Mahnbescheid Stelle Zip Datei entpackt/Alle Daten verschwunden

Exokekso

Hallo zusammen,

ich schreibe im Namen meiner Schwester, da sie sich mit Computern kaum auskennt. Zum Sachverhalt:

Sie hatte in Ihrem GMX Postfach eine E-Mail von der Mahnbescheid Stelle mit einer ZIP-Datei im Anhang bekommen und diese aufgemacht und ausgeführt. Danach blieb sie noch eine Weile in Ihrem Postfach bis auf dem Bildschirm Streifen auftauchten und die GMX-Seite als Quellcode dargestellt wurde. Als sie den PC daraufhin neugestartet hat, war ihr Desktop komplett schwarz und alle ihre Dateien und Programmverknüpfungen waren verschwunden. Wenn ich in die C: Partition schaue, sind die Programme alle vorhanden. Es ist als wären alle Dateien verschwunden. Ich habe danach den AVG Scanner und Malwarebytes laufen lassen. Diese haben einige Schädlinge erkannt und gelöscht, aber die Dateien sind immernoch weg.

Es geht mir hauptsächlich um ihre Fotos von der Familie und der Kindheit meiner Neffen.

Nun bin ich mit meinem Latein am Ende und hoffe, dass ihr mir helfen könnt.

Ich habe defooger, OTL und GMER scannen lassen und folgendes ist dabei rausgekommen.

defogger:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:59 on 28/06/2013 (Kristja)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-



OTL:

OTL logfile created on: 28.06.2013 14:27:17 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = E:\
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

4,00 Gb Total Physical Memory | 2,89 Gb Available Physical Memory | 72,22% Memory free
7,99 Gb Paging File | 6,59 Gb Available in Paging File | 82,45% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 583,38 Gb Total Space | 539,85 Gb Free Space | 92,54% Space Free | Partition Type: NTFS
Drive E: | 3,73 Gb Total Space | 0,59 Gb Free Space | 15,81% Space Free | Partition Type: FAT32

Computer Name: COMPIK | User Name: Kristja | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013.06.27 23:59:18 | 000,602,112 | ---- | M] (OldTimer Tools) -- E:\OTL.exe
PRC - [2013.05.22 09:09:29 | 001,226,928 | ---- | M] (AVG Secure Search) -- C:\Program Files (x86)\AVG Secure Search\vprot.exe
PRC - [2013.05.22 09:09:29 | 001,015,984 | ---- | M] (AVG Secure Search) -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe
PRC - [2012.11.19 18:25:32 | 002,598,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
PRC - [2012.11.02 04:51:18 | 005,174,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe
PRC - [2012.02.14 04:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
PRC - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2010.08.11 03:06:16 | 000,975,952 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe
PRC - [2010.08.11 03:06:16 | 000,321,104 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe
PRC - [2010.08.11 03:06:16 | 000,305,744 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe
PRC - [2010.06.29 00:23:24 | 000,263,936 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe
PRC - [2010.06.29 00:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe
PRC - [2010.06.09 19:54:22 | 000,206,208 | ---- | M] () -- C:\Windows\PLFSetI.exe
PRC - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe
PRC - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe


========== Modules (No Company Name) ==========

MOD - [2013.05.22 09:09:29 | 000,158,384 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.2.0\SiteSafety.dll
MOD - [2010.06.29 00:20:54 | 000,465,576 | ---- | M] () -- C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\sqlite3.dll
MOD - [2010.06.09 19:54:22 | 000,206,208 | ---- | M] () -- C:\Windows\PLFSetI.exe
MOD - [2009.05.21 00:02:04 | 000,072,200 | ---- | M] () -- C:\Program Files (x86)\Launch Manager\CdDirIo.dll


========== Services (SafeList) ==========

SRV:64bit: - [2010.10.28 21:38:14 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2013.05.22 09:09:29 | 001,015,984 | ---- | M] (AVG Secure Search) [Auto | Running] -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe -- (vToolbarUpdater15.2.0)
SRV - [2012.11.02 04:51:18 | 005,174,392 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2012.09.15 00:16:15 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.06.21 15:58:50 | 002,445,880 | ---- | M] (Check Point Software Technologies LTD) [Auto | Stopped] -- C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe -- (vsmon)
SRV - [2012.04.30 21:08:10 | 000,827,520 | ---- | M] (Check Point Software Technologies) [Auto | Running] -- C:\Programme\CheckPoint\ZAForceField\ISWSVC.exe -- (IswSvc)
SRV - [2012.02.14 04:53:38 | 000,193,288 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe -- (avgwd)
SRV - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2010.11.28 08:30:17 | 000,867,080 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010.08.11 03:06:16 | 000,321,104 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2010.06.29 00:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2010.06.11 15:27:26 | 000,868,896 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Packard Bell\Packard Bell Power Management\ePowerSvc.exe -- (ePowerSvc)
SRV - [2010.04.04 01:01:24 | 000,246,520 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Packard Bell Games\Packard Bell Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe -- (Updater Service)
SRV - [2010.01.15 23:08:38 | 000,935,208 | ---- | M] (Nero AG) [On_Demand | Stopped] -- c:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2010.01.09 22:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe -- (GREGService)
SRV - [2009.10.09 06:45:56 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- c:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor8.0)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2013.05.22 09:09:29 | 000,045,856 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtpx64.sys -- (avgtp)
DRV:64bit: - [2013.04.11 03:18:40 | 000,384,800 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)
DRV:64bit: - [2012.12.10 04:28:34 | 000,127,328 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver)
DRV:64bit: - [2012.11.08 04:49:24 | 000,307,040 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)
DRV:64bit: - [2012.04.19 04:50:26 | 000,028,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.01.31 04:46:48 | 000,036,944 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:64bit: - [2011.12.23 13:32:14 | 000,047,696 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:64bit: - [2011.12.23 13:32:04 | 000,029,776 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\avgidsfiltera.sys -- (AVGIDSFilter)
DRV:64bit: - [2011.10.01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011.10.01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011.10.01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011.10.01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011.05.07 17:51:32 | 000,454,232 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vsdatant.sys -- (Vsdatant)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 15:32:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:32:46 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.10.28 22:11:44 | 007,877,120 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2010.10.28 21:03:38 | 000,285,696 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010.09.24 18:46:32 | 000,116,752 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2010.06.17 15:15:36 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie64.sys -- (AtiPcie)
DRV:64bit: - [2010.06.10 22:57:20 | 000,040,448 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmUStor.sys -- (AmUStor)
DRV:64bit: - [2010.06.08 05:36:18 | 000,406,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a)
DRV:64bit: - [2010.05.12 04:11:38 | 002,229,608 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2010.04.29 15:43:20 | 000,038,528 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter)
DRV:64bit: - [2009.12.07 20:53:26 | 000,117,504 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:64bit: - [2009.12.07 20:36:48 | 000,246,224 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbnet.sys -- (ewusbnet)
DRV:64bit: - [2009.10.12 16:23:22 | 000,114,304 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbdev.sys -- (hwusbdev)
DRV:64bit: - [2009.09.18 06:12:06 | 000,292,912 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.20 04:09:57 | 000,054,272 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\L1E62x64.sys -- (L1E)
DRV:64bit: - [2009.06.10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009.06.10 22:34:38 | 001,311,232 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.06 01:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:64bit: - [2009.05.06 01:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:64bit: - [2008.06.16 04:00:00 | 000,055,024 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV - [2012.04.30 21:08:32 | 000,033,672 | ---- | M] (Check Point Software Technologies) [Kernel | Auto | Running] -- C:\Programme\CheckPoint\ZAForceField\ISWKL.sys -- (ISWKL)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=APBTDF&pc=MAPB&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
IE - HKCU\..\URLSearchHook: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://isearch.avg.com/search?cid={73C65BAE-6D9D-4C0A-8C02-465D572EF593}&mid=3f2a18adf11647d08770f123ccc007ec-d96cb879d9924c8e97e74b59b1d1ef79d40f0bce&lang=de&ds=AVG&pr=fr&d=2012-06-25 23:29:17&v=14.2.0.1&pid=avg&sg=&sap=dsp&q={searchTerms}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0

========== FireFox ==========

FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\PROGRAM FILES\CHECKPOINT\ZAFORCEFIELD\TRUSTCHECKER [2012.06.25 23:16:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker [2012.06.25 23:01:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG2012\Firefox4\ [2013.01.31 18:37:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\FireFoxExt\15.2.0.5 [2013.06.24 22:38:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.15 00:16:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.09.15 00:16:15 | 000,000,000 | ---D | M]

[2013.06.25 01:49:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Kristja\AppData\Roaming\mozilla\Extensions
[2011.01.21 22:22:20 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.09.15 00:16:15 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.09.15 00:16:13 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.05.22 09:10:54 | 000,003,714 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
[2012.09.15 00:16:13 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.09.15 00:16:13 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.09.15 00:16:13 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.09.15 00:16:13 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.09.15 00:16:13 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2013.06.25 01:48:50 | 000,447,822 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 123fporn.info
O1 - Hosts: 15376 more lines...
O2:64bit: - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll (AVG Technologies CZ, s.r.o.)
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2:64bit: - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Programme\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.2.0.5\AVG Secure Search_toolbar.dll (AVG Secure Search)
O3:64bit: - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.2.0.5\AVG Secure Search_toolbar.dll (AVG Secure Search)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Programme\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4:64bit: - HKLM..\Run: [Acer ePower Management] C:\Programme\Packard Bell\Packard Bell Power Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Alcor Micro Corp.)
O4:64bit: - HKLM..\Run: [ISW] File not found
O4:64bit: - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe ()
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [VideoWebCamera] C:\Program Files (x86)\VideoWebCamera\VideoWebCamera.exe (Suyin)
O4 - HKLM..\Run: [vProt] C:\Program Files (x86)\AVG Secure Search\vprot.exe (AVG Secure Search)
O4 - HKLM..\Run: [ZoneAlarm] C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9:64bit: - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll (AVG Technologies CZ, s.r.o.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{23E8F97D-9817-4FFF-B22A-7C010F505519}: NameServer = 193.189.244.225 193.189.244.206
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4257782A-CC3D-4501-B6B5-6CF9F3DB38E7}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{71B690D7-6E21-4EE3-BBD9-1E7D3CEDB10B}: NameServer = 193.189.244.225 193.189.244.206
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C6DD9786-C14F-4736-B8C7-1264069C89E1}: NameServer = 193.189.244.225 193.189.244.206
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EBEA0A6B-1FB2-4A1A-974D-DF3FEF373FFE}: NameServer = 193.189.244.225 193.189.244.206
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\viprotocol - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.2.0\ViProtocol.dll (AVG Secure Search)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{35c20df1-27c7-11e0-85da-1c659d53c440}\Shell - "" = AutoRun
O33 - MountPoints2\{35c20df1-27c7-11e0-85da-1c659d53c440}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{35c20e24-27c7-11e0-85da-001e101f4da1}\Shell - "" = AutoRun
O33 - MountPoints2\{35c20e24-27c7-11e0-85da-001e101f4da1}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{38a9eae4-266f-11e0-9e97-1c659d53c440}\Shell - "" = AutoRun
O33 - MountPoints2\{38a9eae4-266f-11e0-9e97-1c659d53c440}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{554423ec-266b-11e0-9ec8-1c659d53c440}\Shell - "" = AutoRun
O33 - MountPoints2\{554423ec-266b-11e0-9ec8-1c659d53c440}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{8cd87fec-393a-11e0-a10b-1c659d53c440}\Shell - "" = AutoRun
O33 - MountPoints2\{8cd87fec-393a-11e0-a10b-1c659d53c440}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /sync /restart)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2013.06.28 12:44:58 | 000,000,000 | ---D | C] -- C:\Users\Kristja\AppData\Roaming\Malwarebytes
[2013.06.28 12:44:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.06.28 12:44:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.06.28 12:44:44 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013.06.28 12:44:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013.06.25 01:49:59 | 000,000,000 | ---D | C] -- C:\Users\Kristja\Documents\ProcAlyzer Dumps
[2013.06.25 01:40:12 | 000,000,000 | ---D | C] -- C:\Users\Kristja\AppData\Local\Programs
[2013.06.25 00:23:16 | 000,000,000 | -H-D | C] -- C:\$AVG
[2013.06.24 23:59:02 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess
[2013.06.24 22:47:38 | 000,000,000 | ---D | C] -- C:\Users\Kristja\AppData\Roaming\ATI
[2013.06.24 22:47:11 | 000,000,000 | ---D | C] -- C:\Users\Kristja\AppData\Local\AVG Secure Search
[2013.06.24 22:46:45 | 000,000,000 | ---D | C] -- C:\Users\Kristja\AppData\Roaming\AVG2012
[2013.06.24 22:46:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2013.06.24 22:46:11 | 000,000,000 | ---D | C] -- C:\Users\Kristja\Documents\ForceField Shared Files
[2013.06.24 22:40:33 | 000,000,000 | ---D | C] -- C:\Users\Kristja\AppData\Local\ATI
[2013.06.24 22:40:33 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2013.06.24 22:39:54 | 000,000,000 | ---D | C] -- C:\Users\Kristja\AppData\Roaming\Adobe
[1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013.06.28 14:12:06 | 000,017,376 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.28 14:12:06 | 000,017,376 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.28 14:04:47 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.06.28 14:04:47 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
[2013.06.28 14:04:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.06.28 14:04:37 | 3219,787,776 | -HS- | M] () -- C:\hiberfil.sys
[2013.06.28 13:59:10 | 000,000,000 | ---- | M] () -- C:\Users\Kristja\defogger_reenable
[2013.06.28 13:40:28 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.06.28 12:44:45 | 000,001,125 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.06.28 12:21:41 | 000,000,085 | ---- | M] () -- C:\Windows\wininit.ini
[2013.06.25 01:48:50 | 000,447,822 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.06.25 01:41:20 | 001,473,514 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.06.25 01:41:20 | 000,644,310 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.06.25 01:41:20 | 000,607,634 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.06.25 01:41:20 | 000,126,580 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.06.25 01:41:20 | 000,103,754 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.06.24 22:46:04 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2013.06.24 21:14:42 | 124,302,133 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\incavi.avm
[1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013.06.28 13:56:45 | 000,000,000 | ---- | C] () -- C:\Users\Kristja\defogger_reenable
[2013.06.28 12:44:45 | 000,001,125 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.06.28 12:21:36 | 000,000,085 | ---- | C] () -- C:\Windows\wininit.ini
[2013.06.24 22:46:04 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2013.06.03 19:07:35 | 000,000,350 | ---- | C] () -- C:\Windows\tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
[2012.11.30 19:12:51 | 000,036,734 | ---- | C] () -- C:\Windows\SysWow64\OggDSuninst.exe

========== ZeroAccess Check ==========

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2013.06.24 22:46:45 | 000,000,000 | ---D | M] -- C:\Users\Kristja\AppData\Roaming\AVG2012
[2012.06.25 23:01:49 | 000,000,000 | ---D | M] -- C:\Users\Kristja\AppData\Roaming\CheckPoint

========== Purity Check ==========



< End of report >


OTL - Extras:


OTL Extras logfile created on: 28.06.2013 14:27:17 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = E:\
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

4,00 Gb Total Physical Memory | 2,89 Gb Available Physical Memory | 72,22% Memory free
7,99 Gb Paging File | 6,59 Gb Available in Paging File | 82,45% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 583,38 Gb Total Space | 539,85 Gb Free Space | 92,54% Space Free | Partition Type: NTFS
Drive E: | 3,73 Gb Total Space | 0,59 Gb Free Space | 15,81% Space Free | Partition Type: FAT32

Computer Name: COMPIK | User Name: Kristja | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01E81074-61FF-4A6B-8502-A59C96095369}" = lport=2869 | protocol=6 | dir=in | app=system |
"{0A9A3AC2-5D78-4115-8830-8521F0F3BF26}" = rport=138 | protocol=17 | dir=out | app=system |
"{102E1959-A935-4EA8-90B3-F63B29B20BC1}" = rport=445 | protocol=6 | dir=out | app=system |
"{15123AB4-4727-48A9-87A1-8C2602538CB4}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{16D2876F-4339-4978-8C66-3229B12A79EF}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{191F215A-AD6E-4347-A4BC-FBB2D528CBB4}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{1A6C59EC-401D-4155-877B-E31AB86A2C08}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2F8FB45F-96B8-43FA-902A-EF3090CF2FC2}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{35F0B5B3-F7A0-40CD-BEB2-C712BF71F2F8}" = lport=139 | protocol=6 | dir=in | app=system |
"{3F2921EF-D5DE-4B73-B5B0-88A9E4270560}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{3F797370-17A5-4281-A67D-3015D1AC3B32}" = lport=2869 | protocol=6 | dir=in | app=system |
"{466C6631-0B5E-4144-A7BC-DDA4CEA2E738}" = rport=10243 | protocol=6 | dir=out | app=system |
"{4BF15EEA-9D81-4DB5-8B59-1CF9EE568961}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{6C32875D-34AD-47B1-A6A2-7C8B78546834}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{6CC3CF36-4E5B-4A83-964D-39E733E27B47}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{71CAC199-B2A3-4AE7-B789-5B7113B14F7D}" = rport=139 | protocol=6 | dir=out | app=system |
"{8028311B-A506-4B0B-9F23-CFBA39DF742E}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8989E05F-FFF5-4287-9D01-D90D6C511C64}" = lport=137 | protocol=17 | dir=in | app=system |
"{BED7126A-68B5-4491-A68C-18155A94C55A}" = rport=137 | protocol=17 | dir=out | app=system |
"{C6E087A6-2CA1-4C2A-AAED-B9B2F98C89E2}" = lport=445 | protocol=6 | dir=in | app=system |
"{CDEFFDC6-3BCC-4058-BEBA-98C53D745612}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{D16B8FDE-8955-424B-995C-9C04B7360252}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D42C1A6E-1898-43D5-9A33-9C18F439D398}" = lport=138 | protocol=17 | dir=in | app=system |
"{D8C861E0-2B4C-4E11-A04C-9364E6553EF2}" = lport=10243 | protocol=6 | dir=in | app=system |
"{F2134785-D42C-4475-9D9C-E96D0E31671E}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03E233C5-1456-4058-8501-7246E7413882}" = protocol=6 | dir=out | app=system |
"{0734E93B-59FC-4606-9202-A4BAEDDD8A08}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{0B6D0877-D687-4A55-9054-400034AD3F8D}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{119F0EF7-5C6D-4965-93BE-10B29F67D441}" = dir=in | app=c:\program files (x86)\windows live\messenger\wlcsdk.exe |
"{1302172F-B9F6-482F-A748-3D1318E9B815}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{1416AF27-1068-4CC7-8BB2-5D73832EBFFC}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{16709205-4D3B-4D54-8C24-54FFF62A1C5E}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgemca.exe |
"{1B81BF98-E416-4EC0-8960-E28179D2BF82}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{26AABDEE-167D-45C5-A0E1-E6B15831EAD6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3623847B-7A37-436E-9E4E-F421ED8D090F}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{4D18EDC5-9216-4F3F-AE54-B14C80297866}" = protocol=17 | dir=in | app=c:\windows\syswow64\lxbkcoms.exe |
"{4FDEFE49-7E47-42ED-BE65-D1A842B26E2B}" = protocol=6 | dir=in | app=c:\windows\syswow64\zonelabs\vsmon.exe |
"{50FCA5CD-AF16-4630-BAC1-A5E0BD9B7E11}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgmfapx.exe |
"{59564018-991E-4297-8B4E-D333F741B821}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{59D61E99-310A-4D57-AFC8-5C5C46DC502C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{7951A374-E465-451B-A920-CA9F97C9BED7}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgnsa.exe |
"{7E84490F-8DDA-4C4E-BBA5-6DF8543ED9E1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{81A52942-006E-4650-B5EA-CCD3D9652F7B}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{830B441D-419D-4707-8A33-AA7AFFCA278D}" = protocol=6 | dir=in | app=c:\windows\syswow64\lxbkcoms.exe |
"{871A55AD-EF16-4830-8492-83D1EDC58D30}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8F2709E9-C7E2-4C4B-92D7-510A4649EB1C}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgdiagex.exe |
"{96260EA6-A913-49FD-A000-C0CF708AB66C}" = protocol=17 | dir=in | app=c:\windows\syswow64\zonelabs\vsmon.exe |
"{992889CE-C4F7-4A7E-AC09-1FA3D8CAFA23}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgnsa.exe |
"{A3263B01-4F8E-4484-BA3B-8F0A4DD5A3A7}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe |
"{A5A54489-9DFD-42A6-8BE3-6ED43FFB1EEB}" = protocol=17 | dir=in | app=c:\windows\syswow64\zonelabs\vsmon.exe |
"{B42A334C-53D5-44CE-82B9-A681D4677E55}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{B43A7186-0563-4D80-B9E3-B9E6AF707345}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B923B713-50EE-4A46-AB4E-7751E83C0D9A}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{BEFB3541-66A1-469D-B2D4-6E234A16864C}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgdiagex.exe |
"{C2539EEA-6600-4FD5-8924-99B4EF3248D6}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgemca.exe |
"{C7B361DD-CDF5-43ED-BAB3-717F3FC30EE7}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgmfapx.exe |
"{CB0ACE43-5442-40F8-8A5E-69D00A7B374B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D04A8C29-F0F0-4BED-A674-E919DC21DAE7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F6EE921B-4BBF-4FE0-82B4-7C242CE24A8A}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{F9F4332E-360D-4503-B164-F4AC680B56B4}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{FD7810F1-294F-4938-BFAF-0EBDD2DA0515}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{FF7C11E0-3C21-477A-A1B9-BD7690720113}" = protocol=6 | dir=in | app=c:\windows\syswow64\zonelabs\vsmon.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{2023DAEC-90C2-E042-909F-BFAD8AC9B60C}" = ATI Catalyst Install Manager
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{53EDAFFA-3724-444C-AC8D-099220CDFB90}" = AVG 2012
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A84DB02B-9C2B-4272-9D2D-A80E00A56513}" = Broadcom Gigabit NetLink Controller
"{B112FEE4-3837-420D-9C10-1C5D5436407A}" = ccc-utility64
"{D9D2CAB2-C726-4372-9F05-51B906C802B5}" = AVG 2012
"{DFE4E6BB-70F0-4292-B7EB-7A3AD48EBB5C}" = AVG 2012
"AVG" = AVG 2012
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"ZoneAlarm LTD Toolbar" = ZoneAlarm LTD Toolbar

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{17DFE37C-064E-4834-AD8F-A4B2B4DF68F8}" = Adobe Photoshop Elements 8.0
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20400DBD-E6DB-45B8-9B6B-1DD7033818EC}" = Nero InfoTool Help
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{212BA4B5-4ED0-CCFD-9675-9D3DE3D049B4}" = Catalyst Control Center Localization All
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2348B586-C9AE-46CE-936C-A68E9426E214}" = Nero StartSmart Help
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{28DFDEAD-1084-0F3F-E068-9135FC876027}" = Catalyst Control Center InstallProxy
"{28E82311-8616-11E1-BEB0-B8AC6F97B88E}" = Google Earth
"{2FCA5F46-55AA-B96E-87FA-47F5811E33AD}" = CCC Help Dutch
"{30026C82-13BA-D7FF-E155-3D2B0C192A28}" = CCC Help Chinese Standard
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{32022218-B297-B983-025B-A03A1C2B202C}" = CCC Help Finnish
"{3351ADF6-B509-4CB5-A3EE-4ACBDB1CB7FB}_is1" = Sportangeln 2012 Suedeuropa Version 1.0
"{33CF58F5-48D8-4575-83D6-96F574E4D83A}" = Nero DriveSpeed
"{3b53cb85-2662-4bb8-968c-a4f4e8e06353}" = Nero 9 Essentials
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Packard Bell Power Management
"{4B33371A-C04F-48D3-980C-285369ECD634}" = ZoneAlarm Firewall
"{4D43D635-6FDA-4FA5-AA9B-23CF73D058EA}" = Nero StartSmart OEM
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{595A3116-40BB-4E0F-A2E8-D7951DA56270}" = NeroExpress
"{64EF903E-D00A-414C-94A4-FBA368FFCDC9}" = Packard Bell Social Networks
"{6617E770-55EE-587D-06FA-B49A8A6F2EF4}" = CCC Help Korean
"{679E3E0C-E913-CA59-6664-A54BE85193E2}" = CCC Help Spanish
"{68A408B2-80E0-9191-6FDF-6F8318E94B71}" = CCC Help Portuguese
"{6D9021DC-CF1B-4148-8C80-6D8E8A8A33EB}" = Video Web Camera
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Backup Manager Basic
"{76A32E41-F8B9-50B3-5CEE-DD42115DF9A2}" = CCC Help Chinese Traditional
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7748AC8C-18E3-43BB-959B-088FAEA16FB2}" = Nero StartSmart
"{7EA8CE23-0C8C-6784-635C-D4F8AFB59AB5}" = ccc-core-static
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Packard Bell Recovery Management
"{813CFC98-FE1C-7249-49C8-017A227F8574}" = CCC Help Danish
"{8218F4EC-35C0-2CEB-1ABC-24E114270157}" = CCC Help Italian
"{823FB107-94F5-405C-8B3D-6F6E66C3A310}" = Catalyst Control Center - Branding
"{83202942-84B3-4C50-8622-B8C0AA2D2885}" = Nero Express Help
"{83C1DE40-C1D3-9F4B-C5E1-12A3835FE1F0}" = CCC Help Polish
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{869200DB-287A-4DC0-B02B-2B6787FBCD4C}" = Nero DiscSpeed
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{8FDE7841-D6E0-26FE-B923-D2F3533C7C9C}" = CCC Help Swedish
"{90140011-0066-0407-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - Deutsch
"{91C6CFF0-F3A1-CB93-9072-446C8B8774C1}" = CCC Help Japanese
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{98ADCC35-E388-B4D7-1353-6964CEF74CF1}" = CCC Help French
"{98EE2259-4D34-6709-1447-6759E0C7C4E8}" = CCC Help Greek
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A38939B8-4DE7-896D-01FA-C183EA33BBDA}" = CCC Help Russian
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.1 MUI
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center
"{B60119FB-0A43-69BC-1D2C-EE3A91A85300}" = CCC Help Hungarian
"{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter
"{BE1738EB-A0EA-0A4F-F9A8-A8731F1B88CC}" = Catalyst Control Center Graphics Previews Common
"{C4C255FE-BE15-4C06-AAD9-A08F2DBB2E39}" = ZoneAlarm Security
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C81A2FE0-3574-00A9-CED4-BDAA334CBE8E}" = Nero Online Upgrade
"{CAAB5F83-B7D1-6AD9-1D86-D37C3E1277C5}" = CCC Help Thai
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CBCFD97D-FE82-43F4-A978-996CACF71E6B}_is1" = UBitMenuDE
"{CC019E3F-59D2-4486-8D4B-878105B62A71}" = Nero DiscSpeed Help
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D7AE3689-D40E-DAFE-385D-2B45308E59B6}" = CCC Help English
"{DBA8B9E1-C6FF-4624-9598-73D3B41A0903}" = Microsoft Picture It! Foto Premium 9
"{DD3E3DAA-B005-54D2-CF94-0C919F55CFCE}" = CCC Help Norwegian
"{DD89CE29-BC88-40C6-A845-E2548682C5D6}" = Alcor Micro USB Card Reader
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E11A86A7-B346-5FA0-A84B-8805B87580B4}" = CCC Help Turkish
"{E5C7D048-F9B4-4219-B323-8BDB01A2563D}" = Nero DriveSpeed Help
"{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer
"{E8ED6EE9-B477-CD27-048A-6291A719A8A1}" = CCC Help German
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Packard Bell Updater
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4041DCE-3FE1-4E18-8A9E-9DE65231EE36}" = Nero ControlCenter
"{FB3EB614-9284-5C13-6BDB-C8915F180881}" = CCC Help Czech
"{FBCDFD61-7DCF-4E71-9226-873BA0053139}" = Nero InfoTool
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop Elements 8.0" = Adobe Photoshop Elements 8.0
"AVG Secure Search" = AVG Security Toolbar
"Google Chrome" = Google Chrome
"Identity Card" = Identity Card
"InstallShield_{64EF903E-D00A-414C-94A4-FBA368FFCDC9}" = Packard Bell Social Networks
"InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}" = Packard Bell MyBackup
"InstallShield_{DD89CE29-BC88-40C6-A845-E2548682C5D6}" = Alcor Micro USB Card Reader
"Lexmark X1100 Series" = Lexmark X1100 Series
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300
"Mobile Partner" = Mobile Partner
"Mozilla Firefox 12.0 (x86 de)" = Mozilla Firefox 12.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"OggDS" = Direct Show Ogg Vorbis Filter (remove only)
"Packard Bell Game Console" = Packard Bell Game Console
"Packard Bell InfoCentre" = Packard Bell InfoCentre
"Packard Bell Registration" = Packard Bell Registration
"Packard Bell Screensaver" = Packard Bell ScreenSaver
"Packard Bell Welcome Center" = Welcome Center
"PictureIt_v9" = Microsoft Picture It! Foto Premium 9
"Virtual DJ Home - Atomix Productions" = Virtual DJ Home - Atomix Productions
"WildTangent packardbell Master Uninstall" = Packard Bell Games
"WinLiveSuite_Wave3" = Windows Live Essentials
"WT088216" = Agatha Christie - Death on the Nile
"WT088226" = Bejeweled 2 Deluxe
"WT088228" = Build-a-lot 2
"WT088235" = Chuzzle Deluxe
"WT088238" = Diner Dash 2 Restaurant Rescue
"WT088260" = Farm Frenzy
"WT088268" = Insaniquarium Deluxe
"WT088269" = Jewel Quest Solitaire 2
"WT088283" = Plants vs. Zombies
"WT088292" = Zuma Deluxe
"WT088416" = FATE
"WT088420" = Final Drive Nitro
"WT088448" = John Deere Drive Green
"WT088452" = Penguins!
"WT088456" = Polar Bowler
"WT088460" = Polar Golfer
"WT088508" = Virtual Villagers 4 - The Tree of Life
"WT088531" = Zuma's Revenge
"ZoneAlarm Free Firewall" = ZoneAlarm Free Firewall

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 27.04.2013 10:41:48 | Computer Name = Compik | Source = CVHSVC | ID = 100
Description = Nur zur Information. (Patch task for {90140011-0066-0407-0000-0000000FF1CE}):
DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar.
Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.


Error - 27.04.2013 11:25:44 | Computer Name = Compik | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Program Files
(x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder
Richtliniendatei "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe
AIR.dll" in Zeile 3. Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error - 27.04.2013 11:26:27 | Computer Name = Compik | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files
(x86)\windows live\photo gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei
"c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" in Zeile 8. Die
im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente
überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition:
WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie
das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error - 27.04.2013 11:26:32 | Computer Name = Compik | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files
(x86)\spybot - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei
"c:\program files (x86)\spybot - search & destroy\DelZip179.dll" in Zeile 8. Der
Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.

Error - 03.05.2013 04:19:20 | Computer Name = Compik | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Program Files
(x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder
Richtliniendatei "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe
AIR.dll" in Zeile 3. Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error - 03.05.2013 04:19:58 | Computer Name = Compik | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files
(x86)\windows live\photo gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei
"c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" in Zeile 8. Die
im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente
überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition:
WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie
das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error - 03.05.2013 04:20:02 | Computer Name = Compik | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files
(x86)\spybot - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei
"c:\program files (x86)\spybot - search & destroy\DelZip179.dll" in Zeile 8. Der
Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.

Error - 13.05.2013 16:02:30 | Computer Name = Compik | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Program Files
(x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder
Richtliniendatei "c:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe
AIR.dll" in Zeile 3. Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error - 13.05.2013 16:03:10 | Computer Name = Compik | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files
(x86)\windows live\photo gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei
"c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" in Zeile 8. Die
im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente
überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition:
WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie
das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error - 13.05.2013 16:03:14 | Computer Name = Compik | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files
(x86)\spybot - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei
"c:\program files (x86)\spybot - search & destroy\DelZip179.dll" in Zeile 8. Der
Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.

[ System Events ]
Error - 24.06.2013 15:58:13 | Computer Name = Compik | Source = Schannel | ID = 36888
Description = Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus
lautet: 10.

Error - 24.06.2013 16:00:54 | Computer Name = Compik | Source = Schannel | ID = 36888
Description = Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus
lautet: 10.

Error - 24.06.2013 16:01:24 | Computer Name = Compik | Source = Schannel | ID = 36888
Description = Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus
lautet: 10.

Error - 24.06.2013 16:01:55 | Computer Name = Compik | Source = Schannel | ID = 36888
Description = Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus
lautet: 10.

Error - 24.06.2013 16:02:00 | Computer Name = Compik | Source = Schannel | ID = 36888
Description = Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus
lautet: 10.

Error - 24.06.2013 16:02:03 | Computer Name = Compik | Source = Schannel | ID = 36888
Description = Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus
lautet: 10.

Error - 24.06.2013 16:02:08 | Computer Name = Compik | Source = Schannel | ID = 36888
Description = Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus
lautet: 10.

Error - 24.06.2013 16:02:22 | Computer Name = Compik | Source = Schannel | ID = 36888
Description = Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus
lautet: 10.

Error - 24.06.2013 16:47:08 | Computer Name = Compik | Source = bowser | ID = 8003
Description =

Error - 28.06.2013 06:22:00 | Computer Name = Compik | Source = WMPNetworkSvc | ID = 866306
Description =


< End of report >



GMER:


GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-06-28 16:27:29
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD6400BEVT-22A0RT0 rev.01.01A01 596,17GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Kristja\AppData\Local\Temp\pftdqpoc.sys


---- User code sections - GMER 2.1 ----

.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00000000777514d0 5 bytes JMP 00000001222ffe7c
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077751500 5 bytes JMP 0000000122300530
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077751960 5 bytes JMP 00000001222ffab8
.text C:\Windows\system32\wininit.exe[484] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077751b00 5 bytes JMP 00000001223005e8
.text C:\Windows\system32\wininit.exe[484] C:\Windows\system32\USER32.dll!FindWindowW 00000000774ed264 5 bytes JMP 00000001222ff174
.text C:\Windows\system32\wininit.exe[484] C:\Windows\system32\USER32.dll!FindWindowA 0000000077508270 5 bytes JMP 00000001222ff1c4
.text C:\Windows\system32\services.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00000000777514d0 5 bytes JMP 00000001222ffe7c
.text C:\Windows\system32\services.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077751500 5 bytes JMP 0000000122300530
.text C:\Windows\system32\services.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077751960 5 bytes JMP 00000001222ffab8
.text C:\Windows\system32\services.exe[544] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077751b00 5 bytes JMP 00000001223005e8
.text C:\Windows\system32\services.exe[544] C:\Windows\system32\USER32.dll!FindWindowW 00000000774ed264 5 bytes JMP 00000001222ff174
.text C:\Windows\system32\services.exe[544] C:\Windows\system32\USER32.dll!FindWindowA 0000000077508270 5 bytes JMP 00000001222ff1c4
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00000000777514d0 5 bytes JMP 00000001222ffe7c
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077751500 5 bytes JMP 0000000122300530
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077751960 5 bytes JMP 00000001222ffab8
.text C:\Windows\system32\lsass.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077751b00 5 bytes JMP 00000001223005e8
.text C:\Windows\system32\lsass.exe[600] C:\Windows\system32\ADVAPI32.dll!ImpersonateNamedPipeClient + 1 000007feff3ab3a1 3 bytes [DD, 4C, FA]
.text C:\Windows\system32\lsm.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00000000777514d0 5 bytes JMP 00000001222ffe7c
.text C:\Windows\system32\lsm.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077751500 5 bytes JMP 0000000122300530
.text C:\Windows\system32\lsm.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077751960 5 bytes JMP 00000001222ffab8
.text C:\Windows\system32\lsm.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077751b00 5 bytes JMP 00000001223005e8
.text C:\Windows\system32\svchost.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00000000777514d0 5 bytes JMP 00000001222ffe7c
.text C:\Windows\system32\svchost.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077751500 5 bytes JMP 0000000122300530
.text C:\Windows\system32\svchost.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077751960 5 bytes JMP 00000001222ffab8
.text C:\Windows\system32\svchost.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077751b00 5 bytes JMP 00000001223005e8
.text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00000000777514d0 5 bytes JMP 00000001222ffe7c
.text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077751500 5 bytes JMP 0000000122300530
.text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077751960 5 bytes JMP 00000001222ffab8
.text C:\Windows\system32\svchost.exe[784] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077751b00 5 bytes JMP 00000001223005e8
.text C:\Windows\system32\svchost.exe[784] C:\Windows\system32\ADVAPI32.dll!ImpersonateNamedPipeClient + 1 000007feff3ab3a1 3 bytes [DD, 4C, FA]
.text C:\Windows\system32\atiesrxx.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00000000777514d0 5 bytes JMP 00000001222ffe7c
.text C:\Windows\system32\atiesrxx.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077751500 5 bytes JMP 0000000122300530
.text C:\Windows\system32\atiesrxx.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077751960 5 bytes JMP 00000001222ffab8
.text C:\Windows\system32\atiesrxx.exe[840] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077751b00 5 bytes JMP 00000001223005e8
.text C:\Windows\System32\svchost.exe[924] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00000000777514d0 5 bytes JMP 00000001222ffe7c
.text C:\Windows\System32\svchost.exe[924] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077751500 5 bytes JMP 0000000122300530
.text C:\Windows\System32\svchost.exe[924] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077751960 5 bytes JMP 00000001222ffab8
.text C:\Windows\System32\svchost.exe[924] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077751b00 5 bytes JMP 00000001223005e8
.text C:\Windows\System32\svchost.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00000000777514d0 5 bytes JMP 00000001222ffe7c
.text C:\Windows\System32\svchost.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077751500 5 bytes JMP 0000000122300530
.text C:\Windows\System32\svchost.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077751960 5 bytes JMP 00000001222ffab8
.text C:\Windows\System32\svchost.exe[956] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077751b00 5 bytes JMP 00000001223005e8
.text C:\Windows\System32\svchost.exe[956] C:\Windows\system32\ADVAPI32.dll!ImpersonateNamedPipeClient + 1 000007feff3ab3a1 3 bytes [DD, 4C, FA]
.text C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00000000777514d0 5 bytes JMP 00000001222ffe7c
.text C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077751500 5 bytes JMP 0000000122300530
.text C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077751960 5 bytes JMP 00000001222ffab8
.text C:\Windows\system32\svchost.exe[980] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077751b00 5 bytes JMP 00000001223005e8
.text C:\Windows\system32\svchost.exe[1004] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00000000777514d0 5 bytes JMP 00000001222ffe7c
.text C:\Windows\system32\svchost.exe[1004] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077751500 5 bytes JMP 0000000122300530
.text C:\Windows\system32\svchost.exe[1004] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077751960 5 bytes JMP 00000001222ffab8
.text C:\Windows\system32\svchost.exe[1004] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077751b00 5 bytes JMP 00000001223005e8
.text C:\Windows\system32\svchost.exe[1004] C:\Windows\system32\ADVAPI32.dll!ImpersonateNamedPipeClient + 1 000007feff3ab3a1 3 bytes [DD, 4C, FA]
.text C:\Windows\system32\svchost.exe[664] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00000000777514d0 5 bytes JMP 00000001222ffe7c
.text C:\Windows\system32\svchost.exe[664] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077751500 5 bytes JMP 0000000122300530
.text C:\Windows\system32\svchost.exe[664] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077751960 5 bytes JMP 00000001222ffab8
.text C:\Windows\system32\svchost.exe[664] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077751b00 5 bytes JMP 00000001223005e8
.text C:\Windows\system32\svchost.exe[664] C:\Windows\system32\ADVAPI32.dll!ImpersonateNamedPipeClient + 1 000007feff3ab3a1 3 bytes [DD, 4C, FA]
.text C:\Windows\system32\svchost.exe[1452] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00000000777514d0 5 bytes JMP 00000001222ffe7c
.text C:\Windows\system32\svchost.exe[1452] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077751500 5 bytes JMP 0000000122300530
.text C:\Windows\system32\svchost.exe[1452] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077751960 5 bytes JMP 00000001222ffab8
.text C:\Windows\system32\svchost.exe[1452] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077751b00 5 bytes JMP 00000001223005e8
.text C:\Windows\system32\svchost.exe[1452] C:\Windows\system32\ADVAPI32.dll!ImpersonateNamedPipeClient + 1 000007feff3ab3a1 3 bytes [DD, 4C, FA]
.text C:\Windows\System32\spoolsv.exe[1712] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00000000777514d0 5 bytes JMP 00000001222ffe7c
.text C:\Windows\System32\spoolsv.exe[1712] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077751500 5 bytes JMP 0000000122300530
.text C:\Windows\System32\spoolsv.exe[1712] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077751960 5 bytes JMP 00000001222ffab8
.text C:\Windows\System32\spoolsv.exe[1712] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077751b00 5 bytes JMP 00000001223005e8
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[1912] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess 00000000778ffb08 5 bytes JMP 0000000120cb89ab
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[1912] C:\Windows\SysWOW64\ntdll.dll!NtImpersonateClientOfPort 00000000778ffb50 5 bytes JMP 0000000120cb8d58
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[1912] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheckByType 0000000077900220 5 bytes JMP 0000000120cb8791
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[1912] C:\Windows\SysWOW64\ntdll.dll!NtAlpcImpersonateClientOfPort 00000000779004a0 5 bytes JMP 0000000120cb8dd9
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[1912] C:\Windows\syswow64\kernel32.dll!OpenProcess 0000000075fc1986 5 bytes JMP 0000000120cb846c
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[1912] C:\Windows\syswow64\ADVAPI32.dll!SetThreadToken 00000000763ec7ce 5 bytes JMP 0000000120cb9036
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[1912] C:\Windows\syswow64\ADVAPI32.dll!ImpersonateNamedPipeClient 0000000076423369 5 bytes JMP 0000000120cb8e5d
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[1912] C:\Windows\syswow64\USER32.dll!FindWindowW 00000000759c98fd 5 bytes JMP 0000000120cb825a
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[1912] C:\Windows\syswow64\USER32.dll!FindWindowA 00000000759cffe6 5 bytes JMP 0000000120cb828f
.text C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe[2012] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00000000777514d0 5 bytes JMP 00000001222ffe7c
.text C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe[2012] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077751500 5 bytes JMP 0000000122300530
.text C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe[2012] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077751960 5 bytes JMP 00000001222ffab8
.text C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe[2012] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077751b00 5 bytes JMP 00000001223005e8
.text C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe[2032] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess 00000000778ffb08 5 bytes JMP 0000000120cb89ab
.text C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe[2032] C:\Windows\SysWOW64\ntdll.dll!NtImpersonateClientOfPort 00000000778ffb50 5 bytes JMP 0000000120cb8d58
.text C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe[2032] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheckByType 0000000077900220 5 bytes JMP 0000000120cb8791
.text C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe[2032] C:\Windows\SysWOW64\ntdll.dll!NtAlpcImpersonateClientOfPort 00000000779004a0 5 bytes JMP 0000000120cb8dd9
.text C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe[2032] C:\Windows\syswow64\kernel32.dll!OpenProcess 0000000075fc1986 5 bytes JMP 0000000120cb846c
.text C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe[2032] C:\Windows\syswow64\ADVAPI32.dll!SetThreadToken 00000000763ec7ce 5 bytes JMP 0000000120cb9036
.text C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe[2032] C:\Windows\syswow64\ADVAPI32.dll!ImpersonateNamedPipeClient 0000000076423369 5 bytes JMP 0000000120cb8e5d
.text C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe[2032] C:\Windows\syswow64\USER32.dll!FindWindowW 00000000759c98fd 5 bytes JMP 0000000120cb825a
.text C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe[2032] C:\Windows\syswow64\USER32.dll!FindWindowA 00000000759cffe6 5 bytes JMP 0000000120cb828f
.text C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe[1104] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess 00000000778ffb08 5 bytes JMP 0000000120cb89ab
.text C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe[1104] C:\Windows\SysWOW64\ntdll.dll!NtImpersonateClientOfPort 00000000778ffb50 5 bytes JMP 0000000120cb8d58
.text C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe[1104] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheckByType 0000000077900220 5 bytes JMP 0000000120cb8791
.text C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe[1104] C:\Windows\SysWOW64\ntdll.dll!NtAlpcImpersonateClientOfPort 00000000779004a0 5 bytes JMP 0000000120cb8dd9
.text C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe[1104] C:\Windows\syswow64\kernel32.dll!OpenProcess 0000000075fc1986 5 bytes JMP 0000000120cb846c
.text C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe[1104] C:\Windows\syswow64\USER32.dll!FindWindowW 00000000759c98fd 5 bytes JMP 0000000120cb825a
.text C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe[1104] C:\Windows\syswow64\USER32.dll!FindWindowA 00000000759cffe6 5 bytes JMP 0000000120cb828f
.text C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe[1104] C:\Windows\syswow64\ADVAPI32.dll!SetThreadToken 00000000763ec7ce 5 bytes JMP 0000000120cb9036
.text C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe[1104] C:\Windows\syswow64\ADVAPI32.dll!ImpersonateNamedPipeClient 0000000076423369 5 bytes JMP 0000000120cb8e5d
.text C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe[1104] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ce1465 2 bytes [CE, 75]
.text C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe[1104] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ce14bb 2 bytes [CE, 75]
.text ... * 2
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[2112] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess 00000000778ffb08 5 bytes JMP 0000000120cb89ab
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[2112] C:\Windows\SysWOW64\ntdll.dll!NtImpersonateClientOfPort 00000000778ffb50 5 bytes JMP 0000000120cb8d58
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[2112] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheckByType 0000000077900220 5 bytes JMP 0000000120cb8791
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[2112] C:\Windows\SysWOW64\ntdll.dll!NtAlpcImpersonateClientOfPort 00000000779004a0 5 bytes JMP 0000000120cb8dd9
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[2112] C:\Windows\syswow64\kernel32.dll!OpenProcess 0000000075fc1986 5 bytes JMP 0000000120cb846c
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[2112] C:\Windows\syswow64\ADVAPI32.dll!SetThreadToken 00000000763ec7ce 5 bytes JMP 0000000120cb9036
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[2112] C:\Windows\syswow64\ADVAPI32.dll!ImpersonateNamedPipeClient 0000000076423369 5 bytes JMP 0000000120cb8e5d
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[2112] C:\Windows\syswow64\USER32.dll!FindWindowW 00000000759c98fd 5 bytes JMP 0000000120cb825a
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[2112] C:\Windows\syswow64\USER32.dll!FindWindowA 00000000759cffe6 5 bytes JMP 0000000120cb828f
.text C:\Windows\system32\svchost.exe[2168] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00000000777514d0 5 bytes JMP 00000001222ffe7c
.text C:\Windows\system32\svchost.exe[2168] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077751500 5 bytes JMP 0000000122300530
.text C:\Windows\system32\svchost.exe[2168] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077751960 5 bytes JMP 00000001222ffab8
.text C:\Windows\system32\svchost.exe[2168] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077751b00 5 bytes JMP 00000001223005e8
.text C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe[2208] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess 00000000778ffb08 5 bytes JMP 0000000120cb89ab
.text C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe[2208] C:\Windows\SysWOW64\ntdll.dll!NtImpersonateClientOfPort 00000000778ffb50 5 bytes JMP 0000000120cb8d58
.text C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe[2208] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheckByType 0000000077900220 5 bytes JMP 0000000120cb8791
.text C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe[2208] C:\Windows\SysWOW64\ntdll.dll!NtAlpcImpersonateClientOfPort 00000000779004a0 5 bytes JMP 0000000120cb8dd9
.text C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe[2208] C:\Windows\syswow64\kernel32.dll!OpenProcess 0000000075fc1986 5 bytes JMP 0000000120cb846c
.text C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe[2208] C:\Windows\syswow64\USER32.dll!FindWindowW 00000000759c98fd 5 bytes JMP 0000000120cb825a
.text C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe[2208] C:\Windows\syswow64\USER32.dll!FindWindowA 00000000759cffe6 5 bytes JMP 0000000120cb828f
.text C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe[2208] C:\Windows\syswow64\ADVAPI32.dll!SetThreadToken 00000000763ec7ce 5 bytes JMP 0000000120cb9036
.text C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe[2208] C:\Windows\syswow64\ADVAPI32.dll!ImpersonateNamedPipeClient 0000000076423369 5 bytes JMP 0000000120cb8e5d
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2272] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess 00000000778ffb08 5 bytes JMP 0000000120cb89ab
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2272] C:\Windows\SysWOW64\ntdll.dll!NtImpersonateClientOfPort 00000000778ffb50 5 bytes JMP 0000000120cb8d58
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2272] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheckByType 0000000077900220 5 bytes JMP 0000000120cb8791
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2272] C:\Windows\SysWOW64\ntdll.dll!NtAlpcImpersonateClientOfPort 00000000779004a0 5 bytes JMP 0000000120cb8dd9
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2272] C:\Windows\syswow64\kernel32.dll!OpenProcess 0000000075fc1986 5 bytes JMP 0000000120cb846c
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2272] C:\Windows\syswow64\ADVAPI32.dll!SetThreadToken 00000000763ec7ce 5 bytes JMP 0000000120cb9036
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2272] C:\Windows\syswow64\ADVAPI32.dll!ImpersonateNamedPipeClient 0000000076423369 5 bytes JMP 0000000120cb8e5d
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2272] C:\Windows\syswow64\USER32.dll!FindWindowW 00000000759c98fd 5 bytes JMP 0000000120cb825a
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2272] C:\Windows\syswow64\USER32.dll!FindWindowA 00000000759cffe6 5 bytes JMP 0000000120cb828f
.text C:\Windows\system32\wbem\wmiprvse.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00000000777514d0 5 bytes JMP 00000001222ffe7c
.text C:\Windows\system32\wbem\wmiprvse.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077751500 5 bytes JMP 0000000122300530
.text C:\Windows\system32\wbem\wmiprvse.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077751960 5 bytes JMP 00000001222ffab8
.text C:\Windows\system32\wbem\wmiprvse.exe[2916] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077751b00 5 bytes JMP 00000001223005e8
.text C:\Windows\system32\wbem\wmiprvse.exe[2916] C:\Windows\system32\ADVAPI32.dll!ImpersonateNamedPipeClient + 1 000007feff3ab3a1 3 bytes [DD, 4C, FA]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2628] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess 00000000778ffb08 5 bytes JMP 0000000120cb89ab
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2628] C:\Windows\SysWOW64\ntdll.dll!NtImpersonateClientOfPort 00000000778ffb50 5 bytes JMP 0000000120cb8d58
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2628] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheckByType 0000000077900220 5 bytes JMP 0000000120cb8791
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2628] C:\Windows\SysWOW64\ntdll.dll!NtAlpcImpersonateClientOfPort 00000000779004a0 5 bytes JMP 0000000120cb8dd9
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2628] C:\Windows\syswow64\kernel32.dll!OpenProcess 0000000075fc1986 5 bytes JMP 0000000120cb846c
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2628] C:\Windows\syswow64\ADVAPI32.dll!SetThreadToken 00000000763ec7ce 5 bytes JMP 0000000120cb9036
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2628] C:\Windows\syswow64\ADVAPI32.dll!ImpersonateNamedPipeClient 0000000076423369 5 bytes JMP 0000000120cb8e5d
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2628] C:\Windows\syswow64\USER32.dll!FindWindowW 00000000759c98fd 5 bytes JMP 0000000120cb825a
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2628] C:\Windows\syswow64\USER32.dll!FindWindowA 00000000759cffe6 5 bytes JMP 0000000120cb828f
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2628] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075ce1465 2 bytes [CE, 75]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2628] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075ce14bb 2 bytes [CE, 75]
.text ... * 2
.text C:\Windows\system32\SearchIndexer.exe[3084] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00000000777514d0 5 bytes JMP 00000001222ffe7c
.text C:\Windows\system32\SearchIndexer.exe[3084] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077751500 5 bytes JMP 0000000122300530
.text C:\Windows\system32\SearchIndexer.exe[3084] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077751960 5 bytes JMP 00000001222ffab8
.text C:\Windows\system32\SearchIndexer.exe[3084] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077751b00 5 bytes JMP 00000001223005e8
.text C:\Windows\system32\svchost.exe[3236] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00000000777514d0 5 bytes JMP 00000001222ffe7c
.text C:\Windows\system32\svchost.exe[3236] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077751500 5 bytes JMP 0000000122300530
.text C:\Windows\system32\svchost.exe[3236] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077751960 5 bytes JMP 00000001222ffab8
.text C:\Windows\system32\svchost.exe[3236] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077751b00 5 bytes JMP 00000001223005e8
.text C:\Windows\system32\WUDFHost.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00000000777514d0 5 bytes JMP 00000001222ffe7c
.text C:\Windows\system32\WUDFHost.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077751500 5 bytes JMP 0000000122300530
.text C:\Windows\system32\WUDFHost.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077751960 5 bytes JMP 00000001222ffab8
.text C:\Windows\system32\WUDFHost.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077751b00 5 bytes JMP 00000001223005e8
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 00000000777514d0 5 bytes JMP 00000001222ffe7c
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077751500 5 bytes JMP 0000000122300530
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077751960 5 bytes JMP 00000001222ffab8
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077751b00 5 bytes JMP 00000001223005e8
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3720] C:\Windows\system32\ADVAPI32.dll!ImpersonateNamedPipeClient + 1 000007feff3ab3a1 3 bytes [DD, 4C, FA]
.text E:\gmer_2.1.19163.exe[2944] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess 00000000778ffb08 5 bytes JMP 0000000120cb89ab
.text E:\gmer_2.1.19163.exe[2944] C:\Windows\SysWOW64\ntdll.dll!NtImpersonateClientOfPort 00000000778ffb50 5 bytes JMP 0000000120cb8d58
.text E:\gmer_2.1.19163.exe[2944] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheckByType 0000000077900220 5 bytes JMP 0000000120cb8791
.text E:\gmer_2.1.19163.exe[2944] C:\Windows\SysWOW64\ntdll.dll!NtAlpcImpersonateClientOfPort 00000000779004a0 5 bytes JMP 0000000120cb8dd9
.text E:\gmer_2.1.19163.exe[2944] C:\Windows\syswow64\kernel32.dll!OpenProcess 0000000075fc1986 5 bytes JMP 0000000120cb846c
.text E:\gmer_2.1.19163.exe[2944] C:\Windows\syswow64\USER32.dll!FindWindowW 00000000759c98fd 5 bytes JMP 0000000120cb825a
.text E:\gmer_2.1.19163.exe[2944] C:\Windows\syswow64\USER32.dll!FindWindowA 00000000759cffe6 5 bytes JMP 0000000120cb828f
.text E:\gmer_2.1.19163.exe[2944] C:\Windows\syswow64\ADVAPI32.dll!SetThreadToken 00000000763ec7ce 5 bytes JMP 0000000120cb9036
.text E:\gmer_2.1.19163.exe[2944] C:\Windows\syswow64\ADVAPI32.dll!ImpersonateNamedPipeClient 0000000076423369 5 bytes JMP 0000000120cb8e5d

---- EOF - GMER 2.1 ----


Ich hoffe ich habe alles richtig gemacht und freue mich auf eure Hilfe. Falls noch andere Angaben benötigt werden, dann sagt mir bescheid und ich werde sie schnellstmöglich weiterleiten.

mit freundlichen Grüßen,

Sergej