| |
| |||||||
Log-Analyse und Auswertung: Avast deaktiviert, Rechner bootet selbst neu, VisthAux.exeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
10.06.2013, 11:18
| #1 |
 |  Avast deaktiviert, Rechner bootet selbst neu, VisthAux.exe Hallo, seit einigen Tagen bootet mein Rechner sich hin und wieder neu. Heute ist mir aufgefallen, dass der Virenscanner (free Avast!) nicht mehr aktiviert ist. Wenn ich über das Vista-Sicherheitscenter den Scanner aktivieren möchte, bittet ein Programm namens VisthAux.exe um Erlaubnis, die Arbeit aufnehmen zu dürfen. Mir schwant Ungutes. Hier mein Logfiles: Code:
ATTFilter OTL logfile created on: 10.06.2013 09:52:55 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Schloik\Desktop 64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 8,00 Gb Total Physical Memory | 6,26 Gb Available Physical Memory | 78,27% Memory free 16,22 Gb Paging File | 14,52 Gb Available in Paging File | 89,51% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 455,32 Gb Total Space | 236,86 Gb Free Space | 52,02% Space Free | Partition Type: NTFS Drive R: | 10,43 Gb Total Space | 4,76 Gb Free Space | 45,64% Space Free | Partition Type: NTFS Computer Name: DON-PC | User Name: Don | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.06.10 09:49:06 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Schloik\Desktop\OTL.exe PRC - [2013.05.15 09:43:07 | 000,389,016 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe PRC - [2013.05.11 08:56:56 | 001,105,408 | ---- | M] (Spotify Ltd) -- C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe PRC - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2013.05.09 10:58:30 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastUI.exe PRC - [2013.05.09 10:58:30 | 000,046,808 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastSvc.exe PRC - [2009.04.11 08:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\conime.exe PRC - [2009.02.23 11:48:50 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe ========== Modules (No Company Name) ========== MOD - [2013.05.15 09:43:10 | 002,244,504 | ---- | M] () -- C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll MOD - [2013.05.15 09:43:10 | 000,158,104 | ---- | M] () -- C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll MOD - [2013.05.15 09:43:10 | 000,022,424 | ---- | M] () -- C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll ========== Services (SafeList) ========== SRV:64bit: - [2010.05.27 18:59:40 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV - [2013.05.22 09:19:34 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.05.15 09:42:22 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2013.05.09 10:58:30 | 000,046,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Programme\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus) SRV - [2010.12.10 17:36:54 | 000,153,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.03.30 06:42:14 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.02.23 11:48:50 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc) ========== Driver Services (SafeList) ========== DRV:64bit: - [2013.05.09 10:59:07 | 001,025,808 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx) DRV:64bit: - [2013.05.09 10:59:07 | 000,378,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP) DRV:64bit: - [2013.05.09 10:59:07 | 000,189,936 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswVmm.sys -- (aswVmm) DRV:64bit: - [2013.05.09 10:59:07 | 000,065,336 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswRvrt.sys -- (aswRvrt) DRV:64bit: - [2013.05.09 10:59:07 | 000,064,288 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi) DRV:64bit: - [2013.05.09 10:59:07 | 000,059,144 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr.sys -- (AswRdr) DRV:64bit: - [2013.05.09 10:59:06 | 000,080,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt) DRV:64bit: - [2013.05.09 10:59:06 | 000,033,400 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk) DRV:64bit: - [2012.02.29 15:52:46 | 000,016,384 | ---- | M] (Microsoft Corporation) [Recognizer | System | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2010.05.27 19:39:12 | 006,856,192 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\atikmdag.sys -- (atikmdag) DRV:64bit: - [2010.05.27 19:39:12 | 006,856,192 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2010.05.27 18:25:36 | 000,264,192 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2009.05.09 01:14:20 | 000,015,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\NuidFltr.sys -- (NuidFltr) DRV:64bit: - [2008.10.04 02:17:30 | 000,184,320 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys -- (RTL8169) DRV:64bit: - [2008.08.26 12:26:02 | 000,185,248 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtHDMIVX.sys -- (RTHDMIAzAudService) DRV:64bit: - [2008.04.28 15:25:06 | 000,016,400 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\AtiPcie.sys -- (AtiPcie) DRV:64bit: - [2007.10.12 03:40:14 | 000,010,632 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\amdide64.sys -- (amdide64) DRV:64bit: - [2006.11.01 15:23:00 | 000,015,680 | ---- | M] () [Kernel | Disabled | Stopped] -- C:\Windows\SysNative\drivers\asacpi.sys -- (MTsensor) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Wikipedia (de)" FF - prefs.js..browser.startup.homepage: "hxxp://news.google.de/nwshp?client=firefox-a&rls=org.mozilla:de:official&ie=UTF-8&oe=UTF-8&hl=de&channel=s&tab=wn&q=&auth=DQAAAHIAAAAQPuJHZ9yGBflo4bWNzUR4hY8oqn1HymfS5StGdq5Yt7l-7_kNrdk02045OwkIwZggqMAlRcsyymwv9DOJS7xyRm7pOBC0ts02LFj1zAA6C4vgOj1OIRk-qkdEPnUM8xWqkaWOoqK9sESENBSTybGtpA63A18Ad1l4psIUL4LqvQ" FF - prefs.js..extensions.enabledAddons: wrc%40avast.com:8.0.1483 FF - prefs.js..extensions.enabledAddons: magicplayer%40torrentstream.org:1.1.22 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0 FF - prefs.js..extensions.enabledItems: de-AT@dictionaries.addons.mozilla.org:1.0.1 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll () FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@acestream.net/acestreamplugin,version=2.0.13: C:\Users\Don\AppData\Roaming\ACEStream\player\npace_plugin.dll (Innovative Digital Technologies) FF - HKCU\Software\MozillaPlugins\@torrentstream.net/tsplugin,version=2.0.8.11.1: C:\Users\Don\AppData\Roaming\TorrentStream\player\npts_plugin.dll (Innovative Digital Technologies) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013.05.31 12:58:51 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.6\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013.05.15 09:43:03 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\magicplayer@torrentstream.org: C:\Users\Don\AppData\Roaming\TorrentStream\extensions\firefox\magicplayer@torrentstream.org [2013.04.09 17:07:03 | 000,000,000 | ---D | M] [2013.04.07 16:45:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Don\AppData\Roaming\mozilla\Extensions [2013.05.22 09:19:36 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions [2013.05.22 09:19:36 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2013.05.31 12:58:51 | 000,000,000 | ---D | M] (avast! Online Security) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF [2013.04.09 17:07:03 | 000,000,000 | ---D | M] (TS Magic Player) -- C:\USERS\DON\APPDATA\ROAMING\TORRENTSTREAM\EXTENSIONS\FIREFOX\MAGICPLAYER@TORRENTSTREAM.ORG O1 HOSTS File: ([2006.09.18 23:37:24 | 000,000,761 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.) O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Windows\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation) O4:64bit: - HKLM..\RunOnce: [*WerKernelReporting] C:\Windows\SysNative\WerFault.exe (Microsoft Corporation) O4 - HKLM..\RunOnce: [aswAhAScr.dll] C:\Program Files\AVAST Software\Avast\aswRegSvr.exe (AVAST Software) O4 - HKLM..\RunOnce: [aswasOutExt.dll] C:\Program Files\AVAST Software\Avast\aswRegSvr.exe (AVAST Software) O4 - HKLM..\RunOnce: [aswredemption.dll] C:\Program Files\AVAST Software\Avast\aswRegSvr.exe (AVAST Software) O4 - HKLM..\RunOnce: [aswredemption64.dll] C:\Program Files\AVAST Software\Avast\aswRegSvr64.exe (AVAST Software) O4 - HKCU..\RunOnce: [RunCanonMsetUp] C:\Program Files (x86)\Canon\IJ_MSetup4\MCDCHK2.EXE (CANON INC.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F7CEEBF4-17E1-408F-9675-AF31881BB483}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\awave.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\awave.jpg O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013.06.01 15:22:20 | 000,000,000 | ---D | C] -- C:\Windows\Minidump [2013.05.22 09:19:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2013.05.20 12:53:01 | 000,201,392 | ---- | C] (AVAST Software) -- C:\Windows\SysWow64\aswBoot.exe [2013.05.16 20:15:02 | 000,000,000 | ---D | C] -- C:\output [2013.05.16 19:41:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome [2013.05.16 19:40:24 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Roaming\PhotoScape [2013.05.16 19:40:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoScape [2013.05.16 19:40:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PhotoScape [2013.05.16 19:40:01 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\Google [2013.05.16 19:40:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google [2013.05.16 14:49:03 | 000,000,000 | ---D | C] -- C:\ProgramData\CanonIJ [2013.05.16 14:48:47 | 000,000,000 | ---D | C] -- C:\ProgramData\CanonIJPLM [2013.05.16 14:48:24 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonIJScan [2013.05.16 14:46:34 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonIJSolutionMenuEX [2013.05.16 14:46:25 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonIJEPPEX2 [2013.05.16 14:46:25 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonEPP [2013.05.16 14:46:14 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonIJMyPrinter [2013.05.16 14:40:52 | 000,000,000 | ---D | C] -- C:\ProgramData\CanonIJMSetup [2013.05.16 14:40:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP280 series Benutzerregistrierung [2013.05.16 14:40:04 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\CANON [2013.05.16 14:39:56 | 000,000,000 | ---D | C] -- C:\ProgramData\CanonIJWSpt [2013.05.16 14:38:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities [2013.05.16 14:38:23 | 000,000,000 | ---D | C] -- C:\Program Files\Canon [2013.05.16 14:38:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP280 series Manual [2013.05.16 14:37:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP280 series [2013.05.16 14:37:31 | 000,000,000 | -H-D | C] -- C:\Program Files\CanonBJ [2013.05.16 14:36:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Canon [2013.05.16 14:35:20 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Roaming\ATI [2013.05.16 14:35:20 | 000,000,000 | ---D | C] -- C:\Users\Don\AppData\Local\ATI [2013.05.15 09:43:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird ========== Files - Modified Within 30 Days ========== [2013.06.10 09:55:00 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.06.10 09:48:29 | 000,000,000 | ---- | M] () -- C:\Users\Don\defogger_reenable [2013.06.10 09:42:15 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013.06.10 08:57:35 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013.06.10 08:23:01 | 001,592,750 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.06.10 08:23:01 | 000,685,474 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.06.10 08:23:01 | 000,642,506 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.06.10 08:23:01 | 000,149,774 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.06.10 08:23:01 | 000,121,394 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.06.10 08:16:02 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2013.06.10 08:16:02 | 000,003,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2013.06.10 08:15:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.06.10 08:15:48 | 486,865,691 | ---- | M] () -- C:\Windows\MEMORY.DMP [2013.06.07 09:58:37 | 000,002,030 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2013.05.31 12:59:56 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt [2013.05.16 19:40:19 | 000,000,875 | ---- | M] () -- C:\Users\Don\Desktop\PhotoScape.lnk [2013.05.16 18:40:23 | 000,401,632 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2013.05.16 14:39:57 | 000,001,915 | ---- | M] () -- C:\Users\Public\Desktop\Canon Solution Menu EX.lnk [2013.05.16 14:38:10 | 000,002,188 | ---- | M] () -- C:\Users\Public\Desktop\Canon MP280 series Online-Handbuch.lnk [2013.05.13 12:57:45 | 000,001,790 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk ========== Files Created - No Company Name ========== [2013.06.10 09:48:29 | 000,000,000 | ---- | C] () -- C:\Users\Don\defogger_reenable [2013.06.01 15:22:15 | 486,865,691 | ---- | C] () -- C:\Windows\MEMORY.DMP [2013.05.16 19:41:37 | 000,002,030 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2013.05.16 19:40:19 | 000,000,875 | ---- | C] () -- C:\Users\Don\Desktop\PhotoScape.lnk [2013.05.16 19:40:06 | 000,001,104 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013.05.16 19:40:05 | 000,001,100 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013.05.16 14:39:57 | 000,001,915 | ---- | C] () -- C:\Users\Public\Desktop\Canon Solution Menu EX.lnk [2013.05.16 14:38:10 | 000,002,188 | ---- | C] () -- C:\Users\Public\Desktop\Canon MP280 series Online-Handbuch.lnk [2013.04.08 10:01:14 | 000,002,137 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2013.04.07 18:58:11 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll [2013.04.07 18:57:25 | 000,107,612 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchema.bin [2013.04.07 18:56:38 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2013.04.07 15:21:02 | 000,000,680 | ---- | C] () -- C:\Users\Don\AppData\Local\d3d9caps.dat [2013.04.07 14:59:19 | 000,000,732 | ---- | C] () -- C:\Users\Don\AppData\Local\d3d9caps64.dat ========== ZeroAccess Check ========== [2006.11.02 17:30:40 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.08 19:59:03 | 012,899,840 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.04.11 09:11:14 | 000,891,392 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2008.01.21 04:50:58 | 000,513,024 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2013.04.09 17:10:58 | 000,000,000 | ---D | M] -- C:\Users\Don\AppData\Roaming\.ACEStream [2013.04.09 17:11:59 | 000,000,000 | ---D | M] -- C:\Users\Don\AppData\Roaming\.Torrent Stream [2013.04.09 16:51:24 | 000,000,000 | ---D | M] -- C:\Users\Don\AppData\Roaming\ACEStream [2013.05.16 20:15:32 | 000,000,000 | ---D | M] -- C:\Users\Don\AppData\Roaming\PhotoScape [2013.04.07 16:51:55 | 000,000,000 | ---D | M] -- C:\Users\Don\AppData\Roaming\Thunderbird ========== Purity Check ========== < End of report > Code:
ATTFilter OTL Extras logfile created on: 10.06.2013 09:52:55 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Schloik\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
8,00 Gb Total Physical Memory | 6,26 Gb Available Physical Memory | 78,27% Memory free
16,22 Gb Paging File | 14,52 Gb Available in Paging File | 89,51% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 455,32 Gb Total Space | 236,86 Gb Free Space | 52,02% Space Free | Partition Type: NTFS
Drive R: | 10,43 Gb Total Space | 4,76 Gb Free Space | 45,64% Space Free | Partition Type: NTFS
Computer Name: DON-PC | User Name: Don | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 9F 9E 16 8C DC 5B C8 01 [binary data]
"VistaSp2" = 5D A9 B5 52 B6 33 CE 01 [binary data]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1
========== Firewall Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{000348F8-0786-462B-9D01-DB5E4D86914F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{08EBCEFA-BD3B-4523-9146-F99C556DD50D}" = lport=139 | protocol=6 | dir=in | app=system |
"{3E5DE383-1EDD-4F26-BE5F-FD55D0919439}" = rport=138 | protocol=17 | dir=out | app=system |
"{595D0AC8-B7DB-462D-9D99-A1E1171EB4F5}" = rport=137 | protocol=17 | dir=out | app=system |
"{923BF3DB-79C4-43FD-85F6-2ACDB7B09F1B}" = lport=137 | protocol=17 | dir=in | app=system |
"{A225E6B7-4705-48AF-8063-E98725EC988E}" = rport=445 | protocol=6 | dir=out | app=system |
"{AFB5E84E-8A80-436C-9EC2-62B3656BDD06}" = rport=139 | protocol=6 | dir=out | app=system |
"{B2A991E1-30BB-48CA-A2BA-4F7A694DB7DD}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{C7E0C3F0-F860-407A-89A0-8728A0F9BA4F}" = lport=138 | protocol=17 | dir=in | app=system |
"{FFDF770C-F89C-40AC-858E-1F88FDDE7C5E}" = lport=445 | protocol=6 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1062FD16-C4D6-4B00-AA93-59B0322EF902}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe |
"{128B4E13-6BE7-4347-9CBE-DF9A5EB27DD5}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii public test.exe |
"{137CD469-476D-41A8-8A0A-E8C2EDB7F668}" = protocol=17 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe |
"{1384A957-BF8A-4141-B3A8-F8792AC8C1A1}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe |
"{254322D6-ADD9-4CBC-B92D-573C9523A2CD}" = protocol=17 | dir=in | app=c:\users\don\appdata\roaming\acestream\engine\ace_engine.exe |
"{2EDB564C-7377-4F2B-9E3B-84D665EA5ED3}" = protocol=6 | dir=in | app=c:\users\don\appdata\roaming\torrentstream\engine\tsengine.exe |
"{501AC23B-CEDE-47EF-93CF-EE7B17CA426B}" = protocol=6 | dir=in | app=c:\users\don\appdata\roaming\acestream\engine\ace_engine.exe |
"{5739E6AC-55CC-4919-B5FC-D0774C78A26E}" = protocol=6 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe |
"{5F2703E0-E56F-4185-8904-519C3E16D0F1}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1737\agent.exe |
"{746EE78E-068D-42CE-9CC6-46D9C875E0B8}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{7522FE70-5931-4CD0-99F2-74DB541FD509}" = protocol=17 | dir=in | app=c:\users\don\appdata\roaming\torrentstream\engine\tsengine.exe |
"{8B5D378B-0B2F-4518-B35E-58FB4CA416DE}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe |
"{8F206CAB-9F2C-4661-9290-FF3059D10EC8}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii public test.exe |
"{AA2B2B45-4D46-4E20-8C85-DA286F1C8A97}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{CA6807E8-EF6F-4345-B582-C87BCE896BD4}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1737\agent.exe |
"{D25760BB-292E-4B4D-B52C-6958762E90C1}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe |
"{EEDBB00B-3091-4CC5-90FB-037F94E1A18C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{FB8B4778-9F71-4EE3-B02E-DC87FD7A01A5}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"TCP Query User{38F5E0B9-10B2-464E-BF82-140F4FB9D6B0}C:\users\schloik\appdata\roaming\torrentstream\engine\tsengine.exe" = protocol=6 | dir=in | app=c:\users\schloik\appdata\roaming\torrentstream\engine\tsengine.exe |
"TCP Query User{69A6DC33-D8AE-4D55-98CB-41CF9548BCD0}C:\program files (x86)\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files (x86)\sopcast\sopcast.exe |
"TCP Query User{91E14813-5D18-4B1F-A816-307AFCB92630}C:\users\schloik\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\schloik\appdata\roaming\spotify\spotify.exe |
"TCP Query User{976BF299-4540-4461-8EB6-36AE2B86B025}C:\users\schloik\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\schloik\appdata\roaming\spotify\spotify.exe |
"TCP Query User{A24EE2EB-4E3A-4347-8606-F822AEE14B47}C:\program files (x86)\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe |
"TCP Query User{DD0C882E-F4D9-45F7-AE1B-75BA42C71099}C:\users\schloik\appdata\roaming\torrentstream\engine\tsengine.exe" = protocol=6 | dir=in | app=c:\users\schloik\appdata\roaming\torrentstream\engine\tsengine.exe |
"TCP Query User{F3BB71FB-0394-44F8-8294-86C780876A5E}C:\users\schloik\downloads\neverwinter_nw.1.20130416a.6.exe" = protocol=6 | dir=in | app=c:\users\schloik\downloads\neverwinter_nw.1.20130416a.6.exe |
"TCP Query User{F8D5756A-6DF8-4A9F-A15C-B0A67913ADC9}C:\program files (x86)\starcraft ii\versions\base24944\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base24944\sc2.exe |
"UDP Query User{01C867A6-65D9-484A-ACD7-2EFE7A409354}C:\program files (x86)\starcraft ii\versions\base24944\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base24944\sc2.exe |
"UDP Query User{11927439-5239-40E7-8C33-1FAA7F0BA548}C:\program files (x86)\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe |
"UDP Query User{4CED8749-4E30-4BE3-B03E-850B87F22A0D}C:\users\schloik\appdata\roaming\torrentstream\engine\tsengine.exe" = protocol=17 | dir=in | app=c:\users\schloik\appdata\roaming\torrentstream\engine\tsengine.exe |
"UDP Query User{88653B42-2A22-41EA-84C5-0D360A60DC9B}C:\users\schloik\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\schloik\appdata\roaming\spotify\spotify.exe |
"UDP Query User{B7DC41C5-D6AF-40DB-9DC1-7B19A7A154EE}C:\users\schloik\downloads\neverwinter_nw.1.20130416a.6.exe" = protocol=17 | dir=in | app=c:\users\schloik\downloads\neverwinter_nw.1.20130416a.6.exe |
"UDP Query User{C66E8F12-8931-4755-A8B5-07AC101A4934}C:\users\schloik\appdata\roaming\torrentstream\engine\tsengine.exe" = protocol=17 | dir=in | app=c:\users\schloik\appdata\roaming\torrentstream\engine\tsengine.exe |
"UDP Query User{CD666C60-1726-4AF8-BEA3-A025C32934AE}C:\program files (x86)\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files (x86)\sopcast\sopcast.exe |
"UDP Query User{ECEFF458-D5C2-453E-8E59-D5162032A1A5}C:\users\schloik\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\schloik\appdata\roaming\spotify\spotify.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP280_series" = Canon MP280 series MP Drivers
"{1FBEA8BA-D40B-48BC-85BC-EE2D5575F27C}" = Microsoft SQL Server VSS Writer
"{2016B2AD-0051-05C7-9CCB-CE9F05659CB7}" = ccc-utility64
"{25D04DBB-FE9D-E3BA-C2F3-F1BE9B8C0709}" = ATI Catalyst Install Manager
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{55B44B84-A758-EAF7-0906-E397B384FCDF}" = ATI AVIVO64 Codecs
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{7C39E0D1-E138-42B1-B083-213EC2CF7692}" = Microsoft SQL Server Native Client
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"NVIDIA Drivers" = NVIDIA Drivers
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{0CA1005F-B640-0354-EC82-F8F7447A8E8A}" = CCC Help Hungarian
"{0FC472C3-6A2A-969F-10E7-E8F61B18117C}" = Catalyst Control Center Localization All
"{12076C90-4A78-7241-F633-4D2B019D5611}" = CCC Help Thai
"{17E11EC2-3736-10A1-330C-CC7EB6CAC6B3}" = CCC Help Turkish
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{31405CA2-F009-D91B-FEFF-35924343CB14}" = Catalyst Control Center InstallProxy
"{31B75145-DF24-C759-E735-9C129956961E}" = CCC Help Spanish
"{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}" = Business Contact Manager für Outlook 2007 SP2
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{59F5C54C-ED39-58B4-42DA-3F20AB440E49}" = CCC Help Czech
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{641C1B16-FD4C-0F97-47AE-76637FC64225}" = CCC Help English
"{64B157C9-C291-2535-8177-237BC2D37EBF}" = CCC Help Korean
"{79C2D7F9-3BF8-52C1-6A7A-84C9296171F8}" = CCC Help German
"{7B29E627-71A5-6824-3F85-DBEF19624BD0}" = ccc-core-static
"{87323561-58BA-4D5B-BADA-A791B69D1705}" = Catalyst Control Center - Branding
"{88B2BB7B-A684-E8E3-65C6-DDC5DC152C2A}" = CCC Help French
"{8CB77076-DB66-5D92-7886-807226C9CE4B}" = CCC Help Italian
"{90A40407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{94F4B1D4-0BCC-E5C6-4EAE-F1A287383D5B}" = CCC Help Finnish
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{98838C21-AD83-77AA-3B09-F437C6F24F8F}" = CCC Help Dutch
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C6F56DA-7051-6677-4E5A-9DC6C573F2B5}" = CCC Help Portuguese
"{9FE051B0-39BC-F5DD-C99B-0D4793184C2A}" = CCC Help Chinese Standard
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AA6B96C4-7AF5-3F6A-E630-4096508A9C47}" = CCC Help Danish
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.7) - Deutsch
"{B48E87FE-A8D9-EE14-B607-3FA1ACEF218E}" = CCC Help Norwegian
"{B4FA8E67-D299-485A-407B-05A2681BAF47}" = CCC Help Japanese
"{BB05BC7D-BEF8-7A7B-C62E-F1BE381E70BB}" = CCC Help Swedish
"{BD49141C-188C-4B75-9F46-C2C42F2D1031}" = Nero 7 Essentials
"{C3FA3CCE-2A88-0976-B875-4B3E9D41204D}" = Catalyst Control Center Graphics Previews Common
"{D34F0251-1C96-09B3-EE29-2A9148413252}" = CCC Help Chinese Traditional
"{D54A0D86-35B0-BFC8-174B-D991EDF903B8}" = Catalyst Control Center Graphics Previews Vista
"{D5610369-AF78-386F-4985-9822654973A3}" = CCC Help Polish
"{E937F8DA-8C7F-ADFE-7EA5-7C1CAAB23C05}" = HydraVision
"{ECD129A4-5A21-1977-0849-6913BA6BA29C}" = CCC Help Russian
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F77D44EB-2A6E-E2EE-7C30-40A5409B2650}" = CCC Help Greek
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"avast" = avast! Free Antivirus
"Business Contact Manager" = Business Contact Manager für Outlook 2007 SP2
"Canon MP280 series Benutzerregistrierung" = Canon MP280 series Benutzerregistrierung
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenuEX" = Canon Solution Menu EX
"Diablo III" = Diablo III
"Easy-PhotoPrint EX" = Canon Easy-PhotoPrint EX
"Easy-WebPrint EX" = Canon Easy-WebPrint EX
"Google Chrome" = Google Chrome
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)
"Mozilla Thunderbird 17.0.6 (x86 de)" = Mozilla Thunderbird 17.0.6 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 4.0" = Canon MP Navigator EX 4.0
"PhotoScape" = PhotoScape
"SopCast" = SopCast 3.8.2
"StarCraft II" = StarCraft II
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"ACEStream" = ACE Stream Media 2.0.13
"TorrentStream" = Torrent Stream 2.0.8.11.1
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 09.04.2013 02:53:17 | Computer Name = Don-PC | Source = WinMgmt | ID = 10
Description =
Error - 09.04.2013 09:35:04 | Computer Name = Don-PC | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 20.0.0.4833 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
das Problem zu suchen. Prozess-ID: bf8 Anfangszeit: 01ce35269494d3f0 Zeitpunkt der
Beendigung: 16
Error - 09.04.2013 09:39:45 | Computer Name = Don-PC | Source = WinMgmt | ID = 10
Description =
Error - 09.04.2013 11:15:48 | Computer Name = Don-PC | Source = WinMgmt | ID = 10
Description =
Error - 09.04.2013 11:46:19 | Computer Name = Don-PC | Source = WinMgmt | ID = 10
Description =
Error - 10.04.2013 03:21:32 | Computer Name = Don-PC | Source = WinMgmt | ID = 10
Description =
Error - 11.04.2013 02:15:45 | Computer Name = Don-PC | Source = WinMgmt | ID = 10
Description =
Error - 12.04.2013 02:45:56 | Computer Name = Don-PC | Source = WinMgmt | ID = 10
Description =
Error - 12.04.2013 03:28:01 | Computer Name = Don-PC | Source = MsiInstaller | ID = 1024
Description =
Error - 12.04.2013 03:39:30 | Computer Name = Don-PC | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 08.04.2013 18:19:26 | Computer Name = Don-PC | Source = bowser | ID = 8003
Description =
Error - 08.04.2013 18:28:38 | Computer Name = Don-PC | Source = DCOM | ID = 10005
Description =
Error - 08.04.2013 18:28:38 | Computer Name = Don-PC | Source = Service Control Manager | ID = 7009
Description =
Error - 08.04.2013 18:28:38 | Computer Name = Don-PC | Source = Service Control Manager | ID = 7000
Description =
< End of report >
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-06-10 11:57:13
Windows 6.0.6002 Service Pack 2 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 Hitachi_HDP725050GLA360 rev.GM4OA52A 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Don\AppData\Local\Temp\kwldapow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\wininit.exe[648] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194 0000000077112c52 1 byte [62]
.text C:\Windows\system32\winlogon.exe[816] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194 0000000077112c52 1 byte [62]
.text C:\Windows\System32\svchost.exe[276] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194 0000000077112c52 1 byte [62]
.text C:\Windows\system32\atiesrxx.exe[536] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194 0000000077112c52 1 byte [62]
.text C:\Windows\System32\svchost.exe[556] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194 0000000077112c52 1 byte [62]
.text C:\Windows\System32\svchost.exe[516] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194 0000000077112c52 1 byte [62]
.text C:\Windows\system32\svchost.exe[932] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194 0000000077112c52 1 byte [62]
.text C:\Windows\System32\spoolsv.exe[1644] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 194 0000000077112c52 1 byte [62]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1288] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000779517d7 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1288] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077953221 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1288] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077969578 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1288] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077969608 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1288] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000077969758 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1288] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077969ab8 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1288] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 000000007796b24c 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1288] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 130 0000000076104228 1 byte [62]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1288] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 00000000761d010d 5 bytes JMP 00000001000c0a08
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1288] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 00000000761d03d2 5 bytes JMP 00000001000c0804
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1288] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 00000000761d1b58 5 bytes JMP 00000001000c0600
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1288] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 00000000761d6530 5 bytes JMP 00000001000c03fc
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1288] C:\Windows\syswow64\USER32.dll!SetWinEventHook 00000000761e653e 5 bytes JMP 00000001000c01f8
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1288] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000075789eb4 5 bytes JMP 00000001000d03fc
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1288] C:\Windows\syswow64\ADVAPI32.dll!DeleteService 000000007578a07e 5 bytes JMP 00000001000d0600
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1288] C:\Windows\syswow64\ADVAPI32.dll!SetServiceObjectSecurity 00000000757c6cd9 5 bytes JMP 00000001000d1014
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1288] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigA 00000000757c6dd9 5 bytes JMP 00000001000d0804
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1288] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigW 00000000757c6f81 5 bytes JMP 00000001000d0a08
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1288] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfig2A 00000000757c7099 5 bytes JMP 00000001000d0c0c
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1288] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfig2W 00000000757c71e1 5 bytes JMP 00000001000d0e10
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1288] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 00000000757c72a1 5 bytes JMP 00000001000d01f8
.text C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe[1244] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000779517d7 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe[1244] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077953221 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe[1244] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077969578 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe[1244] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077969608 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe[1244] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000077969758 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe[1244] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077969ab8 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe[1244] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 000000007796b24c 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe[1244] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 130 0000000076104228 1 byte [62]
.text C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe[1244] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000075789eb4 5 bytes JMP 00000001000f03fc
.text C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe[1244] C:\Windows\syswow64\ADVAPI32.dll!DeleteService 000000007578a07e 5 bytes JMP 00000001000f0600
.text C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe[1244] C:\Windows\syswow64\ADVAPI32.dll!SetServiceObjectSecurity 00000000757c6cd9 5 bytes JMP 00000001000f1014
.text C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe[1244] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigA 00000000757c6dd9 5 bytes JMP 00000001000f0804
.text C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe[1244] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigW 00000000757c6f81 5 bytes JMP 00000001000f0a08
.text C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe[1244] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfig2A 00000000757c7099 5 bytes JMP 00000001000f0c0c
.text C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe[1244] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfig2W 00000000757c71e1 5 bytes JMP 00000001000f0e10
.text C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe[1244] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 00000000757c72a1 5 bytes JMP 00000001000f01f8
.text C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe[1244] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 00000000761d010d 5 bytes JMP 0000000100100a08
.text C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe[1244] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 00000000761d03d2 5 bytes JMP 0000000100100804
.text C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe[1244] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 00000000761d1b58 5 bytes JMP 0000000100100600
.text C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe[1244] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 00000000761d6530 5 bytes JMP 00000001001003fc
.text C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe[1244] C:\Windows\syswow64\USER32.dll!SetWinEventHook 00000000761e653e 5 bytes JMP 00000001001001f8
.text C:\Windows\system32\taskeng.exe[2120] C:\Windows\system32\ntdll.dll!LdrUnloadDll 0000000077776d20 5 bytes JMP 000000010012075c
.text C:\Windows\system32\taskeng.exe[2120] C:\Windows\system32\ntdll.dll!LdrLoadDll 0000000077793bd0 5 bytes JMP 00000001001203a4
.text C:\Windows\system32\taskeng.exe[2120] C:\Windows\system32\ntdll.dll!NtAllocateVirtualMemory 00000000777a6ff0 5 bytes JMP 0000000100120b14
.text C:\Windows\system32\taskeng.exe[2120] C:\Windows\system32\ntdll.dll!NtFreeVirtualMemory 00000000777a7050 5 bytes JMP 0000000100120ecc
.text C:\Windows\system32\taskeng.exe[2120] C:\Windows\system32\ntdll.dll!NtTerminateProcess 00000000777a7130 5 bytes JMP 000000010012163c
.text C:\Windows\system32\taskeng.exe[2120] C:\Windows\system32\ntdll.dll!NtProtectVirtualMemory 00000000777a7370 5 bytes JMP 0000000100121284
.text C:\Windows\system32\taskeng.exe[2120] C:\Windows\system32\ntdll.dll!NtSetContextThread 00000000777a8330 5 bytes JMP 00000001001219f4
.text c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2288] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000779517d7 5 bytes JMP 00000001000301f8
.text c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2288] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077953221 5 bytes JMP 00000001000303fc
.text c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2288] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077969578 5 bytes JMP 0000000100030600
.text c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2288] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077969608 5 bytes JMP 0000000100030804
.text c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2288] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000077969758 5 bytes JMP 0000000100030c0c
.text c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2288] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077969ab8 5 bytes JMP 0000000100030a08
.text c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2288] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 000000007796b24c 5 bytes JMP 0000000100030e10
.text c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2288] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 130 0000000076104228 1 byte [62]
.text c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2288] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000075789eb4 5 bytes JMP 00000001000f03fc
.text c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2288] C:\Windows\syswow64\ADVAPI32.dll!DeleteService 000000007578a07e 5 bytes JMP 00000001000f0600
.text c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2288] C:\Windows\syswow64\ADVAPI32.dll!SetServiceObjectSecurity 00000000757c6cd9 5 bytes JMP 00000001000f1014
.text c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2288] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigA 00000000757c6dd9 5 bytes JMP 00000001000f0804
.text c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2288] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigW 00000000757c6f81 5 bytes JMP 00000001000f0a08
.text c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2288] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfig2A 00000000757c7099 5 bytes JMP 00000001000f0c0c
.text c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2288] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfig2W 00000000757c71e1 5 bytes JMP 00000001000f0e10
.text c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2288] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 00000000757c72a1 5 bytes JMP 00000001000f01f8
.text c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2288] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 00000000761d010d 5 bytes JMP 0000000100130a08
.text c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2288] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 00000000761d03d2 5 bytes JMP 0000000100130804
.text c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2288] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 00000000761d1b58 5 bytes JMP 0000000100130600
.text c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2288] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 00000000761d6530 5 bytes JMP 00000001001303fc
.text c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe[2288] C:\Windows\syswow64\USER32.dll!SetWinEventHook 00000000761e653e 5 bytes JMP 00000001001301f8
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2308] C:\Windows\system32\ntdll.dll!LdrUnloadDll 0000000077776d20 5 bytes JMP 000000010092075c
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2308] C:\Windows\system32\ntdll.dll!LdrLoadDll 0000000077793bd0 5 bytes JMP 00000001009203a4
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2308] C:\Windows\system32\ntdll.dll!NtAllocateVirtualMemory 00000000777a6ff0 5 bytes JMP 0000000100920b14
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2308] C:\Windows\system32\ntdll.dll!NtFreeVirtualMemory 00000000777a7050 5 bytes JMP 0000000100920ecc
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2308] C:\Windows\system32\ntdll.dll!NtTerminateProcess 00000000777a7130 5 bytes JMP 000000010092163c
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2308] C:\Windows\system32\ntdll.dll!NtProtectVirtualMemory 00000000777a7370 5 bytes JMP 0000000100921284
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2308] C:\Windows\system32\ntdll.dll!NtSetContextThread 00000000777a8330 5 bytes JMP 00000001009219f4
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2308] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 194 0000000077112c52 1 byte [62]
.text C:\Windows\system32\svchost.exe[2344] C:\Windows\system32\ntdll.dll!LdrUnloadDll 0000000077776d20 5 bytes JMP 000000010018075c
.text C:\Windows\system32\svchost.exe[2344] C:\Windows\system32\ntdll.dll!LdrLoadDll 0000000077793bd0 5 bytes JMP 00000001001803a4
.text C:\Windows\system32\svchost.exe[2344] C:\Windows\system32\ntdll.dll!NtAllocateVirtualMemory 00000000777a6ff0 5 bytes JMP 0000000100180b14
.text C:\Windows\system32\svchost.exe[2344] C:\Windows\system32\ntdll.dll!NtFreeVirtualMemory 00000000777a7050 5 bytes JMP 0000000100180ecc
.text C:\Windows\system32\svchost.exe[2344] C:\Windows\system32\ntdll.dll!NtTerminateProcess 00000000777a7130 5 bytes JMP 000000010018163c
.text C:\Windows\system32\svchost.exe[2344] C:\Windows\system32\ntdll.dll!NtProtectVirtualMemory 00000000777a7370 5 bytes JMP 0000000100181284
.text C:\Windows\system32\svchost.exe[2344] C:\Windows\system32\ntdll.dll!NtSetContextThread 00000000777a8330 5 bytes JMP 00000001001819f4
.text C:\Windows\System32\svchost.exe[2372] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 194 0000000077112c52 1 byte [62]
.text C:\Windows\system32\SearchIndexer.exe[2416] C:\Windows\system32\ntdll.dll!LdrUnloadDll 0000000077776d20 5 bytes JMP 000000010013075c
.text C:\Windows\system32\SearchIndexer.exe[2416] C:\Windows\system32\ntdll.dll!LdrLoadDll 0000000077793bd0 5 bytes JMP 00000001001303a4
.text C:\Windows\system32\SearchIndexer.exe[2416] C:\Windows\system32\ntdll.dll!NtAllocateVirtualMemory 00000000777a6ff0 5 bytes JMP 0000000100130b14
.text C:\Windows\system32\SearchIndexer.exe[2416] C:\Windows\system32\ntdll.dll!NtFreeVirtualMemory 00000000777a7050 5 bytes JMP 0000000100130ecc
.text C:\Windows\system32\SearchIndexer.exe[2416] C:\Windows\system32\ntdll.dll!NtTerminateProcess 00000000777a7130 5 bytes JMP 000000010013163c
.text C:\Windows\system32\SearchIndexer.exe[2416] C:\Windows\system32\ntdll.dll!NtProtectVirtualMemory 00000000777a7370 5 bytes JMP 0000000100131284
.text C:\Windows\system32\SearchIndexer.exe[2416] C:\Windows\system32\ntdll.dll!NtSetContextThread 00000000777a8330 5 bytes JMP 00000001001319f4
.text C:\Windows\System32\WUDFHost.exe[2508] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 194 0000000077112c52 1 byte [62]
.text C:\Windows\system32\taskeng.exe[3100] C:\Windows\system32\ntdll.dll!LdrUnloadDll 0000000077776d20 5 bytes JMP 00000001001c075c
.text C:\Windows\system32\taskeng.exe[3100] C:\Windows\system32\ntdll.dll!LdrLoadDll 0000000077793bd0 5 bytes JMP 00000001001c03a4
.text C:\Windows\system32\taskeng.exe[3100] C:\Windows\system32\ntdll.dll!NtAllocateVirtualMemory 00000000777a6ff0 5 bytes JMP 00000001001c0b14
.text C:\Windows\system32\taskeng.exe[3100] C:\Windows\system32\ntdll.dll!NtFreeVirtualMemory 00000000777a7050 5 bytes JMP 00000001001c0ecc
.text C:\Windows\system32\taskeng.exe[3100] C:\Windows\system32\ntdll.dll!NtTerminateProcess 00000000777a7130 5 bytes JMP 00000001001c163c
.text C:\Windows\system32\taskeng.exe[3100] C:\Windows\system32\ntdll.dll!NtProtectVirtualMemory 00000000777a7370 5 bytes JMP 00000001001c1284
.text C:\Windows\system32\taskeng.exe[3100] C:\Windows\system32\ntdll.dll!NtSetContextThread 00000000777a8330 5 bytes JMP 00000001001c19f4
.text C:\Windows\Explorer.EXE[3200] C:\Windows\system32\ntdll.dll!LdrUnloadDll 0000000077776d20 5 bytes JMP 000000010016075c
.text C:\Windows\Explorer.EXE[3200] C:\Windows\system32\ntdll.dll!LdrLoadDll 0000000077793bd0 5 bytes JMP 00000001001603a4
.text C:\Windows\Explorer.EXE[3200] C:\Windows\system32\ntdll.dll!NtAllocateVirtualMemory 00000000777a6ff0 5 bytes JMP 0000000100160b14
.text C:\Windows\Explorer.EXE[3200] C:\Windows\system32\ntdll.dll!NtFreeVirtualMemory 00000000777a7050 5 bytes JMP 0000000100160ecc
.text C:\Windows\Explorer.EXE[3200] C:\Windows\system32\ntdll.dll!NtTerminateProcess 00000000777a7130 5 bytes JMP 000000010016163c
.text C:\Windows\Explorer.EXE[3200] C:\Windows\system32\ntdll.dll!NtProtectVirtualMemory 00000000777a7370 5 bytes JMP 0000000100161284
.text C:\Windows\Explorer.EXE[3200] C:\Windows\system32\ntdll.dll!NtSetContextThread 00000000777a8330 5 bytes JMP 00000001001619f4
.text C:\Windows\Explorer.EXE[3200] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 194 0000000077112c52 1 byte [62]
.text C:\Windows\RAVCpl64.exe[3364] C:\Windows\system32\ntdll.dll!LdrUnloadDll 0000000077776d20 5 bytes JMP 000000010074075c
.text C:\Windows\RAVCpl64.exe[3364] C:\Windows\system32\ntdll.dll!LdrLoadDll 0000000077793bd0 5 bytes JMP 00000001007403a4
.text C:\Windows\RAVCpl64.exe[3364] C:\Windows\system32\ntdll.dll!NtAllocateVirtualMemory 00000000777a6ff0 5 bytes JMP 0000000100740b14
.text C:\Windows\RAVCpl64.exe[3364] C:\Windows\system32\ntdll.dll!NtFreeVirtualMemory 00000000777a7050 5 bytes JMP 0000000100740ecc
.text C:\Windows\RAVCpl64.exe[3364] C:\Windows\system32\ntdll.dll!NtTerminateProcess 00000000777a7130 5 bytes JMP 000000010074163c
.text C:\Windows\RAVCpl64.exe[3364] C:\Windows\system32\ntdll.dll!NtProtectVirtualMemory 00000000777a7370 5 bytes JMP 0000000100741284
.text C:\Windows\RAVCpl64.exe[3364] C:\Windows\system32\ntdll.dll!NtSetContextThread 00000000777a8330 5 bytes JMP 00000001007419f4
.text C:\Windows\RAVCpl64.exe[3364] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 194 0000000077112c52 1 byte [62]
.text C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[3468] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000779517d7 5 bytes JMP 00000001000301f8
.text C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[3468] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077953221 5 bytes JMP 00000001000303fc
.text C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077969578 5 bytes JMP 0000000100030600
.text C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077969608 5 bytes JMP 0000000100030804
.text C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000077969758 5 bytes JMP 0000000100030c0c
.text C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077969ab8 5 bytes JMP 0000000100030a08
.text C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[3468] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 000000007796b24c 5 bytes JMP 0000000100030e10
.text C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[3468] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 130 0000000076104228 1 byte [62]
.text C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[3468] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 00000000761d010d 5 bytes JMP 00000001000b0a08
.text C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[3468] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 00000000761d03d2 5 bytes JMP 00000001000b0804
.text C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[3468] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 00000000761d1b58 5 bytes JMP 00000001000b0600
.text C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[3468] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 00000000761d6530 5 bytes JMP 00000001000b03fc
.text C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[3468] C:\Windows\syswow64\USER32.dll!SetWinEventHook 00000000761e653e 5 bytes JMP 00000001000b01f8
.text C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000075789eb4 5 bytes JMP 00000001000c03fc
.text C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!DeleteService 000000007578a07e 5 bytes JMP 00000001000c0600
.text C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!SetServiceObjectSecurity 00000000757c6cd9 5 bytes JMP 00000001000c1014
.text C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigA 00000000757c6dd9 5 bytes JMP 00000001000c0804
.text C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigW 00000000757c6f81 5 bytes JMP 00000001000c0a08
.text C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfig2A 00000000757c7099 5 bytes JMP 00000001000c0c0c
.text C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfig2W 00000000757c71e1 5 bytes JMP 00000001000c0e10
.text C:\Users\Schloik\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[3468] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 00000000757c72a1 5 bytes JMP 00000001000c01f8
.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[3580] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 130 0000000076104228 1 byte [62]
.text C:\Windows\SysWOW64\conime.exe[3984] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000779517d7 5 bytes JMP 00000001000301f8
.text C:\Windows\SysWOW64\conime.exe[3984] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077953221 5 bytes JMP 00000001000303fc
.text C:\Windows\SysWOW64\conime.exe[3984] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077969578 5 bytes JMP 0000000100030600
.text C:\Windows\SysWOW64\conime.exe[3984] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077969608 5 bytes JMP 0000000100030804
.text C:\Windows\SysWOW64\conime.exe[3984] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000077969758 5 bytes JMP 0000000100030c0c
.text C:\Windows\SysWOW64\conime.exe[3984] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077969ab8 5 bytes JMP 0000000100030a08
.text C:\Windows\SysWOW64\conime.exe[3984] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 000000007796b24c 5 bytes JMP 0000000100030e10
.text C:\Windows\SysWOW64\conime.exe[3984] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 130 0000000076104228 1 byte [62]
.text C:\Windows\SysWOW64\conime.exe[3984] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000075789eb4 5 bytes JMP 00000001000603fc
.text C:\Windows\SysWOW64\conime.exe[3984] C:\Windows\syswow64\ADVAPI32.dll!DeleteService 000000007578a07e 5 bytes JMP 0000000100060600
.text C:\Windows\SysWOW64\conime.exe[3984] C:\Windows\syswow64\ADVAPI32.dll!SetServiceObjectSecurity 00000000757c6cd9 5 bytes JMP 0000000100061014
.text C:\Windows\SysWOW64\conime.exe[3984] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigA 00000000757c6dd9 5 bytes JMP 0000000100060804
.text C:\Windows\SysWOW64\conime.exe[3984] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigW 00000000757c6f81 5 bytes JMP 0000000100060a08
.text C:\Windows\SysWOW64\conime.exe[3984] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfig2A 00000000757c7099 5 bytes JMP 0000000100060c0c
.text C:\Windows\SysWOW64\conime.exe[3984] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfig2W 00000000757c71e1 5 bytes JMP 0000000100060e10
.text C:\Windows\SysWOW64\conime.exe[3984] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 00000000757c72a1 5 bytes JMP 00000001000601f8
.text C:\Windows\SysWOW64\conime.exe[3984] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 00000000761d010d 5 bytes JMP 0000000100070a08
.text C:\Windows\SysWOW64\conime.exe[3984] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 00000000761d03d2 5 bytes JMP 0000000100070804
.text C:\Windows\SysWOW64\conime.exe[3984] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 00000000761d1b58 5 bytes JMP 0000000100070600
.text C:\Windows\SysWOW64\conime.exe[3984] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 00000000761d6530 5 bytes JMP 00000001000703fc
.text C:\Windows\SysWOW64\conime.exe[3984] C:\Windows\syswow64\USER32.dll!SetWinEventHook 00000000761e653e 5 bytes JMP 00000001000701f8
.text C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe[2964] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000779517d7 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe[2964] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077953221 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe[2964] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077969578 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe[2964] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077969608 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe[2964] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000077969758 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe[2964] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077969ab8 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe[2964] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 000000007796b24c 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe[2964] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 130 0000000076104228 1 byte [62]
.text C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe[2964] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 00000000761d010d 5 bytes JMP 0000000100070a08
.text C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe[2964] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 00000000761d03d2 5 bytes JMP 0000000100070804
.text C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe[2964] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 00000000761d1b58 5 bytes JMP 0000000100070600
.text C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe[2964] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 00000000761d6530 5 bytes JMP 00000001000703fc
.text C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe[2964] C:\Windows\syswow64\USER32.dll!SetWinEventHook 00000000761e653e 5 bytes JMP 00000001000701f8
.text C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe[2964] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000075789eb4 5 bytes JMP 00000001000803fc
.text C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe[2964] C:\Windows\syswow64\ADVAPI32.dll!DeleteService 000000007578a07e 5 bytes JMP 0000000100080600
.text C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe[2964] C:\Windows\syswow64\ADVAPI32.dll!SetServiceObjectSecurity 00000000757c6cd9 5 bytes JMP 0000000100081014
.text C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe[2964] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigA 00000000757c6dd9 5 bytes JMP 0000000100080804
.text C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe[2964] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigW 00000000757c6f81 5 bytes JMP 0000000100080a08
.text C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe[2964] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfig2A 00000000757c7099 5 bytes JMP 0000000100080c0c
.text C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe[2964] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfig2W 00000000757c71e1 5 bytes JMP 0000000100080e10
.text C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe[2964] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 00000000757c72a1 5 bytes JMP 00000001000801f8
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[4372] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000779517d7 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[4372] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077953221 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[4372] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077969578 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[4372] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077969608 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[4372] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000077969758 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[4372] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077969ab8 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[4372] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 000000007796b24c 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[4372] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 130 0000000076104228 1 byte [62]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[4372] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 00000000761d010d 5 bytes JMP 0000000100080a08
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[4372] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 00000000761d03d2 5 bytes JMP 0000000100080804
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[4372] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 00000000761d1b58 5 bytes JMP 0000000100080600
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[4372] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 00000000761d6530 5 bytes JMP 00000001000803fc
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[4372] C:\Windows\syswow64\USER32.dll!SetWinEventHook 00000000761e653e 5 bytes JMP 00000001000801f8
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[4372] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000075789eb4 5 bytes JMP 00000001000903fc
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[4372] C:\Windows\syswow64\ADVAPI32.dll!DeleteService 000000007578a07e 5 bytes JMP 0000000100090600
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[4372] C:\Windows\syswow64\ADVAPI32.dll!SetServiceObjectSecurity 00000000757c6cd9 5 bytes JMP 0000000100091014
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[4372] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigA 00000000757c6dd9 5 bytes JMP 0000000100090804
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[4372] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigW 00000000757c6f81 5 bytes JMP 0000000100090a08
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[4372] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfig2A 00000000757c7099 5 bytes JMP 0000000100090c0c
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[4372] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfig2W 00000000757c71e1 5 bytes JMP 0000000100090e10
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[4372] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 00000000757c72a1 5 bytes JMP 00000001000901f8
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4396] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000779517d7 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4396] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077953221 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4396] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077969578 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4396] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077969608 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4396] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000077969758 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4396] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077969ab8 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4396] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 000000007796b24c 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4396] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 130 0000000076104228 1 byte [62]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4396] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 00000000761d010d 5 bytes JMP 0000000100090a08
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4396] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 00000000761d03d2 5 bytes JMP 0000000100090804
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4396] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 00000000761d1b58 5 bytes JMP 0000000100090600
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4396] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 00000000761d6530 5 bytes JMP 00000001000903fc
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4396] C:\Windows\syswow64\USER32.dll!SetWinEventHook 00000000761e653e 5 bytes JMP 00000001000901f8
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4396] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000075789eb4 5 bytes JMP 00000001000a03fc
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4396] C:\Windows\syswow64\ADVAPI32.dll!DeleteService 000000007578a07e 5 bytes JMP 00000001000a0600
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4396] C:\Windows\syswow64\ADVAPI32.dll!SetServiceObjectSecurity 00000000757c6cd9 5 bytes JMP 00000001000a1014
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4396] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigA 00000000757c6dd9 5 bytes JMP 00000001000a0804
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4396] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigW 00000000757c6f81 5 bytes JMP 00000001000a0a08
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4396] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfig2A 00000000757c7099 5 bytes JMP 00000001000a0c0c
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4396] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfig2W 00000000757c71e1 5 bytes JMP 00000001000a0e10
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4396] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 00000000757c72a1 5 bytes JMP 00000001000a01f8
.text C:\Windows\splwow64.exe[4492] C:\Windows\system32\ntdll.dll!LdrUnloadDll 0000000077776d20 5 bytes JMP 00000001002b075c
.text C:\Windows\splwow64.exe[4492] C:\Windows\system32\ntdll.dll!LdrLoadDll 0000000077793bd0 5 bytes JMP 00000001002b03a4
.text C:\Windows\splwow64.exe[4492] C:\Windows\system32\ntdll.dll!NtAllocateVirtualMemory 00000000777a6ff0 5 bytes JMP 00000001002b0b14
.text C:\Windows\splwow64.exe[4492] C:\Windows\system32\ntdll.dll!NtFreeVirtualMemory 00000000777a7050 5 bytes JMP 00000001002b0ecc
.text C:\Windows\splwow64.exe[4492] C:\Windows\system32\ntdll.dll!NtTerminateProcess 00000000777a7130 5 bytes JMP 00000001002b163c
.text C:\Windows\splwow64.exe[4492] C:\Windows\system32\ntdll.dll!NtProtectVirtualMemory 00000000777a7370 5 bytes JMP 00000001002b1284
.text C:\Windows\splwow64.exe[4492] C:\Windows\system32\ntdll.dll!NtSetContextThread 00000000777a8330 5 bytes JMP 00000001002b19f4
.text C:\Windows\splwow64.exe[4492] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 194 0000000077112c52 1 byte [62]
.text C:\Users\Schloik\Desktop\gmer_2.1.19163.exe[1312] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 130 0000000076104228 1 byte [62]
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification
INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification
INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification
INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification
---- EOF - GMER 2.1 ----
|
| Themen zu Avast deaktiviert, Rechner bootet selbst neu, VisthAux.exe |
| adobe, antivirus, aswrvrt.sys, autorun, avast, avast deaktiviert, battle.net, bho, defender, error, explorer, firefox, flash player, format, home, install.exe, microsoft office 2003, mozilla, msiinstaller, ntdll.dll, programm, realtek, reboot, registry, rundll, scan, security, server, software, svchost.exe, temp, udp, vista 64 bit, visthaux.exe, winlogon.exe |
Baum-Darstellung