| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: fileConverter 1.3 Customized Web search beim download mitbekommen, vermutlich bei softonicWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
16.04.2013, 21:29
| #1 |
| |  fileConverter 1.3 Customized Web search beim download mitbekommen, vermutlich bei softonic Moin, beim einem freedownload am 01.04.2013 wahrscheinlich den FileConverter mitbekommen. Seit dem habe ich ihn ständig in der Browserleiste. Zwar habe ich die Startseite wieder ganz normal, aber jeder Tab öffnet sich mit oder im FileConverter Web search. Ausserdem dauert es sehr viel länger als vorher, das sich Mozilla firefox öffnet. Zeitgleich konnte ich bestimmte Spiele und Videos eines Kinderprogramms nicht mehr abspielen. Ob da ein Zusammenhan besteht, weiß ich allerdings nicht. Da normales Löschen/ Deinstallieren nichts bringt, versuche ich es über diesen Weg. Nachfolgend die benötigten Dateien. Bei OTL.exe wurde nur ein Textdokument erstellt.OTL Logfile: Code:
ATTFilter OTL logfile created on: 16.04.2013 17:14:35 - Run 3 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Nowilus\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,99 Gb Total Physical Memory | 1,68 Gb Available Physical Memory | 56,13% Memory free 6,18 Gb Paging File | 4,78 Gb Available in Paging File | 77,39% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 116,21 Gb Total Space | 64,16 Gb Free Space | 55,21% Space Free | Partition Type: NTFS Drive E: | 115,21 Gb Total Space | 23,88 Gb Free Space | 20,73% Space Free | Partition Type: NTFS Computer Name: ESTEDEERN | User Name: Nowilus | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.04.16 17:11:12 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Nowilus\Downloads\OTL.exe PRC - [2013.04.13 13:03:48 | 000,920,472 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2013.04.11 19:53:22 | 001,855,880 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe PRC - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2013.04.04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe PRC - [2012.12.18 21:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012.08.10 15:03:46 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.05.15 21:40:44 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2012.05.15 21:40:43 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2012.05.15 21:40:43 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2012.03.07 00:36:42 | 000,021,392 | ---- | M] () -- C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe PRC - [2012.03.07 00:36:32 | 003,508,624 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\Kies\KiesTrayAgent.exe PRC - [2011.06.01 17:57:16 | 000,561,984 | ---- | M] (Apple Inc.) -- C:\Programme\Apple Software Update\SoftwareUpdate.exe PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.04.11 08:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe PRC - [2009.02.26 18:36:46 | 000,030,040 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe PRC - [2008.01.29 19:51:52 | 004,911,104 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe PRC - [2008.01.25 14:33:50 | 000,509,816 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\TOSHIBA\SmoothView\SmoothView.exe PRC - [2008.01.22 15:25:26 | 000,712,704 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\TOSHIBA\FlashCards\TCrdMain.exe PRC - [2008.01.21 17:54:46 | 000,083,312 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe PRC - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2008.01.21 04:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe PRC - [2008.01.21 04:23:32 | 000,397,312 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Mail\WinMail.exe PRC - [2008.01.17 17:27:52 | 000,431,456 | ---- | M] (TOSHIBA Corporation) -- C:\Programme\TOSHIBA\Power Saver\TPwrMain.exe PRC - [2008.01.17 17:27:34 | 000,431,456 | ---- | M] (TOSHIBA Corporation) -- c:\Programme\TOSHIBA\Power Saver\TosCoSrv.exe PRC - [2007.12.25 14:07:14 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe PRC - [2007.12.03 18:03:52 | 000,126,976 | ---- | M] (TOSHIBA Corporation) -- c:\Programme\TOSHIBA\SMARTLogService\TosIPCSrv.exe PRC - [2007.11.21 18:23:32 | 000,129,632 | ---- | M] (TOSHIBA Corporation) -- C:\Windows\System32\TODDSrv.exe PRC - [2007.06.18 11:51:10 | 001,507,328 | ---- | M] (Interactive Digital Media) -- C:\Programme\IDM\Desktop SMS\DesktopSMS.exe PRC - [2006.08.23 17:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) -- C:\Programme\Common Files\Ulead Systems\DVD\ULCDRSvr.exe ========== Modules (No Company Name) ========== MOD - [2013.04.13 13:03:47 | 003,133,336 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll MOD - [2013.04.11 19:53:21 | 016,032,648 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32_11_7_700_169.dll MOD - [2013.03.20 20:47:30 | 013,199,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\39f4c7717661667c68f9af8c4f6402b9\System.Windows.Forms.ni.dll MOD - [2013.01.10 19:20:35 | 001,218,560 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\ac9e3eca6c148504588e7c6d09fe83e3\System.Management.ni.dll MOD - [2013.01.10 19:18:42 | 000,762,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\ba58d64562391191a22ad0133512ed6f\System.Runtime.Remoting.ni.dll MOD - [2013.01.10 19:18:31 | 001,801,728 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\866894ebe5258bf9f45d6b063229e990\System.Xaml.ni.dll MOD - [2013.01.10 01:22:53 | 018,002,944 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\14f511c47523f19ca591eb207e9e2084\PresentationFramework.ni.dll MOD - [2013.01.10 01:22:52 | 001,667,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\b573c6a62bb88df0ee2af59b6a8ca910\System.Drawing.ni.dll MOD - [2013.01.10 01:22:43 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\43cd41484df96d15df949eb17dd88152\System.Xml.ni.dll MOD - [2013.01.10 01:22:35 | 011,451,904 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\e10fd15441d278c04a03302880a3e231\PresentationCore.ni.dll MOD - [2013.01.10 01:22:34 | 000,595,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\dfeff31ab1e7cd3480c8942290c92f5d\PresentationFramework.Aero.ni.dll MOD - [2013.01.10 01:22:27 | 007,069,696 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\27dcf04ed7a3506045597c02a5a1fc31\System.Core.ni.dll MOD - [2013.01.10 01:22:23 | 003,858,944 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\7a9ff5ce3a909d075179a2ac70d8f388\WindowsBase.ni.dll MOD - [2013.01.10 01:22:18 | 009,094,656 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\15872842e3e63ddf0f720f406706198e\System.ni.dll MOD - [2013.01.10 01:22:11 | 014,412,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\3f95a6d480ed1ebe45cf27b770ba94ed\mscorlib.ni.dll MOD - [2013.01.03 21:56:11 | 000,115,137 | ---- | M] () -- C:\Users\Nowilus\AppData\Local\Temp\08f56ff6-864d-4a92-944a-57b870198cb2\CliSecureRT.dll MOD - [2012.03.07 00:36:42 | 000,021,392 | ---- | M] () -- C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe MOD - [2007.12.25 13:03:40 | 000,015,184 | ---- | M] () -- C:\Programme\TOSHIBA\PCDiag\NotifyPCD.dll MOD - [2007.12.14 22:40:00 | 000,090,112 | ---- | M] () -- C:\Programme\TOSHIBA\FlashCards\TWarnMsg\TWarnMsg.dll MOD - [2007.12.14 22:28:38 | 004,726,784 | ---- | M] () -- C:\Programme\TOSHIBA\FlashCards\BlackPng.dll MOD - [2007.09.13 15:11:18 | 000,249,856 | ---- | M] () -- C:\Windows\System32\igfxTMM.dll MOD - [2007.01.18 10:30:00 | 000,094,208 | ---- | M] () -- C:\Programme\IDM\Desktop SMS\oehook.dll MOD - [2006.10.10 12:44:16 | 000,009,728 | ---- | M] () -- C:\Programme\TOSHIBA\TOSHIBA Assist\NotifyX.dll MOD - [2006.10.07 12:57:04 | 000,053,248 | ---- | M] () -- c:\Programme\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll ========== Services (SafeList) ========== SRV - File not found [On_Demand | Stopped] -- C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance) SRV - [2013.04.13 13:03:47 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler) SRV - [2012.12.18 21:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.05.15 21:40:44 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.05.15 21:40:43 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.07.20 05:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2009.02.26 18:36:22 | 000,064,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service) SRV - [2008.01.21 17:54:46 | 000,083,312 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Programme\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe -- (TNaviSrv) SRV - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2008.01.17 17:27:34 | 000,431,456 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- c:\Programme\TOSHIBA\Power Saver\TosCoSrv.exe -- (TosCoSrv) SRV - [2007.12.25 14:07:14 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe -- (ConfigFree Service) SRV - [2007.12.03 18:03:52 | 000,126,976 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- c:\Programme\TOSHIBA\SMARTLogService\TosIPCSrv.exe -- (TOSHIBA SMART Log Service) SRV - [2007.11.21 18:23:32 | 000,129,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\System32\TODDSrv.exe -- (TODDSrv) SRV - [2006.10.26 15:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose) SRV - [2006.08.23 17:39:48 | 000,049,152 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Programme\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme) DRV - [2013.04.04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2012.05.15 21:40:44 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2012.05.15 21:40:44 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011.12.08 06:22:26 | 000,136,808 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdm.sys -- (ssadmdm) DRV - [2011.12.08 06:22:26 | 000,121,064 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadbus.sys -- (ssadbus) DRV - [2011.12.08 06:22:26 | 000,012,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdfl.sys -- (ssadmdfl) DRV - [2011.10.19 17:56:15 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2010.06.17 16:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.06.03 01:57:34 | 000,483,200 | ---- | M] (ITETech ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AF15BDA.sys -- (AF15BDA) DRV - [2008.03.17 11:05:30 | 000,101,632 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard) DRV - [2008.01.21 16:42:24 | 000,285,184 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\tos_sps32.sys -- (tos_sps32) DRV - [2008.01.21 04:23:21 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice) DRV - [2008.01.21 04:23:20 | 002,225,664 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) DRV - [2007.12.28 20:21:54 | 000,104,448 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2007.11.09 15:00:52 | 000,023,640 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\TVALZ_O.SYS -- (TVALZ) DRV - [2007.10.17 23:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio) DRV - [2007.09.26 07:12:22 | 002,251,776 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) DRV - [2006.11.20 15:11:14 | 000,007,168 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\FwLnk.sys -- (FwLnk) DRV - [2006.10.18 12:50:04 | 000,016,128 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tdcmdpst.sys -- (tdcmdpst) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 68 BC 2D 51 75 38 CE 01 [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\..\SearchScopes\{645ABCD8-81EB-4102-B70F-56054108860C}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7TSEA_deDE468 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultthis.engineName: "FileConverter 1.3 Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3241949&CUI=UN16882803402494331&UM=1&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.selectedEngine: "FileConverter 1.3 Customized Web Search" FF - prefs.js..browser.search.suggest.enabled: false FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "https://www.google.de/" FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0033-ABCDEFFEDCBA%7D:6.0.33 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1 FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3241949&SearchSource=2&CUI=UN16882803402494331&UM=&q=" FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll () FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.4: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.04.13 13:03:48 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.10.17 00:50:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nowilus\AppData\Roaming\mozilla\Extensions [2013.04.13 20:17:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nowilus\AppData\Roaming\mozilla\Firefox\Profiles\jiup23h2.default\extensions [2013.04.01 21:42:33 | 000,001,011 | ---- | M] () -- C:\Users\Nowilus\AppData\Roaming\mozilla\firefox\profiles\jiup23h2.default\searchplugins\conduit.xml [2013.04.13 13:03:31 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2013.04.13 13:03:31 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2013.04.13 13:03:31 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2013.04.13 13:03:48 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2013.03.20 21:50:57 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2013.03.20 21:50:57 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2013.03.20 21:50:57 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2013.03.20 21:50:57 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2013.03.20 21:50:57 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2013.03.20 21:50:57 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2013.01.02 19:51:42 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O4 - HKLM..\Run: [00TCrdMain] C:\Programme\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Desktop SMS] C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe (Interactive Digital Media) O4 - HKLM..\Run: [KiesTrayAgent] C:\Programme\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [SmoothView] C:\Programme\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [TPwrMain] C:\Programme\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation) O4 - HKCU..\Run: [DriverTurbo] C:\Program Files\DriverTurbo\DriverTurbo.exe File not found O4 - HKCU..\Run: [KiesHelper] C:\Program Files\Samsung\Kies\KiesHelper.exe (Samsung) O4 - HKCU..\Run: [KiesPDLR] C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe () O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: eBay - Der weltweite Online Marktplatz - {76577871-04EC-495E-A12B-91F7C3600AFA} - hxxp://rover.ebay.com/rover/1/707-44556-9400-3/4 File not found O9 - Extra Button: Amazon.de - {8A918C1D-E123-4E36-B562-5C1519E434CE} - hxxp://www.amazon.de/exec/obidos/redirect-home?tag=Toshibadebholink-21&site=home File not found O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab (Reg Error: Value error.) O16 - DPF: {CAFEEFAC-0017-0000-0009-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab (Java Plug-in 1.7.0_09) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_09-windows-i586.cab (Java Plug-in 10.17.2) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.48.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A24A67D3-3D21-43F9-902B-642E083C636A}: DhcpNameServer = 192.168.48.1 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Nowilus\Desktop\Sweet Home\deskop2.jpg O24 - Desktop BackupWallPaper: C:\Users\Nowilus\Desktop\Sweet Home\deskop2.jpg O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013.04.13 20:51:00 | 000,000,000 | ---D | C] -- C:\Users\Nowilus\AppData\Roaming\ImageAndForm [2013.04.13 20:50:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hugo Troll Race [2013.04.13 20:50:00 | 000,000,000 | ---D | C] -- C:\Program Files\Hugo Troll Race [2013.04.13 19:44:30 | 000,000,000 | ---D | C] -- C:\Program Files\SystemRequirementsLab [2013.04.13 19:44:24 | 000,000,000 | ---D | C] -- C:\Users\Nowilus\SystemRequirementsLab [2013.04.13 13:11:43 | 000,000,000 | ---D | C] -- C:\Users\Nowilus\Desktop\TV-Programm und Sendezeiten bei Nickelodeon - NickJR.de-Dateien [2013.04.13 13:03:30 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2013.04.11 19:59:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2013.04.11 19:59:03 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2013.04.11 19:59:02 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2013.04.01 21:29:48 | 000,000,000 | ---D | C] -- C:\Users\Nowilus\AppData\Roaming\DriverTurbo [2013.04.01 19:53:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hugo Retro Mania [2013.04.01 19:53:10 | 000,000,000 | ---D | C] -- C:\Program Files\Hugo [2013.03.27 19:50:40 | 000,000,000 | ---D | C] -- C:\Users\Nowilus\AppData\Roaming\RavensburgerTipToi [2013.03.27 19:49:40 | 000,000,000 | ---D | C] -- C:\Users\Nowilus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\tiptoi® Manager [2013.03.27 19:49:40 | 000,000,000 | ---D | C] -- C:\ProgramData\RavensburgerTipToi [2013.03.27 19:49:40 | 000,000,000 | ---D | C] -- C:\Program Files\Ravensburger tiptoi ========== Files - Modified Within 30 Days ========== [2013.04.16 17:04:46 | 000,632,252 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2013.04.16 17:04:46 | 000,598,900 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013.04.16 17:04:46 | 000,127,464 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2013.04.16 17:04:46 | 000,104,914 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013.04.16 16:59:00 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2013.04.16 16:59:00 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2013.04.16 16:58:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.04.16 16:57:41 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat [2013.04.16 16:46:47 | 000,000,000 | ---- | M] () -- C:\Users\Nowilus\defogger_reenable [2013.04.13 21:33:38 | 000,016,082 | ---- | M] () -- C:\Windows\System32\results.xml [2013.04.13 20:50:51 | 000,000,893 | ---- | M] () -- C:\Users\Public\Desktop\Hugo Troll Race.lnk [2013.04.13 13:11:49 | 000,042,615 | ---- | M] () -- C:\Users\Nowilus\Desktop\TV-Programm und Sendezeiten bei Nickelodeon - NickJR.de.htm [2013.04.13 12:54:34 | 271,202,536 | ---- | M] () -- C:\Windows\MEMORY.DMP [2013.04.13 12:02:04 | 000,406,096 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2013.04.11 21:20:26 | 000,000,971 | ---- | M] () -- C:\Users\Nowilus\AppData\Roaming\Hugo Retro Maniasavegame.dat [2013.04.11 19:59:05 | 000,000,911 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013.04.04 14:50:32 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2013.04.01 19:53:22 | 000,001,926 | ---- | M] () -- C:\Users\Public\Desktop\Hugo Retro Mania.lnk [2013.03.27 19:49:44 | 000,000,874 | ---- | M] () -- C:\Users\Nowilus\Desktop\tiptoi.lnk ========== Files Created - No Company Name ========== [2013.04.16 16:46:47 | 000,000,000 | ---- | C] () -- C:\Users\Nowilus\defogger_reenable [2013.04.13 20:50:51 | 000,000,893 | ---- | C] () -- C:\Users\Public\Desktop\Hugo Troll Race.lnk [2013.04.13 13:11:42 | 000,042,615 | ---- | C] () -- C:\Users\Nowilus\Desktop\TV-Programm und Sendezeiten bei Nickelodeon - NickJR.de.htm [2013.04.11 19:59:05 | 000,000,911 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013.04.01 19:55:12 | 000,000,971 | ---- | C] () -- C:\Users\Nowilus\AppData\Roaming\Hugo Retro Maniasavegame.dat [2013.04.01 19:53:22 | 000,001,926 | ---- | C] () -- C:\Users\Public\Desktop\Hugo Retro Mania.lnk [2013.03.27 19:49:44 | 000,000,874 | ---- | C] () -- C:\Users\Nowilus\Desktop\tiptoi.lnk [2013.02.28 17:09:13 | 000,000,005 | ---- | C] () -- C:\Users\Nowilus\AppData\Roaming\mbam.context.scan [2013.01.02 19:40:49 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe [2013.01.02 19:40:49 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe [2013.01.02 19:40:49 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2013.01.02 19:40:49 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2013.01.02 19:40:49 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2012.09.19 11:02:46 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2012.05.02 21:04:14 | 000,000,680 | ---- | C] () -- C:\Users\Nowilus\AppData\Local\d3d9caps.dat [2012.03.23 18:32:25 | 000,000,016 | -H-- | C] () -- C:\Users\Nowilus\mxfilerelatedcache.mxc2 [2012.03.04 23:04:55 | 000,040,448 | ---- | C] () -- C:\Users\Nowilus\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.02.05 20:24:43 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat [2012.01.31 02:15:44 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe [2012.01.31 02:15:42 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll [2012.01.31 02:15:42 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll [2012.01.31 02:15:42 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll [2012.01.31 02:15:42 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll [2012.01.30 20:14:22 | 000,185,344 | ---- | C] () -- C:\Windows\System32\SearchProtocolHost.exe [2012.01.30 20:14:10 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2012.01.30 20:14:10 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2012.01.30 20:13:26 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin ========== ZeroAccess Check ========== [2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 08:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2012.10.14 11:27:11 | 000,000,000 | ---D | M] -- C:\Users\Nowilus\AppData\Roaming\Ashampoo [2013.04.01 21:46:34 | 000,000,000 | ---D | M] -- C:\Users\Nowilus\AppData\Roaming\DriverTurbo [2012.10.14 11:53:57 | 000,000,000 | ---D | M] -- C:\Users\Nowilus\AppData\Roaming\FreeVideoConverter [2013.04.13 20:51:00 | 000,000,000 | ---D | M] -- C:\Users\Nowilus\AppData\Roaming\ImageAndForm [2012.03.23 18:55:34 | 000,000,000 | ---D | M] -- C:\Users\Nowilus\AppData\Roaming\Quark [2013.03.27 19:50:40 | 000,000,000 | ---D | M] -- C:\Users\Nowilus\AppData\Roaming\RavensburgerTipToi [2012.05.09 19:14:30 | 000,000,000 | ---D | M] -- C:\Users\Nowilus\AppData\Roaming\Samsung [2012.06.26 13:00:25 | 000,000,000 | ---D | M] -- C:\Users\Nowilus\AppData\Roaming\Toshiba [2012.10.13 13:40:52 | 000,000,000 | ---D | M] -- C:\Users\Nowilus\AppData\Roaming\Ulead Systems [2012.05.08 16:14:46 | 000,000,000 | ---D | M] -- C:\Users\Nowilus\AppData\Roaming\Vodafone [2012.07.10 21:26:42 | 000,000,000 | ---D | M] -- C:\Users\Nowilus\AppData\Roaming\WinBatch ========== Purity Check ========== < End of report > Gmer.txt GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-04-16 21:39:24
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 TOSHIBA_ rev.LB01 232,89GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Nowilus\AppData\Local\Temp\pxrdrpow.sys
---- System - GMER 2.1 ----
SSDT 8D13095E ZwCreateSection
SSDT 8D130968 ZwRequestWaitReplyPort
SSDT 8D130963 ZwSetContextThread
SSDT 8D13096D ZwSetSecurityObject
SSDT 8D130972 ZwSystemDebugControl
SSDT 8D1308FF ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!KeSetEvent + 215 820C2958 4 Bytes [5E, 09, 13, 8D]
.text ntkrnlpa.exe!KeSetEvent + 539 820C2C7C 4 Bytes [68, 09, 13, 8D]
.text ntkrnlpa.exe!KeSetEvent + 56D 820C2CB0 4 Bytes [63, 09, 13, 8D]
.text ntkrnlpa.exe!KeSetEvent + 5D1 820C2D14 4 Bytes [6D, 09, 13, 8D]
.text ntkrnlpa.exe!KeSetEvent + 619 820C2D5C 4 Bytes [72, 09, 13, 8D]
.text ...
.text C:\Windows\system32\DRIVERS\tos_sps32.sys section is writeable [0x8AB58000, 0x4036D, 0xE8000020]
.dsrt C:\Windows\system32\DRIVERS\tos_sps32.sys unknown last section [0x8ABA1000, 0x510, 0x40000040]
---- User code sections - GMER 2.1 ----
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[1392] USER32.dll!InSendMessageEx + 4C9 7625E7C8 7 Bytes JMP 58CD43E6 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[1392] USER32.dll!CreateWindowExW + AA 762613AF 7 Bytes JMP 58CD4375 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[1392] USER32.dll!GetWindowInfo 7626428E 5 Bytes JMP 5891E50D C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[1392] USER32.dll!SetMenuItemBitmaps + 71 762714EE 7 Bytes JMP 5891E9FB C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[2804] ntdll.dll!LdrLoadDll 778B9378 5 Bytes JMP 58746D70 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[2804] kernel32.dll!HeapSetInformation + 26 7619A8B0 7 Bytes JMP 58761C62 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[2804] kernel32.dll!LockResource + C 761B6ACB 7 Bytes JMP 58A9D713 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[2804] kernel32.dll!VirtualAllocEx + 54 761BAF50 7 Bytes JMP 58A9D736 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[2804] GDI32.dll!SetStretchBltMode + 256 7612745C 7 Bytes JMP 58A9D694 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3144] ntdll.dll!DbgUiRemoteBreakin 7791CD44 1 Byte [C3]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtCreateFile + 6 778F424A 4 Bytes [28, 60, 06, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtCreateFile + B 778F424F 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtCreateKey + 6 778F428A 4 Bytes [68, 61, 06, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtCreateKey + B 778F428F 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtCreateMutant + 6 778F42BA 4 Bytes [28, 62, 06, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtCreateMutant + B 778F42BF 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtCreateSection + 6 778F433A 4 Bytes [68, 62, 06, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtCreateSection + B 778F433F 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtMapViewOfSection + 6 778F499A 4 Bytes [A8, 64, 06, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtMapViewOfSection + B 778F499F 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtOpenFile + 6 778F4A2A 4 Bytes [68, 60, 06, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtOpenFile + B 778F4A2F 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtOpenKey + 6 778F4A5A 4 Bytes [A8, 61, 06, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtOpenKey + B 778F4A5F 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtOpenMutant + B 778F4A7F 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtOpenProcess + 6 778F4AAA 4 Bytes [28, 63, 06, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtOpenProcess + B 778F4AAF 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtOpenProcessToken + 6 778F4ABA 4 Bytes [68, 63, 06, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtOpenProcessToken + B 778F4ABF 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtOpenProcessTokenEx + 6 778F4ACA 4 Bytes [28, 64, 06, 00] {SUB [ESI+EAX+0x0], AH}
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtOpenProcessTokenEx + B 778F4ACF 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtOpenSection + 6 778F4ADA 4 Bytes [A8, 62, 06, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtOpenSection + B 778F4ADF 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtOpenThread + B 778F4B1F 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtOpenThreadToken + B 778F4B2F 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtOpenThreadTokenEx + 6 778F4B3A 4 Bytes [68, 64, 06, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtOpenThreadTokenEx + B 778F4B3F 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtQueryAttributesFile + 6 778F4BCA 4 Bytes [A8, 60, 06, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtQueryAttributesFile + B 778F4BCF 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtQueryFullAttributesFile + B 778F4C7F 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtSetInformationFile + 6 778F515A 4 Bytes [28, 61, 06, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtSetInformationFile + B 778F515F 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtSetInformationThread + 6 778F51AA 4 Bytes [A8, 63, 06, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtSetInformationThread + B 778F51AF 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ntdll.dll!NtUnmapViewOfSection + B 778F544F 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] kernel32.dll!CreateProcessW 76171BF3 5 Bytes JMP 000800B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] kernel32.dll!CreateProcessA 76171C28 5 Bytes JMP 000800F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] kernel32.dll!OpenEventW 7618C023 5 Bytes JMP 00080070
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] kernel32.dll!CreateEventW 761BB85E 5 Bytes JMP 00080030
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!DeleteObject 76125A37 5 Bytes JMP 000F01B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!GetDeviceCaps 7612617F 5 Bytes JMP 000F03B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!SelectObject 761262A0 5 Bytes JMP 000F05F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!SetTextColor 7612666B 5 Bytes JMP 000F0A30
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!SetBkMode 76126716 5 Bytes JMP 000F08F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!DeleteDC 761268CD 5 Bytes JMP 000F0170
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!GetCurrentObject 76126B58 5 Bytes JMP 000F0370
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!SetStretchBltMode 76127206 5 Bytes JMP 000F06B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!SaveDC 761275BA 5 Bytes JMP 000F0570
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!RestoreDC 76127675 5 Bytes JMP 000F0530
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!StretchDIBits 761278CF 5 Bytes JMP 000F0770
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!ExtSelectClipRgn 761279F8 5 Bytes JMP 000F02F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!SelectClipRgn 76127AF9 5 Bytes JMP 000F05B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!MoveToEx 76127C33 5 Bytes JMP 000F0470
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!Rectangle 76127EA9 5 Bytes JMP 000F09B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!GetTextAlign 761282E0 5 Bytes JMP 000F0D70
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!SetTextAlign 761285CB 5 Bytes JMP 000F09F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!ExtTextOutW 7612872B 5 Bytes JMP 000F0970
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!GetTextMetricsW 76128A81 5 Bytes JMP 000F0E30
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!IntersectClipRect 76128B64 5 Bytes JMP 000F03F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!GetClipBox 76129071 5 Bytes JMP 000F0330
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!SetICMMode 761294E7 5 Bytes JMP 000F0DB0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!CreateDCW 7612A91D 5 Bytes JMP 000F00F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!CreateDCA 7612AA49 5 Bytes JMP 000F00B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!CreateICW 7612B2E9 5 Bytes JMP 000F0130
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!GetTextFaceW 7612B637 5 Bytes JMP 000F0D30
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!GetFontData 7612BA6C 1 Byte [E9]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!GetFontData 7612BA6C 5 Bytes JMP 000F0C70
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!GetTextExtentPoint32W 7612C01A 5 Bytes JMP 000F0670
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!SetWorldTransform 7612C46A 5 Bytes JMP 000F06F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!LineTo 7612C65E 5 Bytes JMP 000F0430
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!GetTextMetricsA 7612CCEB 5 Bytes JMP 000F0DF0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!ExtTextOutA 761300A5 5 Bytes JMP 000F0930
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!GetTextExtentPoint32A 76130E58 5 Bytes JMP 000F0630
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!ExtEscape 761322A7 5 Bytes JMP 000F02B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!Escape 761327F1 5 Bytes JMP 000F0270
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!ResetDCW 76133132 5 Bytes JMP 000F0AB0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!EndPage 7613375E 5 Bytes JMP 000F0230
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!SetPolyFillMode 761361D3 5 Bytes JMP 000F0B30
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!SetMiterLimit 761362E2 5 Bytes JMP 000F0B70
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!GetTextFaceA 7613F4C5 5 Bytes JMP 000F0CF0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!GetGlyphOutlineW 7614A41F 5 Bytes JMP 000F0CB0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!CreateScalableFontResourceW 7614C88B 5 Bytes JMP 000F0BB0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!AddFontResourceW 7614CC93 5 Bytes JMP 000F0BF0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!RemoveFontResourceW 7614D129 5 Bytes JMP 000F0C30
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!AbortDoc 76152CC4 5 Bytes JMP 000F0030
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!EndDoc 761530D8 5 Bytes JMP 000F01F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!StartPage 761531C3 5 Bytes JMP 000F0730
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!StartDocW 76153CA7 5 Bytes JMP 000F07F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!BeginPath 76154465 5 Bytes JMP 000F0830
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!SelectClipPath 761544BC 5 Bytes JMP 000F0AF0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!CloseFigure 76154517 5 Bytes JMP 000F0070
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!EndPath 7615456E 5 Bytes JMP 000F0A70
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!StrokePath 761547A0 5 Bytes JMP 000F07B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!FillPath 7615482C 5 Bytes JMP 000F0870
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!PolylineTo 76154C95 5 Bytes JMP 000F04F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!PolyBezierTo 76154D25 5 Bytes JMP 000F04B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] GDI32.dll!PolyDraw 76154DD6 5 Bytes JMP 000F08B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!SetCursor 7625D37D 5 Bytes JMP 00100530
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!RegisterClipboardFormatW 7625D6AC 1 Byte [E9]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!RegisterClipboardFormatW 7625D6AC 5 Bytes JMP 001002B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!ActivateKeyboardLayout 7626478C 5 Bytes JMP 001004F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!IsWindowVisible 7626878A 7 Bytes JMP 001006B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!MonitorFromWindow 762688D4 4 Bytes JMP 00100630
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!MonitorFromWindow + 5 762688D9 2 Bytes JMP 5EF35567
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!ScreenToClient 76268C56 7 Bytes JMP 00100670
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!GetClientRect 76268F0D 7 Bytes JMP 001005B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!GetParent 762690AA 7 Bytes JMP 001006F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!RegisterClipboardFormatA 7626A111 5 Bytes JMP 001002F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!PostMessageW 7626A175 5 Bytes JMP 001005F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!MapWindowPoints 7626A30D 5 Bytes JMP 00100570
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!GetClipboardFormatNameA 7626A552 5 Bytes JMP 00100270
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!GetOpenClipboardWindow 762726A6 5 Bytes JMP 001003F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!SetClipboardViewer 7627BA2D 5 Bytes JMP 001004B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!IsClipboardFormatAvailable 7627C2E3 5 Bytes JMP 001000F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!CloseClipboard 7627C2F7 5 Bytes JMP 001000B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!OpenClipboard 7627C31D 5 Bytes JMP 00100070
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!GetTopWindow 7627CE0A 7 Bytes JMP 00100730
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!GetClipboardSequenceNumber 7627D8B7 5 Bytes JMP 00100330
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!ChangeClipboardChain 7627DF83 5 Bytes JMP 00100430
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!CountClipboardFormats 76280048 5 Bytes JMP 001001F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!GetClipboardOwner 762826EF 5 Bytes JMP 00100370
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!SetClipboardData 76296410 5 Bytes JMP 00100170
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!EnumClipboardFormats 76296D16 5 Bytes JMP 001001B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!SetCursorPos 76296FB2 5 Bytes JMP 00100770
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!GetClipboardData 7629715A 5 Bytes JMP 00100030
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!GetClipboardFormatNameW 7629A99F 5 Bytes JMP 00100230
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!EmptyClipboard 762B398B 5 Bytes JMP 00100130
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!GetClipboardViewer 762B39ED 5 Bytes JMP 00100470
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] USER32.dll!GetPriorityClipboardFormat 762B3AEF 5 Bytes JMP 001003B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ole32.dll!OleGetClipboard 777B74C9 5 Bytes JMP 001100B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ole32.dll!OleSetClipboard 777E11E3 5 Bytes JMP 00110030
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] ole32.dll!OleIsCurrentClipboard 777EA8F9 5 Bytes JMP 00110070
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] Secur32.dll!FreeContextBuffer 75DE2D83 5 Bytes JMP 001300F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] Secur32.dll!DeleteSecurityContext 75DE2F18 5 Bytes JMP 00130270
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] Secur32.dll!FreeCredentialsHandle 75DE3598 5 Bytes JMP 00130130
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] Secur32.dll!EncryptMessage 75DE3745 5 Bytes JMP 001301F0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] Secur32.dll!DecryptMessage 75DE3813 5 Bytes JMP 00130230
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] Secur32.dll!InitializeSecurityContextA 75DE87DF 5 Bytes JMP 00130170
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] Secur32.dll!AcquireCredentialsHandleA 75DE8A43 5 Bytes JMP 00130030
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] Secur32.dll!QueryContextAttributesA 75DE8E77 5 Bytes JMP 00130070
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] Secur32.dll!ApplyControlToken 75DEDE4F 5 Bytes JMP 001301B0
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[4056] Secur32.dll!QueryCredentialsAttributesA 75DEE052 5 Bytes JMP 001300B0
---- Devices - GMER 2.1 ----
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001583c0416b
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001583c0416b@8c71f894960f 0xAA 0x08 0xD2 0x6B ...
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001583c0416b (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001583c0416b@8c71f894960f 0xAA 0x08 0xD2 0x6B ...
---- EOF - GMER 2.1 ----
Ich übe mich in Geduld und sage schon mal Danke für die Annahme meines Problems. Geändert von chrisree (16.04.2013 um 21:53 Uhr) |
| Themen zu fileConverter 1.3 Customized Web search beim download mitbekommen, vermutlich bei softonic |
| adobe, antivir, autorun, avg, avira, bho, combofix, defender, desktop, error, explorer, firefox, format, home, logfile, mozilla, nodrives, ntdll.dll, opera, plug-in, programme, realtek, registry, scan, senden, software, temp, vista |
Baum-Darstellung