder64Inst
Roxio Activation Module
Roxio BackOnTrack
Roxio Burn
Roxio Creator Starter
Roxio Express Labeler 3
Roxio File Backup
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft .NET Framework 4 Extended (KB2736428)
Security Update for Microsoft .NET Framework 4 Extended (KB2742595)
Sonic CinePlayer Decoder Pack
Synaptics Pointing Device Driver
System Requirements Lab CYRI
TechPowerUp GPU-Z
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
WIDCOMM Bluetooth Software
.
==== End Of File ======

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 16:02 on 19/02/2013 (Alienware)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-



DDS (Ver_2012-11-20.01) - NTFS_AMD64 
Internet Explorer: 9.0.8112.16464
Run by Alienware at 15:59:20 on 2013-02-19
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.8174.6290 [GMT 1:00]
.
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\IDT\WDM\STacSV64.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\IDT\WDM\AESTSr64.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
C:\Program Files (x86)\Google\Update\1.3.21.123\GoogleCrashHandler.exe
C:\Program Files (x86)\Google\Update\1.3.21.123\GoogleCrashHandler64.exe
C:\Program Files (x86)\AlienRespawn\sftservice.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files (x86)\AlienRespawn\Components\Scheduler\STService.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe
C:\Users\Alienware\AppData\Roaming\Ewceqa\keabi.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe
C:\Program Files\Alienware\Command Center\AWCCServiceController.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe
C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe
C:\Program Files (x86)\CyberLink\Shared files\brs.exe
C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Ask.com\Updater\Updater.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Windows\SysWOW64\RunDll32.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe
C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe
C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher64.exe
C:\Program Files\Alienware\Command Center\AlienFusionService.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Alienware\Command Center\AlienFusionController.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil64_11_5_502_149_ActiveX.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.de/
uDefault_Page_URL = hxxp://www.alienware.com/
uProxyOverride = <local>;*.local
uURLSearchHooks: UrlSearchHook Class: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
mWinlogon: Userinit = userinit.exe
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
uRun: [Akamai NetSession Interface] "C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe"
uRun: [{16039CE0-D422-AD40-EC21-3480ED21179D}] C:\Users\Alienware\AppData\Roaming\Ewceqa\keabi.exe
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun: [AlienwareOn-ScreenDisplay] C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [Integrated Webcam Live! Central] "C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe" /mode2
mRun: [Dell Registration] C:\Program Files (x86)\System Registration\prodreg.exe /boot
mRun: [RemoteControl9] "c:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe"
mRun: [PDVD9LanguageShortcut] "c:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe"
mRun: [BDRegion] c:\Program Files (x86)\Cyberlink\Shared Files\brs.exe
mRun: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"
mRun: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"
mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRunOnce: [Launcher] C:\Program Files (x86)\AlienRespawn\Components\Scheduler\Launcher.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: dell.com
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab
TCP: NameServer = 192.168.2.1
TCP: Interfaces\{0B26FFD0-EF79-497D-954C-E389D0A939BA} : DHCPNameServer = 192.168.2.1
TCP: Interfaces\{D12D4E92-7589-4D35-A703-35639E65D4B7} : DHCPNameServer = 150.200.3.2
SSODL: WebCheck - <orphaned>
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe
x64-Run: [Command Center Controllers] "C:\Program Files\Alienware\Command Center\AWCCStartupOrchestrator.exe"
x64-IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
x64-DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
x64-DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
x64-DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
x64-SSODL: WebCheck - <orphaned>
.
============= SERVICES / DRIVERS ===============
.
R0 EMSC;COMPAL Embedded System Control;C:\Windows\System32\drivers\EMSC.sys [2009-6-26 16752]
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2011-5-18 55856]
R0 stdcfltn;Disk Class Filter Driver for Accelerometer;C:\Windows\System32\drivers\stdcfltn.sys [2011-5-18 21616]
R1 avkmgr;avkmgr;C:\Windows\System32\drivers\avkmgr.sys [2012-11-9 27800]
R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2011-5-18 89600]
R2 AlienFusionService;Alienware Fusion Service;C:\Program Files\Alienware\Command Center\AlienFusionService.exe [2012-6-15 14704]
R2 AntiVirSchedulerService;Avira Planer;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2012-11-9 86752]
R2 AntiVirService;Avira Echtzeit-Scanner;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2012-11-9 110816]
R2 avgntflt;avgntflt;C:\Windows\System32\drivers\avgntflt.sys [2012-11-9 99912]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-5-18 13336]
R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\AlienRespawn\SftService.exe [2011-5-18 689472]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-11-30 382824]
R2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-12-20 2655768]
R3 Acceler;Accelerometer Service;C:\Windows\System32\drivers\Accelern.sys [2011-5-18 27760]
R3 btwampfl;Bluetooth AMP USB Filter;C:\Windows\System32\drivers\btwampfl.sys [2011-5-18 344616]
R3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\System32\drivers\btwl2cap.sys [2011-5-18 39464]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\System32\drivers\CtClsFlt.sys [2011-5-18 175168]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2011-5-18 76912]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2011-5-18 80384]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2011-5-18 180736]
R3 NvStUSB;NVIDIA Stereoscopic 3D USB driver;C:\Windows\System32\drivers\nvstusb.sys [2012-12-20 446312]
S2 CLKMSVC10_9EC60124;CyberLink Product - 2011/05/18 15:38:01;C:\Program Files (x86)\CyberLink\PowerDVD9\NavFilter\kmsvc.exe [2010-10-29 236016]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 RoxWatch12;Roxio Hard Drive Watcher 12;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]
S3 RoxMediaDB12OEM;RoxMediaDB12OEM;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\System32\drivers\RtsPStor.sys [2011-5-18 326760]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-21 59392]
S3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-7-9 52736]
.
=============== Created Last 30 ================
.
2013-02-14 16:33:03	768000	----a-w-	C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-14 16:33:02	996352	----a-w-	C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-14 15:05:20	--------	d-----w-	C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-02-14 15:05:20	--------	d-----w-	C:\Program Files\iTunes
2013-02-14 15:05:20	--------	d-----w-	C:\Program Files\iPod
2013-02-14 15:05:20	--------	d-----w-	C:\Program Files (x86)\iTunes
2013-02-14 15:01:32	3153408	----a-w-	C:\Windows\System32\win32k.sys
2013-02-14 15:01:31	7680	----a-w-	C:\Windows\SysWow64\instnm.exe
2013-02-14 15:01:31	5120	----a-w-	C:\Windows\SysWow64\wow32.dll
2013-02-14 15:01:31	25600	----a-w-	C:\Windows\SysWow64\setup16.exe
2013-02-14 15:01:31	215040	----a-w-	C:\Windows\System32\winsrv.dll
2013-02-14 15:01:31	2048	----a-w-	C:\Windows\SysWow64\user.exe
2013-02-14 15:01:31	14336	----a-w-	C:\Windows\SysWow64\ntvdm64.dll
2013-02-14 15:01:30	5553512	----a-w-	C:\Windows\System32\ntoskrnl.exe
2013-02-14 15:01:30	3967848	----a-w-	C:\Windows\SysWow64\ntkrnlpa.exe
2013-02-14 15:01:30	3913064	----a-w-	C:\Windows\SysWow64\ntoskrnl.exe
2013-02-14 14:58:52	288088	----a-w-	C:\Windows\System32\drivers\FWPKCLNT.SYS
2013-02-14 14:58:52	1913192	----a-w-	C:\Windows\System32\drivers\tcpip.sys
.
==================== Find3M  ====================
.
2013-02-14 15:17:22	74096	----a-w-	C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-02-14 15:17:22	697712	----a-w-	C:\Windows\SysWow64\FlashPlayerApp.exe
2013-01-09 01:19:09	2312704	----a-w-	C:\Windows\System32\jscript9.dll
2013-01-09 01:12:03	1392128	----a-w-	C:\Windows\System32\wininet.dll
2013-01-09 01:11:06	1494528	----a-w-	C:\Windows\System32\inetcpl.cpl
2013-01-09 01:07:51	173056	----a-w-	C:\Windows\System32\ieUnatt.exe
2013-01-09 01:07:47	599040	----a-w-	C:\Windows\System32\vbscript.dll
2013-01-09 01:04:42	2382848	----a-w-	C:\Windows\System32\mshtml.tlb
2013-01-08 22:11:21	1800704	----a-w-	C:\Windows\SysWow64\jscript9.dll
2013-01-08 22:03:20	1129472	----a-w-	C:\Windows\SysWow64\wininet.dll
2013-01-08 22:03:12	1427968	----a-w-	C:\Windows\SysWow64\inetcpl.cpl
2013-01-08 21:59:02	142848	----a-w-	C:\Windows\SysWow64\ieUnatt.exe
2013-01-08 21:58:29	420864	----a-w-	C:\Windows\SysWow64\vbscript.dll
2013-01-08 21:56:23	2382848	----a-w-	C:\Windows\SysWow64\mshtml.tlb
2013-01-04 04:43:21	44032	----a-w-	C:\Windows\apppatch\acwow64.dll
2012-12-16 17:11:22	46080	----a-w-	C:\Windows\System32\atmlib.dll
2012-12-16 14:45:03	367616	----a-w-	C:\Windows\System32\atmfd.dll
2012-12-16 14:13:28	295424	----a-w-	C:\Windows\SysWow64\atmfd.dll
2012-12-16 14:13:20	34304	----a-w-	C:\Windows\SysWow64\atmlib.dll
2012-12-11 17:49:18	99912	----a-w-	C:\Windows\System32\drivers\avgntflt.sys
2012-12-07 13:20:16	441856	----a-w-	C:\Windows\System32\Wpc.dll
2012-12-07 13:15:31	2746368	----a-w-	C:\Windows\System32\gameux.dll
2012-12-07 12:26:17	308736	----a-w-	C:\Windows\SysWow64\Wpc.dll
2012-12-07 12:20:43	2576384	----a-w-	C:\Windows\SysWow64\gameux.dll
2012-12-07 11:20:04	30720	----a-w-	C:\Windows\System32\usk.rs
2012-12-07 11:20:03	43520	----a-w-	C:\Windows\System32\csrr.rs
2012-12-07 11:20:03	23552	----a-w-	C:\Windows\System32\oflc.rs
2012-12-07 11:20:01	45568	----a-w-	C:\Windows\System32\oflc-nz.rs
2012-12-07 11:20:01	44544	----a-w-	C:\Windows\System32\pegibbfc.rs
2012-12-07 11:20:01	20480	----a-w-	C:\Windows\System32\pegi-fi.rs
2012-12-07 11:20:00	20480	----a-w-	C:\Windows\System32\pegi-pt.rs
2012-12-07 11:19:59	20480	----a-w-	C:\Windows\System32\pegi.rs
2012-12-07 11:19:58	46592	----a-w-	C:\Windows\System32\fpb.rs
2012-12-07 11:19:57	40960	----a-w-	C:\Windows\System32\cob-au.rs
2012-12-07 11:19:57	21504	----a-w-	C:\Windows\System32\grb.rs
2012-12-07 11:19:57	15360	----a-w-	C:\Windows\System32\djctq.rs
2012-12-07 11:19:56	55296	----a-w-	C:\Windows\System32\cero.rs
2012-12-07 11:19:55	51712	----a-w-	C:\Windows\System32\esrb.rs
2012-12-03 15:47:14	9271352	----a-w-	C:\Windows\System32\nvcuda.dll
2012-12-01 12:41:38	446312	----a-w-	C:\Windows\System32\drivers\nvstusb.sys
2012-12-01 12:41:38	1509736	----a-w-	C:\Windows\System32\nvir3dgenco6420152.dll
2012-12-01 05:49:26	2557800	----a-w-	C:\Windows\System32\nvsvcr.dll
2012-12-01 05:49:25	63336	----a-w-	C:\Windows\System32\nvshext.dll
2012-12-01 05:49:25	118120	----a-w-	C:\Windows\System32\nvmctray.dll
2012-12-01 05:49:24	890216	----a-w-	C:\Windows\System32\nvvsvc.exe
2012-12-01 05:48:41	6223208	----a-w-	C:\Windows\System32\nvcpl.dll
2012-12-01 05:48:37	3311464	----a-w-	C:\Windows\System32\nvsvc64.dll
2012-11-30 21:43:52	438632	----a-w-	C:\Windows\SysWow64\nvStreaming.exe
2012-11-30 05:45:35	362496	----a-w-	C:\Windows\System32\wow64win.dll
2012-11-30 05:45:35	243200	----a-w-	C:\Windows\System32\wow64.dll
2012-11-30 05:45:35	13312	----a-w-	C:\Windows\System32\wow64cpu.dll
2012-11-30 05:43:12	16384	----a-w-	C:\Windows\System32\ntvdm64.dll
2012-11-30 05:41:07	424448	----a-w-	C:\Windows\System32\KernelBase.dll
2012-11-30 04:53:59	274944	----a-w-	C:\Windows\SysWow64\KernelBase.dll
2012-11-30 03:23:48	338432	----a-w-	C:\Windows\System32\conhost.exe
2012-11-30 02:38:59	6144	---ha-w-	C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
2012-11-30 02:38:59	4608	---ha-w-	C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
2012-11-30 02:38:59	3584	---ha-w-	C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
2012-11-30 02:38:59	3072	---ha-w-	C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
2012-11-23 03:13:57	68608	----a-w-	C:\Windows\System32\taskhost.exe
2012-11-22 05:44:23	800768	----a-w-	C:\Windows\System32\usp10.dll
2012-11-22 04:45:03	626688	----a-w-	C:\Windows\SysWow64\usp10.dll
.
============= FINISH: 15:59:39,30 ===============
         

--- --- ---




.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 07.11.2012 19:33:00
System Uptime: 19.02.2013 15:24:12 (0 hours ago)
.
Motherboard: Alienware | | M17xR3
Processor: Intel(R) Core(TM) i7-2630QM CPU @ 2.00GHz | CPU1 | 2001/1333mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 689 GiB total, 623,207 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft-ISATAP-Adapter
Device ID: ROOT\*ISATAP\0000
Manufacturer: Microsoft
Name: Microsoft-ISATAP-Adapter
PNP Device ID: ROOT\*ISATAP\0000
Service: tunnel
.
==== System Restore Points ===================
.
RP33: 09.01.2013 19:32:02 - Windows Update
RP34: 14.01.2013 16:59:06 - Windows-Sicherung
RP35: 25.01.2013 15:55:44 - Windows-Sicherung
RP36: 28.01.2013 16:06:39 - Windows-Sicherung
RP37: 04.02.2013 15:43:27 - Windows-Sicherung
RP38: 12.02.2013 15:57:15 - Windows-Sicherung
RP39: 14.02.2013 17:31:50 - Windows Update
RP40: 18.02.2013 20:25:22 - Windows-Sicherung
.
==== Installed Programs ======================
.
Adobe Flash Player 11 ActiveX
Adobe Reader 9.1.2 - Deutsch
Advanced Audio FX Engine
Akamai NetSession Interface
AlienRespawn
AlienRespawn - Support Software
Alienware Command Center
Alienware M17x Manual
Alienware On-Screen Display
Alienware Product Registration
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Ask Toolbar
Ask Toolbar Updater
Avira Free Antivirus
Bonjour
CyberLink PowerDVD 9.6
Dell System Detect
Diablo III
DirectX 9 Runtime
EMSC
Google Chrome
Google Update Helper
IDT Audio
Integrated Webcam Live! Central
Intel(R) Management Engine Components
Intel(R) Rapid Storage Technology
iTunes
Java Auto Updater
Java(TM) 6 Update 24 (64-bit)
Java(TM) 6 Update 37
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NVIDIA 3D Vision Controller-Treiber 310.70
NVIDIA 3D Vision Treiber 310.70
NVIDIA Grafiktreiber 310.70
NVIDIA HD-Audiotreiber 1.3.18.0
NVIDIA Install Application
NVIDIA PhysX
NVIDIA PhysX-Systemsoftware 9.12.1031
NVIDIA Stereoscopic 3D Driver
NVIDIA Systemsteuerung 310.70
NVIDIA Update 1.11.3
NVIDIA Update Components
PhotoShowExpress
RBVirtualFolder64Inst
Roxio Activation Module
Roxio BackOnTrack
Roxio Burn
Roxio Creator Starter
Roxio Express Labeler 3
Roxio File Backup
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft .NET Framework 4 Extended (KB2736428)
Security Update for Microsoft .NET Framework 4 Extended (KB2742595)
Sonic CinePlayer Decoder Pack
Synaptics Pointing Device Driver
System Requirements Lab CYRI
TechPowerUp GPU-Z
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
WIDCOMM Bluetooth Software
.
==== End Of File ===========================

GMER Logfile:

GMER 2.1.18952 - hxxp://www.gmer.net
Rootkit scan 2013-02-19 16:35:02
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST975042 rev.0005 698,64GB
Running: bj0vkdbj.exe; Driver: C:\Users\ALIENW~1\AppData\Local\Temp\pwldauob.sys


---- User code sections - GMER 2.1 ----

.text   C:\Program Files (x86)\AlienRespawn\sftservice.EXE[2300] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                   0000000076971465 2 bytes [97, 76]
.text   C:\Program Files (x86)\AlienRespawn\sftservice.EXE[2300] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                  00000000769714bb 2 bytes [97, 76]
.text   ...                                                                                                                                                * 2
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                                 0000000077ea08fc 5 bytes JMP 00000001008ba0ef
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                          0000000077ebc45a 5 bytes JMP 00000001008ba28d
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\USER32.dll!TranslateMessage                                   0000000076697809 5 bytes JMP 000000010089ef39
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\USER32.dll!GetClipboardData                                   00000000766d9f1d 5 bytes JMP 000000010089ef7f
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext                             0000000075580bb9 5 bytes JMP 00000001008a4611
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                                    000000007558124e 5 bytes JMP 00000001008a465b
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\SspiCli.dll!DecryptMessage                                    000000007558129d 5 bytes JMP 00000001008a469f
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WS2_32.dll!closesocket                                        0000000077183918 5 bytes JMP 00000001008a3be4
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                                        0000000077184296 5 bytes JMP 00000001008a3a79
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WS2_32.dll!WSASend                                            0000000077184406 5 bytes JMP 00000001008a3e24
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                                       0000000077184889 5 bytes JMP 00000001008a397a
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                                      0000000077184b1b 5 bytes JMP 00000001008a3af1
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WS2_32.dll!recv                                               0000000077186b0e 5 bytes JMP 00000001008a3c3b
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WS2_32.dll!send                                               0000000077186f01 5 bytes JMP 00000001008a3dd2
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WS2_32.dll!WSARecv                                            0000000077187089 5 bytes JMP 00000001008a3c93
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult                             0000000077187489 5 bytes JMP 00000001008a3ed0
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WS2_32.dll!gethostbyname                                      0000000077197673 1 byte JMP 00000001008a3b77
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WS2_32.dll!gethostbyname + 2                                  0000000077197675 3 bytes {JMP 0xffffffff8970c504}
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                           0000000076971465 2 bytes [97, 76]
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                          00000000769714bb 2 bytes [97, 76]
.text   ...                                                                                                                                                * 2
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                               000000007681c664 5 bytes JMP 00000001008aae9d
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                                    000000007681e13a 5 bytes JMP 00000001008ac1c0
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WININET.dll!InternetReadFile                                  000000007681f8d8 5 bytes JMP 00000001008ac0b3
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable                        0000000076823184 5 bytes JMP 00000001008ac125
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW                                    0000000076845865 5 bytes JMP 00000001008ac1e4
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                                  000000007684632d 5 bytes JMP 00000001008ab977
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WININET.dll!InternetReadFileExW                               000000007684f9ee 5 bytes JMP 00000001008ac0ff
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                               000000007684fa49 5 bytes JMP 00000001008ac0d9
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                                000000007685f564 5 bytes JMP 00000001008ab9bd
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WININET.dll!InternetWriteFile                                 000000007685f6c6 5 bytes JMP 00000001008abb40
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                                  000000007687525a 5 bytes JMP 00000001008ab954
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                                00000000768bece5 5 bytes JMP 00000001008ab99a
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3312] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                                0000000077411224 5 bytes JMP 00000001008b75fb
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                                 0000000077ea08fc 5 bytes JMP 00000001008ba0ef
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                          0000000077ebc45a 5 bytes JMP 00000001008ba28d
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\USER32.dll!TranslateMessage                                   0000000076697809 5 bytes JMP 000000010089ef39
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\USER32.dll!GetClipboardData                                   00000000766d9f1d 5 bytes JMP 000000010089ef7f
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext                             0000000075580bb9 5 bytes JMP 00000001008a4611
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                                    000000007558124e 5 bytes JMP 00000001008a465b
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\SspiCli.dll!DecryptMessage                                    000000007558129d 5 bytes JMP 00000001008a469f
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WS2_32.dll!closesocket                                        0000000077183918 5 bytes JMP 00000001008a3be4
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                                        0000000077184296 5 bytes JMP 00000001008a3a79
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WS2_32.dll!WSASend                                            0000000077184406 5 bytes JMP 00000001008a3e24
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                                       0000000077184889 5 bytes JMP 00000001008a397a
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                                      0000000077184b1b 5 bytes JMP 00000001008a3af1
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WS2_32.dll!recv                                               0000000077186b0e 5 bytes JMP 00000001008a3c3b
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WS2_32.dll!send                                               0000000077186f01 5 bytes JMP 00000001008a3dd2
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WS2_32.dll!WSARecv                                            0000000077187089 5 bytes JMP 00000001008a3c93
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult                             0000000077187489 5 bytes JMP 00000001008a3ed0
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WS2_32.dll!gethostbyname                                      0000000077197673 1 byte JMP 00000001008a3b77
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WS2_32.dll!gethostbyname + 2                                  0000000077197675 3 bytes {JMP 0xffffffff8970c504}
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                           0000000076971465 2 bytes [97, 76]
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                          00000000769714bb 2 bytes [97, 76]
.text   ...                                                                                                                                                * 2
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                               000000007681c664 5 bytes JMP 00000001008aae9d
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                                    000000007681e13a 5 bytes JMP 00000001008ac1c0
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WININET.dll!InternetReadFile                                  000000007681f8d8 5 bytes JMP 00000001008ac0b3
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable                        0000000076823184 5 bytes JMP 00000001008ac125
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW                                    0000000076845865 5 bytes JMP 00000001008ac1e4
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                                  000000007684632d 5 bytes JMP 00000001008ab977
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WININET.dll!InternetReadFileExW                               000000007684f9ee 5 bytes JMP 00000001008ac0ff
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                               000000007684fa49 5 bytes JMP 00000001008ac0d9
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                                000000007685f564 5 bytes JMP 00000001008ab9bd
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WININET.dll!InternetWriteFile                                 000000007685f6c6 5 bytes JMP 00000001008abb40
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                                  000000007687525a 5 bytes JMP 00000001008ab954
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                                00000000768bece5 5 bytes JMP 00000001008ab99a
.text   C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe[3600] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                                0000000077411224 5 bytes JMP 00000001008b75fb
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess              0000000077ea08fc 5 bytes JMP 000000010011a0ef
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                       0000000077ebc45a 5 bytes JMP 000000010011a28d
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext          0000000075580bb9 5 bytes JMP 0000000100104611
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                 000000007558124e 5 bytes JMP 000000010010465b
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\SspiCli.dll!DecryptMessage                 000000007558129d 5 bytes JMP 000000010010469f
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\USER32.dll!TranslateMessage                0000000076697809 5 bytes JMP 00000001000fef39
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\USER32.dll!GetClipboardData                00000000766d9f1d 5 bytes JMP 00000001000fef7f
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WS2_32.dll!closesocket                     0000000077183918 5 bytes JMP 0000000100103be4
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                     0000000077184296 5 bytes JMP 0000000100103a79
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WS2_32.dll!WSASend                         0000000077184406 5 bytes JMP 0000000100103e24
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                    0000000077184889 5 bytes JMP 000000010010397a
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                   0000000077184b1b 5 bytes JMP 0000000100103af1
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WS2_32.dll!recv                            0000000077186b0e 5 bytes JMP 0000000100103c3b
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WS2_32.dll!send                            0000000077186f01 5 bytes JMP 0000000100103dd2
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WS2_32.dll!WSARecv                         0000000077187089 5 bytes JMP 0000000100103c93
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult          0000000077187489 5 bytes JMP 0000000100103ed0
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WS2_32.dll!gethostbyname                   0000000077197673 1 byte JMP 0000000100103b77
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WS2_32.dll!gethostbyname + 2               0000000077197675 3 bytes {JMP 0xffffffff88f6c504}
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore             0000000077411224 5 bytes JMP 00000001001175fb
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WININET.dll!InternetCloseHandle            000000007681c664 5 bytes JMP 000000010010ae9d
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                 000000007681e13a 5 bytes JMP 000000010010c1c0
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WININET.dll!InternetReadFile               000000007681f8d8 5 bytes JMP 000000010010c0b3
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable     0000000076823184 5 bytes JMP 000000010010c125
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW                 0000000076845865 5 bytes JMP 000000010010c1e4
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WININET.dll!HttpSendRequestW               000000007684632d 5 bytes JMP 000000010010b977
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WININET.dll!InternetReadFileExW            000000007684f9ee 3 bytes JMP 000000010010c0ff
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WININET.dll!InternetReadFileExW + 4        000000007684f9f2 1 byte [89]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WININET.dll!InternetReadFileExA            000000007684fa49 3 bytes JMP 000000010010c0d9
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WININET.dll!InternetReadFileExA + 4        000000007684fa4d 1 byte [89]
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW             000000007685f564 5 bytes JMP 000000010010b9bd
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WININET.dll!InternetWriteFile              000000007685f6c6 5 bytes JMP 000000010010bb40
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WININET.dll!HttpSendRequestA               000000007687525a 5 bytes JMP 000000010010b954
.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3696] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA             00000000768bece5 5 bytes JMP 000000010010b99a
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess           0000000077ea08fc 5 bytes JMP 00000001001ea0ef
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                    0000000077ebc45a 5 bytes JMP 00000001001ea28d
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\USER32.dll!TranslateMessage             0000000076697809 5 bytes JMP 00000001001cef39
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\USER32.dll!GetClipboardData             00000000766d9f1d 5 bytes JMP 00000001001cef7f
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext       0000000075580bb9 5 bytes JMP 00000001001d4611
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\SspiCli.dll!EncryptMessage              000000007558124e 5 bytes JMP 00000001001d465b
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\SspiCli.dll!DecryptMessage              000000007558129d 5 bytes JMP 00000001001d469f
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WS2_32.dll!closesocket                  0000000077183918 5 bytes JMP 00000001001d3be4
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                  0000000077184296 5 bytes JMP 00000001001d3a79
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WS2_32.dll!WSASend                      0000000077184406 5 bytes JMP 00000001001d3e24
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                 0000000077184889 5 bytes JMP 00000001001d397a
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                0000000077184b1b 5 bytes JMP 00000001001d3af1
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WS2_32.dll!recv                         0000000077186b0e 5 bytes JMP 00000001001d3c3b
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WS2_32.dll!send                         0000000077186f01 5 bytes JMP 00000001001d3dd2
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WS2_32.dll!WSARecv                      0000000077187089 5 bytes JMP 00000001001d3c93
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult       0000000077187489 5 bytes JMP 00000001001d3ed0
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WS2_32.dll!gethostbyname                0000000077197673 1 byte JMP 00000001001d3b77
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WS2_32.dll!gethostbyname + 2            0000000077197675 3 bytes {JMP 0xffffffff8903c504}
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore          0000000077411224 5 bytes JMP 00000001001e75fb
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WININET.dll!InternetCloseHandle         000000007681c664 5 bytes JMP 00000001001dae9d
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA              000000007681e13a 5 bytes JMP 00000001001dc1c0
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WININET.dll!InternetReadFile            000000007681f8d8 5 bytes JMP 00000001001dc0b3
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable  0000000076823184 5 bytes JMP 00000001001dc125
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW              0000000076845865 5 bytes JMP 00000001001dc1e4
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WININET.dll!HttpSendRequestW            000000007684632d 5 bytes JMP 00000001001db977
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WININET.dll!InternetReadFileExW         000000007684f9ee 5 bytes JMP 00000001001dc0ff
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WININET.dll!InternetReadFileExA         000000007684fa49 5 bytes JMP 00000001001dc0d9
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW          000000007685f564 5 bytes JMP 00000001001db9bd
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WININET.dll!InternetWriteFile           000000007685f6c6 5 bytes JMP 00000001001dbb40
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WININET.dll!HttpSendRequestA            000000007687525a 5 bytes JMP 00000001001db954
.text   C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe[3824] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA          00000000768bece5 5 bytes JMP 00000001001db99a
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                       0000000077ea08fc 5 bytes JMP 00000001001ba0ef
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                0000000077ebc45a 5 bytes JMP 00000001001ba28d
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\USER32.dll!TranslateMessage                         0000000076697809 5 bytes JMP 000000010019ef39
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\USER32.dll!GetClipboardData                         00000000766d9f1d 5 bytes JMP 000000010019ef7f
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext                   0000000075580bb9 5 bytes JMP 00000001001a4611
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                          000000007558124e 5 bytes JMP 00000001001a465b
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\SspiCli.dll!DecryptMessage                          000000007558129d 5 bytes JMP 00000001001a469f
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WS2_32.dll!closesocket                              0000000077183918 5 bytes JMP 00000001001a3be4
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                              0000000077184296 5 bytes JMP 00000001001a3a79
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WS2_32.dll!WSASend                                  0000000077184406 5 bytes JMP 00000001001a3e24
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                             0000000077184889 5 bytes JMP 00000001001a397a
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                            0000000077184b1b 5 bytes JMP 00000001001a3af1
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WS2_32.dll!recv                                     0000000077186b0e 5 bytes JMP 00000001001a3c3b
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WS2_32.dll!send                                     0000000077186f01 5 bytes JMP 00000001001a3dd2
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WS2_32.dll!WSARecv                                  0000000077187089 5 bytes JMP 00000001001a3c93
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult                   0000000077187489 5 bytes JMP 00000001001a3ed0
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WS2_32.dll!gethostbyname                            0000000077197673 1 byte JMP 00000001001a3b77
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WS2_32.dll!gethostbyname + 2                        0000000077197675 3 bytes {JMP 0xffffffff8900c504}
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                      0000000077411224 5 bytes JMP 00000001001b75fb
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                     000000007681c664 5 bytes JMP 00000001001aae9d
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                          000000007681e13a 5 bytes JMP 00000001001ac1c0
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WININET.dll!InternetReadFile                        000000007681f8d8 5 bytes JMP 00000001001ac0b3
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable              0000000076823184 5 bytes JMP 00000001001ac125
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW                          0000000076845865 5 bytes JMP 00000001001ac1e4
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                        000000007684632d 5 bytes JMP 00000001001ab977
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WININET.dll!InternetReadFileExW                     000000007684f9ee 5 bytes JMP 00000001001ac0ff
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                     000000007684fa49 5 bytes JMP 00000001001ac0d9
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                      000000007685f564 5 bytes JMP 00000001001ab9bd
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WININET.dll!InternetWriteFile                       000000007685f6c6 5 bytes JMP 00000001001abb40
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                        000000007687525a 5 bytes JMP 00000001001ab954
.text   C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe[3912] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                      00000000768bece5 5 bytes JMP 00000001001ab99a
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                                   0000000077ea08fc 5 bytes JMP 00000001001ba0ef
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                            0000000077ebc45a 5 bytes JMP 00000001001ba28d
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\USER32.dll!TranslateMessage                                     0000000076697809 5 bytes JMP 000000010019ef39
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\USER32.dll!GetClipboardData                                     00000000766d9f1d 5 bytes JMP 000000010019ef7f
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext                               0000000075580bb9 5 bytes JMP 00000001001a4611
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                                      000000007558124e 5 bytes JMP 00000001001a465b
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\SspiCli.dll!DecryptMessage                                      000000007558129d 5 bytes JMP 00000001001a469f
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WS2_32.dll!closesocket                                          0000000077183918 5 bytes JMP 00000001001a3be4
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                                          0000000077184296 5 bytes JMP 00000001001a3a79
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WS2_32.dll!WSASend                                              0000000077184406 5 bytes JMP 00000001001a3e24
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                                         0000000077184889 5 bytes JMP 00000001001a397a
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                                        0000000077184b1b 5 bytes JMP 00000001001a3af1
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WS2_32.dll!recv                                                 0000000077186b0e 5 bytes JMP 00000001001a3c3b
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WS2_32.dll!send                                                 0000000077186f01 5 bytes JMP 00000001001a3dd2
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WS2_32.dll!WSARecv                                              0000000077187089 5 bytes JMP 00000001001a3c93
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult                               0000000077187489 5 bytes JMP 00000001001a3ed0
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WS2_32.dll!gethostbyname                                        0000000077197673 1 byte JMP 00000001001a3b77
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WS2_32.dll!gethostbyname + 2                                    0000000077197675 3 bytes {JMP 0xffffffff8900c504}
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                                  0000000077411224 5 bytes JMP 00000001001b75fb
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                                 000000007681c664 5 bytes JMP 00000001001aae9d
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                                      000000007681e13a 5 bytes JMP 00000001001ac1c0
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WININET.dll!InternetReadFile                                    000000007681f8d8 5 bytes JMP 00000001001ac0b3
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable                          0000000076823184 5 bytes JMP 00000001001ac125
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW                                      0000000076845865 5 bytes JMP 00000001001ac1e4
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                                    000000007684632d 5 bytes JMP 00000001001ab977
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WININET.dll!InternetReadFileExW                                 000000007684f9ee 5 bytes JMP 00000001001ac0ff
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                                 000000007684fa49 5 bytes JMP 00000001001ac0d9
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                                  000000007685f564 5 bytes JMP 00000001001ab9bd
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WININET.dll!InternetWriteFile                                   000000007685f6c6 5 bytes JMP 00000001001abb40
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                                    000000007687525a 5 bytes JMP 00000001001ab954
.text   C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3956] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                                  00000000768bece5 5 bytes JMP 00000001001ab99a
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                                      0000000077ea08fc 5 bytes JMP 00000001001ba0ef
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                               0000000077ebc45a 5 bytes JMP 00000001001ba28d
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\USER32.dll!TranslateMessage                                        0000000076697809 5 bytes JMP 000000010019ef39
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\USER32.dll!GetClipboardData                                        00000000766d9f1d 5 bytes JMP 000000010019ef7f
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext                                  0000000075580bb9 5 bytes JMP 00000001001a4611
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                                         000000007558124e 5 bytes JMP 00000001001a465b
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\SspiCli.dll!DecryptMessage                                         000000007558129d 5 bytes JMP 00000001001a469f
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WS2_32.dll!closesocket                                             0000000077183918 5 bytes JMP 00000001001a3be4
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                                             0000000077184296 5 bytes JMP 00000001001a3a79
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WS2_32.dll!WSASend                                                 0000000077184406 5 bytes JMP 00000001001a3e24
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                                            0000000077184889 5 bytes JMP 00000001001a397a
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                                           0000000077184b1b 5 bytes JMP 00000001001a3af1
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WS2_32.dll!recv                                                    0000000077186b0e 5 bytes JMP 00000001001a3c3b
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WS2_32.dll!send                                                    0000000077186f01 5 bytes JMP 00000001001a3dd2
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WS2_32.dll!WSARecv                                                 0000000077187089 5 bytes JMP 00000001001a3c93
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult                                  0000000077187489 5 bytes JMP 00000001001a3ed0
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WS2_32.dll!gethostbyname                                           0000000077197673 1 byte JMP 00000001001a3b77
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WS2_32.dll!gethostbyname + 2                                       0000000077197675 3 bytes {JMP 0xffffffff8900c504}
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                                     0000000077411224 5 bytes JMP 00000001001b75fb
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                                    000000007681c664 5 bytes JMP 00000001001aae9d
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                                         000000007681e13a 5 bytes JMP 00000001001ac1c0
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WININET.dll!InternetReadFile                                       000000007681f8d8 5 bytes JMP 00000001001ac0b3
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable                             0000000076823184 5 bytes JMP 00000001001ac125
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW                                         0000000076845865 5 bytes JMP 00000001001ac1e4
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                                       000000007684632d 5 bytes JMP 00000001001ab977
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WININET.dll!InternetReadFileExW                                    000000007684f9ee 5 bytes JMP 00000001001ac0ff
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                                    000000007684fa49 5 bytes JMP 00000001001ac0d9
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                                     000000007685f564 5 bytes JMP 00000001001ab9bd
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WININET.dll!InternetWriteFile                                      000000007685f6c6 5 bytes JMP 00000001001abb40
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                                       000000007687525a 5 bytes JMP 00000001001ab954
.text   C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3980] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                                     00000000768bece5 5 bytes JMP 00000001001ab99a
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                          0000000077ea08fc 5 bytes JMP 00000001001ba0ef
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                   0000000077ebc45a 5 bytes JMP 00000001001ba28d
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\USER32.dll!TranslateMessage                            0000000076697809 5 bytes JMP 000000010019ef39
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\USER32.dll!GetClipboardData                            00000000766d9f1d 5 bytes JMP 000000010019ef7f
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext                      0000000075580bb9 5 bytes JMP 00000001001a4611
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                             000000007558124e 5 bytes JMP 00000001001a465b
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\SspiCli.dll!DecryptMessage                             000000007558129d 5 bytes JMP 00000001001a469f
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WS2_32.dll!closesocket                                 0000000077183918 5 bytes JMP 00000001001a3be4
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                                 0000000077184296 5 bytes JMP 00000001001a3a79
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WS2_32.dll!WSASend                                     0000000077184406 5 bytes JMP 00000001001a3e24
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                                0000000077184889 5 bytes JMP 00000001001a397a
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                               0000000077184b1b 5 bytes JMP 00000001001a3af1
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WS2_32.dll!recv                                        0000000077186b0e 5 bytes JMP 00000001001a3c3b
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WS2_32.dll!send                                        0000000077186f01 5 bytes JMP 00000001001a3dd2
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WS2_32.dll!WSARecv                                     0000000077187089 5 bytes JMP 00000001001a3c93
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult                      0000000077187489 5 bytes JMP 00000001001a3ed0
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WS2_32.dll!gethostbyname                               0000000077197673 1 byte JMP 00000001001a3b77
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WS2_32.dll!gethostbyname + 2                           0000000077197675 3 bytes {JMP 0xffffffff8900c504}
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                         0000000077411224 5 bytes JMP 00000001001b75fb
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                        000000007681c664 5 bytes JMP 00000001001aae9d
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                             000000007681e13a 5 bytes JMP 00000001001ac1c0
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WININET.dll!InternetReadFile                           000000007681f8d8 5 bytes JMP 00000001001ac0b3
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable                 0000000076823184 5 bytes JMP 00000001001ac125
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW                             0000000076845865 5 bytes JMP 00000001001ac1e4
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                           000000007684632d 5 bytes JMP 00000001001ab977
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WININET.dll!InternetReadFileExW                        000000007684f9ee 5 bytes JMP 00000001001ac0ff
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                        000000007684fa49 5 bytes JMP 00000001001ac0d9
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                         000000007685f564 5 bytes JMP 00000001001ab9bd
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WININET.dll!InternetWriteFile                          000000007685f6c6 5 bytes JMP 00000001001abb40
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                           000000007687525a 5 bytes JMP 00000001001ab954
.text   C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe[4004] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                         00000000768bece5 5 bytes JMP 00000001001ab99a
.text   C:\Windows\SysWOW64\ntdll.dll[4024] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                                                              0000000077ea08fc 5 bytes JMP 000000010007a0ef
.text   C:\Windows\SysWOW64\ntdll.dll[4024] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                                       0000000077ebc45a 5 bytes JMP 000000010007a28d
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                           0000000077ea08fc 5 bytes JMP 00000001001ba0ef
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                    0000000077ebc45a 5 bytes JMP 00000001001ba28d
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext                       0000000075580bb9 5 bytes JMP 00000001001a4611
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                              000000007558124e 5 bytes JMP 00000001001a465b
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\SspiCli.dll!DecryptMessage                              000000007558129d 5 bytes JMP 00000001001a469f
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\USER32.dll!TranslateMessage                             0000000076697809 5 bytes JMP 000000010019ef39
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\USER32.dll!GetClipboardData                             00000000766d9f1d 5 bytes JMP 000000010019ef7f
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                         000000007681c664 5 bytes JMP 00000001001aae9d
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                              000000007681e13a 5 bytes JMP 00000001001ac1c0
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WININET.dll!InternetReadFile                            000000007681f8d8 5 bytes JMP 00000001001ac0b3
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable                  0000000076823184 5 bytes JMP 00000001001ac125
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW                              0000000076845865 5 bytes JMP 00000001001ac1e4
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                            000000007684632d 5 bytes JMP 00000001001ab977
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WININET.dll!InternetReadFileExW                         000000007684f9ee 5 bytes JMP 00000001001ac0ff
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                         000000007684fa49 5 bytes JMP 00000001001ac0d9
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                          000000007685f564 5 bytes JMP 00000001001ab9bd
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WININET.dll!InternetWriteFile                           000000007685f6c6 5 bytes JMP 00000001001abb40
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                            000000007687525a 5 bytes JMP 00000001001ab954
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                          00000000768bece5 5 bytes JMP 00000001001ab99a
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WS2_32.dll!closesocket                                  0000000077183918 5 bytes JMP 00000001001a3be4
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                                  0000000077184296 5 bytes JMP 00000001001a3a79
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WS2_32.dll!WSASend                                      0000000077184406 5 bytes JMP 00000001001a3e24
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                                 0000000077184889 5 bytes JMP 00000001001a397a
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                                0000000077184b1b 5 bytes JMP 00000001001a3af1
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WS2_32.dll!recv                                         0000000077186b0e 5 bytes JMP 00000001001a3c3b
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WS2_32.dll!send                                         0000000077186f01 5 bytes JMP 00000001001a3dd2
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WS2_32.dll!WSARecv                                      0000000077187089 5 bytes JMP 00000001001a3c93
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult                       0000000077187489 5 bytes JMP 00000001001a3ed0
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WS2_32.dll!gethostbyname                                0000000077197673 1 byte JMP 00000001001a3b77
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\WS2_32.dll!gethostbyname + 2                            0000000077197675 3 bytes {JMP 0xffffffff8900c504}
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4032] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                          0000000077411224 5 bytes JMP 00000001001b75fb
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                                         0000000077ea08fc 5 bytes JMP 000000010007a0ef
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                  0000000077ebc45a 5 bytes JMP 000000010007a28d
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\USER32.dll!TranslateMessage                                           0000000076697809 5 bytes JMP 000000010005ef39
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\USER32.dll!GetClipboardData                                           00000000766d9f1d 5 bytes JMP 000000010005ef7f
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext                                     0000000075580bb9 5 bytes JMP 0000000100064611
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                                            000000007558124e 5 bytes JMP 000000010006465b
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\SspiCli.dll!DecryptMessage                                            000000007558129d 5 bytes JMP 000000010006469f
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                                       000000007681c664 5 bytes JMP 000000010006ae9d
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                                            000000007681e13a 5 bytes JMP 000000010006c1c0
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WININET.dll!InternetReadFile                                          000000007681f8d8 5 bytes JMP 000000010006c0b3
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable                                0000000076823184 5 bytes JMP 000000010006c125
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW                                            0000000076845865 5 bytes JMP 000000010006c1e4
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                                          000000007684632d 5 bytes JMP 000000010006b977
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WININET.dll!InternetReadFileExW                                       000000007684f9ee 5 bytes JMP 000000010006c0ff
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                                       000000007684fa49 5 bytes JMP 000000010006c0d9
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                                        000000007685f564 5 bytes JMP 000000010006b9bd
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WININET.dll!InternetWriteFile                                         000000007685f6c6 5 bytes JMP 000000010006bb40
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                                          000000007687525a 5 bytes JMP 000000010006b954
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                                        00000000768bece5 5 bytes JMP 000000010006b99a
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                   0000000076971465 2 bytes [97, 76]
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                  00000000769714bb 2 bytes [97, 76]
.text   ...                                                                                                                                                * 2
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                                        0000000077411224 5 bytes JMP 00000001000775fb
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WS2_32.dll!closesocket                                                0000000077183918 5 bytes JMP 0000000100063be4
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                                                0000000077184296 5 bytes JMP 0000000100063a79
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WS2_32.dll!WSASend                                                    0000000077184406 5 bytes JMP 0000000100063e24
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                                               0000000077184889 5 bytes JMP 000000010006397a
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                                              0000000077184b1b 5 bytes JMP 0000000100063af1
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WS2_32.dll!recv                                                       0000000077186b0e 5 bytes JMP 0000000100063c3b
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WS2_32.dll!send                                                       0000000077186f01 5 bytes JMP 0000000100063dd2
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WS2_32.dll!WSARecv                                                    0000000077187089 5 bytes JMP 0000000100063c93
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult                                     0000000077187489 5 bytes JMP 0000000100063ed0
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WS2_32.dll!gethostbyname                                              0000000077197673 1 byte JMP 0000000100063b77
.text   C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4048] C:\Windows\syswow64\WS2_32.dll!gethostbyname + 2                                          0000000077197675 3 bytes {JMP 0xffffffff88ecc504}
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                                             0000000077ea08fc 5 bytes JMP 000000010007a0ef
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                      0000000077ebc45a 5 bytes JMP 000000010007a28d
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext                                         0000000075580bb9 5 bytes JMP 0000000100064611
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                                                000000007558124e 5 bytes JMP 000000010006465b
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\SspiCli.dll!DecryptMessage                                                000000007558129d 5 bytes JMP 000000010006469f
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\USER32.dll!TranslateMessage                                               0000000076697809 5 bytes JMP 000000010005ef39
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\USER32.dll!GetClipboardData                                               00000000766d9f1d 5 bytes JMP 000000010005ef7f
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WS2_32.dll!closesocket                                                    0000000077183918 5 bytes JMP 0000000100063be4
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                                                    0000000077184296 5 bytes JMP 0000000100063a79
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WS2_32.dll!WSASend                                                        0000000077184406 5 bytes JMP 0000000100063e24
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                                                   0000000077184889 5 bytes JMP 000000010006397a
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                                                  0000000077184b1b 5 bytes JMP 0000000100063af1
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WS2_32.dll!recv                                                           0000000077186b0e 5 bytes JMP 0000000100063c3b
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WS2_32.dll!send                                                           0000000077186f01 5 bytes JMP 0000000100063dd2
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WS2_32.dll!WSARecv                                                        0000000077187089 5 bytes JMP 0000000100063c93
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult                                         0000000077187489 5 bytes JMP 0000000100063ed0
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WS2_32.dll!gethostbyname                                                  0000000077197673 1 byte JMP 0000000100063b77
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WS2_32.dll!gethostbyname + 2                                              0000000077197675 3 bytes {JMP 0xffffffff88ecc504}
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                                            0000000077411224 5 bytes JMP 00000001000775fb
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                                           000000007681c664 5 bytes JMP 000000010006ae9d
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                                                000000007681e13a 5 bytes JMP 000000010006c1c0
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WININET.dll!InternetReadFile                                              000000007681f8d8 5 bytes JMP 000000010006c0b3
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable                                    0000000076823184 5 bytes JMP 000000010006c125
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW                                                0000000076845865 5 bytes JMP 000000010006c1e4
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                                              000000007684632d 5 bytes JMP 000000010006b977
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WININET.dll!InternetReadFileExW                                           000000007684f9ee 5 bytes JMP 000000010006c0ff
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                                           000000007684fa49 5 bytes JMP 000000010006c0d9
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                                            000000007685f564 5 bytes JMP 000000010006b9bd
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WININET.dll!InternetWriteFile                                             000000007685f6c6 5 bytes JMP 000000010006bb40
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                                              000000007687525a 5 bytes JMP 000000010006b954
.text   C:\Program Files (x86)\iTunes\iTunesHelper.exe[4088] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                                            00000000768bece5 5 bytes JMP 000000010006b99a
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                                                           0000000077ea08fc 5 bytes JMP 00000001001fa0ef
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                                    0000000077ebc45a 5 bytes JMP 00000001001fa28d
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\USER32.dll!TranslateMessage                                                             0000000076697809 5 bytes JMP 00000001001def39
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\USER32.dll!GetClipboardData                                                             00000000766d9f1d 5 bytes JMP 00000001001def7f
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext                                                       0000000075580bb9 5 bytes JMP 00000001001e4611
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                                                              000000007558124e 5 bytes JMP 00000001001e465b
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\SspiCli.dll!DecryptMessage                                                              000000007558129d 5 bytes JMP 00000001001e469f
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                     0000000076971465 2 bytes [97, 76]
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                    00000000769714bb 2 bytes [97, 76]
.text   ...                                                                                                                                                * 2
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WS2_32.dll!closesocket                                                                  0000000077183918 5 bytes JMP 00000001001e3be4
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                                                                  0000000077184296 5 bytes JMP 00000001001e3a79
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WS2_32.dll!WSASend                                                                      0000000077184406 5 bytes JMP 00000001001e3e24
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                                                                 0000000077184889 5 bytes JMP 00000001001e397a
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                                                                0000000077184b1b 5 bytes JMP 00000001001e3af1
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WS2_32.dll!recv                                                                         0000000077186b0e 5 bytes JMP 00000001001e3c3b
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WS2_32.dll!send                                                                         0000000077186f01 5 bytes JMP 00000001001e3dd2
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WS2_32.dll!WSARecv                                                                      0000000077187089 5 bytes JMP 00000001001e3c93
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult                                                       0000000077187489 5 bytes JMP 00000001001e3ed0
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WS2_32.dll!gethostbyname                                                                0000000077197673 1 byte JMP 00000001001e3b77
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WS2_32.dll!gethostbyname + 2                                                            0000000077197675 3 bytes {JMP 0xffffffff8904c504}
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                                                          0000000077411224 5 bytes JMP 00000001001f75fb
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                                                         000000007681c664 5 bytes JMP 00000001001eae9d
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                                                              000000007681e13a 5 bytes JMP 00000001001ec1c0
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WININET.dll!InternetReadFile                                                            000000007681f8d8 5 bytes JMP 00000001001ec0b3
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable                                                  0000000076823184 5 bytes JMP 00000001001ec125
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW                                                              0000000076845865 5 bytes JMP 00000001001ec1e4
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                                                            000000007684632d 5 bytes JMP 00000001001eb977
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WININET.dll!InternetReadFileExW                                                         000000007684f9ee 5 bytes JMP 00000001001ec0ff
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                                                         000000007684fa49 5 bytes JMP 00000001001ec0d9
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                                                          000000007685f564 5 bytes JMP 00000001001eb9bd
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WININET.dll!InternetWriteFile                                                           000000007685f6c6 5 bytes JMP 00000001001ebb40
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                                                            000000007687525a 5 bytes JMP 00000001001eb954
.text   C:\Windows\SysWOW64\RunDll32.exe[4236] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                                                          00000000768bece5 5 bytes JMP 00000001001eb99a
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                      0000000077ea08fc 5 bytes JMP 000000010025a0ef
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                               0000000077ebc45a 5 bytes JMP 000000010025a28d
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\USER32.dll!TranslateMessage                        0000000076697809 5 bytes JMP 000000010023ef39
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\USER32.dll!GetClipboardData                        00000000766d9f1d 5 bytes JMP 000000010023ef7f
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext                  0000000075580bb9 5 bytes JMP 0000000100244611
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                         000000007558124e 5 bytes JMP 000000010024465b
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\SspiCli.dll!DecryptMessage                         000000007558129d 5 bytes JMP 000000010024469f
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WS2_32.dll!closesocket                             0000000077183918 5 bytes JMP 0000000100243be4
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                             0000000077184296 5 bytes JMP 0000000100243a79
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WS2_32.dll!WSASend                                 0000000077184406 5 bytes JMP 0000000100243e24
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                            0000000077184889 5 bytes JMP 000000010024397a
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                           0000000077184b1b 5 bytes JMP 0000000100243af1
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WS2_32.dll!recv                                    0000000077186b0e 5 bytes JMP 0000000100243c3b
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WS2_32.dll!send                                    0000000077186f01 5 bytes JMP 0000000100243dd2
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WS2_32.dll!WSARecv                                 0000000077187089 5 bytes JMP 0000000100243c93
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult                  0000000077187489 5 bytes JMP 0000000100243ed0
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WS2_32.dll!gethostbyname                           0000000077197673 1 byte JMP 0000000100243b77
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WS2_32.dll!gethostbyname + 2                       0000000077197675 3 bytes {JMP 0xffffffff890ac504}
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                     0000000077411224 5 bytes JMP 00000001002575fb
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                    000000007681c664 5 bytes JMP 000000010024ae9d
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                         000000007681e13a 5 bytes JMP 000000010024c1c0
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WININET.dll!InternetReadFile                       000000007681f8d8 5 bytes JMP 000000010024c0b3
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable             0000000076823184 5 bytes JMP 000000010024c125
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW                         0000000076845865 5 bytes JMP 000000010024c1e4
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                       000000007684632d 5 bytes JMP 000000010024b977
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WININET.dll!InternetReadFileExW                    000000007684f9ee 5 bytes JMP 000000010024c0ff
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                    000000007684fa49 5 bytes JMP 000000010024c0d9
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                     000000007685f564 5 bytes JMP 000000010024b9bd
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WININET.dll!InternetWriteFile                      000000007685f6c6 5 bytes JMP 000000010024bb40
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                       000000007687525a 5 bytes JMP 000000010024b954
.text   C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe[4436] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                     00000000768bece5 5 bytes JMP 000000010024b99a
.text   C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe[4532] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69             0000000076971465 2 bytes [97, 76]
.text   C:\Program Files\Alienware\Command Center\AlienwareAlienFXController.exe[4532] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155            00000000769714bb 2 bytes [97, 76]
.text   ...                                                                                                                                                * 2
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                     0000000077ea08fc 5 bytes JMP 00000001002ba0ef
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                              0000000077ebc45a 5 bytes JMP 00000001002ba28d
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext                 0000000075580bb9 5 bytes JMP 00000001002a4611
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                        000000007558124e 5 bytes JMP 00000001002a465b
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\SspiCli.dll!DecryptMessage                        000000007558129d 5 bytes JMP 00000001002a469f
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\USER32.dll!TranslateMessage                       0000000076697809 5 bytes JMP 000000010029ef39
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\USER32.dll!GetClipboardData                       00000000766d9f1d 5 bytes JMP 000000010029ef7f
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WS2_32.dll!closesocket                            0000000077183918 5 bytes JMP 00000001002a3be4
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                            0000000077184296 5 bytes JMP 00000001002a3a79
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WS2_32.dll!WSASend                                0000000077184406 5 bytes JMP 00000001002a3e24
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                           0000000077184889 5 bytes JMP 00000001002a397a
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                          0000000077184b1b 5 bytes JMP 00000001002a3af1
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WS2_32.dll!recv                                   0000000077186b0e 5 bytes JMP 00000001002a3c3b
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WS2_32.dll!send                                   0000000077186f01 5 bytes JMP 00000001002a3dd2
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WS2_32.dll!WSARecv                                0000000077187089 5 bytes JMP 00000001002a3c93
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult                 0000000077187489 5 bytes JMP 00000001002a3ed0
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WS2_32.dll!gethostbyname                          0000000077197673 1 byte JMP 00000001002a3b77
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WS2_32.dll!gethostbyname + 2                      0000000077197675 3 bytes {JMP 0xffffffff8910c504}
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                    0000000077411224 5 bytes JMP 00000001002b75fb
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                   000000007681c664 5 bytes JMP 00000001002aae9d
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                        000000007681e13a 5 bytes JMP 00000001002ac1c0
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WININET.dll!InternetReadFile                      000000007681f8d8 5 bytes JMP 00000001002ac0b3
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable            0000000076823184 5 bytes JMP 00000001002ac125
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW                        0000000076845865 5 bytes JMP 00000001002ac1e4
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                      000000007684632d 5 bytes JMP 00000001002ab977
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WININET.dll!InternetReadFileExW                   000000007684f9ee 5 bytes JMP 00000001002ac0ff
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                   000000007684fa49 5 bytes JMP 00000001002ac0d9
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                    000000007685f564 5 bytes JMP 00000001002ab9bd
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WININET.dll!InternetWriteFile                     000000007685f6c6 5 bytes JMP 00000001002abb40
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                      000000007687525a 5 bytes JMP 00000001002ab954
.text   C:\Program Files\Alienware\Command Center\AWCCApplicationWatcher32.exe[4868] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                    00000000768bece5 5 bytes JMP 00000001002ab99a
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                        0000000077ea08fc 5 bytes JMP 000000010219a0ef
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                 0000000077ebc45a 5 bytes JMP 000000010219a28d
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext                    0000000075580bb9 5 bytes JMP 0000000102184611
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                           000000007558124e 5 bytes JMP 000000010218465b
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\SspiCli.dll!DecryptMessage                           000000007558129d 5 bytes JMP 000000010218469f
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\USER32.dll!TranslateMessage                          0000000076697809 5 bytes JMP 000000010217ef39
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\USER32.dll!GetClipboardData                          00000000766d9f1d 5 bytes JMP 000000010217ef7f
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                  0000000076971465 2 bytes [97, 76]
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                 00000000769714bb 2 bytes [97, 76]
.text   ...                                                                                                                                                * 2
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WS2_32.dll!closesocket                               0000000077183918 5 bytes JMP 0000000102183be4
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                               0000000077184296 5 bytes JMP 0000000102183a79
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WS2_32.dll!WSASend                                   0000000077184406 5 bytes JMP 0000000102183e24
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                              0000000077184889 5 bytes JMP 000000010218397a
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                             0000000077184b1b 5 bytes JMP 0000000102183af1
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WS2_32.dll!recv                                      0000000077186b0e 5 bytes JMP 0000000102183c3b
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WS2_32.dll!send                                      0000000077186f01 5 bytes JMP 0000000102183dd2
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WS2_32.dll!WSARecv                                   0000000077187089 5 bytes JMP 0000000102183c93
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult                    0000000077187489 5 bytes JMP 0000000102183ed0
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WS2_32.dll!gethostbyname                             0000000077197673 1 byte JMP 0000000102183b77
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WS2_32.dll!gethostbyname + 2                         0000000077197675 3 bytes {JMP 0xffffffff8afec504}
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                       0000000077411224 5 bytes JMP 00000001021975fb
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                      000000007681c664 5 bytes JMP 000000010218ae9d
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                           000000007681e13a 5 bytes JMP 000000010218c1c0
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WININET.dll!InternetReadFile                         000000007681f8d8 5 bytes JMP 000000010218c0b3
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable               0000000076823184 5 bytes JMP 000000010218c125
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW                           0000000076845865 5 bytes JMP 000000010218c1e4
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                         000000007684632d 5 bytes JMP 000000010218b977
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WININET.dll!InternetReadFileExW                      000000007684f9ee 5 bytes JMP 000000010218c0ff
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                      000000007684fa49 5 bytes JMP 000000010218c0d9
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                       000000007685f564 5 bytes JMP 000000010218b9bd
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WININET.dll!InternetWriteFile                        000000007685f6c6 5 bytes JMP 000000010218bb40
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                         000000007687525a 5 bytes JMP 000000010218b954
.text   C:\Program Files\Alienware\Command Center\AlienFusionController.exe[2732] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                       00000000768bece5 5 bytes JMP 000000010218b99a
.text   C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4944] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69             0000000076971465 2 bytes [97, 76]
.text   C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[4944] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155            00000000769714bb 2 bytes [97, 76]
.text   ...                                                                                                                                                * 2

---- Threads - GMER 2.1 ----

Thread  C:\Windows\SysWOW64\ntdll.dll [4024:4028]                                                                                                          0000000000cb49bf
Thread  C:\Windows\SysWOW64\ntdll.dll [4024:1652]                                                                                                          0000000072f88cf7
Thread  C:\Windows\SysWOW64\ntdll.dll [4024:2416]                                                                                                          0000000072f88fce
Thread  C:\Windows\SysWOW64\ntdll.dll [4024:3148]                                                                                                          0000000072f888e0
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [1660:3240]                                                                                     000007fefc1c2a7c

---- Registry - GMER 2.1 ----

Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\68a3c44821e7                                                                        
Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\68a3c44821e7 (not active ControlSet)                                                    

---- EOF - GMER 2.1 ----
         

--- --- ---


defogger_disable by jpshortstuff (23.02.10.1)
Log created at 16:02 on 19/02/2013 (Alienware)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

Servus,



verwendest du die AskToolbar? Diese hast du dir wohl über Avira mit installiert. Viel Sinn macht sie nämlich nicht.


Du bist in der Tat mit Zbot infiziert. Wir kümmern uns in den nächsten Tagen darum.




Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hallo , hmm keine Ahnung nutzen tuhe ich es nicht... hier die logfile:


Combofix Logfile:

ComboFix 13-02-18.02 - Alienware 19.02.2013  18:07:57.1.8 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.8174.6285 [GMT 1:00]
ausgeführt von:: c:\users\Alienware\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Alienware\AppData\Roaming\Akozxu
c:\users\Alienware\AppData\Roaming\Akozxu\ramaqo.exe
c:\users\Alienware\AppData\Roaming\Ewceqa
c:\users\Alienware\AppData\Roaming\Ewceqa\keabi.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-01-19 bis 2013-02-19  ))))))))))))))))))))))))))))))
.
.
2013-02-19 17:11 . 2013-02-19 17:11	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2013-02-19 17:11 . 2013-02-19 17:11	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-02-14 16:33 . 2013-01-08 22:01	768000	----a-w-	c:\program files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-14 16:33 . 2013-01-09 01:10	996352	----a-w-	c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-14 15:05 . 2013-02-14 15:05	--------	d-----w-	c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-02-14 15:05 . 2013-02-14 15:05	--------	d-----w-	c:\program files\iTunes
2013-02-14 15:05 . 2013-02-14 15:05	--------	d-----w-	c:\program files (x86)\iTunes
2013-02-14 15:05 . 2013-02-14 15:05	--------	d-----w-	c:\program files\iPod
2013-02-14 15:01 . 2013-01-04 03:26	3153408	----a-w-	c:\windows\system32\win32k.sys
2013-02-14 15:01 . 2013-01-04 05:46	215040	----a-w-	c:\windows\system32\winsrv.dll
2013-02-14 15:01 . 2013-01-04 04:51	5120	----a-w-	c:\windows\SysWow64\wow32.dll
2013-02-14 15:01 . 2013-01-04 02:47	25600	----a-w-	c:\windows\SysWow64\setup16.exe
2013-02-14 15:01 . 2013-01-04 02:47	7680	----a-w-	c:\windows\SysWow64\instnm.exe
2013-02-14 15:01 . 2013-01-04 02:47	2048	----a-w-	c:\windows\SysWow64\user.exe
2013-02-14 15:01 . 2013-01-04 02:47	14336	----a-w-	c:\windows\SysWow64\ntvdm64.dll
2013-02-14 15:01 . 2013-01-05 05:53	5553512	----a-w-	c:\windows\system32\ntoskrnl.exe
2013-02-14 15:01 . 2013-01-05 05:00	3967848	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2013-02-14 15:01 . 2013-01-05 05:00	3913064	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2013-02-14 14:58 . 2013-01-03 06:00	1913192	----a-w-	c:\windows\system32\drivers\tcpip.sys
2013-02-14 14:58 . 2013-01-03 06:00	288088	----a-w-	c:\windows\system32\drivers\FWPKCLNT.SYS
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-14 16:34 . 2012-11-09 17:17	70004024	----a-w-	c:\windows\system32\MRT.exe
2013-02-14 15:17 . 2012-11-11 15:01	74096	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-02-14 15:17 . 2012-11-11 15:01	697712	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-01-04 04:43 . 2013-02-14 15:01	44032	----a-w-	c:\windows\apppatch\acwow64.dll
2012-12-16 17:11 . 2012-12-21 21:08	46080	----a-w-	c:\windows\system32\atmlib.dll
2012-12-16 14:45 . 2012-12-21 21:08	367616	----a-w-	c:\windows\system32\atmfd.dll
2012-12-16 14:13 . 2012-12-21 21:08	295424	----a-w-	c:\windows\SysWow64\atmfd.dll
2012-12-16 14:13 . 2012-12-21 21:08	34304	----a-w-	c:\windows\SysWow64\atmlib.dll
2012-12-11 17:49 . 2012-11-09 16:21	99912	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2012-12-11 17:49 . 2012-11-09 16:21	129216	----a-w-	c:\windows\system32\drivers\avipbb.sys
2012-12-07 13:20 . 2013-01-09 18:08	441856	----a-w-	c:\windows\system32\Wpc.dll
2012-12-07 13:15 . 2013-01-09 18:08	2746368	----a-w-	c:\windows\system32\gameux.dll
2012-12-07 12:26 . 2013-01-09 18:08	308736	----a-w-	c:\windows\SysWow64\Wpc.dll
2012-12-07 12:20 . 2013-01-09 18:08	2576384	----a-w-	c:\windows\SysWow64\gameux.dll
2012-12-07 11:20 . 2013-01-09 18:08	30720	----a-w-	c:\windows\system32\usk.rs
2012-12-07 11:20 . 2013-01-09 18:08	43520	----a-w-	c:\windows\system32\csrr.rs
2012-12-07 11:20 . 2013-01-09 18:08	23552	----a-w-	c:\windows\system32\oflc.rs
2012-12-07 11:20 . 2013-01-09 18:08	45568	----a-w-	c:\windows\system32\oflc-nz.rs
2012-12-07 11:20 . 2013-01-09 18:08	44544	----a-w-	c:\windows\system32\pegibbfc.rs
2012-12-07 11:20 . 2013-01-09 18:08	20480	----a-w-	c:\windows\system32\pegi-fi.rs
2012-12-07 11:20 . 2013-01-09 18:08	20480	----a-w-	c:\windows\system32\pegi-pt.rs
2012-12-07 11:19 . 2013-01-09 18:08	20480	----a-w-	c:\windows\system32\pegi.rs
2012-12-07 11:19 . 2013-01-09 18:08	46592	----a-w-	c:\windows\system32\fpb.rs
2012-12-07 11:19 . 2013-01-09 18:08	40960	----a-w-	c:\windows\system32\cob-au.rs
2012-12-07 11:19 . 2013-01-09 18:08	21504	----a-w-	c:\windows\system32\grb.rs
2012-12-07 11:19 . 2013-01-09 18:08	15360	----a-w-	c:\windows\system32\djctq.rs
2012-12-07 11:19 . 2013-01-09 18:08	55296	----a-w-	c:\windows\system32\cero.rs
2012-12-07 11:19 . 2013-01-09 18:08	51712	----a-w-	c:\windows\system32\esrb.rs
2012-12-07 10:46 . 2013-01-09 18:08	43520	----a-w-	c:\windows\SysWow64\csrr.rs
2012-12-07 10:46 . 2013-01-09 18:08	30720	----a-w-	c:\windows\SysWow64\usk.rs
2012-12-07 10:46 . 2013-01-09 18:08	45568	----a-w-	c:\windows\SysWow64\oflc-nz.rs
2012-12-07 10:46 . 2013-01-09 18:08	44544	----a-w-	c:\windows\SysWow64\pegibbfc.rs
2012-12-07 10:46 . 2013-01-09 18:08	23552	----a-w-	c:\windows\SysWow64\oflc.rs
2012-12-07 10:46 . 2013-01-09 18:08	20480	----a-w-	c:\windows\SysWow64\pegi-pt.rs
2012-12-07 10:46 . 2013-01-09 18:08	20480	----a-w-	c:\windows\SysWow64\pegi-fi.rs
2012-12-07 10:46 . 2013-01-09 18:08	46592	----a-w-	c:\windows\SysWow64\fpb.rs
2012-12-07 10:46 . 2013-01-09 18:08	20480	----a-w-	c:\windows\SysWow64\pegi.rs
2012-12-07 10:46 . 2013-01-09 18:08	21504	----a-w-	c:\windows\SysWow64\grb.rs
2012-12-07 10:46 . 2013-01-09 18:08	40960	----a-w-	c:\windows\SysWow64\cob-au.rs
2012-12-07 10:46 . 2013-01-09 18:08	15360	----a-w-	c:\windows\SysWow64\djctq.rs
2012-12-07 10:46 . 2013-01-09 18:08	55296	----a-w-	c:\windows\SysWow64\cero.rs
2012-12-07 10:46 . 2013-01-09 18:08	51712	----a-w-	c:\windows\SysWow64\esrb.rs
2012-12-03 15:47 . 2012-12-20 11:31	9271352	----a-w-	c:\windows\system32\nvcuda.dll
2012-12-03 15:47 . 2012-12-20 11:31	7819016	----a-w-	c:\windows\SysWow64\nvcuda.dll
2012-12-03 15:47 . 2012-12-20 11:31	7446192	----a-w-	c:\windows\system32\nvopencl.dll
2012-12-03 15:47 . 2012-12-20 11:31	6149904	----a-w-	c:\windows\SysWow64\nvopencl.dll
2012-12-03 15:47 . 2012-12-20 11:31	2816824	----a-w-	c:\windows\system32\nvapi64.dll
2012-12-03 15:47 . 2012-12-20 11:31	2784104	----a-w-	c:\windows\system32\nvcuvid.dll
2012-12-03 15:47 . 2012-12-20 11:31	26811240	----a-w-	c:\windows\system32\nvoglv64.dll
2012-12-03 15:47 . 2012-12-20 11:31	2606440	----a-w-	c:\windows\SysWow64\nvcuvid.dll
2012-12-03 15:47 . 2012-12-20 11:31	25256296	----a-w-	c:\windows\system32\nvcompiler.dll
2012-12-03 15:47 . 2012-12-20 11:31	2496976	----a-w-	c:\windows\SysWow64\nvapi.dll
2012-12-03 15:47 . 2012-12-20 11:31	2226024	----a-w-	c:\windows\system32\nvcuvenc.dll
2012-12-03 15:47 . 2012-12-20 11:31	20335976	----a-w-	c:\windows\SysWow64\nvoglv32.dll
2012-12-03 15:47 . 2012-12-20 11:31	1874280	----a-w-	c:\windows\SysWow64\nvcuvenc.dll
2012-12-03 15:47 . 2012-12-20 11:31	1805672	----a-w-	c:\windows\system32\nvdispco64.dll
2012-12-03 15:47 . 2012-12-20 11:31	18045968	----a-w-	c:\windows\system32\nvd3dumx.dll
2012-12-03 15:47 . 2012-12-20 11:31	17559912	----a-w-	c:\windows\SysWow64\nvcompiler.dll
2012-12-03 15:47 . 2012-12-20 11:31	15122280	----a-w-	c:\windows\SysWow64\nvd3dum.dll
2012-12-03 15:47 . 2012-12-20 11:31	1504104	----a-w-	c:\windows\system32\nvdispgenco64.dll
2012-12-03 15:47 . 2012-12-20 11:31	15016256	----a-w-	c:\windows\system32\nvwgf2umx.dll
2012-12-03 15:47 . 2012-12-20 11:31	12603960	----a-w-	c:\windows\SysWow64\nvwgf2um.dll
2012-12-03 15:47 . 2012-12-20 11:31	11532648	----a-w-	c:\windows\system32\drivers\nvlddmkm.sys
2012-12-01 12:41 . 2012-12-20 11:31	446312	----a-w-	c:\windows\system32\drivers\nvstusb.sys
2012-12-01 12:41 . 2012-11-18 12:40	1509736	----a-w-	c:\windows\system32\nvir3dgenco6420152.dll
2012-12-01 05:49 . 2011-03-09 15:38	2557800	----a-w-	c:\windows\system32\nvsvcr.dll
2012-12-01 05:49 . 2011-03-09 15:38	118120	----a-w-	c:\windows\system32\nvmctray.dll
2012-12-01 05:49 . 2011-03-09 15:38	63336	----a-w-	c:\windows\system32\nvshext.dll
2012-12-01 05:49 . 2011-03-09 15:38	890216	----a-w-	c:\windows\system32\nvvsvc.exe
2012-12-01 05:48 . 2011-03-09 15:38	6223208	----a-w-	c:\windows\system32\nvcpl.dll
2012-12-01 05:48 . 2011-03-09 15:38	3311464	----a-w-	c:\windows\system32\nvsvc64.dll
2012-11-30 21:43 . 2012-11-30 21:43	438632	----a-w-	c:\windows\SysWow64\nvStreaming.exe
2012-11-30 05:45 . 2013-01-09 18:07	362496	----a-w-	c:\windows\system32\wow64win.dll
2012-11-30 05:45 . 2013-01-09 18:07	243200	----a-w-	c:\windows\system32\wow64.dll
2012-11-30 05:45 . 2013-01-09 18:07	13312	----a-w-	c:\windows\system32\wow64cpu.dll
2012-11-30 05:43 . 2013-01-09 18:07	16384	----a-w-	c:\windows\system32\ntvdm64.dll
2012-11-30 05:41 . 2013-01-09 18:07	424448	----a-w-	c:\windows\system32\KernelBase.dll
2012-11-30 05:41 . 2013-01-09 18:07	1161216	----a-w-	c:\windows\system32\kernel32.dll
2012-11-30 05:38 . 2013-01-09 18:07	6144	---ha-w-	c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 18:07	4608	---ha-w-	c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 18:07	4608	---ha-w-	c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 18:07	4096	---ha-w-	c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 18:07	4096	---ha-w-	c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 18:07	3584	---ha-w-	c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 18:07	3584	---ha-w-	c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 18:07	3584	---ha-w-	c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 18:07	3584	---ha-w-	c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 18:07	3072	---ha-w-	c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 18:07	3072	---ha-w-	c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 18:07	3072	---ha-w-	c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 18:07	3072	---ha-w-	c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 18:07	5120	---ha-w-	c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 18:07	4096	---ha-w-	c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 18:07	4096	---ha-w-	c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 18:07	3584	---ha-w-	c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 18:07	3584	---ha-w-	c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 18:07	3584	---ha-w-	c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 18:07	3072	---ha-w-	c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 18:07	3072	---ha-w-	c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2012-11-30 05:38 . 2013-01-09 18:07	3072	---ha-w-	c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-10-16 1521352]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2012-10-16 23:46	1521352	----a-w-	c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-10-16 1521352]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Akamai NetSession Interface"="c:\users\Alienware\AppData\Local\Akamai\netsession_win.exe" [2012-10-09 4441920]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-09-13 283160]
"AlienwareOn-ScreenDisplay"="c:\program files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe" [2010-11-17 1500528]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Integrated Webcam Live! Central"="c:\program files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe" [2010-08-19 487562]
"Dell Registration"="c:\program files (x86)\System Registration\prodreg.exe" [2010-11-10 4144448]
"RemoteControl9"="c:\program files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe" [2010-10-01 87336]
"PDVD9LanguageShortcut"="c:\program files (x86)\CyberLink\PowerDVD9\Language\Language.exe" [2010-09-17 50472]
"BDRegion"="c:\program files (x86)\Cyberlink\Shared Files\brs.exe" [2010-10-29 75048]
"RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-02-12 385248]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2012-10-16 1573576]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-12-12 152544]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\program files (x86)\AlienRespawn\Components\Scheduler\Launcher.exe" [2010-08-11 163040]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-7-29 1132320]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 CLKMSVC10_9EC60124;CyberLink Product - 2011/05/18 15:38;c:\program files (x86)\CyberLink\PowerDVD9\NavFilter\kmsvc.exe [2010-10-29 236016]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]
R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]
R3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [2010-11-30 326760]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]
S0 EMSC;COMPAL Embedded System Control;c:\windows\system32\DRIVERS\EMSC.SYS [2009-06-26 16752]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856]
S0 stdcfltn;Disk Class Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdcfltn.sys [2010-08-20 21616]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-09-24 27800]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2011-03-21 89600]
S2 AlienFusionService;Alienware Fusion Service;c:\program files\Alienware\Command Center\AlienFusionService.exe [2012-06-15 14704]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2013-02-12 86752]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-09-13 13336]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\AlienRespawn\sftservice.EXE [2010-08-20 689472]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-11-30 382824]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-09 2655768]
S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Accelern.sys [2010-09-07 27760]
S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [2010-08-17 344616]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2010-08-17 39464]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2010-08-12 175168]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2010-11-30 76912]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-11-17 80384]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-11-17 180736]
S3 NvStUSB;NVIDIA Stereoscopic 3D USB driver;c:\windows\system32\DRIVERS\nvstusb.sys [2012-12-01 446312]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - CLKMDRV10_9EC60124
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-02-02 13:04	1607120	----a-w-	c:\program files (x86)\Google\Chrome\Application\24.0.1312.57\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-02-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-11 15:17]
.
2013-02-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-20 10:59]
.
2013-02-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-20 10:59]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-03-21 525312]
"Command Center Controllers"="c:\program files\Alienware\Command Center\AWCCStartupOrchestrator.exe" [2012-06-15 12656]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>;*.local
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: dell.com
TCP: DhcpNameServer = 192.168.2.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-{16039CE0-D422-AD40-EC21-3480ED21179D} - c:\users\Alienware\AppData\Roaming\Ewceqa\keabi.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_149_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_149_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_149_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_149_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_149.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_149.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_149.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_149.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-02-19  18:12:18
ComboFix-quarantined-files.txt  2013-02-19 17:12
.
Vor Suchlauf: 13 Verzeichnis(se), 668.737.699.840 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 669.166.141.440 Bytes frei
.
- - End Of File - - 078968307E7261FE005C930D49E4383F
         

--- --- ---

Servus,



sieht schon besser aus.



Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop (falls noch nicht vorhanden).

• Starte bitte die OTL.exe.
• Oben findest Du ein Kästchen mit Ausgabe. Wähle bitte Standard Ausgabe.
• Setze einen Haken bei Scanne alle Benutzer.
• Unter Extra Registry, wähle bitte Use SafeList.
• Kopiere nun den Inhalt aus der Codebox in die Textbox.

activex
netsvcs
msconfig
drivers32
safebootminimal
safebootnetwork
hklm\software\clients\startmenuinternet|command /rs
hklm\software\clients\startmenuinternet|command /64 /rs
CREATERESTOREPOINT
         

• Schließe bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Scan Button.
• Am Ende des Suchlaufs werden 2 Logdateien erstellt.
• Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Hey , so da sind sie..:OTL Logfile:

OTL logfile created on: 19.02.2013 18:54:13 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Alienware\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 6,08 Gb Available Physical Memory | 76,18% Memory free
15,96 Gb Paging File | 13,91 Gb Available in Paging File | 87,13% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 689,37 Gb Total Space | 622,19 Gb Free Space | 90,26% Space Free | Partition Type: NTFS
 
Computer Name: ALIENWARE-PC | User Name: Alienware | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.02.19 18:51:05 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Alienware\Desktop\OTL.exe
PRC - [2013.02.12 15:53:43 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2013.02.12 15:52:59 | 000,385,248 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2013.02.12 15:52:59 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.12.20 11:59:35 | 000,212,432 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Update\1.3.21.123\GoogleCrashHandler.exe
PRC - [2012.12.03 16:47:14 | 001,259,880 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012.11.30 22:43:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2012.10.17 00:46:34 | 001,573,576 | ---- | M] (Ask) -- C:\Program Files (x86)\Ask.com\Updater\Updater.exe
PRC - [2012.06.15 16:14:40 | 000,014,192 | ---- | M] (Alienware) -- C:\Programme\Alienware\Command Center\AWCCApplicationWatcher32.exe
PRC - [2012.06.15 16:12:40 | 000,071,024 | ---- | M] (Alienware) -- C:\Programme\Alienware\Command Center\AlienwareAlienFXController.exe
PRC - [2012.06.15 16:10:58 | 000,016,240 | ---- | M] (Alienware) -- C:\Programme\Alienware\Command Center\AlienFusionController.exe
PRC - [2010.12.09 14:38:20 | 002,655,768 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2010.12.09 14:38:20 | 000,325,656 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010.11.17 17:03:56 | 001,500,528 | ---- | M] () -- C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
PRC - [2010.10.29 22:20:58 | 000,075,048 | ---- | M] (cyberlink) -- C:\Program Files (x86)\CyberLink\Shared files\brs.exe
PRC - [2010.10.01 22:55:28 | 000,087,336 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe
PRC - [2010.09.14 00:32:32 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010.09.14 00:32:30 | 000,283,160 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010.08.21 00:53:08 | 000,689,472 | ---- | M] (SoftThinks SAS) -- C:\Program Files (x86)\AlienRespawn\sftservice.EXE
PRC - [2010.08.20 00:06:56 | 000,487,562 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe
PRC - [2010.08.12 00:19:16 | 000,781,536 | ---- | M] () -- C:\Program Files (x86)\AlienRespawn\Components\Scheduler\STService.exe
PRC - [2010.07.29 19:39:24 | 000,013,600 | ---- | M] (Broadcom Corporation.) -- C:\Programme\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.02.18 20:16:35 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\cb562e2e4f74ae607f1186f6ec50cec7\System.Windows.Forms.ni.dll
MOD - [2013.02.14 17:34:47 | 013,199,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\39f4c7717661667c68f9af8c4f6402b9\System.Windows.Forms.ni.dll
MOD - [2013.01.10 20:31:01 | 001,218,560 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\ac9e3eca6c148504588e7c6d09fe83e3\System.Management.ni.dll
MOD - [2013.01.10 20:29:59 | 000,134,656 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data.DataSet#\41c8b10b4eee399c4abfa970b73ecd74\System.Data.DataSetExtensions.ni.dll
MOD - [2013.01.10 20:29:37 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\5ea93652e4752c75bc6fbb195b4eb864\System.Runtime.Remoting.ni.dll
MOD - [2013.01.10 20:29:12 | 001,801,728 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\866894ebe5258bf9f45d6b063229e990\System.Xaml.ni.dll
MOD - [2013.01.10 20:27:30 | 000,475,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\ceda881f46083cfb6356ed39e6bf9dcb\IAStorUtil.ni.dll
MOD - [2013.01.10 20:27:30 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\85a17526c326bfb377b5c2124dce39f2\IAStorCommon.ni.dll
MOD - [2013.01.10 16:37:36 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\90b89f6e8032310e9ac72a309fd49e83\System.Runtime.Remoting.ni.dll
MOD - [2013.01.10 16:37:08 | 001,592,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\eead6629e384a5b69f9ae35284b7eeed\System.Drawing.ni.dll
MOD - [2013.01.10 16:36:58 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\cf827fe7bc99d9bcf0ba3621054ef527\WindowsBase.ni.dll
MOD - [2013.01.10 16:36:55 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f687c43e9fdec031988b33ae722c4613\System.Xml.ni.dll
MOD - [2013.01.10 16:36:52 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\195a77fcc6206f8bb35d419ff2cf0d72\System.Configuration.ni.dll
MOD - [2013.01.10 16:36:51 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\369f8bdca364e2b4936d18dea582912c\System.ni.dll
MOD - [2013.01.10 16:36:46 | 011,493,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll
MOD - [2013.01.09 19:39:02 | 018,002,944 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\14f511c47523f19ca591eb207e9e2084\PresentationFramework.ni.dll
MOD - [2013.01.09 19:38:52 | 011,451,904 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\e10fd15441d278c04a03302880a3e231\PresentationCore.ni.dll
MOD - [2013.01.09 19:38:51 | 006,815,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\9071f089ab65d518d1bd7e8fa857a95f\System.Data.ni.dll
MOD - [2013.01.09 19:38:46 | 007,069,696 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\27dcf04ed7a3506045597c02a5a1fc31\System.Core.ni.dll
MOD - [2013.01.09 19:38:44 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\43cd41484df96d15df949eb17dd88152\System.Xml.ni.dll
MOD - [2013.01.09 19:38:43 | 003,858,944 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\7a9ff5ce3a909d075179a2ac70d8f388\WindowsBase.ni.dll
MOD - [2013.01.09 19:38:42 | 001,667,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\b573c6a62bb88df0ee2af59b6a8ca910\System.Drawing.ni.dll
MOD - [2013.01.09 19:38:41 | 000,982,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\5de5d8c1c02e33789e3cf7e3f54c0ec9\System.Configuration.ni.dll
MOD - [2013.01.09 19:38:40 | 009,094,656 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\15872842e3e63ddf0f720f406706198e\System.ni.dll
MOD - [2013.01.09 19:38:36 | 000,145,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Numerics\c300c8ca0910bbffb16a244b56be6d05\System.Numerics.ni.dll
MOD - [2013.01.09 19:38:35 | 014,412,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\3f95a6d480ed1ebe45cf27b770ba94ed\mscorlib.ni.dll
MOD - [2012.08.27 21:33:32 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012.08.27 21:33:08 | 001,242,512 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010.11.21 07:49:22 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2010.11.17 17:03:56 | 001,500,528 | ---- | M] () -- C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe
MOD - [2010.11.13 00:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.08.12 00:19:34 | 000,077,024 | ---- | M] () -- C:\Program Files (x86)\AlienRespawn\zlib1.dll
MOD - [2010.08.12 00:19:32 | 000,109,792 | ---- | M] () -- C:\Program Files (x86)\AlienRespawn\STPE.dll
MOD - [2010.08.12 00:19:32 | 000,072,928 | ---- | M] () -- C:\Program Files (x86)\AlienRespawn\STRegistry.dll
MOD - [2010.08.12 00:19:30 | 000,232,672 | ---- | M] () -- C:\Program Files (x86)\AlienRespawn\STFiles.dll
MOD - [2010.08.12 00:19:30 | 000,126,176 | ---- | M] () -- C:\Program Files (x86)\AlienRespawn\STLog.dll
MOD - [2010.08.12 00:19:30 | 000,119,008 | ---- | M] () -- C:\Program Files (x86)\AlienRespawn\STNLS.dll
MOD - [2010.08.12 00:19:26 | 001,121,504 | ---- | M] () -- C:\Program Files (x86)\AlienRespawn\LibXml2.dll
MOD - [2010.08.12 00:19:16 | 000,781,536 | ---- | M] () -- C:\Program Files (x86)\AlienRespawn\Components\Scheduler\STService.exe
MOD - [2009.12.18 17:07:06 | 000,577,536 | ---- | M] () -- C:\Program Files (x86)\Alienware On-Screen Display\EMSC.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2013.02.14 16:17:23 | 000,251,248 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.02.12 15:53:43 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2013.02.12 15:52:59 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.12.03 16:47:14 | 001,259,880 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.11.30 22:43:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.06.15 16:10:58 | 000,014,704 | ---- | M] (Alienware) [Auto | Running] -- C:\Programme\Alienware\Command Center\AlienFusionService.exe -- (AlienFusionService)
SRV - [2011.03.21 17:48:14 | 000,283,648 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Programme\IDT\WDM\stacsv64.exe -- (STacSV)
SRV - [2011.03.21 17:48:10 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Programme\IDT\WDM\AESTSr64.exe -- (AESTFilters)
SRV - [2010.12.09 14:38:20 | 002,655,768 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2010.12.09 14:38:20 | 000,325,656 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010.11.25 11:34:18 | 000,219,632 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe -- (RoxWatch12)
SRV - [2010.11.25 11:33:18 | 001,116,656 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe -- (RoxMediaDB12OEM)
SRV - [2010.10.29 19:20:58 | 000,236,016 | ---- | M] (CyberLink) [Auto | Stopped] -- c:\Program Files (x86)\CyberLink\PowerDVD9\NavFilter\kmsvc.exe -- (CLKMSVC10_9EC60124)
SRV - [2010.09.14 00:32:32 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010.08.21 00:53:08 | 000,689,472 | ---- | M] (SoftThinks SAS) [Auto | Running] -- C:\Program Files (x86)\AlienRespawn\sftservice.EXE -- (SftService)
SRV - [2010.07.29 19:39:24 | 000,951,584 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.12.11 18:49:18 | 000,129,216 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.12.11 18:49:18 | 000,099,912 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\WINDOWS\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.12.01 13:41:38 | 000,446,312 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\nvstusb.sys -- (NvStUSB)
DRV:64bit: - [2012.09.24 09:58:11 | 000,027,800 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\WINDOWS\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.08.21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012.07.09 13:42:54 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.07.03 16:25:16 | 000,189,288 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.03.21 17:48:16 | 000,520,192 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\WINDOWS\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.12.09 17:38:18 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010.11.30 14:48:38 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\L1C62x64.sys -- (L1C)
DRV:64bit: - [2010.11.30 14:32:36 | 000,326,760 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\RtsPStor.sys -- (RSPCIESTOR)
DRV:64bit: - [2010.11.29 17:03:06 | 001,395,760 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2010.11.21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 04:23:47 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.11.21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.11.17 01:43:32 | 000,180,736 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010.11.17 01:43:32 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010.09.14 00:24:26 | 000,437,272 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010.09.07 14:41:14 | 000,027,760 | ---- | M] (ST Microelectronics) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\Accelern.sys -- (Acceler)
DRV:64bit: - [2010.08.20 10:05:12 | 000,021,616 | ---- | M] (ST Microelectronics) [Kernel | Boot | Running] -- C:\WINDOWS\SysNative\drivers\stdcfltn.sys -- (stdcfltn)
DRV:64bit: - [2010.08.17 14:17:46 | 000,135,720 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\btwavdt.sys -- (btwavdt)
DRV:64bit: - [2010.08.17 14:17:46 | 000,102,952 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\btwaudio.sys -- (btwaudio)
DRV:64bit: - [2010.08.17 14:17:46 | 000,039,464 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\btwl2cap.sys -- (btwl2cap)
DRV:64bit: - [2010.08.17 14:17:46 | 000,021,544 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\btwrchid.sys -- (btwrchid)
DRV:64bit: - [2010.08.17 10:17:46 | 000,344,616 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\btwampfl.sys -- (btwampfl)
DRV:64bit: - [2010.08.12 16:51:30 | 000,175,168 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt)
DRV:64bit: - [2010.07.15 13:59:30 | 003,058,168 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2010.03.19 09:00:00 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.26 21:43:42 | 000,016,752 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | Boot | Running] -- C:\WINDOWS\SysNative\drivers\EMSC.sys -- (EMSC)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2006.11.01 18:51:00 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009.06.26 21:43:42 | 000,013,680 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | Boot | Running] -- C:\WINDOWS\SysWOW64\drivers\EMSC.sys -- (EMSC)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2045273759-2768515641-435408660-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://support.alienware.com [binary data]
IE - HKU\S-1-5-21-2045273759-2768515641-435408660-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-2045273759-2768515641-435408660-1000\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\S-1-5-21-2045273759-2768515641-435408660-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2045273759-2768515641-435408660-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2045273759-2768515641-435408660-1000\..\SearchScopes\{A48BDA03-1D0B-4F06-B196-AAD984061403}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=C355AEF6-C597-4534-9DFA-4E12721F697E&apn_sauid=57C6BEDE-6CC1-4670-A6E3-6E733949EB15
IE - HKU\S-1-5-21-2045273759-2768515641-435408660-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2045273759-2768515641-435408660-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
 
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_37: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
 
 
========== Chrome  ==========
 
CHR - homepage: 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR - homepage: 
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.52\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.52\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.52\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 6 U37 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Java Deployment Toolkit 6.0.370.6 (Enabled) = C:\Windows\SysWOW64\npdeployJava1.dll
 
O1 HOSTS File: ([2013.02.19 18:11:06 | 000,000,027 | ---- | M]) - C:\WINDOWS\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [Command Center Controllers] C:\Program Files\Alienware\Command Center\AWCCStartupOrchestrator.exe (Alienware)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [AlienwareOn-ScreenDisplay] C:\Program Files (x86)\Alienware On-Screen Display\AlienwareOn-ScreenDisplay.exe ()
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BDRegion] c:\Program Files (x86)\Cyberlink\Shared Files\brs.exe (cyberlink)
O4 - HKLM..\Run: [Dell Registration] C:\Program Files (x86)\System Registration\prodreg.exe (Dell, Inc.)
O4 - HKLM..\Run: [Desktop Disc Tool] C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe ()
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [Integrated Webcam Live! Central] C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [PDVD9LanguageShortcut] c:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RemoteControl9] c:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe (Sonic Solutions)
O4 - HKU\S-1-5-21-2045273759-2768515641-435408660-1000..\Run: [Akamai NetSession Interface] C:\Users\Alienware\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.)
O4 - HKU\S-1-5-21-2045273759-2768515641-435408660-1005..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Launcher] C:\Program Files (x86)\AlienRespawn\Components\Scheduler\Launcher.exe (Softthinks)
O4 - HKU\S-1-5-21-2045273759-2768515641-435408660-1005..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2045273759-2768515641-435408660-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2045273759-2768515641-435408660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-2045273759-2768515641-435408660-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8:64bit: - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8:64bit: - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-2045273759-2768515641-435408660-1000\..Trusted Domains: dell.com ([]* in Trusted sites)
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab (Java Plug-in 1.6.0_37)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0B26FFD0-EF79-497D-954C-E389D0A939BA}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D12D4E92-7589-4D35-A703-35639E65D4B7}: DhcpNameServer = 150.200.3.2
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\WINDOWS\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\WINDOWS\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
 
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\WINDOWS\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
 
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.02.19 18:51:05 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Alienware\Desktop\OTL.exe
[2013.02.19 18:12:20 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013.02.19 18:02:13 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.02.19 18:02:13 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.02.19 18:02:13 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.02.19 18:02:07 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.02.19 18:01:53 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.02.19 18:00:35 | 005,034,457 | R--- | C] (Swearware) -- C:\Users\Alienware\Desktop\ComboFix.exe
[2013.02.19 15:57:06 | 000,688,992 | R--- | C] (Swearware) -- C:\Users\Alienware\Desktop\dds.com
[2013.02.14 17:32:08 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2013.02.14 17:32:08 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2013.02.14 17:32:07 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013.02.14 17:32:07 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2013.02.14 17:32:07 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013.02.14 17:32:07 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2013.02.14 17:32:07 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2013.02.14 17:32:06 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013.02.14 17:32:06 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2013.02.14 17:32:06 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2013.02.14 17:32:06 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013.02.14 17:32:06 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2013.02.14 17:32:05 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013.02.14 17:32:05 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013.02.14 17:32:05 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2013.02.14 16:05:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013.02.14 16:05:20 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2013.02.14 16:05:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2013.02.14 16:05:20 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2013.02.14 16:05:20 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2013.02.14 16:01:31 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2013.02.14 16:01:31 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2013.02.14 16:01:31 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2013.02.14 16:01:31 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2013.02.14 16:01:31 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2013.02.14 16:01:31 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2013.02.14 16:01:30 | 005,553,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2013.02.14 16:01:30 | 003,967,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2013.02.14 16:01:30 | 003,913,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2013.02.14 15:58:52 | 000,288,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\FWPKCLNT.SYS
 
========== Files - Modified Within 30 Days ==========
 
[2013.02.19 18:51:05 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Alienware\Desktop\OTL.exe
[2013.02.19 18:17:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.02.19 18:11:06 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.02.19 18:05:07 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.02.19 18:05:07 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.02.19 18:04:00 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.02.19 18:00:55 | 005,034,457 | R--- | M] (Swearware) -- C:\Users\Alienware\Desktop\ComboFix.exe
[2013.02.19 17:57:49 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.02.19 17:57:38 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.02.19 17:57:33 | 2133,188,607 | -HS- | M] () -- C:\hiberfil.sys
[2013.02.19 16:04:51 | 000,374,784 | ---- | M] () -- C:\Users\Alienware\Desktop\bj0vkdbj.exe
[2013.02.19 16:01:31 | 000,000,000 | ---- | M] () -- C:\Users\Alienware\defogger_reenable
[2013.02.19 15:57:43 | 000,050,477 | ---- | M] () -- C:\Users\Alienware\Desktop\Defogger.exe
[2013.02.19 15:57:06 | 000,688,992 | R--- | M] (Swearware) -- C:\Users\Alienware\Desktop\dds.com
[2013.02.18 20:15:12 | 000,323,248 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.02.14 17:33:58 | 001,634,476 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.02.14 17:33:58 | 000,696,870 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.02.14 17:33:58 | 000,652,148 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.02.14 17:33:58 | 000,148,134 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.02.14 17:33:58 | 000,121,080 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.02.14 16:17:22 | 000,697,712 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.02.14 16:17:22 | 000,074,096 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.02.14 16:05:31 | 000,001,793 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
 
========== Files Created - No Company Name ==========
 
[2013.02.19 18:02:13 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.02.19 18:02:13 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.02.19 18:02:13 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.02.19 18:02:13 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.02.19 18:02:13 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.02.19 16:04:51 | 000,374,784 | ---- | C] () -- C:\Users\Alienware\Desktop\bj0vkdbj.exe
[2013.02.19 16:01:31 | 000,000,000 | ---- | C] () -- C:\Users\Alienware\defogger_reenable
[2013.02.19 15:57:43 | 000,050,477 | ---- | C] () -- C:\Users\Alienware\Desktop\Defogger.exe
[2012.12.20 12:07:24 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll
[2012.11.13 16:54:24 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2012.11.13 16:54:24 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2012.06.15 16:13:58 | 000,022,384 | ---- | C] () -- C:\Windows\SysWow64\LightFX.dll
[2011.06.27 09:07:14 | 000,098,232 | ---- | C] () -- C:\Windows\SysWow64\CCBiosSupportAPI.dll
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\WINDOWS\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\WINDOWS\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\WINDOWS\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== Custom Scans ==========
 
< hklm\software\clients\startmenuinternet|command /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ReinstallCommand: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --make-default-browser [2013.01.26 03:35:08 | 001,248,208 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\HideIconsCommand: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --hide-icons [2013.01.26 03:35:08 | 001,248,208 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ShowIconsCommand: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --show-icons [2013.01.26 03:35:08 | 001,248,208 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\shell\open\command\\: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" [2013.01.26 03:35:08 | 001,248,208 | ---- | M] (Google Inc.)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\Windows\System32\ie4uinit.exe" -show [2012.11.09 17:45:53 | 000,074,240 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\Windows\System32\ie4uinit.exe" -reinstall [2012.11.09 17:45:53 | 000,074,240 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\Windows\System32\ie4uinit.exe" -hide [2012.11.09 17:45:53 | 000,074,240 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -extoff [2013.01.08 23:42:06 | 000,757,280 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "C:\Program Files (x86)\Internet Explorer\iexplore.exe" [2013.01.08 23:42:06 | 000,757,280 | ---- | M] (Microsoft Corporation)
 
< hklm\software\clients\startmenuinternet|command /64 /rs >
64bit-HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ReinstallCommand: "C:\PROGRAM FILES (X86)\GOOGLE\CHROME\APPLICATION\CHROME.EXE" --MAKE-DEFAULT-BROWSER [2013.01.26 03:35:08 | 001,248,208 | ---- | M] (Google Inc.)
64bit-HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\HideIconsCommand: "C:\PROGRAM FILES (X86)\GOOGLE\CHROME\APPLICATION\CHROME.EXE" --HIDE-ICONS [2013.01.26 03:35:08 | 001,248,208 | ---- | M] (Google Inc.)
64bit-HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\InstallInfo\\ShowIconsCommand: "C:\PROGRAM FILES (X86)\GOOGLE\CHROME\APPLICATION\CHROME.EXE" --SHOW-ICONS [2013.01.26 03:35:08 | 001,248,208 | ---- | M] (Google Inc.)
64bit-HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\Google Chrome\shell\open\command\\: "C:\PROGRAM FILES (X86)\GOOGLE\CHROME\APPLICATION\CHROME.EXE" [2013.01.26 03:35:08 | 001,248,208 | ---- | M] (Google Inc.)
64bit-HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\SYSTEM32\IE4UINIT.EXE" -SHOW [2012.11.09 17:45:53 | 000,089,088 | ---- | M] (Microsoft Corporation)
64bit-HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\SYSTEM32\IE4UINIT.EXE" -REINSTALL [2012.11.09 17:45:53 | 000,089,088 | ---- | M] (Microsoft Corporation)
64bit-HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\SYSTEM32\IE4UINIT.EXE" -HIDE [2012.11.09 17:45:53 | 000,089,088 | ---- | M] (Microsoft Corporation)
64bit-HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IEXPLORE.EXE" -EXTOFF [2013.01.08 23:42:06 | 000,757,280 | ---- | M] (Microsoft Corporation)
64bit-HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IEXPLORE.EXE" [2013.01.08 23:42:06 | 000,757,280 | ---- | M] (Microsoft Corporation)
 
<           >

< End of report >
         

--- --- ---


OTL EXTRAS Logfile:

OTL Extras logfile created on: 19.02.2013 18:54:13 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Alienware\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 6,08 Gb Available Physical Memory | 76,18% Memory free
15,96 Gb Paging File | 13,91 Gb Available in Paging File | 87,13% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 689,37 Gb Total Space | 622,19 Gb Free Space | 90,26% Space Free | Partition Type: NTFS
 
Computer Name: ALIENWARE-PC | User Name: Alienware | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-2045273759-2768515641-435408660-1000\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{235533F7-2E57-4CB0-917C-BA1C963818A7}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{45BC3690-92B3-4CF8-8812-98566229652C}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{556465FF-8201-4F7D-BA00-71EA93B37E41}" = rport=445 | protocol=6 | dir=out | app=system | 
"{5A5FAC66-BD7F-41E3-89F5-4AA7330AED33}" = lport=137 | protocol=17 | dir=in | app=system | 
"{647E005E-9BDA-4350-8A35-FD9D3D1AC707}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{6EFAB3B2-0DFA-487B-A614-C2DE77147756}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{6F70B20B-99A3-40D8-BC87-4CDE2CEE21E8}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{76E06B65-3365-4528-A605-9E849AC75AE9}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{839FCA0C-9D1D-40BC-BBC4-89CE463365BC}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{8CD93F08-1361-4936-B59F-AEF3BAE81108}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{92992F7C-03C7-446E-8FA6-5C6932BD5BE8}" = lport=139 | protocol=6 | dir=in | app=system | 
"{BC4A9D62-D3C6-45CE-B48E-27F07AAF5A74}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{C7CAFB40-D984-40F3-9AF5-B308C57A3291}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{D3A09565-B161-4EA4-A32F-DB0FB50B72F5}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{D676997F-6EEE-4824-8025-3487C6B46A73}" = lport=138 | protocol=17 | dir=in | app=system | 
"{D97DA763-2AC4-48D4-BEF8-1AFE845DC8CA}" = lport=445 | protocol=6 | dir=in | app=system | 
"{DC598B2E-4752-4347-BF26-EFE44192CB53}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{DE059EEF-0A23-4D81-8F04-42E8DD732D9E}" = rport=139 | protocol=6 | dir=out | app=system | 
"{E2D4828F-DCFF-426F-8F46-429EE191EDA0}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{E47B983E-34C0-4550-A142-E212B2A437E6}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{EABA84BE-9C18-4362-82D5-F6CBC15D785C}" = rport=138 | protocol=17 | dir=out | app=system | 
"{F7E8404D-EC93-459A-AB34-38120655525C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{FE5BF338-7A7A-4968-A931-C7AA644B7B97}" = rport=137 | protocol=17 | dir=out | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0663DCAD-EBFC-4607-9BCC-B962C82344C6}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe | 
"{12001E3C-3ADE-42E0-B6EF-B71CBC101D48}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe | 
"{1729C89E-3AE4-47A2-97D0-66EBB99B7EB4}" = protocol=6 | dir=out | app=system | 
"{1BFD4E96-7F6A-46CE-9740-A1127CC60CA7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{27BD9C51-E3B9-4D1D-8A64-7BD9CEC1922A}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe | 
"{2A33E8B6-C415-4A1E-96E0-17ECD899FA03}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe | 
"{2A7FC90D-B711-4047-84DA-4147F874A46D}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{2BEC0D25-95AF-4D42-9021-35483609E78D}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe | 
"{302C906D-51CD-497D-B290-1AE267099218}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe | 
"{34903843-215F-4272-9636-DED8D6CF08FD}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{39F66A3F-12DC-4341-8577-747593EF571C}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe | 
"{4888A287-8389-4988-A106-FBCA9BD0E1FC}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{4910EC6C-9EE8-42A4-92D0-09ED01284953}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe | 
"{4B55CFD6-95B6-4BA5-B1D3-EEBDEEDE7EAE}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{4C7F2961-5BA6-41CC-9F74-77299EAA8716}" = protocol=17 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe | 
"{4E87CFD1-3EEB-40D7-8EA8-1E683E701E04}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{556F5654-547C-444A-9967-703AA71CADBA}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{5586202E-57F9-4919-8E56-3F59317AEEFC}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{6046F60F-0486-4CC7-8136-591798E70800}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{7FED894E-BAE0-423C-8C75-8EE039F2CB2F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{81146DBF-8BD7-441A-9EB8-514AF6821150}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{833D855D-1A60-4B29-92E3-2AD919CF3C98}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{8A08F0FB-4E3D-4D20-A2E1-61212B360E37}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{8E76A0BA-11BD-44DF-A8AF-1242DEBE857B}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{9A60D2BD-D7D2-4324-8142-4ACB1AEA3082}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{9A64C52E-020C-4456-B1CE-09CBCFDC5128}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe | 
"{9B7A5AC0-0896-472F-B42E-A2A7518C3895}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{C1C1E89C-157B-4D23-A1A9-3A0702D5771A}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd9\powerdvd9.exe | 
"{C73730B3-0F53-41FF-B01E-72856EDEB268}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{C7C35243-258F-493C-888B-8E64D3D35ED4}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe | 
"{CF6679FF-7B2B-4FEC-BB75-E685994E88C6}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd9\powerdvd cinema\powerdvdcinema.exe | 
"{DF563D59-E62A-43AE-915E-46F6DAAB5C0A}" = protocol=6 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe | 
"{EB7BE4D4-491C-4B59-852B-AD9F423FDEDA}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{EBDA0C37-3AA5-4725-BD00-D366D1FD3C89}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{ED4BA28E-F9DA-4F5F-A71F-524329482846}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{F1AE055E-2B2C-4870-996C-16F5BE739F91}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{F217D9C3-D713-4498-98DB-839FB58874EA}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{F7005CE8-1CC5-4BCB-858D-81FA811FFF48}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{F7E1887E-8299-4D84-B537-FA1A9AEB9DBD}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"TCP Query User{5A93BB05-38DF-402D-B8BD-5B16C3246930}C:\users\alienware\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\alienware\appdata\local\akamai\netsession_win.exe | 
"TCP Query User{D077669E-0D7D-41A1-BC6A-4451031D5846}C:\users\alienware\appdata\roaming\ewceqa\keabi.exe" = protocol=6 | dir=in | app=c:\users\alienware\appdata\roaming\ewceqa\keabi.exe | 
"TCP Query User{E248B234-4C87-4C37-B859-5321F702092F}C:\users\alienware\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\alienware\appdata\local\akamai\netsession_win.exe | 
"TCP Query User{F04B2657-AEFB-4AF3-90CE-66385FD7C14E}C:\users\alienware\appdata\roaming\ewceqa\keabi.exe" = protocol=6 | dir=in | app=c:\users\alienware\appdata\roaming\ewceqa\keabi.exe | 
"UDP Query User{29E500AC-09D3-466B-AE04-86F3ED9E3B0B}C:\users\alienware\appdata\roaming\ewceqa\keabi.exe" = protocol=17 | dir=in | app=c:\users\alienware\appdata\roaming\ewceqa\keabi.exe | 
"UDP Query User{3F8E3572-991F-4C33-BC91-FE34FCF917BE}C:\users\alienware\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\alienware\appdata\local\akamai\netsession_win.exe | 
"UDP Query User{C8499AD8-53CC-4959-BA0D-EB9CC099C532}C:\users\alienware\appdata\roaming\ewceqa\keabi.exe" = protocol=17 | dir=in | app=c:\users\alienware\appdata\roaming\ewceqa\keabi.exe | 
"UDP Query User{EE9E4173-3A9B-47F8-A1E5-85A176ED3519}C:\users\alienware\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\alienware\appdata\local\akamai\netsession_win.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E5D76AD-A3FB-48D5-8400-8903B10317D3}" = iTunes
"{26A24AE4-039D-4CA4-87B4-2F86416024FF}" = Java(TM) 6 Update 24 (64-bit)
"{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}" = WIDCOMM Bluetooth Software
"{60B2315F-680F-4EB3-B8DD-CCDC86A7CCAB}" = Roxio File Backup
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{9D6DFAD6-09E5-445E-A4B5-A388FEEBD90D}" = RBVirtualFolder64Inst
"{A140A094-942E-4F76-B8F4-850EC146170F}" = Alienware M17x Manual
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 310.70
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 310.70
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 310.70
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 310.70
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.1031
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.11.3
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.18.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{D70884EA-E2CE-4539-91DB-4766CC1E5F5F}" = Apple Mobile Device Support
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FD1AE10F-163C-4D4B-9FCE-AC667AF1DC6E}" = Alienware Command Center
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"SynTPDeinstKey" = Synaptics Pointing Device Driver
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052bac4a-6f79-46d4-a024-1ce1b4f73cd4}" = Microsoft Visual C++ 2005 Redistributable
"{0D69462F-99CC-4F8D-942E-666E21CE59F8}" = Alienware On-Screen Display
"{0ED7EE95-6A97-47AA-AD73-152C08A15B04}" = AlienRespawn
"{26A24AE4-039D-4CA4-87B4-2F83216037FF}" = Java(TM) 6 Update 37
"{2A0F2CC5-3065-492C-8380-B03AA7106B1A}" = Alienware Product Registration
"{3250260C-7A95-4632-893B-89657EB5545B}" = PhotoShowExpress
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5A06423A-210C-49FB-950E-CB0EB8C5CEC7}" = Roxio BackOnTrack
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{6F0BBEFE-BE1C-419B-BA1F-D36C9E7915BC}" = Roxio Creator Starter
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7746BFAA-2B5D-4FFD-A0E8-4558F4668105}" = Roxio Burn
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}" = NVIDIA PhysX
"{9A00EC4E-27E1-42C4-98DD-662F32AC8870}" = Sonic CinePlayer Decoder Pack
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A121EEDE-C68F-461D-91AA-D48BA226AF1C}" = Roxio Activation Module
"{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9.6
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9668246-FB70-4103-A1E3-66C9BC2EFB49}" = AlienRespawn - Support Software
"{AC76BA86-7AD7-1031-7B44-A91000000001}" = Adobe Reader 9.1.2 - Deutsch
"{AF9E97C1-7431-426D-A8D5-ABE40995C0B1}" = DirectX 9 Runtime
"{CCE825DB-347A-4004-A186-5F4A6FDD8547}" = Apple Application Support
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E5F05232-96B6-4552-A480-785A60A94B21}" = System Requirements Lab CYRI
"{EF56258E-0326-48C5-A86C-3BAC26FC15DF}" = Roxio Creator Starter
"{F06B5C4C-8D2E-4B24-9D43-7A45EEC6C878}" = Roxio Creator Starter
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{FEF06E73-A519-4510-8CF3-B66041B91D8A}" = EMSC
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Avira AntiVir Desktop" = Avira Free Antivirus
"Diablo III" = Diablo III
"Google Chrome" = Google Chrome
"InstallShield_{0D69462F-99CC-4F8D-942E-666E21CE59F8}" = Alienware On-Screen Display
"InstallShield_{A140A094-942E-4F76-B8F4-850EC146170F}" = Alienware M17x Manual
"InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}" = CyberLink PowerDVD 9.6
"InstallShield_{FD1AE10F-163C-4D4B-9FCE-AC667AF1DC6E}" = Alienware Command Center
"Integrated Webcam Live! Central" = Integrated Webcam Live! Central
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"TechPowerUp GPU-Z" = TechPowerUp GPU-Z
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-2045273759-2768515641-435408660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Ask Toolbar Updater
"9204f5692a8faf3b" = Dell System Detect
"Akamai" = Akamai NetSession Interface
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 10.01.2013 11:36:25 | Computer Name = Alienware-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 10.01.2013 11:57:18 | Computer Name = Alienware-PC | Source = Customer Experience Improvement Program | ID = 1008
Description = 
 
Error - 10.01.2013 15:01:24 | Computer Name = Alienware-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 11.01.2013 11:13:54 | Computer Name = Alienware-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 11.01.2013 15:35:43 | Computer Name = Alienware-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 12.01.2013 22:06:41 | Computer Name = Alienware-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 13.01.2013 08:41:03 | Computer Name = Alienware-PC | Source = Customer Experience Improvement Program | ID = 1008
Description = 
 
Error - 14.01.2013 11:49:54 | Computer Name = Alienware-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 14.01.2013 12:29:17 | Computer Name = Alienware-PC | Source = Customer Experience Improvement Program | ID = 1008
Description = 
 
Error - 16.01.2013 07:02:08 | Computer Name = Alienware-PC | Source = WinMgmt | ID = 10
Description = 
 
[ Dell Events ]
Error - 09.11.2012 09:55:09 | Computer Name = Alienware-PC | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
 
Error - 09.11.2012 10:56:01 | Computer Name = Alienware-PC | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
 
Error - 09.11.2012 10:56:01 | Computer Name = Alienware-PC | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
 
Error - 23.11.2012 12:30:26 | Computer Name = Alienware-PC | Source = DataSafe | ID = 17
Description = Der Vorgang wurde unterbrochen, bevor er abgeschlossen werden konnte.
 
[ System Events ]
Error - 20.12.2012 07:23:09 | Computer Name = Alienware-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der
 aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068
 
Error - 21.12.2012 17:08:27 | Computer Name = Alienware-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 24.12.2012 11:10:24 | Computer Name = Alienware-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?24.?12.?2012 um 15:41:21 unerwartet heruntergefahren.
 
Error - 03.01.2013 05:00:14 | Computer Name = Alienware-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?03.?01.?2013 um 09:59:30 unerwartet heruntergefahren.
 
Error - 04.01.2013 03:17:07 | Computer Name = Alienware-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "Alienware Fusion Service" wurde unerwartet beendet. Dies ist
 bereits 1 Mal passiert.
 
Error - 09.01.2013 13:52:01 | Computer Name = Alienware-PC | Source = VDS Basic Provider | ID = 33554433
Description = 
 
Error - 09.01.2013 13:52:01 | Computer Name = Alienware-PC | Source = VDS Basic Provider | ID = 33554433
Description = 
 
Error - 09.01.2013 14:32:24 | Computer Name = Alienware-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 11.01.2013 11:13:02 | Computer Name = Alienware-PC | Source = VDS Basic Provider | ID = 33554433
Description = 
 
Error - 11.01.2013 11:13:02 | Computer Name = Alienware-PC | Source = VDS Basic Provider | ID = 33554433
Description = 
 
 
< End of report >
         

--- --- ---

Servus,



wie läuft dein Rechner derzeit?
Gibt es noch Probleme? Wenn ja, welche?







Schritt 1

Fixen mit OTL

• Starte bitte die OTL.exe.
• Kopiere nun den Inhalt aus der Codebox in die Textbox.

:OTL
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: []  File not found

:reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"TCP Query User{D077669E-0D7D-41A1-BC6A-4451031D5846}C:\users\alienware\appdata\roaming\ewceqa\keabi.exe"=-
"TCP Query User{F04B2657-AEFB-4AF3-90CE-66385FD7C14E}C:\users\alienware\appdata\roaming\ewceqa\keabi.exe"=-
"UDP Query User{29E500AC-09D3-466B-AE04-86F3ED9E3B0B}C:\users\alienware\appdata\roaming\ewceqa\keabi.exe"=-
"UDP Query User{C8499AD8-53CC-4959-BA0D-EB9CC099C532}C:\users\alienware\appdata\roaming\ewceqa\keabi.exe"=-

:commands
[Emptytemp]
         

• Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
• Schließe bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
  ( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
  Kopiere nun den Inhalt hier in Deinen Thread

Schritt 2

• Starte Malwarebytes' Anti-Malware, klicke auf Aktualisierung --> Suche nach Aktualisierung
• Wenn das Update beendet wurde, aktiviere Quick-Scan durchführen und drücke auf Scannen.
• Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen.
• Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
• Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
• Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Schritt 3

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 4
Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.





Bitte poste mit deiner nächsten Antwort

• die Beantwortung der gestellten Fragen,
• die Logdatei von OTL,
• die Logdatei von MBAM,
• die Logdatei von ESET,
• die Logdatei von SecurityCheck.

Hey , der Rechner läuft ohne Probleme.....ausser die Viren giebt es keine probleme

ich poste in jede Antwort 1 log,...hoffe das ist ok für dich....

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{D077669E-0D7D-41A1-BC6A-4451031D5846}C:\users\alienware\appdata\roaming\ewceqa\keabi.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{F04B2657-AEFB-4AF3-90CE-66385FD7C14E}C:\users\alienware\appdata\roaming\ewceqa\keabi.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{29E500AC-09D3-466B-AE04-86F3ED9E3B0B}C:\users\alienware\appdata\roaming\ewceqa\keabi.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{C8499AD8-53CC-4959-BA0D-EB9CC099C532}C:\users\alienware\appdata\roaming\ewceqa\keabi.exe deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Alienware
->Temp folder emptied: 932809 bytes
->Temporary Internet Files folder emptied: 591120381 bytes
->Java cache emptied: 1110503 bytes
->Google Chrome cache emptied: 113295280 bytes
->Flash cache emptied: 2369 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
RecycleBin emptied: 304987 bytes

Total Files Cleaned = 674,00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 02202013_183208

Files\Folders moved on Reboot...
C:\Users\Alienware\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Malwarebytes Anti-Malware (Test) 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.02.20.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Alienware :: ALIENWARE-PC [Administrator]

Schutz: Aktiviert

20.02.2013 18:40:44
mbam-log-2013-02-20 (18-40-44).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 232858
Laufzeit: 1 Minute(n), 57 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)




ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=ef952bf14175c349969586d3ef42e223
# engine=13199
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-02-20 06:28:58
# local_time=2013-02-20 07:28:58 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 96 17747 226804628 10535 0
# compatibility_mode=5893 16776574 100 94 71066338 113014788 0 0
# scanned=116804
# found=2
# cleaned=0
# scan_time=2444
sh=5495806883EB8840CAB603C0E1A5B5CC0EA73E92 ft=1 fh=58e2ca4e8afa142c vn="a variant of Win32/Kryptik.AUFQ trojan" ac=I fn="C:\Qoobox\Quarantine\C\Users\Alienware\AppData\Roaming\Akozxu\ramaqo.exe.vir"
sh=A0E83A73D4BD255F0941B02E301A424A2CFFFFB1 ft=1 fh=58e2ca4e8afa142c vn="a variant of Win32/Kryptik.AUFQ trojan" ac=I fn="C:\Qoobox\Quarantine\C\Users\Alienware\AppData\Roaming\Ewceqa\keabi.exe.vir"






Results of screen317's Security Check version 0.99.58
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware Version 1.70.0.1100
Java(TM) 6 Update 37
Java version out of Date!
Adobe Reader 9 Adobe Reader out of Date!
Google Chrome 24.0.1312.56
Google Chrome 24.0.1312.57
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````

Servus,



Wenn du keine Probleme mehr hast, dann sind wir hier fertig. Deine Logdateien sind sauber.
Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern.



Schritt 1
Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

• Downloade dir bitte die neueste Java-Version von hier:
  Java Download (32 bit)
• Speichere die Datei auf deinem Desktop.
• Schließe alle laufenden Programme. Speziell deinen Browser.
• Starte die Datei. Diese wird die neueste Java Version ( Java 7 Update 13 ) installieren.
• Entferne den Haken bei "Installieren Sie die Ask-Toolbar ..." während der Installation.
• Wenn die Installation beendet wurde
  Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
• Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

• Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
• Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
• Klicke auf Dateien löschen....
• Gehe sicher das überall ein Haken gesetzt ist und klicke OK.
• Klicke erneut OK.

schneller Plugin-Test: PluginCheck





Schritt 2
Deinstalliere bitte deine aktuelle Version von Adobe Reader
Start--> Systemsteuerung--> Software / Programme deinstallieren--> Adobe Reader
und lade dir die neue Version von Hier herunter-
Entferne den Hacken für den McAfee SecurityScan bzw. Google Chrome.





Schritt 3
Starte DeFogger und klicke auf Re-enable.
Gegebenenfalls muss dein Rechner neu gestartet werden.





Schritt 4
Bitte vor der folgenden Aktion wieder temporär Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.

Windows-Taste + R drücke. Kopiere nun folgende Zeile in die Kommandozeile und klicke OK.

Combofix /Uninstall
         

Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert, damit auch aus dieser die Schädlinge verschwinden.

Nun die eben deaktivierten Programme wieder aktivieren.





Schritt 5
Downloade dir bitte delfix auf deinen Desktop.

• Schließe alle offenen Programme.
• Starte die delfix.exe mit einem Doppelklick.
• Setze vor jede Funktion ein Häkchen.
• Klicke auf Start.
• DelFix entfernt u. a. alle verwendeten Programme und löscht sich abschließend selbst.
• Sollten noch Programme, die wir verwendet haben, vorhanden sein, so lösche diese bitte per Hand.

Schritt 6
Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

• Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
• Windows Updates
  • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
  • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
• Gehe sicher das die automatischen Updates aktiviert sind.
• Software Updates
  Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
  Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

• Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

• MalwareBytes Anti Malware
  Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
  Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
  Ein Tutorial zur Verwendung findest Du hier.
• WinPatrol
  Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

• SpywareBlaster
  Eine kurze Einführung findest du Hier
• MVPs hosts file
  Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
• WOT (Web of trust)
  Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

• Opera
• Mozilla Firefox.
  • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
  • NoScript
    Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    
  • AdblockPlus
    Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
    Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts

• Klicke nicht auf alles, nur weil es Dich dazu auffordert und schön bunt ist.
• Verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
• Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
• Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe.

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.



Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.

Juhuuu vielen dank ...ich werde soweit alles noch befolgen heute und nochmals Tausend dank......

Ich bin froh, dass wir helfen konnten

Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen.