| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Pop up u. Skip Trojaner?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
29.07.2013, 15:33
| #1 |
 |  Pop up u. Skip Trojaner? Hallo bei mir geht seit einiger zeit immer mal wieder ein pop-up fester auf. Die Adresszeile der Seite zeigt '' ezpowerads.com ''. dann habe ich hin und wieder wenn ich irgendwelche seiten im internet besuche, dass da "skip" steht. wenn ich da rauf klicke gehts ganz normal weiter. dann hat mein avast vorgestern angefangen mir zu sagen : eine Bedrohung wurde entdeckt.. jetzt habe ich gestern schon mal mit Malwarebytes gescant (2 funde) hier der log dazu PHP-Code: PHP-Code: PHP-Code: PHP-Code: lg |
|
29.07.2013, 15:36
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Pop up u. Skip Trojaner? Hallo und
__________________ Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die jemals fündig geworden? Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520 Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs posten!  Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
29.07.2013, 15:46
| #3 |
| | Pop up u. Skip Trojaner? hey
__________________danke für die schnelle antwort sorry dachte das waren alle hab aber noch was gefunden  Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.07.22.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16635 Marucs :: MARUCS-PC [Administrator] 22.07.2013 17:34:16 mbam-log-2013-07-22 (17-34-16).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 269615 Laufzeit: 4 Minute(n), 6 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 2 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007} (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007} (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 C:\Users\Marucs\AppData\Local\Temp\lyricstmp.exe (PUP.LyricsAd) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Marucs\AppData\Local\Temp\mkyltmp.exe (PUP.LyricsAd) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) lg |
|
29.07.2013, 22:31
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Pop up u. Skip Trojaner? Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
Note: Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread. Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards. Rootkitscan mit GMER Bitte lade dir  GMER herunter: (Dateiname zufällig)
Tauchen Probleme auf?
Anschließend bitte MBAR ausführen: Malwarebytes Anti-Rootkit (MBAR) Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
30.07.2013, 06:25
| #5 |
| | Pop up u. Skip Trojaner? guten morgen und danke das du mir hilfst! Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.07.28.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16635 Marucs :: MARUCS-PC [Administrator] 28.07.2013 13:39:36 mbam-log-2013-07-28 (13-39-36).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 269475 Laufzeit: 4 Minute(n), 9 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 C:\Users\Marucs\Downloads\CheatEngine62.exe (PUP.Optional.Somoto) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Marucs\Downloads\hdplugin_firefox.exe (PUP.BundleInstaller.DW) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.06.0.1004
www.malwarebytes.org
Database version: v2013.07.30.02
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16635
Marucs :: MARUCS-PC [administrator]
30.07.2013 07:16:19
mbar-log-2013-07-30 (07-16-19).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2P
Scan options disabled: PUP
Kernel memory modifications detected. Deep Anti-Rootkit Scan engaged.
Objects scanned: 302571
Time elapsed: 11 minute(s), 22 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
|
|
30.07.2013, 13:34
| #7 |
| | Pop up u. Skip Trojaner? uppps sorry was ich da denn gemacht.... Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-07-30 07:08:52
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST315003 rev.CC4H 1397,27GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Marucs\AppData\Local\Temp\pxdiypog.sys
---- Kernel code sections - GMER 2.1 ----
.text C:\Windows\system32\DRIVERS\USBPORT.SYS!DllUnload fffff8800536ed64 12 bytes {MOV RAX, 0xfffffa80079c12a0; JMP RAX}
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\wininit.exe[652] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000077a3eecd 1 byte [62]
.text C:\Windows\system32\services.exe[708] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000077a3eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[836] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000077a3eecd 1 byte [62]
.text C:\Windows\system32\atiesrxx.exe[988] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000077a3eecd 1 byte [62]
.text C:\Windows\system32\winlogon.exe[124] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000077a3eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[464] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000077a3eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[596] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000077a3eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[728] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000077a3eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1028] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000077a3eecd 1 byte [62]
.text C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189 0000000077a3eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1288] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000077a3eecd 1 byte [62]
.text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000077a3eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1676] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000077a3eecd 1 byte [62]
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1752] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000776ea30a 1 byte [62]
.text C:\Program Files (x86)\avmwlanstick\WlanNetService.exe[1812] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000776ea30a 1 byte [62]
.text C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe[1856] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000776ea30a 1 byte [62]
.text C:\Program Files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe[2032] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000776ea30a 1 byte [62]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1148] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000776ea30a 1 byte [62]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1148] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000075351a22 2 bytes [35, 75]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1148] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000075351ad0 2 bytes [35, 75]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1148] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000075351b08 2 bytes [35, 75]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1148] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000075351bba 2 bytes [35, 75]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1148] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000075351bda 2 bytes [35, 75]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1148] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000766b1465 2 bytes [6B, 76]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1148] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000766b14bb 2 bytes [6B, 76]
.text ... * 2
.text C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe[1468] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000776ea30a 1 byte [62]
.text C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe[1468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000766b1465 2 bytes [6B, 76]
.text C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe[1468] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000766b14bb 2 bytes [6B, 76]
.text ... * 2
.text C:\Windows\system32\svchost.exe[1516] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000077a3eecd 1 byte [62]
.text C:\Program Files\Acer\Acer Updater\UpdaterService.exe[912] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000776ea30a 1 byte [62]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2068] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000077a3eecd 1 byte [62]
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe[2096] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000776ea30a 1 byte [62]
.text C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe[2436] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000776ea30a 1 byte [62]
.text C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe[2520] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000776ea30a 1 byte [62]
.text C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe[2528] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000776ea30a 1 byte [62]
.text C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe[2536] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000776ea30a 1 byte [62]
.text C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe[2544] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000776ea30a 1 byte [62]
.text C:\Windows\system32\svchost.exe[3096] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe816e00 5 bytes JMP 000007ff7e831dac
.text C:\Windows\system32\svchost.exe[3096] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe816f2c 5 bytes JMP 000007ff7e830ecc
.text C:\Windows\system32\svchost.exe[3096] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe817220 5 bytes JMP 000007ff7e831284
.text C:\Windows\system32\svchost.exe[3096] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe81739c 5 bytes JMP 000007ff7e83163c
.text C:\Windows\system32\svchost.exe[3096] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe817538 5 bytes JMP 000007ff7e8319f4
.text C:\Windows\system32\svchost.exe[3096] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe8175e8 5 bytes JMP 000007ff7e8303a4
.text C:\Windows\system32\svchost.exe[3096] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe81790c 5 bytes JMP 000007ff7e83075c
.text C:\Windows\system32\svchost.exe[3096] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe817ab4 5 bytes JMP 000007ff7e830b14
.text C:\Windows\System32\svchost.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077b23ae0 5 bytes JMP 000000010025075c
.text C:\Windows\System32\svchost.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077b27a90 5 bytes JMP 00000001002503a4
.text C:\Windows\System32\svchost.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077b51490 5 bytes JMP 0000000100250b14
.text C:\Windows\System32\svchost.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077b514f0 5 bytes JMP 0000000100250ecc
.text C:\Windows\System32\svchost.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000077b515d0 5 bytes JMP 000000010025163c
.text C:\Windows\System32\svchost.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077b51810 5 bytes JMP 0000000100251284
.text C:\Windows\System32\svchost.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077b52840 5 bytes JMP 00000001002519f4
.text C:\Windows\System32\svchost.exe[4084] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe816e00 5 bytes JMP 000007ff7e831dac
.text C:\Windows\System32\svchost.exe[4084] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe816f2c 5 bytes JMP 000007ff7e830ecc
.text C:\Windows\System32\svchost.exe[4084] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe817220 5 bytes JMP 000007ff7e831284
.text C:\Windows\System32\svchost.exe[4084] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe81739c 5 bytes JMP 000007ff7e83163c
.text C:\Windows\System32\svchost.exe[4084] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe817538 5 bytes JMP 000007ff7e8319f4
.text C:\Windows\System32\svchost.exe[4084] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe8175e8 5 bytes JMP 000007ff7e8303a4
.text C:\Windows\System32\svchost.exe[4084] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe81790c 5 bytes JMP 000007ff7e83075c
.text C:\Windows\System32\svchost.exe[4084] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe817ab4 5 bytes JMP 000007ff7e830b14
.text C:\Windows\system32\SearchIndexer.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077b23ae0 5 bytes JMP 000000010031075c
.text C:\Windows\system32\SearchIndexer.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077b27a90 5 bytes JMP 00000001003103a4
.text C:\Windows\system32\SearchIndexer.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077b51490 5 bytes JMP 0000000100310b14
.text C:\Windows\system32\SearchIndexer.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077b514f0 5 bytes JMP 0000000100310ecc
.text C:\Windows\system32\SearchIndexer.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000077b515d0 5 bytes JMP 000000010031163c
.text C:\Windows\system32\SearchIndexer.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077b51810 5 bytes JMP 0000000100311284
.text C:\Windows\system32\SearchIndexer.exe[3328] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077b52840 5 bytes JMP 00000001003119f4
.text C:\Windows\system32\SearchIndexer.exe[3328] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000077a3eecd 1 byte [62]
.text C:\Windows\system32\SearchIndexer.exe[3328] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe816e00 5 bytes JMP 000007ff7e831dac
.text C:\Windows\system32\SearchIndexer.exe[3328] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe816f2c 5 bytes JMP 000007ff7e830ecc
.text C:\Windows\system32\SearchIndexer.exe[3328] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe817220 5 bytes JMP 000007ff7e831284
.text C:\Windows\system32\SearchIndexer.exe[3328] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe81739c 5 bytes JMP 000007ff7e83163c
.text C:\Windows\system32\SearchIndexer.exe[3328] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe817538 5 bytes JMP 000007ff7e8319f4
.text C:\Windows\system32\SearchIndexer.exe[3328] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe8175e8 5 bytes JMP 000007ff7e8303a4
.text C:\Windows\system32\SearchIndexer.exe[3328] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe81790c 5 bytes JMP 000007ff7e83075c
.text C:\Windows\system32\SearchIndexer.exe[3328] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe817ab4 5 bytes JMP 000007ff7e830b14
.text C:\Windows\system32\taskhost.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077b23ae0 5 bytes JMP 00000001002d075c
.text C:\Windows\system32\taskhost.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077b27a90 5 bytes JMP 00000001002d03a4
.text C:\Windows\system32\taskhost.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077b51490 5 bytes JMP 00000001002d0b14
.text C:\Windows\system32\taskhost.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077b514f0 5 bytes JMP 00000001002d0ecc
.text C:\Windows\system32\taskhost.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000077b515d0 5 bytes JMP 00000001002d163c
.text C:\Windows\system32\taskhost.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077b51810 5 bytes JMP 00000001002d1284
.text C:\Windows\system32\taskhost.exe[2000] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077b52840 5 bytes JMP 00000001002d19f4
.text C:\Windows\system32\taskhost.exe[2000] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000077a3eecd 1 byte [62]
.text C:\Windows\system32\taskhost.exe[2000] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe816e00 5 bytes JMP 000007ff7e831dac
.text C:\Windows\system32\taskhost.exe[2000] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe816f2c 5 bytes JMP 000007ff7e830ecc
.text C:\Windows\system32\taskhost.exe[2000] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe817220 5 bytes JMP 000007ff7e831284
.text C:\Windows\system32\taskhost.exe[2000] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe81739c 5 bytes JMP 000007ff7e83163c
.text C:\Windows\system32\taskhost.exe[2000] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe817538 5 bytes JMP 000007ff7e8319f4
.text C:\Windows\system32\taskhost.exe[2000] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe8175e8 5 bytes JMP 000007ff7e8303a4
.text C:\Windows\system32\taskhost.exe[2000] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe81790c 5 bytes JMP 000007ff7e83075c
.text C:\Windows\system32\taskhost.exe[2000] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe817ab4 5 bytes JMP 000007ff7e830b14
.text C:\Windows\system32\Dwm.exe[3848] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077b23ae0 5 bytes JMP 000000010035075c
.text C:\Windows\system32\Dwm.exe[3848] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077b27a90 5 bytes JMP 00000001003503a4
.text C:\Windows\system32\Dwm.exe[3848] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077b51490 5 bytes JMP 0000000100350b14
.text C:\Windows\system32\Dwm.exe[3848] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077b514f0 5 bytes JMP 0000000100350ecc
.text C:\Windows\system32\Dwm.exe[3848] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000077b515d0 5 bytes JMP 000000010035163c
.text C:\Windows\system32\Dwm.exe[3848] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077b51810 5 bytes JMP 0000000100351284
.text C:\Windows\system32\Dwm.exe[3848] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077b52840 5 bytes JMP 00000001003519f4
.text C:\Windows\system32\Dwm.exe[3848] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe816e00 5 bytes JMP 000007ff7e831dac
.text C:\Windows\system32\Dwm.exe[3848] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe816f2c 5 bytes JMP 000007ff7e830ecc
.text C:\Windows\system32\Dwm.exe[3848] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe817220 5 bytes JMP 000007ff7e831284
.text C:\Windows\system32\Dwm.exe[3848] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe81739c 5 bytes JMP 000007ff7e83163c
.text C:\Windows\system32\Dwm.exe[3848] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe817538 5 bytes JMP 000007ff7e8319f4
.text C:\Windows\system32\Dwm.exe[3848] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe8175e8 5 bytes JMP 000007ff7e8303a4
.text C:\Windows\system32\Dwm.exe[3848] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe81790c 5 bytes JMP 000007ff7e83075c
.text C:\Windows\system32\Dwm.exe[3848] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe817ab4 5 bytes JMP 000007ff7e830b14
.text C:\Windows\Explorer.EXE[3684] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077b23ae0 5 bytes JMP 000000010011075c
.text C:\Windows\Explorer.EXE[3684] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077b27a90 5 bytes JMP 00000001001103a4
.text C:\Windows\Explorer.EXE[3684] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077b51490 5 bytes JMP 0000000100110b14
.text C:\Windows\Explorer.EXE[3684] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077b514f0 5 bytes JMP 0000000100110ecc
.text C:\Windows\Explorer.EXE[3684] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000077b515d0 5 bytes JMP 000000010011163c
.text C:\Windows\Explorer.EXE[3684] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077b51810 5 bytes JMP 0000000100111284
.text C:\Windows\Explorer.EXE[3684] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077b52840 5 bytes JMP 00000001001119f4
.text C:\Windows\Explorer.EXE[3684] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000077a3eecd 1 byte [62]
.text C:\Windows\Explorer.EXE[3684] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe816e00 5 bytes JMP 000007ff7e831dac
.text C:\Windows\Explorer.EXE[3684] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe816f2c 5 bytes JMP 000007ff7e830ecc
.text C:\Windows\Explorer.EXE[3684] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe817220 5 bytes JMP 000007ff7e831284
.text C:\Windows\Explorer.EXE[3684] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe81739c 5 bytes JMP 000007ff7e83163c
.text C:\Windows\Explorer.EXE[3684] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe817538 5 bytes JMP 000007ff7e8319f4
.text C:\Windows\Explorer.EXE[3684] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe8175e8 5 bytes JMP 000007ff7e8303a4
.text C:\Windows\Explorer.EXE[3684] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe81790c 5 bytes JMP 000007ff7e83075c
.text C:\Windows\Explorer.EXE[3684] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe817ab4 5 bytes JMP 000007ff7e830b14
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[3952] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077cffaa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[3952] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077cffb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[3952] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000077cffc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[3952] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077d00018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[3952] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077d01900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[3952] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 0000000077d1c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[3952] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077d21217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[3952] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 00000000776ea30a 1 byte [62]
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[3952] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007593ee09 5 bytes JMP 00000001001d01f8
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[3952] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075943982 5 bytes JMP 00000001001d03fc
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[3952] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075947603 5 bytes JMP 00000001001d0804
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[3952] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007594835c 5 bytes JMP 00000001001d0600
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[3952] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007595f52b 5 bytes JMP 00000001001d0a08
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[3952] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 00000000764e5181 5 bytes JMP 00000001001e1014
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[3952] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 00000000764e5254 5 bytes JMP 00000001001e0804
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[3952] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000764e53d5 5 bytes JMP 00000001001e0a08
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[3952] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000764e54c2 5 bytes JMP 00000001001e0c0c
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[3952] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000764e55e2 5 bytes JMP 00000001001e0e10
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[3952] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 00000000764e567c 5 bytes JMP 00000001001e01f8
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[3952] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 00000000764e589f 5 bytes JMP 00000001001e03fc
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[3952] C:\Windows\SysWOW64\sechost.dll!DeleteService 00000000764e5a22 5 bytes JMP 00000001001e0600
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077b23ae0 5 bytes JMP 00000001003e075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077b27a90 5 bytes JMP 00000001003e03a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077b51490 5 bytes JMP 00000001003e0b14
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077b514f0 5 bytes JMP 00000001003e0ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000077b515d0 5 bytes JMP 00000001003e163c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077b51810 5 bytes JMP 00000001003e1284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3940] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077b52840 5 bytes JMP 00000001003e19f4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3940] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000077a3eecd 1 byte [62]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3940] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe816e00 5 bytes JMP 000007ff7e831dac
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3940] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe816f2c 5 bytes JMP 000007ff7e830ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3940] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe817220 5 bytes JMP 000007ff7e831284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3940] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe81739c 5 bytes JMP 000007ff7e83163c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3940] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe817538 5 bytes JMP 000007ff7e8319f4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3940] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe8175e8 5 bytes JMP 000007ff7e8303a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3940] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe81790c 5 bytes JMP 000007ff7e83075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3940] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe817ab4 5 bytes JMP 000007ff7e830b14
.text C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe[348] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077cffaa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe[348] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077cffb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe[348] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000077cffc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe[348] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077d00018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe[348] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077d01900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe[348] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 0000000077d1c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe[348] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077d21217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe[348] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 00000000776ea30a 1 byte [62]
.text C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe[348] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007593ee09 5 bytes JMP 00000001002401f8
.text C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe[348] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075943982 5 bytes JMP 00000001002403fc
.text C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe[348] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075947603 5 bytes JMP 0000000100240804
.text C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe[348] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007594835c 5 bytes JMP 0000000100240600
.text C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe[348] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007595f52b 5 bytes JMP 0000000100240a08
.text C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe[348] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 00000000764e5181 5 bytes JMP 0000000100261014
.text C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe[348] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 00000000764e5254 5 bytes JMP 0000000100260804
.text C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe[348] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000764e53d5 5 bytes JMP 0000000100260a08
.text C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe[348] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000764e54c2 5 bytes JMP 0000000100260c0c
.text C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe[348] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000764e55e2 5 bytes JMP 0000000100260e10
.text C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe[348] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 00000000764e567c 5 bytes JMP 00000001002601f8
.text C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe[348] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 00000000764e589f 5 bytes JMP 00000001002603fc
.text C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe[348] C:\Windows\SysWOW64\sechost.dll!DeleteService 00000000764e5a22 5 bytes JMP 0000000100260600
.text C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077cffaa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077cffb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000077cffc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077d00018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe[2856] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077d01900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe[2856] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 0000000077d1c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe[2856] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077d21217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe[2856] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 00000000776ea30a 1 byte [62]
.text C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe[2856] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007593ee09 5 bytes JMP 00000001001601f8
.text C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe[2856] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075943982 5 bytes JMP 00000001001603fc
.text C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe[2856] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075947603 5 bytes JMP 0000000100160804
.text C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe[2856] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007594835c 5 bytes JMP 0000000100160600
.text C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe[2856] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007595f52b 5 bytes JMP 0000000100160a08
.text C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe[2856] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 00000000764e5181 5 bytes JMP 0000000100171014
.text C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe[2856] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 00000000764e5254 5 bytes JMP 0000000100170804
.text C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe[2856] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000764e53d5 5 bytes JMP 0000000100170a08
.text C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe[2856] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000764e54c2 5 bytes JMP 0000000100170c0c
.text C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe[2856] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000764e55e2 5 bytes JMP 0000000100170e10
.text C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe[2856] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 00000000764e567c 5 bytes JMP 00000001001701f8
.text C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe[2856] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 00000000764e589f 5 bytes JMP 00000001001703fc
.text C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe[2856] C:\Windows\SysWOW64\sechost.dll!DeleteService 00000000764e5a22 5 bytes JMP 0000000100170600
.text C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[1876] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077cffaa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[1876] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077cffb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[1876] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000077cffc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[1876] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077d00018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[1876] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077d01900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[1876] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 0000000077d1c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[1876] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077d21217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[1876] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 00000000776ea30a 1 byte [62]
.text C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[1876] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 00000000764e5181 5 bytes JMP 00000001001d1014
.text C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[1876] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 00000000764e5254 5 bytes JMP 00000001001d0804
.text C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[1876] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000764e53d5 5 bytes JMP 00000001001d0a08
.text C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[1876] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000764e54c2 5 bytes JMP 00000001001d0c0c
.text C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[1876] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000764e55e2 5 bytes JMP 00000001001d0e10
.text C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[1876] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 00000000764e567c 5 bytes JMP 00000001001d01f8
.text C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[1876] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 00000000764e589f 5 bytes JMP 00000001001d03fc
.text C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[1876] C:\Windows\SysWOW64\sechost.dll!DeleteService 00000000764e5a22 5 bytes JMP 00000001001d0600
.text C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[1876] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007593ee09 5 bytes JMP 00000001001e01f8
.text C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[1876] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075943982 5 bytes JMP 00000001001e03fc
.text C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[1876] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075947603 5 bytes JMP 00000001001e0804
.text C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[1876] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007594835c 5 bytes JMP 00000001001e0600
.text C:\Program Files (x86)\avmwlanstick\WLanGUI.exe[1876] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007595f52b 5 bytes JMP 00000001001e0a08
.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[2760] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000776ea30a 1 byte [62]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077cffaa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077cffb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000077cffc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077d00018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077d01900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 0000000077d1c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077d21217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 00000000776ea30a 1 byte [62]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 00000000764e5181 5 bytes JMP 00000001001e1014
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 00000000764e5254 5 bytes JMP 00000001001e0804
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000764e53d5 5 bytes JMP 00000001001e0a08
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000764e54c2 5 bytes JMP 00000001001e0c0c
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000764e55e2 5 bytes JMP 00000001001e0e10
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 00000000764e567c 5 bytes JMP 00000001001e01f8
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 00000000764e589f 5 bytes JMP 00000001001e03fc
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\SysWOW64\sechost.dll!DeleteService 00000000764e5a22 5 bytes JMP 00000001001e0600
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007593ee09 3 bytes JMP 00000001001f01f8
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\syswow64\USER32.dll!SetWinEventHook + 4 000000007593ee0d 1 byte [8A]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075943982 5 bytes JMP 00000001001f03fc
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075947603 5 bytes JMP 00000001001f0804
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007594835c 5 bytes JMP 00000001001f0600
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2216] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007595f52b 5 bytes JMP 00000001001f0a08
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2696] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077b23ae0 5 bytes JMP 000000010031075c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2696] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077b27a90 5 bytes JMP 00000001003103a4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2696] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077b51490 5 bytes JMP 0000000100310b14
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2696] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077b514f0 5 bytes JMP 0000000100310ecc
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2696] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000077b515d0 5 bytes JMP 000000010031163c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2696] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077b51810 5 bytes JMP 0000000100311284
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2696] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077b52840 5 bytes JMP 00000001003119f4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[1536] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077b23ae0 5 bytes JMP 000000010039075c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[1536] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077b27a90 5 bytes JMP 00000001003903a4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[1536] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077b51490 5 bytes JMP 0000000100390b14
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[1536] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077b514f0 5 bytes JMP 0000000100390ecc
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[1536] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000077b515d0 5 bytes JMP 000000010039163c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[1536] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077b51810 5 bytes JMP 0000000100391284
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[1536] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077b52840 5 bytes JMP 00000001003919f4
.text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077b23ae0 5 bytes JMP 000000010011075c
.text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077b27a90 5 bytes JMP 00000001001103a4
.text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077b51490 5 bytes JMP 0000000100110b14
.text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077b514f0 5 bytes JMP 0000000100110ecc
.text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000077b515d0 5 bytes JMP 000000010011163c
.text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077b51810 5 bytes JMP 0000000100111284
.text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[4868] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077b52840 5 bytes JMP 00000001001119f4
.text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[4868] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000077a3eecd 1 byte [62]
.text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[4868] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe816e00 5 bytes JMP 000007ff7e831dac
.text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[4868] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe816f2c 5 bytes JMP 000007ff7e830ecc
.text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[4868] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe817220 5 bytes JMP 000007ff7e831284
.text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[4868] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe81739c 5 bytes JMP 000007ff7e83163c
.text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[4868] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe817538 5 bytes JMP 000007ff7e8319f4
.text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[4868] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe8175e8 5 bytes JMP 000007ff7e8303a4
.text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[4868] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe81790c 5 bytes JMP 000007ff7e83075c
.text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[4868] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe817ab4 5 bytes JMP 000007ff7e830b14
.text C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe816e00 5 bytes JMP 000007ff7e831dac
.text C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe816f2c 5 bytes JMP 000007ff7e830ecc
.text C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe817220 5 bytes JMP 000007ff7e831284
.text C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe81739c 5 bytes JMP 000007ff7e83163c
.text C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe817538 5 bytes JMP 000007ff7e8319f4
.text C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe8175e8 5 bytes JMP 000007ff7e8303a4
.text C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe81790c 5 bytes JMP 000007ff7e83075c
.text C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe817ab4 5 bytes JMP 000007ff7e830b14
.text C:\Users\Marucs\Desktop\gmer_2.1.19163.exe[3960] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000776ea30a 1 byte [62]
---- Devices - GMER 2.1 ----
Device \Driver\ae9l8huw \Device\Scsi\ae9l8huw1 fffffa80073002c0
Device \FileSystem\Ntfs \Ntfs fffffa80062362c0
Device \Driver\usbehci \Device\USBFDO-7 fffffa8007ba72c0
Device \Driver\usbuhci \Device\USBPDO-5 fffffa80079c32c0
Device \Driver\usbehci \Device\USBFDO-3 fffffa8007ba72c0
Device \Driver\usbuhci \Device\USBPDO-1 fffffa80079c32c0
Device \Driver\USBSTOR \Device\000000ae fffffa8007d652c0
Device \Driver\USBSTOR \Device\000000b0 fffffa8007d652c0
Device \Driver\usbuhci \Device\USBPDO-6 fffffa80079c32c0
Device \Driver\usbuhci \Device\USBFDO-4 fffffa80079c32c0
Device \Driver\usbuhci \Device\USBFDO-0 fffffa80079c32c0
Device \Driver\usbuhci \Device\USBPDO-2 fffffa80079c32c0
Device \Driver\USBSTOR \Device\000000af fffffa8007d652c0
Device \Driver\NetBT \Device\NetBT_Tcpip_{05C2EE7A-AD2C-45F2-AECB-866D401A5243} fffffa8007a092c0
Device \Driver\USBSTOR \Device\000000b1 fffffa8007d652c0
Device \Driver\usbehci \Device\USBPDO-7 fffffa8007ba72c0
Device \Driver\usbuhci \Device\USBFDO-5 fffffa80079c32c0
Device \Driver\usbehci \Device\USBPDO-3 fffffa8007ba72c0
Device \Driver\usbuhci \Device\USBFDO-1 fffffa80079c32c0
Device \Driver\volmgr \Device\HarddiskVolume1 fffffa80054dd2c0
Device \Driver\volmgr \Device\FtControl fffffa80054dd2c0
Device \Driver\volmgr \Device\VolMgrControl fffffa80054dd2c0
Device \Driver\volmgr \Device\HarddiskVolume2 fffffa80054dd2c0
Device \Driver\volmgr \Device\HarddiskVolume3 fffffa80054dd2c0
Device \Driver\volmgr \Device\HarddiskVolume4 fffffa80054dd2c0
Device \Driver\volmgr \Device\HarddiskVolume5 fffffa80054dd2c0
Device \Driver\volmgr \Device\HarddiskVolume6 fffffa80054dd2c0
Device \Driver\USBSTOR \Device\000000b2 fffffa8007d652c0
Device \Driver\volmgr \Device\HarddiskVolume7 fffffa80054dd2c0
Device \Driver\NetBT \Device\NetBt_Wins_Export fffffa8007a092c0
Device \Driver\volmgr \Device\HarddiskVolume8 fffffa80054dd2c0
Device \Driver\usbuhci \Device\USBFDO-6 fffffa80079c32c0
Device \Driver\volmgr \Device\HarddiskVolume9 fffffa80054dd2c0
Device \Driver\usbuhci \Device\USBPDO-4 fffffa80079c32c0
Device \Driver\usbuhci \Device\USBFDO-2 fffffa80079c32c0
Device \Driver\usbuhci \Device\USBPDO-0 fffffa80079c32c0
Device \Driver\ae9l8huw \Device\ScsiPort1 fffffa80073002c0
Device \Driver\USBSTOR \Device\000000ad fffffa8007d652c0
---- Modules - GMER 2.1 ----
Module \SystemRoot\System32\Drivers\ae9l8huw.SYS fffff88005200000-fffff88005245000 (282624 bytes)
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [4084:3352] 000007fef6f89688
Thread C:\Windows\system32\SearchIndexer.exe [3328:3320] 000007fef7275170
Thread C:\Windows\system32\SearchIndexer.exe [3328:1980] 000007fef68369ac
Thread C:\Windows\system32\SearchIndexer.exe [3328:3380] 000007fef6b33dac
Thread C:\Windows\system32\SearchIndexer.exe [3328:3376] 000007fef6b31700
Thread C:\Windows\system32\SearchIndexer.exe [3328:3396] 000007fef6b5b248
Thread C:\Windows\system32\SearchIndexer.exe [3328:3392] 000007fef6b5c4ac
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Tag 3
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswKbd@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswKbd@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswKbd@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswKbd@DisplayName aswKbd
Reg HKLM\SYSTEM\CurrentControlSet\services\aswKbd@Group Keyboard Port
Reg HKLM\SYSTEM\CurrentControlSet\services\aswKbd@Description avast! keyboard filter driver (aswKbd)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswKbd@Tag 7
Reg HKLM\SYSTEM\CurrentControlSet\services\aswKbd
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@MSIgnoreLSPDefault
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@DisplayName aswRvrt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Description avast! Revert
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@BootCounter 3
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@TickCounter 47187
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition3\Windows
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Tag 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@BehavShield 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@GadgetFolder \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DisplayName avast! Network Shield Support
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Description avast! Network Shield TDI driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Tag 9
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@DisplayName aswVmm
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Type 32
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Description Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xEE 0x9F 0xED 0x88 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xBC 0x7A 0x08 0xE4 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xE0 0x39 0xEB 0x2D ...
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Tag 3
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswKbd@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswKbd@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswKbd@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswKbd@DisplayName aswKbd
Reg HKLM\SYSTEM\ControlSet002\services\aswKbd@Group Keyboard Port
Reg HKLM\SYSTEM\ControlSet002\services\aswKbd@Description avast! keyboard filter driver (aswKbd)
Reg HKLM\SYSTEM\ControlSet002\services\aswKbd@Tag 7
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@MSIgnoreLSPDefault
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@DisplayName aswRvrt
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Description avast! Revert
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@BootCounter 3
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@TickCounter 47187
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition3\Windows
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Tag 2
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@BehavShield 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@GadgetFolder \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DisplayName avast! Network Shield Support
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Description avast! Network Shield TDI driver
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Tag 9
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@DisplayName aswVmm
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Type 32
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Description Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xEE 0x9F 0xED 0x88 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xBC 0x7A 0x08 0xE4 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xE0 0x39 0xEB 0x2D ...
---- EOF - GMER 2.1 ----
|
|
30.07.2013, 15:04
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Pop up u. Skip Trojaner? JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Im Anschluss: adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Danach eine Kontrolle mit Farbars Tool bitte: Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten |
|
30.07.2013, 15:46
| #9 |
| | Pop up u. Skip Trojaner? hey Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.2.8 (07.29.2013:2)
OS: Windows 7 Home Premium x64
Ran by Marucs on 30.07.2013 at 16:31:39,72
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-2654453199-4005105099-35965596-1000\Software\Microsoft\Internet Explorer\Main\\Start Page
~~~ Registry Keys
Successfully deleted: [Registry Key] "HKEY_CURRENT_USER\Software\Microsoft\internet explorer\internetregistry\registry\user\S-1-5-21-2654453199-4005105099-35965596-1000\software\web assistant"
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\appid\tdataprotocol.dll
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\appid\updatebho.dll
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\appid\wit4ie.dll
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\appid\{c26644c4-2a12-4ca6-8f2e-0ede6cf018f3}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\appid\{ea28b360-05e0-4f93-8150-02891f1d8d3c}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\1clickdownload
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\babylon
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\babylontoolbar
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\babylontoolbar
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\bi
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\blabbers
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\browsercompanion
Failed to delete: [Registry Key] HKEY_CURRENT_USER\Software\datamngr
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\datamngr
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\delta ltd
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\im
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\iminent
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\iminstaller
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\softonic
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\web assistant
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\yahoopartnertoolbar
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\windows\currentversion\ext\settings\{98889811-442d-49dd-99d7-dc866be87dbc}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\movie2kdownloader
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\prod.cap
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\apnstub_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\apnstub_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\iminent_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\iminent_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\incredibartoolbar_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\incredibartoolbar_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\mybabylontb_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\mybabylontb_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\new_correct_incredibar_install_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\new_correct_incredibar_install_rasmancs
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\datamngr
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{4327FABE-3C22-4689-8DBF-D226CF777FE9}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\babylon"
Successfully deleted: [Folder] "C:\ProgramData\partner"
Successfully deleted: [Folder] "C:\Users\Marucs\AppData\Roaming\babylon"
Successfully deleted: [Folder] "C:\Users\Marucs\AppData\Roaming\browsercompanion"
Successfully deleted: [Folder] "C:\Users\Marucs\appdata\locallow\delta"
Successfully deleted: [Folder] "C:\Users\Marucs\appdata\locallow\incredibar.com"
Successfully deleted: [Folder] "C:\Program Files (x86)\lyricsmonkey"
~~~ FireFox
Successfully deleted: [File] C:\user.js
Failed to delete: [File] "C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml"
Successfully deleted: [File] "C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml"
Successfully deleted: [File] C:\Users\Marucs\AppData\Roaming\mozilla\firefox\profiles\vldk26wf.default\user.js
Successfully deleted: [File] C:\Users\Marucs\AppData\Roaming\mozilla\firefox\profiles\vldk26wf.default\searchplugins\delta.xml
Successfully deleted: [File] C:\Users\Marucs\AppData\Roaming\mozilla\firefox\profiles\vldk26wf.default\searchplugins\mystart search.xml
Successfully deleted: [File] C:\Users\Marucs\AppData\Roaming\mozilla\firefox\profiles\vldk26wf.default\searchplugins\plusnetwork.xml
Successfully deleted: [Folder] C:\Users\Marucs\AppData\Roaming\mozilla\firefox\profiles\vldk26wf.default\jetpack
Successfully deleted: [Folder] C:\Users\Marucs\AppData\Roaming\mozilla\firefox\profiles\vldk26wf.default\extensions\bbrs_002@blabbers.com
Successfully deleted: [Folder] C:\Users\Marucs\AppData\Roaming\mozilla\firefox\profiles\vldk26wf.default\extensions\ffxtlbr@incredibar.com
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions\\{336d0c35-8a85-403a-b9d2-65c292c39087}
Successfully deleted the following from C:\Users\Marucs\AppData\Roaming\mozilla\firefox\profiles\vldk26wf.default\prefs.js
user_pref("avg.install.userHPSettings", "hxxp://www.delta-search.com/?affID=119816&tt=190313_wo2&babsrc=HP_ss&mntrId=E6ED0025115A6362");
user_pref("avg.install.userSPSettings", "Delta Search");
user_pref("extensions.BabylonToolbar_i.newTab", true);
user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://www.delta-search.com/?affID=119776&babsrc=NT_ss&mntrId=e6eda7f70000000000000025115a6362");
user_pref("extensions.delta.admin", false);
user_pref("extensions.delta.aflt", "babsst");
user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
user_pref("extensions.delta.autoRvrt", "false");
user_pref("extensions.delta.bbDpng", "3");
user_pref("extensions.delta.cntry", "DE");
user_pref("extensions.delta.dfltLng", "en");
user_pref("extensions.delta.excTlbr", false);
user_pref("extensions.delta.hdrMd5", "43962FC83CBB368F231225DE45D24B41");
user_pref("extensions.delta.id", "e6eda7f70000000000000025115a6362");
user_pref("extensions.delta.instlDay", "15797");
user_pref("extensions.delta.instlRef", "sst");
user_pref("extensions.delta.lastVrsnTs", "1.8.10.022:06:28");
user_pref("extensions.delta.newTab", false);
user_pref("extensions.delta.prdct", "delta");
user_pref("extensions.delta.prtnrId", "delta");
user_pref("extensions.delta.rvrt", "false");
user_pref("extensions.delta.sg", "azb");
user_pref("extensions.delta.smplGrp", "azb");
user_pref("extensions.delta.tlbrId", "base");
user_pref("extensions.delta.tlbrSrchUrl", "");
user_pref("extensions.delta.vrsn", "1.8.10.0");
user_pref("extensions.delta.vrsnTs", "1.8.10.022:06:28");
user_pref("extensions.delta.vrsni", "1.8.10.0");
user_pref("extensions.incredibar_i.aflt", "orgnl");
user_pref("extensions.incredibar_i.dfltLng", "");
user_pref("extensions.incredibar_i.did", "10665");
user_pref("extensions.incredibar_i.excTlbr", false);
user_pref("extensions.incredibar_i.id", "e6eda7f7000000000000bc054300795c");
user_pref("extensions.incredibar_i.installerproductid", "26");
user_pref("extensions.incredibar_i.instlDay", "15506");
user_pref("extensions.incredibar_i.instlRef", "");
user_pref("extensions.incredibar_i.ms_url_id", "");
user_pref("extensions.incredibar_i.newTab", false);
user_pref("extensions.incredibar_i.ppd", "");
user_pref("extensions.incredibar_i.prdct", "incredibar");
user_pref("extensions.incredibar_i.productid", "26");
user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
user_pref("extensions.incredibar_i.smplGrp", "none");
user_pref("extensions.incredibar_i.tlbrId", "base");
user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8w77jo2H&loc=IB_TB&i=26&search=");
user_pref("extensions.incredibar_i.upn2", "6R8w77jo2H");
user_pref("extensions.incredibar_i.upn2n", "92824541918953983");
user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.140:31:11");
user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
user_pref("iminent.webbooster.scripts.minibar.ROOTEXTENSION", "chrome://iminentwebbooster/content/minibar");
user_pref("iminent.webbooster.scripts.minibar.Services.BHPCode", "01");
user_pref("iminent.webbooster.scripts.minibar.Services.DefaultEvent", "000");
user_pref("iminent.webbooster.scripts.minibar.Services.DefaultWebSite", "000");
user_pref("iminent.webbooster.scripts.minibar.Services.IminentClientCode", "11");
user_pref("iminent.webbooster.scripts.minibar.Services.SmartFavCode", "02");
user_pref("iminent.webbooster.scripts.minibar.ShowThankyouPixel", "0");
user_pref("iminent.webbooster.scripts.minibar.displayFavLinks", "1");
user_pref("iminent.webbooster.scripts.sslminibar.ROOTEXTENSION", "chrome://iminentwebbooster/content/minibar");
user_pref("iminent.webbooster.scripts.sslminibar.Services.BHPCode", "01");
user_pref("iminent.webbooster.scripts.sslminibar.Services.DefaultEvent", "000");
user_pref("iminent.webbooster.scripts.sslminibar.Services.DefaultWebSite", "000");
user_pref("iminent.webbooster.scripts.sslminibar.Services.IminentClientCode", "11");
user_pref("iminent.webbooster.scripts.sslminibar.Services.SmartFavCode", "02");
user_pref("iminent.webbooster.scripts.sslminibar.ShowThankyouPixel", "0");
user_pref("iminent.webbooster.scripts.sslminibar.displayFavLinks", "1");
user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent109", "1365707678441");
user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent111", "1365707678447");
user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent122", "1365707678453");
user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_referrer", "hxxp://us.yhs4.search.yahoo.com/yhs/search?fr=altavista&itag=ody&q=hxxp://vergessen.rn/|||86413474
user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_temp_referer", "hxxp://us.yhs4.search.yahoo.com/yhs/search?fr=altavista&itag=ody&q=hxxp://us.yhs4.search.yahoo
user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\":\"q\",\"search.sweetim.com\":\"q\",\"search.imesh.net\":\"q\",\"www.searc
user_pref("{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}.ScriptData_WSG_blackList", "form=CONTLB|babsrc=toolbar|babsrc=tb_ss|invocationType=tb50-ie-aolsoftonic-tbsbox-en-us|invocatio
user_pref("{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}.ScriptData_WSG_referrer", "hxxp://www.delta-search.com/?affID=119816&tt=190313_wo2&babsrc=HP_ss&mntrId=E6ED0025115A6362/|||86
user_pref("{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}.ScriptData_WSG_temp_referer", "hxxp://us.yhs4.search.yahoo.com/yhs/search?fr=altavista&itag=ody&q=hxxp://www.fritz.box/");
user_pref("{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}.ScriptData_WSG_whiteList", "{\"search.babylon.com\":\"q\",\"search.imesh.net\":\"q\",\"www.search-results.com\":\"q\",\"home.
Emptied folder: C:\Users\Marucs\AppData\Roaming\mozilla\firefox\profiles\vldk26wf.default\minidumps [179 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 30.07.2013 at 16:37:30,87
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter # AdwCleaner v2.306 - Datei am 30/07/2013 um 16:41:31 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Marucs - MARUCS-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Marucs\Desktop\adwcleaner(1).exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gelöscht : C:\Users\Marucs\AppData\Roaming\Mozilla\Firefox\Profiles\vldk26wf.default\extensions\gophoto@gophoto.it.xpi
Datei Gelöscht : C:\Users\Marucs\Desktop\HDVidCodec.lnk
Ordner Gelöscht : C:\Program Files (x86)\Gophoto.it
Ordner Gelöscht : C:\Program Files (x86)\HDvidCodec.com
Ordner Gelöscht : C:\Program Files (x86)\XingHaoLyrics
Ordner Gelöscht : C:\Users\Marucs\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Marucs\AppData\Local\PutLockerDownloader
Ordner Gelöscht : C:\Users\Marucs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HDvidCodec.com
Ordner Gelöscht : C:\Users\Marucs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Movie2KDownloader.com
Ordner Gelöscht : C:\Users\Marucs\AppData\Roaming\Mozilla\Firefox\Profiles\vldk26wf.default\jetpack
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\bLyrics
Schlüssel Gelöscht : HKCU\Software\DataMngr
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403A-B9D2-65C292C39087}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A3DAEB01-4C15-4AC6-A689-6406FD954EE0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403A-B9D2-65C292C39087}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A3DAEB01-4C15-4AC6-A689-6406FD954EE0}
Schlüssel Gelöscht : HKCU\Software\e08b8de53bba46
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{20EDC024-43C5-423E-B7F5-FD93523E0D9F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{373ED12D-B306-43AC-9485-A7C5133DC34C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{ED6535E7-F778-48A5-A060-549D30024511}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\bodddioamolcibagionmmobehnbhiakf
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pfmopbbadnfoelckkcmjjeaaegjpjjbk
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schlüssel Gelöscht : HKLM\SOFTWARE\Web Assistant
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}]
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16635
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v22.0 (de)
Datei : C:\Users\Marucs\AppData\Roaming\Mozilla\Firefox\Profiles\vldk26wf.default\prefs.js
Gelöscht : user_pref("{336D0C35-8A85-403a-B9D2-65C292C39087}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...]
Gelöscht : user_pref("{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...]
*************************
AdwCleaner[R1].txt - [23129 octets] - [27/07/2013 08:00:34]
AdwCleaner[S1].txt - [12818 octets] - [30/07/2013 16:41:31]
########## EOF - C:\AdwCleaner[S1].txt - [12879 octets] ##########
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-07-2013 03
Ran by Marucs (administrator) on 30-07-2013 16:48:16
Running from C:\Users\Marucs\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Farbar) C:\Users\Marucs\Downloads\FRST64(1).exe
(Microsoft Corporation) \\?\C:\Windows\system32\wbem\WMIADAP.EXE
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7981088 2009-07-20] (Realtek Semiconductor)
HKLM\...\InprocServer32: [Default-cscui] <==== ATTENTION!
HKLM-x32\...\Run: [Hotkey Utility] - C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [629280 2009-08-18] ()
HKLM-x32\...\Run: [EgisTecLiveUpdate] - C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)
HKLM-x32\...\Run: [AVMWlanClient] - C:\Program Files (x86)\avmwlanstick\wlangui.exe [1904640 2009-03-20] (AVM Berlin)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [641704 2012-05-22] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AMD AVT] - C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [20992 2012-03-19] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162336 2009-07-22] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162336 2009-07-22] ()
HKU\postgres\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162336 2009-07-22] ()
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
BHO: avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler-x32: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files (x86)\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Marucs\AppData\Roaming\Mozilla\Firefox\Profiles\vldk26wf.default
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.2 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.2\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Extension: Deutsches Wörterbuch (Schweiz) - C:\Users\Marucs\AppData\Roaming\Mozilla\Firefox\Profiles\vldk26wf.default\Extensions\de-CH@dictionaries.addons.mozilla.org
FF Extension: No Name - C:\Users\Marucs\AppData\Roaming\Mozilla\Firefox\Profiles\vldk26wf.default\Extensions\{b8cbd8e0-e642-11dd-ba2f-0800200c9a66}
FF Extension: DownloadHelper - C:\Users\Marucs\AppData\Roaming\Mozilla\Firefox\Profiles\vldk26wf.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: elemhidehelper - C:\Users\Marucs\AppData\Roaming\Mozilla\Firefox\Profiles\vldk26wf.default\Extensions\elemhidehelper@adblockplus.org.xpi
FF Extension: m2k - C:\Users\Marucs\AppData\Roaming\Mozilla\Firefox\Profiles\vldk26wf.default\Extensions\m2k@m2kdownloader.com.xpi
FF Extension: sound - C:\Users\Marucs\AppData\Roaming\Mozilla\Firefox\Profiles\vldk26wf.default\Extensions\sound@cloud.com.xpi
FF Extension: youtubeunblocker - C:\Users\Marucs\AppData\Roaming\Mozilla\Firefox\Profiles\vldk26wf.default\Extensions\youtubeunblocker@unblocker.yt.xpi
FF Extension: youtube_downloader - C:\Users\Marucs\AppData\Roaming\Mozilla\Firefox\Profiles\vldk26wf.default\Extensions\youtube_downloader@anishsane.googlepages.com.xpi
FF Extension: No Name - C:\Users\Marucs\AppData\Roaming\Mozilla\Firefox\Profiles\vldk26wf.default\Extensions\{988da70d-b78d-44a1-a9c7-ed11832a9e2e}.xpi
FF Extension: No Name - C:\Users\Marucs\AppData\Roaming\Mozilla\Firefox\Profiles\vldk26wf.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
FF Extension: No Name - C:\Users\Marucs\AppData\Roaming\Mozilla\Firefox\Profiles\vldk26wf.default\Extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi
FF Extension: No Name - C:\Users\Marucs\AppData\Roaming\Mozilla\Firefox\Profiles\vldk26wf.default\Extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi
FF Extension: No Name - C:\Users\Marucs\AppData\Roaming\Mozilla\Firefox\Profiles\vldk26wf.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\Marucs\AppData\Roaming\Mozilla\Firefox\Profiles\vldk26wf.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi
FF Extension: G Data WebFilter - C:\Program Files (x86)\Mozilla Firefox\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] C:\Program Files\Web Assistant\Firefox
FF HKLM\...\Firefox\Extensions: [{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}] C:\Program Files\Web Assistant\Firefox
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
==================== Services (Whitelisted) =================
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [368640 2009-03-20] (AVM Berlin)
R2 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [311592 2009-08-06] (Egis Technology Inc.)
S3 npggsvc; C:\Windows\SysWow64\GameMon.des [3969336 2012-04-05] (INCA Internet Co., Ltd.)
R2 pgsql-8.3; C:\Program Files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe [65536 2008-02-01] (PostgreSQL Global Development Group)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2013-05-16] ()
==================== Drivers (Whitelisted) ====================
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [21136 2012-10-31] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-07-29] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-07-29] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-07-29] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2009-12-19] ()
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2009-03-20] (AVM Berlin)
R3 cbfs3; C:\Windows\System32\DRIVERS\cbfs3.sys [352144 2012-04-09] (EldoS Corporation)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [460800 2009-03-20] (AVM GmbH)
S3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [552704 2009-03-20] (AVM GmbH)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2009-12-19] ()
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2009-12-24] ()
U3 a1pb17n3; C:\Windows\System32\Drivers\a1pb17n3.sys [0 ] (Microsoft Corporation)
S3 Afc; system32\drivers\Afc.sys [x]
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 GearAspiWDM; System32\drivers\GEARAspiWDM.sys [x]
S4 NVHDA; system32\drivers\nvhda64v.sys [x]
S4 nvlddmkm; system32\DRIVERS\nvlddmkm.sys [x]
S3 X6va005; \??\C:\Users\Marucs\AppData\Local\Temp\005E016.tmp [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-30 16:45 - 2013-07-30 16:45 - 00012857 _____ C:\Users\Marucs\Desktop\AdwCleaner[S1].txt
2013-07-30 16:41 - 2013-07-30 16:41 - 00012857 _____ C:\AdwCleaner[S1].txt
2013-07-30 16:39 - 2013-07-30 16:40 - 00666633 _____ C:\Users\Marucs\Desktop\adwcleaner(1).exe
2013-07-30 16:37 - 2013-07-30 16:37 - 00013098 _____ C:\Users\Marucs\Desktop\JRT.txt
2013-07-30 16:31 - 2013-07-30 16:31 - 00000000 ____D C:\Windows\ERUNT
2013-07-30 16:29 - 2013-07-30 16:29 - 00562042 _____ (Oleg N. Scherbakov) C:\Users\Marucs\Desktop\JRT.exe
2013-07-30 07:51 - 2013-07-30 07:51 - 00456016 _____ C:\Windows\Minidump\073013-18673-01.dmp
2013-07-30 07:50 - 2013-07-30 07:50 - 675589967 _____ C:\Windows\MEMORY.DMP
2013-07-30 07:16 - 2013-07-30 07:27 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-07-30 07:14 - 2013-07-30 07:14 - 00000000 ____D C:\Users\Marucs\Desktop\mbar-1.06.0.1004
2013-07-30 07:12 - 2013-07-30 07:12 - 13399154 _____ C:\Users\Marucs\Desktop\mbar-1.06.0.1004.zip
2013-07-30 07:08 - 2013-07-30 07:08 - 00111387 _____ C:\Users\Marucs\Desktop\GMER.txt
2013-07-30 06:57 - 2013-07-30 06:57 - 00377856 _____ C:\Users\Marucs\Desktop\gmer_2.1.19163.exe
2013-07-29 14:53 - 2013-07-29 14:53 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-07-29 14:53 - 2013-07-29 14:53 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-07-29 14:53 - 2013-07-29 14:53 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-07-28 14:38 - 2013-07-28 14:38 - 00072254 _____ C:\Users\Marucs\Desktop\OTL.Txt
2013-07-28 14:32 - 2013-07-28 14:32 - 00027019 _____ C:\Users\Marucs\Desktop\FRST.txt
2013-07-28 14:31 - 2013-07-28 14:31 - 00031917 _____ C:\Users\Marucs\Desktop\Addition.txt
2013-07-28 14:21 - 2013-07-28 14:21 - 00031917 _____ C:\Users\Marucs\Downloads\Addition.txt
2013-07-28 14:20 - 2013-07-28 14:20 - 00000000 ____D C:\FRST
2013-07-28 14:19 - 2013-07-28 14:19 - 01780547 _____ (Farbar) C:\Users\Marucs\Downloads\FRST64.exe
2013-07-28 13:58 - 2013-07-29 14:53 - 00189936 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-07-28 13:58 - 2013-05-09 10:59 - 00065336 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-07-28 13:35 - 2013-07-30 16:44 - 00000504 _____ C:\Windows\setupact.log
2013-07-28 13:35 - 2013-07-28 13:51 - 00003630 _____ C:\Windows\PFRO.log
2013-07-28 13:35 - 2013-07-28 13:35 - 00000000 _____ C:\Windows\setuperr.log
2013-07-28 12:28 - 2013-07-28 12:28 - 00000000 ____D C:\Windows\pss
2013-07-27 08:00 - 2013-07-27 08:00 - 00666633 _____ C:\Users\Marucs\Downloads\adwcleaner.exe
2013-07-27 08:00 - 2013-07-27 08:00 - 00023129 _____ C:\AdwCleaner[R1].txt
2013-07-27 00:16 - 2013-07-27 00:16 - 02347384 _____ (ESET) C:\Users\Marucs\Downloads\esetsmartinstaller_enu.exe
2013-07-11 03:07 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-11 03:07 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-11 03:07 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-11 03:07 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-11 03:07 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-11 03:07 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-11 03:07 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-11 03:07 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-11 03:07 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-11 03:07 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-11 03:07 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-11 03:07 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-11 03:07 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-11 03:07 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-11 03:07 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 03:06 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-11 03:06 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-11 03:06 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-11 03:06 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-11 03:06 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-11 03:06 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-11 03:06 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-11 03:06 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-11 03:06 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-11 03:06 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-11 03:06 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-11 03:06 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-11 03:06 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-11 03:06 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-11 03:06 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-11 03:06 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-10 22:09 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 22:09 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 22:09 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 22:09 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 22:08 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 22:08 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 22:08 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
106
==================== One Month Modified Files and Folders =======
2013-07-30 16:47 - 2013-07-30 16:47 - 01781589 _____ (Farbar) C:\Users\Marucs\Downloads\FRST64(1).exe
2013-07-30 16:45 - 2013-07-30 16:45 - 00012857 _____ C:\Users\Marucs\Desktop\AdwCleaner[S1].txt
2013-07-30 16:44 - 2013-07-28 13:35 - 00000504 _____ C:\Windows\setupact.log
2013-07-30 16:44 - 2013-02-10 18:10 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-07-30 16:44 - 2011-01-30 18:57 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-30 16:44 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-30 16:42 - 2013-02-10 18:00 - 01267166 _____ C:\Windows\WindowsUpdate.log
2013-07-30 16:41 - 2013-07-30 16:41 - 00012857 _____ C:\AdwCleaner[S1].txt
2013-07-30 16:40 - 2013-07-30 16:39 - 00666633 _____ C:\Users\Marucs\Desktop\adwcleaner(1).exe
2013-07-30 16:37 - 2013-07-30 16:37 - 00013098 _____ C:\Users\Marucs\Desktop\JRT.txt
2013-07-30 16:31 - 2013-07-30 16:31 - 00000000 ____D C:\Windows\ERUNT
2013-07-30 16:29 - 2013-07-30 16:29 - 00562042 _____ (Oleg N. Scherbakov) C:\Users\Marucs\Desktop\JRT.exe
2013-07-30 16:17 - 2011-01-30 18:57 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-30 16:07 - 2012-05-11 16:57 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-30 07:59 - 2009-07-14 06:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-30 07:59 - 2009-07-14 06:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-30 07:56 - 2009-09-09 00:47 - 00696832 _____ C:\Windows\system32\perfh007.dat
2013-07-30 07:56 - 2009-09-09 00:47 - 00148128 _____ C:\Windows\system32\perfc007.dat
2013-07-30 07:56 - 2009-07-14 07:13 - 01613340 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-30 07:51 - 2013-07-30 07:51 - 00456016 _____ C:\Windows\Minidump\073013-18673-01.dmp
2013-07-30 07:51 - 2010-09-29 20:38 - 00000000 ____D C:\Windows\Minidump
2013-07-30 07:50 - 2013-07-30 07:50 - 675589967 _____ C:\Windows\MEMORY.DMP
2013-07-30 07:27 - 2013-07-30 07:16 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-07-30 07:14 - 2013-07-30 07:14 - 00000000 ____D C:\Users\Marucs\Desktop\mbar-1.06.0.1004
2013-07-30 07:12 - 2013-07-30 07:12 - 13399154 _____ C:\Users\Marucs\Desktop\mbar-1.06.0.1004.zip
2013-07-30 07:08 - 2013-07-30 07:08 - 00111387 _____ C:\Users\Marucs\Desktop\GMER.txt
2013-07-30 06:57 - 2013-07-30 06:57 - 00377856 _____ C:\Users\Marucs\Desktop\gmer_2.1.19163.exe
2013-07-29 14:53 - 2013-07-29 14:53 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-07-29 14:53 - 2013-07-29 14:53 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-07-29 14:53 - 2013-07-29 14:53 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-07-29 14:53 - 2013-07-28 13:58 - 00189936 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-07-29 14:53 - 2012-05-14 22:01 - 01030952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-07-29 14:53 - 2012-05-14 22:01 - 00378944 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-07-28 14:38 - 2013-07-28 14:38 - 00072254 _____ C:\Users\Marucs\Desktop\OTL.Txt
2013-07-28 14:32 - 2013-07-28 14:32 - 00027019 _____ C:\Users\Marucs\Desktop\FRST.txt
2013-07-28 14:31 - 2013-07-28 14:31 - 00031917 _____ C:\Users\Marucs\Desktop\Addition.txt
2013-07-28 14:21 - 2013-07-28 14:21 - 00031917 _____ C:\Users\Marucs\Downloads\Addition.txt
2013-07-28 14:20 - 2013-07-28 14:20 - 00000000 ____D C:\FRST
2013-07-28 14:19 - 2013-07-28 14:19 - 01780547 _____ (Farbar) C:\Users\Marucs\Downloads\FRST64.exe
2013-07-28 13:58 - 2012-05-14 22:01 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-07-28 13:51 - 2013-07-28 13:35 - 00003630 _____ C:\Windows\PFRO.log
2013-07-28 13:37 - 2009-12-18 18:20 - 00084168 _____ C:\Users\Marucs\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-28 13:35 - 2013-07-28 13:35 - 00000000 _____ C:\Windows\setuperr.log
2013-07-28 13:35 - 2012-01-22 13:57 - 00000000 ____D C:\Users\elephant
2013-07-28 13:35 - 2009-07-14 06:45 - 00364584 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-28 13:33 - 2012-01-13 13:14 - 00000000 ____D C:\Poker
2013-07-28 13:24 - 2011-11-05 21:18 - 00000000 ____D C:\Program Files (x86)\JDownloader
2013-07-28 12:57 - 2012-09-28 00:39 - 00000000 ____D C:\Users\Marucs\AppData\Roaming\DVDVideoSoft
2013-07-28 12:28 - 2013-07-28 12:28 - 00000000 ____D C:\Windows\pss
2013-07-28 12:28 - 2009-12-18 18:21 - 00000000 ___RD C:\Users\Marucs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-07-27 23:03 - 2012-07-04 00:16 - 00000000 ____D C:\Users\Marucs\AppData\Local\Windows Live
2013-07-27 20:30 - 2012-06-16 00:30 - 00000000 ____D C:\Program Files (x86)\Steam
2013-07-27 20:30 - 2009-12-25 18:45 - 00000000 ____D C:\Users\Marucs\AppData\Roaming\Winamp
2013-07-27 20:30 - 2007-07-12 03:49 - 00000000 ____D C:\Windows\Panther
2013-07-27 08:00 - 2013-07-27 08:00 - 00666633 _____ C:\Users\Marucs\Downloads\adwcleaner.exe
2013-07-27 08:00 - 2013-07-27 08:00 - 00023129 _____ C:\AdwCleaner[R1].txt
2013-07-27 00:16 - 2013-07-27 00:16 - 02347384 _____ (ESET) C:\Users\Marucs\Downloads\esetsmartinstaller_enu.exe
2013-07-22 17:33 - 2013-01-30 02:18 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-18 00:50 - 2012-11-12 03:20 - 00000000 ____D C:\Program Files (x86)\ShotOnline
2013-07-15 10:12 - 2011-01-30 18:57 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-15 10:12 - 2011-01-30 18:57 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-11 03:30 - 2013-03-14 02:35 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-11 03:30 - 2013-03-14 02:35 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-11 03:28 - 2009-07-14 09:45 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-11 03:28 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-11 03:28 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-11 03:08 - 2009-12-20 14:54 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-08 03:19 - 2009-12-26 02:01 - 00000000 ____D C:\Users\Marucs\AppData\Roaming\vlc
2013-07-06 17:44 - 2011-10-02 20:36 - 00000000 ____D C:\Users\Marucs\AppData\Roaming\TeraCopy
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-23 01:14
==================== End Of Log ============================
hmmm irgendwie gab es nur eine text datei vom Farbar's Recovery Scan Tool. hoffe ich habe nichts falsch gemacht. gruss wawa |
|
30.07.2013, 15:51
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Pop up u. Skip Trojaner? Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKLM\...\InprocServer32: [Default-cscui] <==== ATTENTION!
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
30.07.2013, 16:07
| #11 |
| | Pop up u. Skip Trojaner?Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 30-07-2013 03
Ran by Marucs at 2013-07-30 17:10:52 Run:1
Running from C:\Users\Marucs\Desktop
Boot Mode: Normal
==============================================
HKLM\Software\Classes\CLSID\{750fdf10-2a26-11d1-a3ea-080036587f03}\InprocServer32\\Default => Value was restored successfully.
==== End of Fixlog ====
|
|
30.07.2013, 16:15
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Pop up u. Skip Trojaner? Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Vollscan mit Malwarebytes Anti-Malware (MBAM) (falls du vor kurzem erst einen Vollscan gemacht hast, reicht auch ein Quickscan (spart Zeit), das dann mir bitte auch mitteilen) Hinweis: Denk bitte vorher daran, Malwarebytes Anti-Malware über den Updatebutton zu aktualisieren! Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt: ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
01.08.2013, 05:52
| #13 |
| | Pop up u. Skip Trojaner? hey hab bis jetzt nur den MBAM scan geschafft weil der mit funden ist poste ich ihn einfach schon mal. was mich etwas wundert ist das hinter den funden im log steht "Keine Aktion durchgeführt." obwohl ich auf entfernen geklickt habe und diese auch markiert waren. Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.07.31.02 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16635 Marucs :: MARUCS-PC [Administrator] 31.07.2013 07:16:52 MBAM-log-2013-07-31 (08-33-30).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 537108 Laufzeit: 1 Stunde(n), 15 Minute(n), 58 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 3 C:\Users\Marucs\Desktop\Neuer Ordner\wirelesskeyview\WirelessKeyView.exe (PUP.WirelessKeyView) -> Keine Aktion durchgeführt. D:\Spiele\New Folder\paul.dll (PUP.RiskwareTool.CK) -> Keine Aktion durchgeführt. D:\Spiele\New Folder\SKIDROW.dll (Trojan.Downloader.H) -> Keine Aktion durchgeführt. (Ende) danke und gruß wawa |
|
01.08.2013, 11:37
| #14 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Pop up u. Skip Trojaner?Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
01.08.2013, 12:50
| #15 |
| | Pop up u. Skip Trojaner? hey uppps ja das ist wohl dann noch ne Altlast xd heißt das den das mir hier nicht mehr geholfen wird? meine so was mal gelesen zu haben. da nach solchen funden vorbei ist. danke und gruß wawa |
|
| Themen zu Pop up u. Skip Trojaner? |
| adware.agent, antivirus, autorun, branding, combofix, device driver, downloader, farbar recovery scan tool, flash player, format, frst.txt, gophoto, internet, intranet, launch, plug-in, problem, pup.bundleinstaller.dw, pup.lyricsad, pup.optional.somoto, realtek, registry, richtlinie, rundll, security, services.exe, software, stick, svchost.exe, trojaner, trojaner? |
Linear-Darstellung
