|
Log-Analyse und Auswertung: 2ter Rechner mit Win32.downloader.gen (Win 7)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
31.08.2013, 12:54 | #1 |
| 2ter Rechner mit Win32.downloader.gen (Win 7) Hallo, mein zweiter Rechner ist auch infiziert. Bitte helft mir auch den wieder sauber zu kriegen. Die Files sind zu groß, daher habe ich die Dateien gezippt angehängt. Ich hoffe Ihr wisst einen Weg das Teil wieder los zu werden. Vielen Dank für die Hilfe. |
31.08.2013, 13:36 | #2 |
/// the machine /// TB-Ausbilder | 2ter Rechner mit Win32.downloader.gen (Win 7) hi,
__________________Logs teilen und posten. So funktioniert es: Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
31.08.2013, 14:02 | #3 |
| 2ter Rechner mit Win32.downloader.gen (Win 7) OK, das ist das Logfile von Spybot:
__________________Code:
ATTFilter Search results from Spybot - Search & Destroy 8/31/2013 11:50:06 AM Scan took 00:29:35. 66 items found. Win32.Downloader.gen: [SBI $4FAD8AA1] Configuration file (File, nothing done) C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Firefox\Profiles\49a0ufp2.default\searchplugins\conduit.xml Properties.size=943 Properties.md5=3AC23F4D45FFDC9477BD14ADCEB81CA0 Properties.filedate=1295271700 Properties.filedatetext=2011-01-17 15:41:40 Win32.Downloader.gen: [SBI $97C26527] Configuration file (File, nothing done) C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Firefox\Profiles\49a0ufp2.default\prefs.js Properties.size=30904 Properties.md5=1094C06DDEBA6EC394C8332A1045424B Properties.filedate=1377940785 Properties.filedatetext=2013-08-31 11:19:44 Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done) C:\Users\Bernhard Speiser\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\9MDNJMY4\cdn.flashtalking.com\ftLocalComms.sol Properties.size=61 Properties.md5=FD3E80A7C58C90200C320A635DB3EF8B Properties.filedate=1374089682 Properties.filedatetext=2013-07-17 21:34:41 Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done) C:\Users\Bernhard Speiser\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\9MDNJMY4\cdn.flashtalking.com\FT_cookie.sol Properties.size=43 Properties.md5=B36E1847615191796283CCC5FD9777EA Properties.filedate=1371499070 Properties.filedatetext=2013-06-17 21:57:49 Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done) C:\Users\Bernhard Speiser\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\9MDNJMY4\cdn.movad.net\movad.sol Properties.size=67 Properties.md5=42864F95D4DAF9407D0B73991B1BDA76 Properties.filedate=1371291821 Properties.filedatetext=2013-06-15 12:23:41 Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done) C:\Users\Bernhard Speiser\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\9MDNJMY4\www.paypalobjects.com\paypalLSO.sol Properties.size=111 Properties.md5=7394400F12FEED90AA030FDB54BA7C84 Properties.filedate=1371297334 Properties.filedatetext=2013-06-15 13:55:34 Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done) C:\Users\Bernhard Speiser\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\9MDNJMY4\www.paypalobjects.com\ppLsoTest.sol Properties.size=48 Properties.md5=74EE4375686A2069414EEF13E7B62789 Properties.filedate=1371297313 Properties.filedatetext=2013-06-15 13:55:13 Macromedia.FlashPlayer.Cookies: [SBI $5555F3D7] Text file (File, nothing done) C:\Users\Bernhard Speiser\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\9MDNJMY4\heias.com\x\heias_sc.swf\heias.sol Properties.size=63 Properties.md5=5DE47F5D69058879575330A3B88FA494 Properties.filedate=1370631939 Properties.filedatetext=2013-06-07 21:05:38 DoubleClick: [SBI $8E73A7FB] Tracking cookie (Internet Explorer (Benutzer): Bernhard Speiser) (Browser: Cookie, nothing done) DoubleClick: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) MediaPlex: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) MediaPlex: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) MediaPlex: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) BurstMedia: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) Statcounter: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) MediaPlex: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) MediaPlex: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) WebTrends live: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) Tradedoubler: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) Tradedoubler: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) Tradedoubler: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) Tradedoubler: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) BurstMedia: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) BurstMedia: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) CasaleMedia: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) FastClick: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) CasaleMedia: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) CasaleMedia: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) CasaleMedia: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) CasaleMedia: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) DoubleClick: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) DoubleClick: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) DoubleClick: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) MediaPlex: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) DoubleClick: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) MediaPlex: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done) Internet Explorer: [SBI $1E8157BE] Typed URL list (Registry Key, nothing done) HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Internet Explorer\TypedURLs Internet Explorer: [SBI $FF589D0C] Download directory (Registry Change, nothing done) HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Internet Explorer\Download Directory Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done) HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent MS Management Console: [SBI $ECD50EAD] Recent command list (Registry Key, nothing done) HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Microsoft Management Console\Recent File List MS Media Player: [SBI $5C51E349] Client ID (Registry Change, nothing done) HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\MediaPlayer\Player\Settings\Client ID MS Direct3D: [SBI $7FB7B83F] Most recent application (Registry Change, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Direct3D\MostRecentApplication\Name MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done) HKEY_USERS\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication\Name MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done) HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Direct3D\MostRecentApplication\Name MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done) HKEY_USERS\S-1-5-18\Software\Microsoft\Direct3D\MostRecentApplication\Name MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done) HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\DirectInput\MostRecentApplication\Name MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done) HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\DirectInput\MostRecentApplication\Id MS Paint: [SBI $07867C39] Recent file list (Registry Key, nothing done) HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources Windows.OpenWith: [SBI $16E309E0] Open with list - .ASF extension (Registry Key, nothing done) HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ASF\OpenWithList Windows.OpenWith: [SBI $F7204896] Open with list - .AVI extension (Registry Key, nothing done) HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AVI\OpenWithList Windows.OpenWith: [SBI $A1C94E79] Open with list - .BMP extension (Registry Key, nothing done) HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\OpenWithList Windows Explorer: [SBI $AA0766B5] Stream history (Registry Key, nothing done) HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU Windows Explorer: [SBI $D20DA0AD] Recent file global history (Registry Key, nothing done) HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done) HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Windows Media\WMSDK\General\ComputerName Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done) HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Windows Media\WMSDK\General\UniqueID Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done) HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber Cookie: [SBI $49804B54] Browser: Cookie (41) (Browser: Cookie, nothing done) Cache: [SBI $49804B54] Browser: Cache (43) (Browser: Cache, nothing done) Verlauf: [SBI $49804B54] Browser: History (84) (Browser: History, nothing done) Cookie: [SBI $49804B54] Browser: Cookie (1512) (Browser: Cookie, nothing done) Cookie: [SBI $49804B54] Browser: Cookie (25) (Browser: Cookie, nothing done) --- Spybot - Search & Destroy version: 2.1.18.131 DLL (build: 20130516) --- 2013-05-16 blindman.exe (2.1.18.151) 2013-05-16 explorer.exe (2.1.18.177) 2013-05-16 SDBootCD.exe (2.1.18.109) 2013-05-16 SDCleaner.exe (2.1.18.110) 2013-05-16 SDDelFile.exe (2.1.18.94) 2013-06-18 SDDisableProxy.exe 2013-05-16 SDFiles.exe (2.1.18.135) 2013-03-20 SDFileScanHelper.exe (2.1.16.1) 2013-05-16 SDFSSvc.exe (2.1.18.208) 2013-05-16 SDHookHelper.exe (2.1.18.2) 2013-05-16 SDHookInst32.exe (2.1.18.2) 2013-05-16 SDHookInst64.exe (2.1.18.2) 2013-05-16 SDImmunize.exe (2.1.18.130) 2013-05-16 SDLogReport.exe (2.1.18.107) 2013-05-16 SDOnAccess.exe (2.1.18.4) 2013-05-16 SDPESetup.exe (2.1.18.3) 2013-05-16 SDPEStart.exe (2.1.18.86) 2013-05-16 SDPhoneScan.exe (2.1.18.28) 2013-05-16 SDPRE.exe (2.1.18.22) 2013-05-16 SDPrepPos.exe (2.1.18.10) 2013-05-16 SDQuarantine.exe (2.1.18.103) 2013-05-16 SDRootAlyzer.exe (2.1.18.116) 2013-05-16 SDSBIEdit.exe (2.1.18.39) 2013-05-16 SDScan.exe (2.1.18.177) 2013-05-16 SDScript.exe (2.1.18.53) 2013-05-16 SDSettings.exe (2.1.18.136) 2013-05-16 SDShell.exe (2.1.18.2) 2013-05-16 SDShred.exe (2.1.18.107) 2013-05-16 SDSysRepair.exe (2.1.18.101) 2013-05-16 SDTools.exe (2.1.18.150) 2013-07-25 SDTray.exe (2.1.21.129) 2013-05-16 SDUpdate.exe (2.1.18.91) 2013-05-16 SDUpdSvc.exe (2.1.18.76) 2013-07-10 SDWelcome.exe (2.1.21.129) 2013-05-15 SDWSCSvc.exe (2.1.18.2) 2013-06-19 spybotsd2-translation-frx.exe 2013-08-31 unins000.exe (51.1052.0.0) 1999-12-02 xcacls.exe 2012-08-23 borlndmm.dll (10.0.2288.42451) 2012-09-05 DelZip190.dll (1.9.0.107) 2012-09-10 libeay32.dll (1.0.0.4) 2012-09-10 libssl32.dll (1.0.0.4) 2013-05-16 SDAdvancedCheckLibrary.dll (2.1.18.98) 2013-05-16 SDAV.dll 2013-05-16 SDECon32.dll (2.1.18.113) 2013-05-16 SDECon64.dll (2.1.18.113) 2013-04-05 SDEvents.dll (2.1.16.2) 2013-05-16 SDFileScanLibrary.dll (2.1.18.12) 2013-05-16 SDHook32.dll (2.1.18.2) 2013-05-16 SDHook64.dll (2.1.18.2) 2013-05-16 SDImmunizeLibrary.dll (2.1.18.2) 2013-05-16 SDLicense.dll (2.1.18.0) 2013-05-16 SDLists.dll (2.1.18.4) 2013-05-16 SDResources.dll (2.1.18.7) 2013-05-16 SDScanLibrary.dll (2.1.18.131) 2013-05-16 SDTasks.dll (2.1.18.15) 2013-05-16 SDWinLogon.dll (2.1.18.0) 2012-08-23 sqlite3.dll 2012-09-10 ssleay32.dll (1.0.0.4) 2013-05-16 Tools.dll (2.1.18.36) 2012-12-18 Includes\Adware.sbi (*) 2013-08-28 Includes\AdwareC.sbi (*) 2010-08-13 Includes\Cookies.sbi (*) 2012-11-14 Includes\Dialer.sbi (*) 2012-11-14 Includes\DialerC.sbi (*) 2012-11-14 Includes\HeavyDuty.sbi (*) 2012-11-14 Includes\Hijackers.sbi (*) 2012-11-14 Includes\HijackersC.sbi (*) 2013-08-22 Includes\iPhone.sbi (*) 2013-06-25 Includes\Keyloggers.sbi (*) 2012-12-18 Includes\KeyloggersC.sbi (*) 2013-05-29 Includes\Malware.sbi (*) 2013-08-28 Includes\MalwareC.sbi (*) 2012-11-14 Includes\PUPS.sbi (*) 2013-08-06 Includes\PUPSC.sbi (*) 2012-11-14 Includes\Security.sbi (*) 2012-11-14 Includes\SecurityC.sbi (*) 2013-05-22 Includes\Spyware.sbi (*) 2013-08-06 Includes\SpywareC.sbi (*) 2011-06-07 Includes\Tracks.sbi (*) 2012-11-19 Includes\Tracks.uti (*) 2013-01-16 Includes\Trojans.sbi (*) 2013-05-13 Includes\TrojansC-02.sbi (*) 2013-07-31 Includes\TrojansC-03.sbi (*) 2013-08-28 Includes\TrojansC-04.sbi (*) 2013-05-08 Includes\TrojansC-05.sbi (*) 2013-08-06 Includes\TrojansC.sbi (*) Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1) Log created at 12:40 on 31/08/2013 (Bernhard Speiser) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-08-2013 01 Ran by Bernhard Speiser (administrator) on BSP on 31-08-2013 12:41:02 Running from C:\Users\Bernhard Speiser\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\system32\atiesrxx.exe (Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Microsoft Corporation) C:\Windows\system32\CISVC.EXE (Microsoft Corporation) C:\Windows\system32\inetsrv\inetinfo.exe (Intel Corporation) C:\Windows\system32\IProsetMonitor.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe (Microsoft Corporation) C:\Windows\System32\tcpsvcs.exe (Microsoft Corporation) C:\Windows\System32\snmp.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (AMD) C:\Windows\system32\atieclxx.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Dropbox, Inc.) C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe (Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11490408 2010-10-22] (Realtek Semiconductor) HKLM\...\Run: [ISW] - C:\Program Files\CheckPoint\ZAForceField\ForceField.exe [1127592 2012-11-22] (Check Point Software Technologies) HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-10-01] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-09-14] (Intel Corporation) HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-03] (CyberLink) HKLM-x32\...\Run: [BDRegion] - C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2010-01-19] (cyberlink) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [ZoneAlarm] - C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [73832 2013-01-29] (Check Point Software Technologies LTD) HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software) HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.) HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.) Startup: C:\Users\Bernhard Speiser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Bernhard Speiser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=MDNB&bmod=MDNB HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=MDNB&bmod=MDNB SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550 SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550 SearchScopes: HKCU - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550 SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550 BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) BHO-x32: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies) BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) Toolbar: HKLM - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) Toolbar: HKLM-x32 - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies) Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) Toolbar: HKCU - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies) Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Firefox\Profiles\49a0ufp2.default FF user.js: detected! => C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Firefox\Profiles\49a0ufp2.default\user.js FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll () FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @checkpoint.com/FFApi - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll () FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @videolan.org/vlc,version=1.1.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Firefox\Profiles\49a0ufp2.default\searchplugins\conduit.xml FF SearchPlugin: C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Firefox\Profiles\49a0ufp2.default\searchplugins\zonealarm.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wikipedia-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: No Name - C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} FF Extension: No Name - C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} FF HKLM\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\TrustChecker FF Extension: No Name - C:\Program Files\CheckPoint\ZAForceField\TrustChecker FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker FF Extension: ZoneAlarm Security Engine - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker ==================== Services (Whitelisted) ================= R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software) R2 ftpsvc; C:\Windows\system32\inetsrv\ftpsvc.dll [350720 2012-06-01] (Microsoft Corporation) R2 IISADMIN; C:\Windows\system32\inetsrv\inetinfo.exe [15872 2010-11-20] (Microsoft Corporation) R2 iprip; C:\Windows\System32\iprip.dll [35328 2009-07-14] (Microsoft Corporation) R2 IswSvc; C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [828072 2012-11-22] (Check Point Software Technologies) R2 LPDSVC; C:\Windows\system32\lpdsvc.dll [45568 2009-07-14] (Microsoft Corporation) R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-04-17] () R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.) R2 SNMP; C:\Windows\System32\snmp.exe [49664 2010-11-20] (Microsoft Corporation) R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2447888 2013-01-29] (Check Point Software Technologies LTD) R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation) S3 WMSVC; C:\Windows\system32\inetsrv\wmsvc.exe [10752 2009-07-14] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software) R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software) R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] () R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-29] (AVAST Software) R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-29] (AVAST Software) R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-29] () S3 IAMTVE; C:\Windows\system32\DRIVERS\IAMTVE.sys [43416 2007-04-12] (Intel Corporation) S3 IAMTXPE; C:\Windows\system32\DRIVERS\IAMTXPE.sys [51096 2007-04-12] (Intel Corporation) R2 ISWKL; C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33712 2012-11-22] (Check Point Software Technologies) R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [611160 2012-11-15] (Kaspersky Lab) R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [450136 2012-12-13] (Check Point Software Technologies LTD) R2 {B154377D-700F-42cc-9474-23858FBDF4BD}; C:\Program Files (x86)\CyberLink\PowerDVD9\000.fcl [146928 2010-01-20] (CyberLink Corp.) R2 {B154377D-700F-42cc-9474-23858FBDF4BD}; C:\Program Files (x86)\CyberLink\PowerDVD9\000.fcl [146928 2010-01-20] (CyberLink Corp.) S3 GEARAspiWDM; system32\DRIVERS\GEARAspiWDM.sys [x] U5 klflt; C:\Windows\System32\Drivers\klflt.sys [89432 2012-11-15] (Kaspersky Lab) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-08-31 12:40 - 2013-08-31 12:40 - 00000000 ____D C:\FRST 2013-08-31 12:40 - 2013-08-31 12:40 - 00000000 _____ C:\Users\Bernhard Speiser\defogger_reenable 2013-08-31 12:37 - 2013-08-31 12:37 - 00377856 _____ C:\Users\Bernhard Speiser\Downloads\gmer_2.1.19163.exe 2013-08-31 12:37 - 2013-08-31 12:37 - 00377856 _____ C:\Users\Bernhard Speiser\Desktop\gmer_2.1.19163.exe 2013-08-31 12:36 - 2013-08-31 12:36 - 01587214 _____ (Farbar) C:\Users\Bernhard Speiser\Downloads\FRST64.exe 2013-08-31 12:36 - 2013-08-31 12:36 - 01587214 _____ (Farbar) C:\Users\Bernhard Speiser\Desktop\FRST64.exe 2013-08-31 12:35 - 2013-08-31 12:35 - 01082213 _____ (Farbar) C:\Users\Bernhard Speiser\Downloads\FRST.exe 2013-08-31 12:35 - 2013-08-31 12:35 - 00050477 _____ C:\Users\Bernhard Speiser\Desktop\Defogger.exe 2013-08-31 11:50 - 2013-08-31 11:50 - 00015147 _____ C:\Users\Bernhard Speiser\Desktop\Checks.130831-1150.txt 2013-08-31 11:03 - 2013-08-31 11:03 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking 2013-08-31 11:02 - 2013-08-31 12:32 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-08-31 11:02 - 2013-08-31 11:17 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2 2013-08-31 11:02 - 2013-08-31 11:02 - 00001383 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2013-08-31 11:02 - 2009-01-25 13:14 - 00017272 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe 2013-08-31 10:57 - 2013-08-31 10:58 - 37672592 _____ (Safer-Networking Ltd. ) C:\Users\Bernhard Speiser\Downloads\spybotsd-2.1.21-SR2.exe 2013-08-31 09:31 - 2013-08-31 09:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-08-29 12:59 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-08-29 12:59 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-08-29 12:59 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-08-29 12:59 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-08-29 12:59 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-08-29 12:59 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-08-29 12:59 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-08-29 12:59 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-08-29 12:59 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-08-29 12:59 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-08-29 12:59 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-08-29 12:59 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-08-29 12:08 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL 2013-08-29 12:08 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL 2013-08-29 12:08 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2013-08-29 12:08 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2013-08-29 12:08 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2013-08-29 12:08 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2013-08-29 12:08 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2013-08-29 12:08 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2013-08-29 12:08 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll 2013-08-29 12:08 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2013-08-29 12:08 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2013-08-29 12:08 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2013-08-29 12:08 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2013-08-29 12:08 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll 2013-08-29 12:08 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys 2013-08-29 12:07 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys ==================== One Month Modified Files and Folders ======= 2013-08-31 12:40 - 2013-08-31 12:40 - 00000494 _____ C:\Users\Bernhard Speiser\Desktop\defogger_disable.log 2013-08-31 12:40 - 2013-08-31 12:40 - 00000000 ____D C:\FRST 2013-08-31 12:40 - 2013-08-31 12:40 - 00000000 _____ C:\Users\Bernhard Speiser\defogger_reenable 2013-08-31 12:40 - 2011-03-17 00:05 - 00000000 ____D C:\Users\Bernhard Speiser 2013-08-31 12:40 - 2011-03-17 00:02 - 01049134 _____ C:\Windows\WindowsUpdate.log 2013-08-31 12:37 - 2013-08-31 12:37 - 00377856 _____ C:\Users\Bernhard Speiser\Downloads\gmer_2.1.19163.exe 2013-08-31 12:37 - 2013-08-31 12:37 - 00377856 _____ C:\Users\Bernhard Speiser\Desktop\gmer_2.1.19163.exe 2013-08-31 12:36 - 2013-08-31 12:36 - 01587214 _____ (Farbar) C:\Users\Bernhard Speiser\Downloads\FRST64.exe 2013-08-31 12:36 - 2013-08-31 12:36 - 01587214 _____ (Farbar) C:\Users\Bernhard Speiser\Desktop\FRST64.exe 2013-08-31 12:35 - 2013-08-31 12:35 - 01082213 _____ (Farbar) C:\Users\Bernhard Speiser\Downloads\FRST.exe 2013-08-31 12:35 - 2013-08-31 12:35 - 00050477 _____ C:\Users\Bernhard Speiser\Desktop\Defogger.exe 2013-08-31 12:34 - 2012-06-22 00:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-08-31 12:32 - 2013-08-31 11:02 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-08-31 12:12 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache 2013-08-31 12:10 - 2012-04-01 18:06 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-08-31 11:50 - 2013-08-31 11:50 - 00015147 _____ C:\Users\Bernhard Speiser\Desktop\Checks.130831-1150.txt 2013-08-31 11:17 - 2013-08-31 11:02 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2 2013-08-31 11:03 - 2013-08-31 11:03 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking 2013-08-31 11:02 - 2013-08-31 11:02 - 00001383 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2013-08-31 10:58 - 2013-08-31 10:57 - 37672592 _____ (Safer-Networking Ltd. ) C:\Users\Bernhard Speiser\Downloads\spybotsd-2.1.21-SR2.exe 2013-08-31 09:34 - 2009-07-14 06:45 - 00010096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-08-31 09:34 - 2009-07-14 06:45 - 00010096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-08-31 09:31 - 2013-08-31 09:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-08-31 09:30 - 2011-05-24 21:03 - 00000000 ___RD C:\Users\Bernhard Speiser\Dropbox 2013-08-31 09:30 - 2011-05-24 21:01 - 00000000 ____D C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox 2013-08-31 09:28 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\inetsrv 2013-08-31 09:25 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-08-31 09:24 - 2009-07-14 06:51 - 00116364 _____ C:\Windows\setupact.log 2013-08-29 12:55 - 2010-11-25 18:28 - 00777172 _____ C:\Windows\system32\perfh007.dat 2013-08-29 12:55 - 2010-11-25 18:28 - 00176608 _____ C:\Windows\system32\perfc007.dat 2013-08-29 12:55 - 2009-07-14 07:13 - 01835326 _____ C:\Windows\system32\PerfStringBackup.INI 2013-08-29 12:52 - 2013-07-27 16:56 - 00000000 ____D C:\Windows\system32\MRT 2013-08-29 12:49 - 2010-11-26 19:57 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-08-29 12:10 - 2012-04-01 18:06 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-08-29 12:10 - 2012-04-01 18:06 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2013-08-29 12:10 - 2011-06-03 15:30 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-08-29 11:53 - 2013-05-12 21:16 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update 2013-08-07 04:22 - 2010-11-26 19:22 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe Files to move or delete: ==================== C:\Users\BERNHA~1\AppData\Local\Temp\_is1334.exe C:\Users\BERNHA~1\AppData\Local\Temp\_isFB61.exe C:\Users\BERNHA~1\AppData\Local\Temp\{AC1AFBD6-44D4-404C-B7BB-402478A7C3EF}\ISSetup.dll C:\Users\BERNHA~1\AppData\Local\Temp\{AC1AFBD6-44D4-404C-B7BB-402478A7C3EF}\_Setup.dll C:\Users\BERNHA~1\AppData\Local\Temp\{98A57D83-0AE1-4370-91CD-87B70B361DEA}\ISSetup.dll C:\Users\BERNHA~1\AppData\Local\Temp\{98A57D83-0AE1-4370-91CD-87B70B361DEA}\_Setup.dll ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-08-31 12:05 ==================== End Of Log ============================ Das ist die Addition.txt von FRS: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-08-2013 01 Ran by Bernhard Speiser at 2013-08-31 12:41:43 Running from C:\Users\Bernhard Speiser\Desktop Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Acrobat.com (x32 Version: 1.6.65) Adobe AIR (x32 Version: 3.7.0.1530) Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94) Adobe Reader X (10.1.7) - Deutsch (x32 Version: 10.1.7) Apple Application Support (x32 Version: 2.3.4) Apple Mobile Device Support (Version: 6.1.0.13) Apple Software Update (x32 Version: 2.1.3.127) ATI Catalyst Install Manager (Version: 3.0.795.0) avast! Free Antivirus (x32 Version: 8.0.1489.0) BioShock (x32 Version: 2.62.0000) Bonjour (Version: 3.0.0.10) Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0930.2237.38732) Catalyst Control Center InstallProxy (x32 Version: 2010.0930.2237.38732) Catalyst Control Center Localization All (x32 Version: 2010.0930.2237.38732) CCC Help Danish (x32 Version: 2010.0930.2236.38732) CCC Help Dutch (x32 Version: 2010.0930.2236.38732) CCC Help English (x32 Version: 2010.0930.2236.38732) CCC Help Finnish (x32 Version: 2010.0930.2236.38732) CCC Help French (x32 Version: 2010.0930.2236.38732) CCC Help German (x32 Version: 2010.0930.2236.38732) CCC Help Italian (x32 Version: 2010.0930.2236.38732) CCC Help Japanese (x32 Version: 2010.0930.2236.38732) CCC Help Norwegian (x32 Version: 2010.0930.2236.38732) CCC Help Spanish (x32 Version: 2010.0930.2236.38732) CCC Help Swedish (x32 Version: 2010.0930.2236.38732) ccc-core-static (x32 Version: 2010.0930.2237.38732) ccc-utility64 (Version: 2010.0930.2237.38732) Control ActiveX de Windows Live Mesh para conexiones remotas (x32 Version: 15.4.5722.2) Contrôle ActiveX Windows Live Mesh pour connexions à distance (x32 Version: 15.4.5722.2) Controlo ActiveX do Windows Live Mesh para Ligações Remotas (x32 Version: 15.4.5722.2) CyberLink LabelPrint (x32 Version: 2.5.2602) CyberLink Power2Go (x32 Version: 6.1.3802) CyberLink PowerDirector (x32 Version: 8.0.2815) CyberLink PowerDVD 9 (x32 Version: 9.0.2519.50) CyberLink PowerDVD Copy (x32 Version: 1.5.1306) CyberLink PowerProducer (x32 Version: 5.0.2.2326) D3DX10 (x32 Version: 15.4.2368.0902) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32) Dropbox (HKCU Version: 2.0.22) Fotogalerija Windows Live (x32 Version: 15.4.3502.0922) Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922) Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922) Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922) Galerie de photos Windows Live (x32 Version: 15.4.3502.0922) Intel(R) Management Engine Components (x32 Version: 7.0.0.1118) Intel(R) Network Connections 15.6.25.0 (Version: 15.6.25.0) Intel(R) Rapid Storage Technology (x32 Version: 10.0.0.1046) iTunes (Version: 11.0.4.4) Java Auto Updater (x32 Version: 2.0.7.1) Java(TM) 6 Update 31 (x32 Version: 6.0.310) Junk Mail filter update (x32 Version: 15.4.3502.0922) Kontrolnik Windows Live Mesh ActiveX za oddaljene povezave (x32 Version: 15.4.5722.2) Medion Home Cinema (x32 Version: 8.0.1517) Mesh Runtime (x32 Version: 15.4.5722.2) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Office 2010 Service Pack 1 (SP1) (x32) Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Home and Student 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000) Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000) Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Single Image 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1) Mozilla Maintenance Service (x32 Version: 23.0.1) Mozilla Thunderbird 17.0.7 (x86 de) (x32 Version: 17.0.7) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT_amd64 (x32 Version: 15.4.2862.0708) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) MSXML 4.0 SP3 Parser (KB2721691) (x32 Version: 4.30.2114.0) MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0) MSXML 4.0 SP3 Parser (KB973685) (x32 Version: 4.30.2107.0) NVIDIA PhysX (x32 Version: 9.10.0222) PlayReady PC Runtime amd64 (Version: 1.3.0) Poczta usługi Windows Live (x32 Version: 15.4.3502.0922) Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922) Pošta Windows Live (x32 Version: 15.4.3502.0922) QuickTime (x32 Version: 7.74.80.86) Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922) Realtek High Definition Audio Driver (x32 Version: 6.0.1.6225) Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.26.0) rosoft .NET Framework 4 Client Profile (Version: 4.0.30319) Skype Click to Call (x32 Version: 5.6.8442) Skype™ 5.10 (x32 Version: 5.10.116) Spybot - Search & Destroy (x32 Version: 2.1.21) swMSM (x32 Version: 12.0.0.1) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1) Update for Microsoft Office 2010 (KB2494150) (x32) Update for Microsoft Office 2010 (KB2553065) (x32) Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2566458) (x32) Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32) Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32) Update for Microsoft Outlook 2010 (KB2597090) 32-Bit Edition (x32) Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32) Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32) Update for Microsoft PowerPoint 2010 (KB2598240) 32-Bit Edition (x32) Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32) VLC media player 1.1.7 (x32 Version: 1.1.7) Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3502.0922) Windows Live Fotogalerie (x32 Version: 15.4.3502.0922) Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922) Windows Live Fotótár (x32 Version: 15.4.3502.0922) Windows Live ID Sign-in Assistant (Version: 7.250.4225.0) Windows Live Installer (x32 Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3502.0922) Windows Live Mail (x32 Version: 15.4.3502.0922) Windows Live Mesh (x32 Version: 15.4.3502.0922) Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2) Windows Live Messenger (x32 Version: 15.4.3502.0922) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Movie Maker (x32 Version: 15.4.3502.0922) Windows Live Photo Common (x32 Version: 15.4.3502.0922) Windows Live Photo Gallery (x32 Version: 15.4.3502.0922) Windows Live PIMT Platform (x32 Version: 15.4.3502.0922) Windows Live Remote Client (Version: 15.4.5722.2) Windows Live Remote Client Resources (Version: 15.4.5722.2) Windows Live Remote Service (Version: 15.4.5722.2) Windows Live Remote Service Resources (Version: 15.4.5722.2) Windows Live SOXE (x32 Version: 15.4.3502.0922) Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922) Windows Live UX Platform (x32 Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922) Windows Live Writer (x32 Version: 15.4.3502.0922) Windows Live Writer Resources (x32 Version: 15.4.3502.0922) Yahoo! Detect (x32) ZoneAlarm Antivirus (x32 Version: 11.0.000.057) ZoneAlarm Firewall (x32 Version: 11.0.000.057) ZoneAlarm Free Antivirus + Firewall (x32 Version: 11.0.000.057) ZoneAlarm LTD Toolbar ZoneAlarm Security (x32 Version: 11.0.000.057) Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922) ==================== Restore Points ========================= 29-06-2013 10:34:37 Windows Update 11-07-2013 18:43:06 Windows Update 11-07-2013 19:07:20 Windows Update 17-07-2013 18:46:02 Windows Update 17-07-2013 21:45:55 Windows Update 22-07-2013 20:22:11 Windows Update 27-07-2013 09:46:25 Windows Update 27-07-2013 14:55:49 Windows Update 29-08-2013 10:07:31 Windows Update 29-08-2013 10:48:15 Windows Update ==================== Hosts content: ========================== 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {0E003600-969A-4AF0-9D27-DEC8B47E58EF} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe No File Task: {2054264E-29A2-4F78-9CE8-390498C6EFF9} - System32\Tasks\{236C362C-4AAA-47B0-B5B5-7E635C71CF60} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2012-07-13] (Skype Technologies S.A.) Task: {3512346C-C9A6-4FAC-A00E-E14319D7A3D3} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe No File Task: {4593BA8F-4BCF-469E-B37C-BADF53F36877} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software) Task: {77D903ED-A9EA-43BF-93B1-F0D2BD3067CC} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation) Task: {7E361E09-42F3-4EFE-BACA-5DF606A86C11} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task Task: {93C0D303-8C98-4EFA-92F2-61A7335FF1D3} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation) Task: {A35C0DD6-2375-4838-9A7A-377581035B7E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-29] (Adobe Systems Incorporated) Task: {AA4C3CFE-FC3F-4CFC-94F0-F1C424120D4F} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {C12208C3-04C8-4E29-8C30-24E7DEFA258C} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe No File Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe ==================== Loaded Modules (whitelisted) ============= 2013-05-12 21:15 - 2013-05-09 10:58 - 00302224 _____ (AVAST Software) C:\Program Files\AVAST Software\Avast\snxhk64.dll 2012-08-25 22:43 - 2012-07-05 00:16 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\NETAPI32.dll 2012-11-22 16:16 - 2012-11-22 16:16 - 01784320 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ISWRCS.dll 2012-11-22 16:36 - 2012-11-22 16:36 - 01221800 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\trustchecker\bin\trustchecker.dll 2012-11-22 16:35 - 2012-11-22 16:35 - 01509032 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ISWUL.dll 2012-11-22 16:35 - 2012-11-22 16:35 - 00879784 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ISWUL_MIN\ISWUL.dll 2012-11-22 16:35 - 2012-11-22 16:35 - 00796840 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWDMP.dll 2012-11-22 16:35 - 2012-11-22 16:35 - 01368744 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWMENUS.dll 2012-11-22 16:35 - 2012-11-22 16:35 - 00525992 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ISWUIlib.dll 2012-11-22 16:35 - 2012-11-22 16:35 - 00965288 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll 2012-11-22 16:36 - 2012-11-22 16:36 - 00852648 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWUPD.dll 2012-11-22 16:36 - 2012-11-22 16:36 - 00311464 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\Plugins\updating.dll 2012-11-22 16:35 - 2012-11-22 16:35 - 00467624 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSTATS.dll 2012-11-22 16:35 - 2012-11-22 16:35 - 01050280 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll 2012-11-22 16:36 - 2012-11-22 16:36 - 00545960 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\Plugins\SiteChecker.dll 2010-03-18 18:53 - 2010-03-18 18:53 - 08831840 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\trustchecker\bin\samplesites.dll 2010-09-22 00:49 - 2010-09-22 00:49 - 00170880 _____ (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL 2011-08-31 00:05 - 2011-08-31 00:05 - 00132968 _____ (Apple Inc.) C:\Program Files\Bonjour\mdnsNSP.dll 2012-11-22 16:35 - 2012-11-22 16:35 - 00138408 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\trustchecker\bin\liblua.dll 2012-11-22 16:35 - 2012-11-22 16:35 - 00282280 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\trustchecker\bin\libtextcat.dll 2012-11-22 16:36 - 2012-11-22 16:36 - 00180392 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\trustchecker\bin\tcdata.dll 2010-11-25 18:07 - 2010-09-29 03:14 - 00039936 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiuxp64.dll 2010-11-25 18:07 - 2010-09-29 03:54 - 00628224 _____ (ATI Technologies Inc. ) C:\Windows\system32\aticfx64.dll 2010-11-25 18:07 - 2010-09-29 03:37 - 04660224 _____ (ATI Technologies Inc. ) C:\Windows\system32\atidxx64.dll 2013-05-12 21:15 - 2013-05-09 10:58 - 00133840 _____ (AVAST Software) C:\Program Files\AVAST Software\Avast\ashShA64.dll 2013-05-25 02:36 - 2013-05-25 02:36 - 00164016 _____ (Dropbox, Inc.) C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll 2012-11-22 16:36 - 2012-11-22 16:36 - 00906408 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll 2011-07-01 21:21 - 2010-11-20 15:25 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\cabview.dll 2011-07-01 21:21 - 2010-11-20 15:25 - 00094720 _____ (Microsoft Corporation) C:\Windows\system32\Cabinet.dll 2009-07-14 02:17 - 2009-07-14 03:40 - 00024576 _____ (Microsoft Corporation) C:\Windows\System32\drprov.dll 2011-07-01 21:21 - 2010-11-20 15:27 - 00129536 _____ (Microsoft Corporation) C:\Windows\System32\ntlanman.dll 2011-07-01 21:22 - 2010-11-20 15:26 - 00100864 _____ (Microsoft Corporation) C:\Windows\System32\davclnt.dll 2009-07-14 01:23 - 2009-07-14 03:40 - 00025600 _____ (Microsoft Corporation) C:\Windows\System32\DAVHLPR.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00875008 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atiacm64.dll 2010-10-01 08:29 - 2010-10-01 08:29 - 00003584 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atiamdeu.dll 2011-02-04 23:40 - 2011-02-04 23:40 - 01269648 _____ (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll 2009-07-14 02:25 - 2009-07-14 03:41 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\PhotoMetadataHandler.dll 2009-07-14 01:42 - 2009-07-14 03:41 - 01039872 _____ (Microsoft Corporation) C:\Windows\system32\OPENGL32.dll 2009-07-14 01:42 - 2009-07-14 03:40 - 00165376 _____ (Microsoft Corporation) C:\Windows\system32\GLU32.dll 2009-07-14 01:41 - 2009-07-14 03:40 - 00569344 _____ (Microsoft Corporation) C:\Windows\system32\DDRAW.dll 2009-07-14 01:38 - 2009-07-14 03:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\DCIMAN32.dll 2013-07-11 20:47 - 2013-04-24 00:56 - 09991832 _____ (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll 2013-07-17 20:43 - 2013-07-17 20:43 - 15577088 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\88744044294787b99dd4a8704ab75a79\mscorlib.ni.dll 2013-01-22 22:11 - 2012-10-05 12:52 - 01574496 _____ (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll 2013-08-31 09:28 - 2013-08-31 09:28 - 10655744 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System\af0a0b96a02f9925eb84392ee65a5cfa\System.ni.dll 2013-08-31 09:29 - 2013-08-31 09:29 - 02320384 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Drawing\868d117286ad259249f31d3fe813d39a\System.Drawing.ni.dll 2013-08-31 09:29 - 2013-08-31 09:29 - 17383424 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Windows.Forms\95674cb72317e3a5380ea450b913786f\System.Windows.Forms.ni.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00106496 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.Implementation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00032768 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\LOG.Foundation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00036864 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\LOG.Foundation.Private.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00065536 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\LOG.Foundation.Implementation.dll 2011-07-08 18:26 - 2010-11-13 02:08 - 00315392 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00005632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.Foundation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00020480 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\LOG.Foundation.Implementation.Private.dll 2011-07-01 21:21 - 2010-11-05 03:58 - 00303104 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll 2013-07-27 16:21 - 2013-04-20 00:54 - 05292032 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_64\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00032768 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.Implementation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00015360 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\NEWAEM.Foundation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00098304 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Foundation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00057344 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.SkinFactory.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00028672 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Foundation.XManifest.dll 2013-08-31 09:28 - 2013-08-31 09:28 - 06964736 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Xml\3975acf49313ceea1280da91f0383480\System.Xml.ni.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00061440 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Runtime.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00049152 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Runtime.Shared.Private.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00040960 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Foundation.Private.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00005632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Runtime.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00032768 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\ATICCCom.dll 2010-04-29 13:30 - 2010-04-29 13:30 - 00066048 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\ADL.Foundation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00045056 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Server.dll 2010-11-25 18:07 - 2010-09-29 03:15 - 00340480 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiadlxx.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00006144 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Server.Shared.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00045056 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.Source.Kit.Server.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00006656 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.DPPE.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00007168 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.Hotkeys.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00006144 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.WinMessages.Shared.dll 2009-04-22 22:13 - 2009-04-22 22:13 - 00045056 _____ (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0601.dll 2010-03-04 10:27 - 2010-03-04 10:27 - 00016384 _____ (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Foundation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00006656 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.dll 2010-08-18 13:28 - 2010-08-18 13:28 - 00450560 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\ATIDEMGX.dll 2013-08-31 09:28 - 2013-08-31 09:28 - 01320448 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Configuration\1031b311ee568364d4ca1c4db634eaf0\System.Configuration.ni.dll 2010-11-25 18:07 - 2010-09-29 03:49 - 00421376 _____ (ATI Technologies, Inc.) C:\Windows\system32\atipdl64.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00385024 _____ (Advanced Mirco Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Runtime.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00155648 _____ (Advanced Mirco Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Shared.dll 2009-06-17 15:27 - 2009-06-17 15:27 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0709.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00005632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.GD.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00008192 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Actions.CCAA.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00007168 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\ResourceManagement.Foundation.Private.dll 2008-04-04 02:29 - 2008-04-04 02:29 - 00020480 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0804.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00045056 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00036864 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00040960 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll 2010-10-01 08:32 - 2010-10-01 08:32 - 00040960 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00008704 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Runtime.Shared.Private.dll 2010-10-01 08:32 - 2010-10-01 08:32 - 00065536 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00028672 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00073728 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Radeon3D.Graphics.Runtime.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00032768 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceLCD.Graphics.Shared.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00053248 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceDFP.Graphics.Shared.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00028672 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CustomFormats.Graphics.Shared.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00077824 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.OverDrive5.Graphics.Runtime.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00065536 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Radeon3D.Graphics.Shared.dll 2010-10-01 08:36 - 2010-10-01 08:36 - 00013824 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.TransCode.Graphics.Runtime.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00102400 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.MMVideo.Graphics.Runtime.dll 2010-10-01 08:36 - 2010-10-01 08:36 - 00013312 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Welcome.Graphics.Runtime.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00020480 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00077824 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceTV.Graphics.Runtime.dll 2010-10-01 08:32 - 2010-10-01 08:32 - 00065536 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.MMVideo.Graphics.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00020480 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00069632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCV.Graphics.Runtime.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00024576 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00053248 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCRT.Graphics.shared.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00045056 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.TransCode.Graphics.shared.dll 2009-06-17 20:24 - 2009-06-17 20:24 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0906.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00065536 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceTV.Graphics.shared.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00061440 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.OverDrive5.Graphics.shared.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00009728 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Welcome.Graphics.shared.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00040960 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCV.Graphics.Shared.dll 2009-12-08 16:49 - 2009-12-08 16:49 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0912.dll 2007-08-10 02:58 - 2007-08-10 02:58 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0706.dll 2009-06-17 20:24 - 2009-06-17 20:24 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0712.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00049152 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceProperty.Graphics.Shared.dll 2010-10-01 08:32 - 2010-10-01 08:32 - 00053248 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll 2008-12-30 21:04 - 2008-12-30 21:04 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0812.dll 2009-04-22 22:13 - 2009-04-22 22:13 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0805.dll 2007-05-03 03:44 - 2007-05-03 03:44 - 00020480 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0703.dll 2009-01-20 23:51 - 2009-01-20 23:51 - 00007168 _____ ( ) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atixclib.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00011776 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.HydraVision.Runtime.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00008704 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.HydraVision.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00061440 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\APM.Server.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00020480 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\APM.Foundation.dll 2011-07-10 08:37 - 2010-11-13 02:08 - 00434176 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00007168 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Runtime.Extension.EEU.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00005632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.REG.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00005632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.EEU.Shared.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00581632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Systemtray.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00040960 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Client.Shared.Private.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00405504 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Wizard.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00007680 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Client.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00020480 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Wizard.Shared.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00011776 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Wizard.Shared.Private.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00040960 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Wizard.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00016384 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Wizard.Shared.dll 2010-10-01 08:36 - 2010-10-01 08:36 - 00741376 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\ResourceManagement.Foundation.Implementation.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00094208 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Radeon3D.Graphics.Wizard.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00409600 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.MMVideo.Graphics.Wizard.dll 2010-10-01 08:36 - 2010-10-01 08:36 - 01708032 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysManager2.Graphics.Wizard.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00204800 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.InfoCentre.Graphics.Wizard.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00007680 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.HydraVision.Wizard.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 01220608 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Dashboard.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00024576 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Dashboard.Shared.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00010240 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Dashboard.Shared.Private.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00073728 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Dashboard.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00016384 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Dashboard.Shared.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00065536 _____ (Advanced Mirco Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Welcome.Graphics.Dashboard.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00196608 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll 2010-10-01 08:36 - 2010-10-01 08:36 - 01306624 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysManager2.Graphics.Dashboard.dll 2010-10-01 08:36 - 2010-10-01 08:36 - 00270336 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00094208 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00397312 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll 2010-10-01 08:32 - 2010-10-01 08:32 - 00376832 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00397312 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00573440 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00880640 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.MMVideo.Graphics.Dashboard.dll 2010-10-01 08:36 - 2010-10-01 08:36 - 00184320 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.TransCode.Graphics.Dashboard.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00655360 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.OverDrive5.Graphics.Dashboard.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00007680 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.HydraVision.Dashboard.dll 2009-07-14 01:31 - 2009-07-14 03:41 - 00090624 _____ (Microsoft Corporation) C:\Windows\System32\wdi.dll 2009-07-14 01:32 - 2009-07-14 03:41 - 00071168 _____ (Microsoft Corporation) C:\Windows\system32\radarrs.dll 2009-07-14 01:35 - 2009-07-14 03:41 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\RstrtMgr.DLL ==================== Alternate Data Streams (whitelisted) ========== ==================== Faulty Device Manager Devices ============= Name: Realtek RTL8191SU Wireless LAN 802.11n USB 2.0 Network Adapter Description: Realtek RTL8191SU Wireless LAN 802.11n USB 2.0 Network Adapter Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Realtek Semiconductor Corp. Service: RTL8192su Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. Name: Microsoft PS/2-Maus Description: Microsoft PS/2-Maus Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: i8042prt Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. ==================== Event log errors: ========================= Application errors: ================== Error: (08/31/2013 00:05:10 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig. Error: (07/25/2013 09:52:24 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig. Error: (07/17/2013 10:13:57 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig. Error: (07/01/2013 09:10:06 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig. Error: (06/24/2013 09:46:34 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig. Error: (06/17/2013 10:55:47 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig. Error: (06/13/2013 00:30:01 AM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig. Error: (06/12/2013 08:56:19 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig. Error: (06/08/2013 00:01:02 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig. Error: (06/07/2013 07:57:35 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig. System errors: ============= Error: (08/31/2013 09:26:21 AM) (Source: SNMP) (User: ) Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten. Error: (08/29/2013 11:52:30 AM) (Source: SNMP) (User: ) Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten. Error: (07/28/2013 03:24:00 PM) (Source: SNMP) (User: ) Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten. Error: (07/27/2013 10:44:01 PM) (Source: SNMP) (User: ) Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten. Error: (07/27/2013 06:32:16 PM) (Source: SNMP) (User: ) Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten. Error: (07/27/2013 06:15:18 PM) (Source: SNMP) (User: ) Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten. Error: (07/27/2013 04:11:59 PM) (Source: SNMP) (User: ) Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten. Error: (07/27/2013 11:40:15 AM) (Source: SNMP) (User: ) Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten. Error: (07/25/2013 09:13:10 PM) (Source: SNMP) (User: ) Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten. Error: (07/22/2013 11:11:10 PM) (Source: SNMP) (User: ) Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten. Microsoft Office Sessions: ========================= Error: (08/31/2013 00:05:10 PM) (Source: SideBySide)(User: ) Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2 Error: (07/25/2013 09:52:24 PM) (Source: SideBySide)(User: ) Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2 Error: (07/17/2013 10:13:57 PM) (Source: SideBySide)(User: ) Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2 Error: (07/01/2013 09:10:06 PM) (Source: SideBySide)(User: ) Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2 Error: (06/24/2013 09:46:34 PM) (Source: SideBySide)(User: ) Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2 Error: (06/17/2013 10:55:47 PM) (Source: SideBySide)(User: ) Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2 Error: (06/13/2013 00:30:01 AM) (Source: SideBySide)(User: ) Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2 Error: (06/12/2013 08:56:19 PM) (Source: SideBySide)(User: ) Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2 Error: (06/08/2013 00:01:02 PM) (Source: SideBySide)(User: ) Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2 Error: (06/07/2013 07:57:35 PM) (Source: SideBySide)(User: ) Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2 CodeIntegrity Errors: =================================== Date: 2013-08-31 12:40:39.144 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-31 12:32:28.672 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-31 11:25:47.746 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-31 11:17:58.038 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-29 12:21:50.910 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-07-27 23:21:26.451 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-07-27 23:08:03.183 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-07-27 20:34:23.709 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-07-27 18:49:56.640 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-07-27 18:41:22.960 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Percentage of memory in use: 44% Total physical RAM: 6125.64 MB Available physical RAM: 3423.08 MB Total Pagefile: 12249.47 MB Available Pagefile: 9439.68 MB Total Virtual: 8192 MB Available Virtual: 8191.81 MB ==================== Drives ================================ Drive c: (Boot) (Fixed) (Total:900.41 GB) (Free:769.96 GB) NTFS Drive d: (Recover) (Fixed) (Total:30 GB) (Free:9.48 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 932 GB) (Disk ID: 2BD2C32A) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=900 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=30 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=1 GB) - (Type=12) ==================== End Of Log ============================ |
31.08.2013, 14:04 | #4 |
| 2ter Rechner mit Win32.downloader.gen (Win 7) GMER Log Teil 1: Code:
ATTFilter Rootkit scan 2013-08-31 13:02:30 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.JC4O 931,51GB Running: gmer_2.1.19163.exe; Driver: C:\Users\BERNHA~1\AppData\Local\Temp\fgtdqpow.sys ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 560 fffff80002db5000 45 bytes [00, 00, 09, 02, 56, 61, 64, ...] INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 607 fffff80002db502f 17 bytes [00, A7, 52, 07, 00, 00, 00, ...] ---- User code sections - GMER 2.1 ---- .text C:\Windows\system32\csrss.exe[664] C:\Windows\SYSTEM32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\csrss.exe[724] C:\Windows\SYSTEM32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\wininit.exe[732] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\winlogon.exe[768] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\services.exe[828] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\lsass.exe[836] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\lsm.exe[844] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\svchost.exe[936] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\svchost.exe[128] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\atiesrxx.exe[584] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\System32\svchost.exe[896] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\System32\svchost.exe[1040] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\svchost.exe[1068] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\svchost.exe[1092] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\svchost.exe[1352] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe[1708] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe[1708] C:\Windows\system32\USER32.dll!SetLayeredWindowAttributes + 20 000000007764cd04 5 bytes JMP 0000000122310df8 .text C:\Windows\System32\spoolsv.exe[1860] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\svchost.exe[1944] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1304] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62] .text C:\Windows\system32\svchost.exe[1348] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[880] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62] .text C:\Program Files\Bonjour\mDNSResponder.exe[2008] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\svchost.exe[2080] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\svchost.exe[2104] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\inetsrv\inetinfo.exe[2144] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\IProsetMonitor.exe[2200] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\System32\svchost.exe[2252] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\System32\svchost.exe[2272] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe[2292] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[2536] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62] .text C:\Windows\System32\tcpsvcs.exe[2572] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\System32\snmp.exe[2628] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\svchost.exe[2664] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\svchost.exe[2712] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2752] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3068] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 00000001001c075c .text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001001c03a4 .text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 00000001001c0b14 .text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 00000001001c0ecc .text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 00000001001c163c .text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 00000001001c1284 .text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001001c19f4 .text C:\Windows\system32\svchost.exe[3880] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac .text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc .text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284 .text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c .text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4 .text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4 .text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c .text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14 .text C:\Windows\system32\svchost.exe[3880] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010041075c .text C:\Windows\system32\svchost.exe[3880] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100411284 .text C:\Windows\system32\svchost.exe[3880] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100410ecc .text C:\Windows\system32\svchost.exe[3880] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001004103a4 .text C:\Windows\system32\svchost.exe[3880] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100410b14 .text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010035075c .text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001003503a4 .text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100350b14 .text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100350ecc .text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010035163c .text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100351284 .text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001003519f4 .text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac .text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc .text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284 .text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c .text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4 .text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4 .text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c .text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14 .text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010040075c .text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100401284 .text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100400ecc .text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001004003a4 .text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100400b14 .text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010046075c .text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001004603a4 .text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100460b14 .text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100460ecc .text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010046163c .text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100461284 .text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001004619f4 .text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 00000001004b075c .text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 00000001004b1284 .text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 00000001004b0ecc .text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001004b03a4 .text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 00000001004b0b14 .text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac .text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc .text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284 .text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c .text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4 .text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4 .text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c .text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100090600 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100090804 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100090c0c .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100090a08 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100090e10 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000901f8 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000903fc .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62] .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 00000001000a1014 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 00000001000a0804 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 00000001000a0a08 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 00000001000a0c0c .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 00000001000a0e10 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001000a01f8 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001000a03fc .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 00000001000a0600 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001000b01f8 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001000b03fc .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 00000001000b0804 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 00000001000b0600 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 00000001000b0a08 .text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010047075c .text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001004703a4 .text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100470b14 .text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100470ecc .text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010047163c .text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100471284 .text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001004719f4 .text C:\Windows\System32\svchost.exe[4248] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac .text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc .text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284 .text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c .text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4 .text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4 .text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c .text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14 .text C:\Windows\System32\svchost.exe[4248] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010031075c .text C:\Windows\System32\svchost.exe[4248] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100311284 .text C:\Windows\System32\svchost.exe[4248] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100310ecc .text C:\Windows\System32\svchost.exe[4248] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001003103a4 .text C:\Windows\System32\svchost.exe[4248] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100310b14 .text C:\Program Files\Windows Media Player\wmpnetwk.exe[964] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010029075c .text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001002903a4 .text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100290b14 .text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100290ecc .text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010029163c .text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100291284 .text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001002919f4 .text C:\Windows\system32\taskhost.exe[3136] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\taskhost.exe[3136] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010048075c .text C:\Windows\system32\taskhost.exe[3136] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100481284 .text C:\Windows\system32\taskhost.exe[3136] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100480ecc .text C:\Windows\system32\taskhost.exe[3136] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001004803a4 .text C:\Windows\system32\taskhost.exe[3136] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100480b14 .text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac .text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc .text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284 .text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c .text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4 .text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4 .text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c .text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14 .text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 00000001003c075c .text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001003c03a4 .text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 00000001003c0b14 .text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 00000001003c0ecc .text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 00000001003c163c .text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 00000001003c1284 .text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001003c19f4 .text C:\Windows\system32\Dwm.exe[3480] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\Dwm.exe[3480] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000007fff075c .text C:\Windows\system32\Dwm.exe[3480] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 000000007fff1284 .text C:\Windows\system32\Dwm.exe[3480] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 000000007fff0ecc .text C:\Windows\system32\Dwm.exe[3480] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 000000007fff03a4 .text C:\Windows\system32\Dwm.exe[3480] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 000000007fff0b14 .text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac .text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc .text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284 .text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c .text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4 .text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4 .text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c .text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14 .text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010035075c .text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001003503a4 .text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100350b14 .text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100350ecc .text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010035163c .text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100351284 .text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001003519f4 .text C:\Windows\Explorer.EXE[4896] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac .text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc .text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284 .text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c .text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4 .text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4 .text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c .text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14 .text C:\Windows\Explorer.EXE[4896] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 00000001004d075c .text C:\Windows\Explorer.EXE[4896] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 00000001004d1284 .text C:\Windows\Explorer.EXE[4896] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 00000001004d0ecc .text C:\Windows\Explorer.EXE[4896] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001004d03a4 .text C:\Windows\Explorer.EXE[4896] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 00000001004d0b14 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010025075c .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001002503a4 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100250b14 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100250ecc .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010025163c .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100251284 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001002519f4 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010054075c .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100541284 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100540ecc .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001005403a4 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100540b14 .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600 .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804 .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08 .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10 .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8 .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62] .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001002401f8 .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001002403fc .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 0000000100240804 .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 0000000100240600 .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 0000000100240a08 .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 0000000100251014 .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 0000000100250804 .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 0000000100250a08 .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 0000000100250c0c .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 0000000100250e10 .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001002501f8 .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001002503fc .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 0000000100250600 .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69 0000000075751465 2 bytes [75, 75] .text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155 00000000757514bb 2 bytes [75, 75] .text ... * 2 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62] .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 00000001000d1014 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 00000001000d0804 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 00000001000d0a08 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 00000001000d0c0c .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 00000001000d0e10 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001000d01f8 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001000d03fc .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 00000001000d0600 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001000e01f8 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001000e03fc .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 00000001000e0804 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 00000001000e0600 .text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 00000001000e0a08 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62] .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001002401f8 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001002403fc .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 0000000100240804 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 0000000100240600 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 0000000100240a08 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 0000000100251014 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 0000000100250804 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 0000000100250a08 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 0000000100250c0c .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 0000000100250e10 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001002501f8 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001002503fc .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 0000000100250600 .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600 .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804 .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08 .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10 .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8 .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62] Code:
ATTFilter .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001001001f8 .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001001003fc .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 0000000100100804 .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 0000000100100600 .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 0000000100100a08 .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 0000000100111014 .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 0000000100110804 .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 0000000100110a08 .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 0000000100110c0c .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 0000000100110e10 .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001001101f8 .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001001103fc .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 0000000100110600 .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600 .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804 .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08 .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10 .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8 .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62] .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001001c01f8 .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001001c03fc .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 00000001001c0804 .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 00000001001c0600 .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 00000001001c0a08 .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 00000001001d1014 .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 00000001001d0804 .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 00000001001d0a08 .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 00000001001d0c0c .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 00000001001d0e10 .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001001d01f8 .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001001d03fc .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 00000001001d0600 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[3080] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62] .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010010075c .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001001003a4 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100100b14 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100100ecc .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010010163c .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100101284 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001001019f4 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 00000001004d075c .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 00000001004d1284 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 00000001004d0ecc .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001004d03a4 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 00000001004d0b14 .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600 .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804 .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08 .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10 .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8 .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62] .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 0000000100091014 .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 0000000100090804 .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 0000000100090a08 .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 0000000100090c0c .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 0000000100090e10 .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001000901f8 .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001000903fc .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 0000000100090600 .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001000a01f8 .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001000a03fc .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 00000001000a0804 .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 00000001000a0600 .text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 00000001000a0a08 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010040075c .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001004003a4 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100400b14 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100400ecc .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010040163c .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100401284 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001004019f4 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010046075c .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100461284 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100460ecc .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001004603a4 .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100460b14 .text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010020075c .text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001002003a4 .text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100200b14 .text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100200ecc .text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010020163c .text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100201284 .text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001002019f4 .text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac .text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc .text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284 .text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c .text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4 .text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4 .text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c .text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14 .text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010036075c .text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100361284 .text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100360ecc .text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001003603a4 .text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100360b14 .text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010018075c .text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001001803a4 .text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100180b14 .text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100180ecc .text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010018163c .text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100181284 .text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001001819f4 .text C:\Windows\System32\svchost.exe[5752] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac .text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc .text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284 .text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c .text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4 .text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4 .text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c .text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14 .text C:\Windows\System32\svchost.exe[5752] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010028075c .text C:\Windows\System32\svchost.exe[5752] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100281284 .text C:\Windows\System32\svchost.exe[5752] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100280ecc .text C:\Windows\System32\svchost.exe[5752] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001002803a4 .text C:\Windows\System32\svchost.exe[5752] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100280b14 .text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 00000001001d075c .text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001001d03a4 .text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 00000001001d0b14 .text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 00000001001d0ecc .text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 00000001001d163c .text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 00000001001d1284 .text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001001d19f4 .text C:\Windows\system32\DllHost.exe[6676] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\DllHost.exe[6676] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 00000001002f075c .text C:\Windows\system32\DllHost.exe[6676] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 00000001002f1284 .text C:\Windows\system32\DllHost.exe[6676] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 00000001002f0ecc .text C:\Windows\system32\DllHost.exe[6676] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001002f03a4 .text C:\Windows\system32\DllHost.exe[6676] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 00000001002f0b14 .text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac .text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc .text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284 .text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c .text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4 .text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4 .text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c .text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62] .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001002401f8 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001002403fc .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 0000000100240804 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 0000000100240600 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 0000000100240a08 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 0000000100251014 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 0000000100250804 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 0000000100250a08 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 0000000100250c0c .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 0000000100250e10 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001002501f8 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001002503fc .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 0000000100250600 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000075751465 2 bytes [75, 75] .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000757514bb 2 bytes [75, 75] .text ... * 2 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62] .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001002301f8 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001002303fc .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 0000000100230804 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 0000000100230600 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 0000000100230a08 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 0000000100241014 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 0000000100240804 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 0000000100240a08 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 0000000100240c0c .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 0000000100240e10 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001002401f8 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001002403fc .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 0000000100240600 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000075751465 2 bytes [75, 75] .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000757514bb 2 bytes [75, 75] .text ... * 2 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62] .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001000901f8 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001000903fc .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 0000000100090804 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 0000000100090600 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 0000000100090a08 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 00000001000a1014 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 00000001000a0804 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 00000001000a0a08 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 00000001000a0c0c .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 00000001000a0e10 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001000a01f8 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001000a03fc .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 00000001000a0600 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62] .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001002c01f8 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001002c03fc .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 00000001002c0804 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 00000001002c0600 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 00000001002c0a08 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 00000001002d1014 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 00000001002d0804 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 00000001002d0a08 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 00000001002d0c0c |
31.08.2013, 14:05 | #5 |
| 2ter Rechner mit Win32.downloader.gen (Win 7) Gmer Teil 3: Code:
ATTFilter .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 00000001002d0e10 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001002d01f8 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001002d03fc .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 00000001002d0600 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075751465 2 bytes [75, 75] .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000757514bb 2 bytes [75, 75] .text ... * 2 .text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010038075c .text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001003803a4 .text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100380b14 .text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100380ecc .text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010038163c .text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100381284 .text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001003819f4 .text C:\Windows\system32\taskhost.exe[3212] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac .text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc .text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284 .text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c .text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4 .text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4 .text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c .text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14 .text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010027075c .text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001002703a4 .text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100270b14 .text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100270ecc .text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010027163c .text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100271284 .text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001002719f4 .text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac .text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc .text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284 .text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c .text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4 .text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4 .text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c .text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14 .text C:\Windows\system32\AUDIODG.EXE[8284] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62] .text C:\Users\Bernhard Speiser\Desktop\gmer_2.1.19163.exe[1492] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62] ---- Threads - GMER 2.1 ---- Thread C:\Windows\System32\svchost.exe [4248:4860] 000007fef0c59688 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Type 2 Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Start 2 Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@ErrorControl 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DisplayName aswFsBlk Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Group FSFilter Activity Monitor Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DependOnService FltMgr? Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk) Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Tag 3 Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400 Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0 Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Type 2 Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Start 2 Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ErrorControl 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DisplayName aswMonFlt Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Group FSFilter Anti-Virus Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DependOnService FltMgr? Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt) Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700 Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0 Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Type 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Start 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ErrorControl 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DisplayName aswRdr Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Group PNP_TDI Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DependOnService tcpip? Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Description avast! WFP Redirect driver Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@DisableAutostart 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@MSIgnoreLSPDefault Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Type 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Start 0 Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@ErrorControl 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@DisplayName aswRvrt Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Description avast! Revert Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@BootCounter 51 Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@TickCounter 308742 Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@ImproperShutdown 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Type 2 Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Start 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@ErrorControl 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DisplayName aswSnx Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Group FSFilter Virtualization Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DependOnService FltMgr? Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Description avast! virtualization driver (aswSnx) Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Tag 2 Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances@DefaultInstance aswSnx Instance Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Altitude 137600 Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Flags 0 Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Type 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Start 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@ErrorControl 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@DisplayName aswSP Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Description avast! Self Protection Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@BehavShield 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@GadgetFolder \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@NoWelcomeScreen 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Type 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Start 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@ErrorControl 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DisplayName avast! Network Shield Support Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Group PNP_TDI Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DependOnService tcpip? Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Description avast! Network Shield TDI driver Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Tag 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi\Parameters Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi\Parameters@DisableAutostart 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi\Parameters@ProviderStart 3 Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Type 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Start 0 Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@ErrorControl 1 Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@DisplayName aswVmm Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Description avast! VM Monitor Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm\Parameters Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Type 32 Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Start 2 Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ErrorControl 1 Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe" Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DisplayName avast! Antivirus Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Group ShellSvcGroup Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS? Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@WOW64 1 Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ObjectName LocalSystem Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ServiceSidType 1 Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Description Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer. Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Type 2 Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Start 2 Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@ErrorControl 1 Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DisplayName aswFsBlk Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Group FSFilter Activity Monitor Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DependOnService FltMgr? Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk) Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Tag 3 Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400 Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0 Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Type 2 Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Start 2 Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ErrorControl 1 Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DisplayName aswMonFlt Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Group FSFilter Anti-Virus Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DependOnService FltMgr? Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt) Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700 Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0 Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Type 1 Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Start 1 Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ErrorControl 1 Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DisplayName aswRdr Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Group PNP_TDI Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DependOnService tcpip? Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Description avast! WFP Redirect driver Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@DisableAutostart 1 Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@MSIgnoreLSPDefault Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Type 1 Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Start 0 Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@ErrorControl 1 Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@DisplayName aswRvrt Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Description avast! Revert Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@BootCounter 51 Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@TickCounter 308742 Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@ImproperShutdown 1 Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Type 2 Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Start 1 Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@ErrorControl 1 Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DisplayName aswSnx Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Group FSFilter Virtualization Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DependOnService FltMgr? Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Description avast! virtualization driver (aswSnx) Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Tag 2 Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances@DefaultInstance aswSnx Instance Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Altitude 137600 Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Flags 0 Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Type 1 Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Start 1 Reg HKLM\SYSTEM\ControlSet002\services\aswSP@ErrorControl 1 Reg HKLM\SYSTEM\ControlSet002\services\aswSP@DisplayName aswSP Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Description avast! Self Protection Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@BehavShield 1 Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@GadgetFolder \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Type 1 Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Start 1 Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@ErrorControl 1 Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DisplayName avast! Network Shield Support Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Group PNP_TDI Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DependOnService tcpip? Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Description avast! Network Shield TDI driver Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Tag 1 Reg HKLM\SYSTEM\ControlSet002\services\aswTdi\Parameters (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\aswTdi\Parameters@DisableAutostart 1 Reg HKLM\SYSTEM\ControlSet002\services\aswTdi\Parameters@ProviderStart 1 Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Type 1 Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Start 0 Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@ErrorControl 1 Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@DisplayName aswVmm Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Description avast! VM Monitor Reg HKLM\SYSTEM\ControlSet002\services\aswVmm\Parameters (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Type 32 Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Start 2 Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ErrorControl 1 Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe" Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DisplayName avast! Antivirus Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Group ShellSvcGroup Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS? Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@WOW64 1 Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ObjectName LocalSystem Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ServiceSidType 1 Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Description Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer. ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ---- Vielen Dank |
31.08.2013, 14:34 | #6 | |
/// the machine /// TB-Ausbilder | 2ter Rechner mit Win32.downloader.gen (Win 7)Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ --> 2ter Rechner mit Win32.downloader.gen (Win 7) |
31.08.2013, 15:46 | #7 |
| 2ter Rechner mit Win32.downloader.gen (Win 7) So da ist das Logfile von Combofix: Code:
ATTFilter Combofix Logfile: |
31.08.2013, 20:24 | #8 |
/// the machine /// TB-Ausbilder | 2ter Rechner mit Win32.downloader.gen (Win 7) Downloade Dir bitte Malwarebytes Anti-Malware
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
01.09.2013, 12:12 | #9 |
| 2ter Rechner mit Win32.downloader.gen (Win 7) Ok, hab alles gemacht: Malware Logfile (mbam-log-2013-09-01 (11-57-08)): Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.01.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16660 Bernhard Speiser :: BSP [Administrator] Schutz: Deaktiviert 01.09.2013 11:57:08 mbam-log-2013-09-01 (11-57-08).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 280716 Laufzeit: 3 Minute(n), 25 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.001 - Report created 01/09/2013 at 12:44:25 # Updated 24/08/2013 by Xplode # Operating System : Windows 7 Home Premium Service Pack 1 (64 bits) # Username : Bernhard Speiser - BSP # Running from : C:\Users\Bernhard Speiser\Desktop\adwcleaner.exe # Option : Clean ***** [ Services ] ***** ***** [ Files / Folders ] ***** Folder Deleted : C:\ProgramData\Partner Folder Deleted : C:\Users\Bernhard Speiser\AppData\LocalLow\Conduit Folder Deleted : C:\Users\Bernhard Speiser\AppData\Roaming\CheckPoint\ZoneAlarm LTD Toolbar Folder Deleted : C:\Users\Gast\AppData\Roaming\CheckPoint\ZoneAlarm LTD Toolbar File Deleted : C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Firefox\Profiles\49a0ufp2.default\searchplugins\Conduit.xml File Deleted : C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Firefox\Profiles\49a0ufp2.default\searchplugins\zonealarm.xml File Deleted : C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Firefox\Profiles\49a0ufp2.default\user.js ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@checkpoint.com/FFApi Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Deleted : HKCU\Software\YahooPartnerToolbar Key Deleted : HKCU\Software\AppDataLow\Toolbar Key Deleted : HKCU\Software\AppDataLow\Software\Conduit Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm LTD Toolbar ***** [ Browsers ] ***** -\\ Internet Explorer v10.0.9200.16660 -\\ Mozilla Firefox v23.0.1 (de) [ File : C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Firefox\Profiles\49a0ufp2.default\prefs.js ] Line Deleted : user_pref("browser.search.defaultthis.engineName", "ZoneAlarm-Sicherheit Customized Web Search"); Line Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2613550&SearchSource=3&q={searchTerms}"); [ File : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\053fdzoy.default\prefs.js ] ************************* AdwCleaner[R0].txt - [3495 octets] - [01/09/2013 12:44:01] AdwCleaner[S0].txt - [3306 octets] - [01/09/2013 12:44:25] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3366 octets] ########## JRT Logfile: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 5.5.6 (08.30.2013:1) OS: Windows 7 Home Premium x64 Ran by Bernhard Speiser on 01.09.2013 at 12:49:11,89 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Toolbar.CT2613550 ~~~ Files ~~~ Folders ~~~ FireFox Emptied folder: C:\Users\Bernhard Speiser\AppData\Roaming\mozilla\firefox\profiles\49a0ufp2.default\minidumps [71 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 01.09.2013 at 12:54:01,77 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-09-2013 Ran by Bernhard Speiser (administrator) on BSP on 01-09-2013 13:02:02 Running from C:\Users\Bernhard Speiser\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\system32\atiesrxx.exe (AMD) C:\Windows\system32\atieclxx.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Microsoft Corporation) C:\Windows\system32\CISVC.EXE (Microsoft Corporation) C:\Windows\system32\inetsrv\inetinfo.exe (Intel Corporation) C:\Windows\system32\IProsetMonitor.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe (Microsoft Corporation) C:\Windows\System32\tcpsvcs.exe (Microsoft Corporation) C:\Windows\System32\snmp.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Dropbox, Inc.) C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Farbar) C:\Users\Bernhard Speiser\Desktop\FRST64(1).exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11490408 2010-10-22] (Realtek Semiconductor) HKLM\...\Policies\Explorer: [NoDrives] 0 HKCU\...\Policies\Explorer: [NoDrives] 0 HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-10-01] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-09-14] (Intel Corporation) HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-03] (CyberLink) HKLM-x32\...\Run: [BDRegion] - C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2010-01-19] (cyberlink) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.) Startup: C:\Users\Bernhard Speiser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Bernhard Speiser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== ProxyServer: localhost:8080 HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=MDNB&bmod=MDNB StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) Toolbar: HKCU - No Name - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Firefox\Profiles\49a0ufp2.default FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll () FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @videolan.org/vlc,version=1.1.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker ==================== Services (Whitelisted) ================= R2 ftpsvc; C:\Windows\system32\inetsrv\ftpsvc.dll [350720 2012-06-01] (Microsoft Corporation) R2 IISADMIN; C:\Windows\system32\inetsrv\inetinfo.exe [15872 2010-11-20] (Microsoft Corporation) R2 iprip; C:\Windows\System32\iprip.dll [35328 2009-07-14] (Microsoft Corporation) R2 LPDSVC; C:\Windows\system32\lpdsvc.dll [45568 2009-07-14] (Microsoft Corporation) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-04-17] () R2 SNMP; C:\Windows\System32\snmp.exe [49664 2010-11-20] (Microsoft Corporation) R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation) S3 WMSVC; C:\Windows\system32\inetsrv\wmsvc.exe [10752 2009-07-14] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== S3 IAMTVE; C:\Windows\system32\DRIVERS\IAMTVE.sys [43416 2007-04-12] (Intel Corporation) S3 IAMTXPE; C:\Windows\system32\DRIVERS\IAMTXPE.sys [51096 2007-04-12] (Intel Corporation) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R2 {B154377D-700F-42cc-9474-23858FBDF4BD}; C:\Program Files (x86)\CyberLink\PowerDVD9\000.fcl [146928 2010-01-20] (CyberLink Corp.) R2 {B154377D-700F-42cc-9474-23858FBDF4BD}; C:\Program Files (x86)\CyberLink\PowerDVD9\000.fcl [146928 2010-01-20] (CyberLink Corp.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [x] S3 GEARAspiWDM; system32\DRIVERS\GEARAspiWDM.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-09-01 13:01 - 2013-09-01 13:01 - 01590206 _____ (Farbar) C:\Users\Bernhard Speiser\Desktop\FRST64(1).exe 2013-09-01 12:54 - 2013-09-01 12:56 - 00000978 _____ C:\Users\Bernhard Speiser\Desktop\JRT.txt 2013-09-01 12:49 - 2013-09-01 12:49 - 00000000 ____D C:\Windows\ERUNT 2013-09-01 12:47 - 2013-09-01 12:47 - 00003450 _____ C:\Users\Bernhard Speiser\Desktop\AdwCleaner[S0].txt 2013-09-01 12:43 - 2013-09-01 12:44 - 00000000 ____D C:\AdwCleaner 2013-09-01 11:53 - 2013-09-01 11:53 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-09-01 11:53 - 2013-09-01 11:53 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-09-01 11:53 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-09-01 11:46 - 2013-09-01 11:46 - 00000000 ____D C:\Users\Bernhard Speiser\AppData\Roaming\Malwarebytes 2013-09-01 11:40 - 2013-09-01 11:40 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-09-01 11:36 - 2013-09-01 11:36 - 00001787 _____ C:\Users\Public\Desktop\iTunes.lnk 2013-09-01 11:36 - 2013-09-01 11:36 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-09-01 11:36 - 2013-09-01 11:36 - 00000000 ____D C:\Program Files\iTunes 2013-09-01 11:36 - 2013-09-01 11:36 - 00000000 ____D C:\Program Files\iPod 2013-09-01 11:36 - 2013-09-01 11:36 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-09-01 11:32 - 2013-09-01 11:32 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Bernhard Speiser\Downloads\mbam-setup-1.75.0.1300.exe 2013-09-01 11:32 - 2013-09-01 11:32 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Bernhard Speiser\Desktop\mbam-setup-1.75.0.1300.exe 2013-08-31 16:31 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2013-08-31 16:31 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2013-08-31 16:31 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2013-08-31 16:31 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2013-08-31 16:31 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2013-08-31 16:31 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2013-08-31 16:31 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2013-08-31 16:31 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2013-08-31 16:31 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2013-08-31 16:31 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2013-08-31 16:31 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2013-08-31 16:30 - 2013-08-31 16:30 - 00020017 _____ C:\ComboFix.txt 2013-08-31 16:20 - 2013-08-31 16:30 - 00000000 ____D C:\Qoobox 2013-08-31 16:20 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe 2013-08-31 16:20 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe 2013-08-31 16:20 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2013-08-31 16:20 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2013-08-31 16:20 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2013-08-31 16:20 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe 2013-08-31 16:20 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe 2013-08-31 16:20 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe 2013-08-31 15:55 - 2013-08-31 16:29 - 00000000 ____D C:\Windows\erdnt 2013-08-31 14:35 - 2013-08-31 14:35 - 01027511 _____ (Thisisu) C:\Users\Bernhard Speiser\Desktop\JRT.exe 2013-08-31 14:34 - 2013-08-31 14:35 - 05117322 ____R (Swearware) C:\Users\Bernhard Speiser\Desktop\ComboFix.exe 2013-08-31 14:34 - 2013-08-31 14:35 - 00994642 _____ C:\Users\Bernhard Speiser\Desktop\adwcleaner.exe 2013-08-31 14:22 - 2013-08-31 14:22 - 00062464 _____ C:\Users\Bernhard Speiser\Desktop\Fragebogen Gehalt 09-2012_mit IBAN_11072013.xls 2013-08-31 13:53 - 2013-08-31 13:53 - 00027577 _____ C:\Users\Bernhard Speiser\Desktop\Logfiles.zip 2013-08-31 13:50 - 2013-08-31 13:53 - 00000000 ____D C:\Users\Bernhard Speiser\AppData\Roaming\WinRAR 2013-08-31 13:50 - 2013-08-31 13:50 - 01758824 _____ C:\Users\Bernhard Speiser\Downloads\winrar-x64-420d.exe 2013-08-31 13:50 - 2013-08-31 13:50 - 00000000 ____D C:\Users\Bernhard Speiser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR 2013-08-31 13:50 - 2013-08-31 13:50 - 00000000 ____D C:\Program Files\WinRAR 2013-08-31 13:18 - 2013-08-31 13:18 - 00456968 _____ C:\Windows\Minidump\083113-20311-01.dmp 2013-08-31 13:02 - 2013-08-31 13:02 - 00165091 _____ C:\Users\Bernhard Speiser\Desktop\Gmerlog.log 2013-08-31 12:40 - 2013-08-31 12:40 - 00000494 _____ C:\Users\Bernhard Speiser\Desktop\defogger_disable.log 2013-08-31 12:40 - 2013-08-31 12:40 - 00000000 ____D C:\FRST 2013-08-31 12:40 - 2013-08-31 12:40 - 00000000 _____ C:\Users\Bernhard Speiser\defogger_reenable 2013-08-31 12:37 - 2013-08-31 12:37 - 00377856 _____ C:\Users\Bernhard Speiser\Downloads\gmer_2.1.19163.exe 2013-08-31 12:37 - 2013-08-31 12:37 - 00377856 _____ C:\Users\Bernhard Speiser\Desktop\gmer_2.1.19163.exe 2013-08-31 12:36 - 2013-08-31 12:36 - 01587214 _____ (Farbar) C:\Users\Bernhard Speiser\Downloads\FRST64.exe 2013-08-31 12:35 - 2013-08-31 12:35 - 01082213 _____ (Farbar) C:\Users\Bernhard Speiser\Downloads\FRST.exe 2013-08-31 12:35 - 2013-08-31 12:35 - 00050477 _____ C:\Users\Bernhard Speiser\Desktop\Defogger.exe 2013-08-31 11:03 - 2013-08-31 11:03 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking 2013-08-31 11:02 - 2013-08-31 14:38 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2 2013-08-31 11:02 - 2013-08-31 12:32 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-08-31 10:57 - 2013-08-31 10:58 - 37672592 _____ (Safer-Networking Ltd. ) C:\Users\Bernhard Speiser\Downloads\spybotsd-2.1.21-SR2.exe 2013-08-31 09:31 - 2013-08-31 09:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-08-29 12:59 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-08-29 12:59 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-08-29 12:59 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-08-29 12:59 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-08-29 12:59 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-08-29 12:59 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-08-29 12:59 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-08-29 12:59 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-08-29 12:59 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-08-29 12:59 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-08-29 12:59 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-08-29 12:59 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-08-29 12:08 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL 2013-08-29 12:08 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL 2013-08-29 12:08 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2013-08-29 12:08 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2013-08-29 12:08 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2013-08-29 12:08 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2013-08-29 12:08 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2013-08-29 12:08 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2013-08-29 12:08 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll 2013-08-29 12:08 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2013-08-29 12:08 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2013-08-29 12:08 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2013-08-29 12:08 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2013-08-29 12:08 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll 2013-08-29 12:08 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys 2013-08-29 12:07 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys ==================== One Month Modified Files and Folders ======= 2013-09-01 13:01 - 2013-09-01 13:01 - 01590206 _____ (Farbar) C:\Users\Bernhard Speiser\Downloads\FRST64(1).exe 2013-09-01 13:01 - 2013-09-01 13:01 - 01590206 _____ (Farbar) C:\Users\Bernhard Speiser\Desktop\FRST64(1).exe 2013-09-01 12:56 - 2013-09-01 12:54 - 00000978 _____ C:\Users\Bernhard Speiser\Desktop\JRT.txt 2013-09-01 12:52 - 2009-07-14 06:45 - 00010096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-09-01 12:52 - 2009-07-14 06:45 - 00010096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-09-01 12:49 - 2013-09-01 12:49 - 00000000 ____D C:\Windows\ERUNT 2013-09-01 12:49 - 2011-03-17 00:02 - 01750658 _____ C:\Windows\WindowsUpdate.log 2013-09-01 12:47 - 2013-09-01 12:47 - 00003450 _____ C:\Users\Bernhard Speiser\Desktop\AdwCleaner[S0].txt 2013-09-01 12:47 - 2011-05-24 21:03 - 00000000 ___RD C:\Users\Bernhard Speiser\Dropbox 2013-09-01 12:47 - 2011-05-24 21:01 - 00000000 ____D C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox 2013-09-01 12:47 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\inetsrv 2013-09-01 12:45 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-09-01 12:45 - 2009-07-14 06:51 - 00116756 _____ C:\Windows\setupact.log 2013-09-01 12:44 - 2013-09-01 12:43 - 00000000 ____D C:\AdwCleaner 2013-09-01 12:44 - 2013-07-27 23:26 - 00000000 ____D C:\Users\Gast\AppData\Roaming\CheckPoint 2013-09-01 12:10 - 2012-04-01 18:06 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-09-01 11:53 - 2013-09-01 11:53 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-09-01 11:53 - 2013-09-01 11:53 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-09-01 11:46 - 2013-09-01 11:46 - 00000000 ____D C:\Users\Bernhard Speiser\AppData\Roaming\Malwarebytes 2013-09-01 11:40 - 2013-09-01 11:40 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-09-01 11:36 - 2013-09-01 11:36 - 00001787 _____ C:\Users\Public\Desktop\iTunes.lnk 2013-09-01 11:36 - 2013-09-01 11:36 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-09-01 11:36 - 2013-09-01 11:36 - 00000000 ____D C:\Program Files\iTunes 2013-09-01 11:36 - 2013-09-01 11:36 - 00000000 ____D C:\Program Files\iPod 2013-09-01 11:36 - 2013-09-01 11:36 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-09-01 11:32 - 2013-09-01 11:32 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Bernhard Speiser\Downloads\mbam-setup-1.75.0.1300.exe 2013-09-01 11:32 - 2013-09-01 11:32 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Bernhard Speiser\Desktop\mbam-setup-1.75.0.1300.exe 2013-09-01 11:28 - 2013-07-11 20:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird 2013-09-01 11:19 - 2010-11-29 15:52 - 00093344 _____ C:\Windows\PFRO.log 2013-08-31 16:30 - 2013-08-31 16:30 - 00020017 _____ C:\ComboFix.txt 2013-08-31 16:30 - 2013-08-31 16:20 - 00000000 ____D C:\Qoobox 2013-08-31 16:29 - 2013-08-31 15:55 - 00000000 ____D C:\Windows\erdnt 2013-08-31 16:28 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini 2013-08-31 16:17 - 2011-03-17 00:45 - 00000000 ____D C:\ProgramData\AVAST Software 2013-08-31 14:38 - 2013-08-31 11:02 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2 2013-08-31 14:35 - 2013-08-31 14:35 - 01027511 _____ (Thisisu) C:\Users\Bernhard Speiser\Desktop\JRT.exe 2013-08-31 14:35 - 2013-08-31 14:34 - 05117322 ____R (Swearware) C:\Users\Bernhard Speiser\Desktop\ComboFix.exe 2013-08-31 14:35 - 2013-08-31 14:34 - 00994642 _____ C:\Users\Bernhard Speiser\Desktop\adwcleaner.exe 2013-08-31 14:22 - 2013-08-31 14:22 - 00062464 _____ C:\Users\Bernhard Speiser\Desktop\Fragebogen Gehalt 09-2012_mit IBAN_11072013.xls 2013-08-31 13:53 - 2013-08-31 13:53 - 00027577 _____ C:\Users\Bernhard Speiser\Desktop\Logfiles.zip 2013-08-31 13:53 - 2013-08-31 13:50 - 00000000 ____D C:\Users\Bernhard Speiser\AppData\Roaming\WinRAR 2013-08-31 13:50 - 2013-08-31 13:50 - 01758824 _____ C:\Users\Bernhard Speiser\Downloads\winrar-x64-420d.exe 2013-08-31 13:50 - 2013-08-31 13:50 - 00000000 ____D C:\Users\Bernhard Speiser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR 2013-08-31 13:50 - 2013-08-31 13:50 - 00000000 ____D C:\Program Files\WinRAR 2013-08-31 13:18 - 2013-08-31 13:18 - 00456968 _____ C:\Windows\Minidump\083113-20311-01.dmp 2013-08-31 13:18 - 2012-06-22 00:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-08-31 13:18 - 2011-05-26 07:57 - 1006322187 _____ C:\Windows\MEMORY.DMP 2013-08-31 13:18 - 2011-05-26 07:57 - 00000000 ____D C:\Windows\Minidump 2013-08-31 13:02 - 2013-08-31 13:02 - 00165091 _____ C:\Users\Bernhard Speiser\Desktop\Gmerlog.log 2013-08-31 12:40 - 2013-08-31 12:40 - 00000494 _____ C:\Users\Bernhard Speiser\Desktop\defogger_disable.log 2013-08-31 12:40 - 2013-08-31 12:40 - 00000000 ____D C:\FRST 2013-08-31 12:40 - 2013-08-31 12:40 - 00000000 _____ C:\Users\Bernhard Speiser\defogger_reenable 2013-08-31 12:40 - 2011-03-17 00:05 - 00000000 ____D C:\Users\Bernhard Speiser 2013-08-31 12:37 - 2013-08-31 12:37 - 00377856 _____ C:\Users\Bernhard Speiser\Downloads\gmer_2.1.19163.exe 2013-08-31 12:37 - 2013-08-31 12:37 - 00377856 _____ C:\Users\Bernhard Speiser\Desktop\gmer_2.1.19163.exe 2013-08-31 12:36 - 2013-08-31 12:36 - 01587214 _____ (Farbar) C:\Users\Bernhard Speiser\Downloads\FRST64.exe 2013-08-31 12:35 - 2013-08-31 12:35 - 01082213 _____ (Farbar) C:\Users\Bernhard Speiser\Downloads\FRST.exe 2013-08-31 12:35 - 2013-08-31 12:35 - 00050477 _____ C:\Users\Bernhard Speiser\Desktop\Defogger.exe 2013-08-31 12:32 - 2013-08-31 11:02 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-08-31 12:12 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache 2013-08-31 11:03 - 2013-08-31 11:03 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking 2013-08-31 10:58 - 2013-08-31 10:57 - 37672592 _____ (Safer-Networking Ltd. ) C:\Users\Bernhard Speiser\Downloads\spybotsd-2.1.21-SR2.exe 2013-08-31 09:31 - 2013-08-31 09:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-08-29 12:55 - 2010-11-25 18:28 - 00777172 _____ C:\Windows\system32\perfh007.dat 2013-08-29 12:55 - 2010-11-25 18:28 - 00176608 _____ C:\Windows\system32\perfc007.dat 2013-08-29 12:55 - 2009-07-14 07:13 - 01835326 _____ C:\Windows\system32\PerfStringBackup.INI 2013-08-29 12:52 - 2013-07-27 16:56 - 00000000 ____D C:\Windows\system32\MRT 2013-08-29 12:49 - 2010-11-26 19:57 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-08-29 12:10 - 2012-04-01 18:06 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-08-29 12:10 - 2012-04-01 18:06 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2013-08-29 12:10 - 2011-06-03 15:30 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-08-07 04:22 - 2010-11-26 19:22 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe Files to move or delete: ==================== C:\Users\BERNHA~1\AppData\Local\Temp\Quarantine.exe C:\Users\BERNHA~1\AppData\Local\Temp\jrt\erunt\ERUNT.EXE ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-09-01 12:14 ==================== End Of Log ============================ Addition.txt: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-09-2013 Ran by Bernhard Speiser at 2013-09-01 13:02:45 Running from C:\Users\Bernhard Speiser\Desktop Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Acrobat.com (x32 Version: 1.6.65) Adobe AIR (x32 Version: 3.7.0.1530) Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94) Adobe Reader X (10.1.7) - Deutsch (x32 Version: 10.1.7) Apple Application Support (x32 Version: 2.3.4) Apple Mobile Device Support (Version: 6.1.0.13) Apple Software Update (x32 Version: 2.1.3.127) ATI Catalyst Install Manager (Version: 3.0.795.0) BioShock (x32 Version: 2.62.0000) Bonjour (Version: 3.0.0.10) Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0930.2237.38732) Catalyst Control Center InstallProxy (x32 Version: 2010.0930.2237.38732) Catalyst Control Center Localization All (x32 Version: 2010.0930.2237.38732) CCC Help Danish (x32 Version: 2010.0930.2236.38732) CCC Help Dutch (x32 Version: 2010.0930.2236.38732) CCC Help English (x32 Version: 2010.0930.2236.38732) CCC Help Finnish (x32 Version: 2010.0930.2236.38732) CCC Help French (x32 Version: 2010.0930.2236.38732) CCC Help German (x32 Version: 2010.0930.2236.38732) CCC Help Italian (x32 Version: 2010.0930.2236.38732) CCC Help Japanese (x32 Version: 2010.0930.2236.38732) CCC Help Norwegian (x32 Version: 2010.0930.2236.38732) CCC Help Spanish (x32 Version: 2010.0930.2236.38732) CCC Help Swedish (x32 Version: 2010.0930.2236.38732) ccc-core-static (x32 Version: 2010.0930.2237.38732) ccc-utility64 (Version: 2010.0930.2237.38732) Control ActiveX de Windows Live Mesh para conexiones remotas (x32 Version: 15.4.5722.2) Contrôle ActiveX Windows Live Mesh pour connexions à distance (x32 Version: 15.4.5722.2) Controlo ActiveX do Windows Live Mesh para Ligações Remotas (x32 Version: 15.4.5722.2) CyberLink LabelPrint (x32 Version: 2.5.2602) CyberLink Power2Go (x32 Version: 6.1.3802) CyberLink PowerDirector (x32 Version: 8.0.2815) CyberLink PowerDVD 9 (x32 Version: 9.0.2519.50) CyberLink PowerDVD Copy (x32 Version: 1.5.1306) CyberLink PowerProducer (x32 Version: 5.0.2.2326) D3DX10 (x32 Version: 15.4.2368.0902) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32) Dropbox (HKCU Version: 2.0.22) Fotogalerija Windows Live (x32 Version: 15.4.3502.0922) Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922) Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922) Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922) Galerie de photos Windows Live (x32 Version: 15.4.3502.0922) Intel(R) Management Engine Components (x32 Version: 7.0.0.1118) Intel(R) Network Connections 15.6.25.0 (Version: 15.6.25.0) Intel(R) Rapid Storage Technology (x32 Version: 10.0.0.1046) iTunes (Version: 11.0.5.5) Java Auto Updater (x32 Version: 2.0.7.1) Java(TM) 6 Update 31 (x32 Version: 6.0.310) Junk Mail filter update (x32 Version: 15.4.3502.0922) Kontrolnik Windows Live Mesh ActiveX za oddaljene povezave (x32 Version: 15.4.5722.2) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Medion Home Cinema (x32 Version: 8.0.1517) Mesh Runtime (x32 Version: 15.4.5722.2) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Office 2010 Service Pack 1 (SP1) (x32) Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Home and Student 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000) Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000) Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Single Image 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1) Mozilla Maintenance Service (x32 Version: 23.0.1) Mozilla Thunderbird 17.0.7 (x86 de) (x32 Version: 17.0.7) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT_amd64 (x32 Version: 15.4.2862.0708) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) MSXML 4.0 SP3 Parser (KB2721691) (x32 Version: 4.30.2114.0) MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0) MSXML 4.0 SP3 Parser (KB973685) (x32 Version: 4.30.2107.0) NVIDIA PhysX (x32 Version: 9.10.0222) PlayReady PC Runtime amd64 (Version: 1.3.0) Poczta usługi Windows Live (x32 Version: 15.4.3502.0922) Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922) Pošta Windows Live (x32 Version: 15.4.3502.0922) QuickTime (x32 Version: 7.74.80.86) Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922) Realtek High Definition Audio Driver (x32 Version: 6.0.1.6225) Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.26.0) rosoft .NET Framework 4 Client Profile (Version: 4.0.30319) Skype Click to Call (x32 Version: 5.6.8442) Skype™ 5.10 (x32 Version: 5.10.116) swMSM (x32 Version: 12.0.0.1) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1) Update for Microsoft Office 2010 (KB2494150) (x32) Update for Microsoft Office 2010 (KB2553065) (x32) Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2566458) (x32) Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32) Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32) Update for Microsoft Outlook 2010 (KB2597090) 32-Bit Edition (x32) Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32) Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32) Update for Microsoft PowerPoint 2010 (KB2598240) 32-Bit Edition (x32) Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32) VLC media player 1.1.7 (x32 Version: 1.1.7) Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3502.0922) Windows Live Fotogalerie (x32 Version: 15.4.3502.0922) Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922) Windows Live Fotótár (x32 Version: 15.4.3502.0922) Windows Live ID Sign-in Assistant (Version: 7.250.4225.0) Windows Live Installer (x32 Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3502.0922) Windows Live Mail (x32 Version: 15.4.3502.0922) Windows Live Mesh (x32 Version: 15.4.3502.0922) Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2) Windows Live Messenger (x32 Version: 15.4.3502.0922) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Movie Maker (x32 Version: 15.4.3502.0922) Windows Live Photo Common (x32 Version: 15.4.3502.0922) Windows Live Photo Gallery (x32 Version: 15.4.3502.0922) Windows Live PIMT Platform (x32 Version: 15.4.3502.0922) Windows Live Remote Client (Version: 15.4.5722.2) Windows Live Remote Client Resources (Version: 15.4.5722.2) Windows Live Remote Service (Version: 15.4.5722.2) Windows Live Remote Service Resources (Version: 15.4.5722.2) Windows Live SOXE (x32 Version: 15.4.3502.0922) Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922) Windows Live UX Platform (x32 Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922) Windows Live Writer (x32 Version: 15.4.3502.0922) Windows Live Writer Resources (x32 Version: 15.4.3502.0922) WinRAR 4.20 (64-Bit) (Version: 4.20.0) Yahoo! Detect (x32) Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922) ==================== Restore Points ========================= 17-07-2013 18:46:02 Windows Update 17-07-2013 21:45:55 Windows Update 22-07-2013 20:22:11 Windows Update 27-07-2013 09:46:25 Windows Update 27-07-2013 14:55:49 Windows Update 29-08-2013 10:07:31 Windows Update 29-08-2013 10:48:15 Windows Update 31-08-2013 14:13:03 avast! Free Antivirus Setup 31-08-2013 15:19:59 Windows Update ==================== Hosts content: ========================== 2009-07-14 04:34 - 2013-08-31 16:28 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= Task: {2054264E-29A2-4F78-9CE8-390498C6EFF9} - System32\Tasks\{236C362C-4AAA-47B0-B5B5-7E635C71CF60} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2012-07-13] (Skype Technologies S.A.) Task: {62571FCC-E764-4A7F-9AAF-B0AA4E33D015} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation) Task: {77D903ED-A9EA-43BF-93B1-F0D2BD3067CC} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation) Task: {7E361E09-42F3-4EFE-BACA-5DF606A86C11} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task Task: {A35C0DD6-2375-4838-9A7A-377581035B7E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-29] (Adobe Systems Incorporated) Task: {AA4C3CFE-FC3F-4CFC-94F0-F1C424120D4F} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe ==================== Loaded Modules (whitelisted) ============= 2010-11-25 18:07 - 2010-09-29 03:14 - 00039936 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiuxp64.dll 2010-11-25 18:07 - 2010-09-29 03:54 - 00628224 _____ (ATI Technologies Inc. ) C:\Windows\system32\aticfx64.dll 2010-11-25 18:07 - 2010-09-29 03:37 - 04660224 _____ (ATI Technologies Inc. ) C:\Windows\system32\atidxx64.dll 2013-07-11 20:47 - 2013-04-24 00:56 - 09991832 _____ (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll 2013-07-17 20:43 - 2013-07-17 20:43 - 15577088 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\88744044294787b99dd4a8704ab75a79\mscorlib.ni.dll 2013-01-22 22:11 - 2012-10-05 12:52 - 01574496 _____ (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll 2013-08-31 09:28 - 2013-08-31 09:28 - 10655744 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System\af0a0b96a02f9925eb84392ee65a5cfa\System.ni.dll 2013-08-31 09:29 - 2013-08-31 09:29 - 02320384 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Drawing\868d117286ad259249f31d3fe813d39a\System.Drawing.ni.dll 2013-08-31 09:29 - 2013-08-31 09:29 - 17383424 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Windows.Forms\95674cb72317e3a5380ea450b913786f\System.Windows.Forms.ni.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00106496 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.Implementation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00032768 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\LOG.Foundation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00036864 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\LOG.Foundation.Private.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00065536 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\LOG.Foundation.Implementation.dll 2011-07-08 18:26 - 2010-11-13 02:08 - 00315392 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00005632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.Foundation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00020480 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\LOG.Foundation.Implementation.Private.dll 2013-08-31 09:30 - 2013-08-31 09:30 - 01022976 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Runtime.Remo#\5d7208467b0ffffee644a83f4e76fa12\System.Runtime.Remoting.ni.dll 2013-08-31 09:30 - 2013-08-31 09:30 - 15362048 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Web\1223cf3c9fcc905300e20364b7a26097\System.Web.ni.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00032768 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.Implementation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00015360 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\NEWAEM.Foundation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00098304 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Foundation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00057344 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.SkinFactory.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00028672 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Foundation.XManifest.dll 2013-08-31 09:28 - 2013-08-31 09:28 - 06964736 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Xml\3975acf49313ceea1280da91f0383480\System.Xml.ni.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00061440 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Runtime.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00049152 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Runtime.Shared.Private.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00040960 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Foundation.Private.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00005632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Runtime.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00032768 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\ATICCCom.dll 2010-04-29 13:30 - 2010-04-29 13:30 - 00066048 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\ADL.Foundation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00045056 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Server.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00006144 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Server.Shared.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00045056 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.Source.Kit.Server.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00006656 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.DPPE.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00007168 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.Hotkeys.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00006144 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.WinMessages.Shared.dll 2009-04-22 22:13 - 2009-04-22 22:13 - 00045056 _____ (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0601.dll 2010-03-04 10:27 - 2010-03-04 10:27 - 00016384 _____ (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Foundation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00006656 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.dll 2010-08-18 13:28 - 2010-08-18 13:28 - 00450560 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\ATIDEMGX.dll 2013-08-31 09:28 - 2013-08-31 09:28 - 01320448 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Configuration\1031b311ee568364d4ca1c4db634eaf0\System.Configuration.ni.dll 2010-11-25 18:07 - 2010-09-29 03:49 - 00421376 _____ (ATI Technologies, Inc.) C:\Windows\system32\atipdl64.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00385024 _____ (Advanced Mirco Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Runtime.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00155648 _____ (Advanced Mirco Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Shared.dll 2009-06-17 15:27 - 2009-06-17 15:27 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0709.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00005632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.GD.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00008192 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Actions.CCAA.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00007168 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\ResourceManagement.Foundation.Private.dll 2008-04-04 02:29 - 2008-04-04 02:29 - 00020480 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0804.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00045056 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00040960 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll 2010-10-01 08:32 - 2010-10-01 08:32 - 00040960 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00008704 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Runtime.Shared.Private.dll 2010-10-01 08:32 - 2010-10-01 08:32 - 00065536 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00036864 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00028672 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00053248 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceDFP.Graphics.Shared.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00032768 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceLCD.Graphics.Shared.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00028672 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CustomFormats.Graphics.Shared.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00073728 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Radeon3D.Graphics.Runtime.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00102400 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.MMVideo.Graphics.Runtime.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00069632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCV.Graphics.Runtime.dll 2010-10-01 08:36 - 2010-10-01 08:36 - 00013312 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Welcome.Graphics.Runtime.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00077824 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.OverDrive5.Graphics.Runtime.dll 2010-10-01 08:32 - 2010-10-01 08:32 - 00065536 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.MMVideo.Graphics.Shared.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00065536 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Radeon3D.Graphics.Shared.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00040960 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCV.Graphics.Shared.dll 2009-06-17 20:24 - 2009-06-17 20:24 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0906.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00024576 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysOptions.Graphics.shared.dll 2010-10-01 08:36 - 2010-10-01 08:36 - 00013824 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.TransCode.Graphics.Runtime.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00020480 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00053248 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCRT.Graphics.shared.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00009728 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Welcome.Graphics.shared.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00061440 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.OverDrive5.Graphics.shared.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00045056 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.TransCode.Graphics.shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00020480 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00077824 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceTV.Graphics.Runtime.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00065536 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceTV.Graphics.shared.dll 2009-12-08 16:49 - 2009-12-08 16:49 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0912.dll 2007-08-10 02:58 - 2007-08-10 02:58 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0706.dll 2009-06-17 20:24 - 2009-06-17 20:24 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0712.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00049152 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceProperty.Graphics.Shared.dll 2010-10-01 08:32 - 2010-10-01 08:32 - 00053248 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll 2008-12-30 21:04 - 2008-12-30 21:04 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0812.dll 2009-04-22 22:13 - 2009-04-22 22:13 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0805.dll 2007-05-03 03:44 - 2007-05-03 03:44 - 00020480 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0703.dll 2009-01-20 23:51 - 2009-01-20 23:51 - 00007168 _____ ( ) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atixclib.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00011776 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.HydraVision.Runtime.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00008704 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.HydraVision.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00061440 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\APM.Server.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00020480 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\APM.Foundation.dll 2011-07-10 08:37 - 2010-11-13 02:08 - 00434176 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00007168 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Runtime.Extension.EEU.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00005632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.REG.Shared.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00581632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Systemtray.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00005632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.EEU.Shared.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00040960 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Client.Shared.Private.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00405504 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Wizard.dll 2010-10-01 08:36 - 2010-10-01 08:36 - 00741376 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\ResourceManagement.Foundation.Implementation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00007680 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Client.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00020480 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Wizard.Shared.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00011776 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Wizard.Shared.Private.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00040960 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Wizard.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00016384 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Wizard.Shared.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00094208 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Radeon3D.Graphics.Wizard.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00409600 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.MMVideo.Graphics.Wizard.dll 2010-10-01 08:36 - 2010-10-01 08:36 - 01708032 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysManager2.Graphics.Wizard.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00204800 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.InfoCentre.Graphics.Wizard.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00007680 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.HydraVision.Wizard.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 01220608 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Dashboard.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00024576 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Dashboard.Shared.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00010240 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Dashboard.Shared.Private.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00073728 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Dashboard.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00016384 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Dashboard.Shared.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00065536 _____ (Advanced Mirco Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Welcome.Graphics.Dashboard.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00196608 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll 2010-10-01 08:36 - 2010-10-01 08:36 - 01306624 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysManager2.Graphics.Dashboard.dll 2010-10-01 08:36 - 2010-10-01 08:36 - 00270336 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00094208 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00397312 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll 2010-10-01 08:32 - 2010-10-01 08:32 - 00376832 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00397312 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00573440 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00880640 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.MMVideo.Graphics.Dashboard.dll 2010-10-01 08:36 - 2010-10-01 08:36 - 00184320 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.TransCode.Graphics.Dashboard.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00655360 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.OverDrive5.Graphics.Dashboard.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00007680 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.HydraVision.Dashboard.dll 2011-07-01 21:22 - 2010-11-20 15:26 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\hgprint.dll 2013-08-31 13:50 - 2012-06-09 19:20 - 00196096 _____ (Alexander Roshal) C:\Program Files\WinRAR\rarext.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00875008 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atiacm64.dll 2010-10-01 08:29 - 2010-10-01 08:29 - 00003584 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atiamdeu.dll 2009-07-14 02:17 - 2009-07-14 03:40 - 00024576 _____ (Microsoft Corporation) C:\Windows\System32\drprov.dll 2011-07-01 21:21 - 2010-11-20 15:27 - 00129536 _____ (Microsoft Corporation) C:\Windows\System32\ntlanman.dll 2011-07-01 21:22 - 2010-11-20 15:26 - 00100864 _____ (Microsoft Corporation) C:\Windows\System32\davclnt.dll 2011-07-01 21:21 - 2010-11-20 15:25 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\cabview.dll 2011-07-01 21:21 - 2010-11-20 15:25 - 00094720 _____ (Microsoft Corporation) C:\Windows\system32\Cabinet.dll 2009-07-14 01:19 - 2009-07-14 03:41 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\ktmw32.dll 2009-07-14 01:46 - 2009-07-14 03:41 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\tschannel.dll 2009-07-14 01:46 - 2009-07-14 03:41 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\TaskSchdPS.dll 2011-08-31 00:05 - 2011-08-31 00:05 - 00132968 _____ (Apple Inc.) C:\Program Files\Bonjour\mdnsNSP.dll ==================== Alternate Data Streams (whitelisted) ========== ==================== Faulty Device Manager Devices ============= Name: Realtek RTL8191SU Wireless LAN 802.11n USB 2.0 Network Adapter Description: Realtek RTL8191SU Wireless LAN 802.11n USB 2.0 Network Adapter Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Realtek Semiconductor Corp. Service: RTL8192su Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. Name: Microsoft PS/2-Maus Description: Microsoft PS/2-Maus Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: i8042prt Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. ==================== Event log errors: ========================= Application errors: ================== System errors: ============= Microsoft Office Sessions: ========================= CodeIntegrity Errors: =================================== Date: 2013-08-31 16:27:41.270 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2013-08-31 16:27:41.177 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2013-08-31 16:07:18.807 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-31 15:56:08.006 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-31 14:33:05.220 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-31 14:17:55.951 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-31 13:49:56.000 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-31 13:02:19.846 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-31 12:40:39.144 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-31 12:32:28.672 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Percentage of memory in use: 29% Total physical RAM: 6125.64 MB Available physical RAM: 4316.1 MB Total Pagefile: 12249.47 MB Available Pagefile: 10199.93 MB Total Virtual: 8192 MB Available Virtual: 8191.82 MB ==================== Drives ================================ Drive c: (Boot) (Fixed) (Total:900.41 GB) (Free:773.75 GB) NTFS Drive d: (Recover) (Fixed) (Total:30 GB) (Free:9.48 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 932 GB) (Disk ID: 2BD2C32A) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=900 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=30 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=1 GB) - (Type=12) ==================== End Of Log ============================ Grüße Bernhard |
01.09.2013, 13:43 | #10 |
/// the machine /// TB-Ausbilder | 2ter Rechner mit Win32.downloader.gen (Win 7)ESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
01.09.2013, 17:35 | #11 |
| 2ter Rechner mit Win32.downloader.gen (Win 7) So das sind die Logfiles: Eset Scanner: (2 Meldungen über heuritische Suche): Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=950fb43c1f69b94d9115354af6c20d87 # engine=14974 # end=stopped # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2013-09-01 01:25:43 # local_time=2013-09-01 03:25:43 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=771 16777214 16 1 83283 83283 0 0 # compatibility_mode=5893 16776573 100 94 8996 129671793 0 0 # scanned=51 # found=0 # cleaned=0 # scan_time=2 ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=950fb43c1f69b94d9115354af6c20d87 # engine=14974 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2013-09-01 03:24:05 # local_time=2013-09-01 05:24:05 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=771 16777214 16 1 90385 90385 0 0 # compatibility_mode=5893 16776573 100 94 16098 129678895 0 0 # scanned=285338 # found=2 # cleaned=0 # scan_time=6880 sh=E7F5E4396AC2244DDE408ACDA4CC44D16F7EE16B ft=1 fh=37b392d6c3cd1960 vn="probably unknown NewHeur_PE virus" ac=I fn="I:\System Volume Information\_restore{6B916A41-8485-4A6A-BC69-669605E696B1}\RP607\A0282851.exe" sh=E7F5E4396AC2244DDE408ACDA4CC44D16F7EE16B ft=1 fh=37b392d6c3cd1960 vn="probably unknown NewHeur_PE virus" ac=I fn="I:\System Volume Information\_restore{6B916A41-8485-4A6A-BC69-669605E696B1}\RP607\A0282852.exe" Code:
ATTFilter Results of screen317's Security Check version 0.99.72 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Java(TM) 6 Update 31 Java version out of Date! Adobe Flash Player 11.8.800.94 Adobe Reader 10.1.7 Adobe Reader out of Date! Mozilla Firefox (23.0.1) Mozilla Thunderbird (17.0.8) ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-09-2013 Ran by Bernhard Speiser (administrator) on BSP on 01-09-2013 18:33:11 Running from C:\Users\Bernhard Speiser\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\system32\atiesrxx.exe (AMD) C:\Windows\system32\atieclxx.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Microsoft Corporation) C:\Windows\system32\CISVC.EXE (Microsoft Corporation) C:\Windows\system32\inetsrv\inetinfo.exe (Intel Corporation) C:\Windows\system32\IProsetMonitor.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe (Microsoft Corporation) C:\Windows\System32\tcpsvcs.exe (Microsoft Corporation) C:\Windows\System32\snmp.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Dropbox, Inc.) C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe (Farbar) C:\Users\Bernhard Speiser\Desktop\FRST64(1).exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11490408 2010-10-22] (Realtek Semiconductor) HKLM\...\Policies\Explorer: [NoDrives] 0 HKCU\...\Policies\Explorer: [NoDrives] 0 HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-10-01] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-09-14] (Intel Corporation) HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-03] (CyberLink) HKLM-x32\...\Run: [BDRegion] - C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2010-01-19] (cyberlink) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.) Startup: C:\Users\Bernhard Speiser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Bernhard Speiser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== ProxyServer: localhost:8080 HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=MDNB&bmod=MDNB StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) Toolbar: HKCU - No Name - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Firefox\Profiles\49a0ufp2.default FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll () FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @videolan.org/vlc,version=1.1.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker ==================== Services (Whitelisted) ================= R2 ftpsvc; C:\Windows\system32\inetsrv\ftpsvc.dll [350720 2012-06-01] (Microsoft Corporation) R2 IISADMIN; C:\Windows\system32\inetsrv\inetinfo.exe [15872 2010-11-20] (Microsoft Corporation) R2 iprip; C:\Windows\System32\iprip.dll [35328 2009-07-14] (Microsoft Corporation) R2 LPDSVC; C:\Windows\system32\lpdsvc.dll [45568 2009-07-14] (Microsoft Corporation) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-04-17] () R2 SNMP; C:\Windows\System32\snmp.exe [49664 2010-11-20] (Microsoft Corporation) R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation) S3 WMSVC; C:\Windows\system32\inetsrv\wmsvc.exe [10752 2009-07-14] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== S3 IAMTVE; C:\Windows\system32\DRIVERS\IAMTVE.sys [43416 2007-04-12] (Intel Corporation) S3 IAMTXPE; C:\Windows\system32\DRIVERS\IAMTXPE.sys [51096 2007-04-12] (Intel Corporation) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R2 {B154377D-700F-42cc-9474-23858FBDF4BD}; C:\Program Files (x86)\CyberLink\PowerDVD9\000.fcl [146928 2010-01-20] (CyberLink Corp.) R2 {B154377D-700F-42cc-9474-23858FBDF4BD}; C:\Program Files (x86)\CyberLink\PowerDVD9\000.fcl [146928 2010-01-20] (CyberLink Corp.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [x] S3 GEARAspiWDM; system32\DRIVERS\GEARAspiWDM.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-09-01 17:50 - 2013-09-01 17:50 - 00891115 _____ C:\Users\Bernhard Speiser\Desktop\SecurityCheck(1).exe 2013-09-01 15:22 - 2013-09-01 15:22 - 00891115 _____ C:\Users\Bernhard Speiser\Downloads\SecurityCheck.exe 2013-09-01 15:22 - 2013-09-01 15:18 - 02347384 _____ (ESET) C:\Users\Bernhard Speiser\Desktop\esetsmartinstaller_enu.exe 2013-09-01 15:18 - 2013-09-01 15:18 - 02347384 _____ (ESET) C:\Users\Bernhard Speiser\Downloads\esetsmartinstaller_enu.exe 2013-09-01 13:01 - 2013-09-01 13:01 - 01590206 _____ (Farbar) C:\Users\Bernhard Speiser\Downloads\FRST64(1).exe 2013-09-01 13:01 - 2013-09-01 13:01 - 01590206 _____ (Farbar) C:\Users\Bernhard Speiser\Desktop\FRST64(1).exe 2013-09-01 12:54 - 2013-09-01 12:56 - 00000978 _____ C:\Users\Bernhard Speiser\Desktop\JRT.txt 2013-09-01 12:49 - 2013-09-01 12:49 - 00000000 ____D C:\Windows\ERUNT 2013-09-01 12:47 - 2013-09-01 12:47 - 00003450 _____ C:\Users\Bernhard Speiser\Desktop\AdwCleaner[S0].txt 2013-09-01 12:43 - 2013-09-01 12:44 - 00000000 ____D C:\AdwCleaner 2013-09-01 11:53 - 2013-09-01 11:53 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-09-01 11:53 - 2013-09-01 11:53 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-09-01 11:53 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-09-01 11:46 - 2013-09-01 11:46 - 00000000 ____D C:\Users\Bernhard Speiser\AppData\Roaming\Malwarebytes 2013-09-01 11:40 - 2013-09-01 11:40 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-09-01 11:36 - 2013-09-01 11:36 - 00001787 _____ C:\Users\Public\Desktop\iTunes.lnk 2013-09-01 11:36 - 2013-09-01 11:36 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-09-01 11:36 - 2013-09-01 11:36 - 00000000 ____D C:\Program Files\iTunes 2013-09-01 11:36 - 2013-09-01 11:36 - 00000000 ____D C:\Program Files\iPod 2013-09-01 11:36 - 2013-09-01 11:36 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-09-01 11:32 - 2013-09-01 11:32 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Bernhard Speiser\Downloads\mbam-setup-1.75.0.1300.exe 2013-09-01 11:32 - 2013-09-01 11:32 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Bernhard Speiser\Desktop\mbam-setup-1.75.0.1300.exe 2013-09-01 11:28 - 2013-09-01 13:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird 2013-08-31 16:31 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2013-08-31 16:31 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2013-08-31 16:31 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2013-08-31 16:31 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2013-08-31 16:31 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2013-08-31 16:31 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2013-08-31 16:31 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2013-08-31 16:31 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2013-08-31 16:31 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2013-08-31 16:31 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2013-08-31 16:31 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2013-08-31 16:30 - 2013-08-31 16:30 - 00020017 _____ C:\ComboFix.txt 2013-08-31 16:20 - 2013-08-31 16:30 - 00000000 ____D C:\Qoobox 2013-08-31 16:20 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe 2013-08-31 16:20 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe 2013-08-31 16:20 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2013-08-31 16:20 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2013-08-31 16:20 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2013-08-31 16:20 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe 2013-08-31 16:20 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe 2013-08-31 16:20 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe 2013-08-31 15:55 - 2013-08-31 16:29 - 00000000 ____D C:\Windows\erdnt 2013-08-31 14:35 - 2013-08-31 14:35 - 01027511 _____ (Thisisu) C:\Users\Bernhard Speiser\Desktop\JRT.exe 2013-08-31 14:34 - 2013-08-31 14:35 - 05117322 ____R (Swearware) C:\Users\Bernhard Speiser\Desktop\ComboFix.exe 2013-08-31 14:34 - 2013-08-31 14:35 - 00994642 _____ C:\Users\Bernhard Speiser\Desktop\adwcleaner.exe 2013-08-31 14:22 - 2013-08-31 14:22 - 00062464 _____ C:\Users\Bernhard Speiser\Desktop\Fragebogen Gehalt 09-2012_mit IBAN_11072013.xls 2013-08-31 13:53 - 2013-08-31 13:53 - 00027577 _____ C:\Users\Bernhard Speiser\Desktop\Logfiles.zip 2013-08-31 13:50 - 2013-08-31 13:53 - 00000000 ____D C:\Users\Bernhard Speiser\AppData\Roaming\WinRAR 2013-08-31 13:50 - 2013-08-31 13:50 - 01758824 _____ C:\Users\Bernhard Speiser\Downloads\winrar-x64-420d.exe 2013-08-31 13:50 - 2013-08-31 13:50 - 00000000 ____D C:\Users\Bernhard Speiser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR 2013-08-31 13:50 - 2013-08-31 13:50 - 00000000 ____D C:\Program Files\WinRAR 2013-08-31 13:18 - 2013-08-31 13:18 - 00456968 _____ C:\Windows\Minidump\083113-20311-01.dmp 2013-08-31 13:02 - 2013-08-31 13:02 - 00165091 _____ C:\Users\Bernhard Speiser\Desktop\Gmerlog.log 2013-08-31 12:40 - 2013-08-31 12:40 - 00000494 _____ C:\Users\Bernhard Speiser\Desktop\defogger_disable.log 2013-08-31 12:40 - 2013-08-31 12:40 - 00000000 ____D C:\FRST 2013-08-31 12:40 - 2013-08-31 12:40 - 00000000 _____ C:\Users\Bernhard Speiser\defogger_reenable 2013-08-31 12:37 - 2013-08-31 12:37 - 00377856 _____ C:\Users\Bernhard Speiser\Desktop\gmer_2.1.19163.exe 2013-08-31 12:35 - 2013-08-31 12:35 - 00050477 _____ C:\Users\Bernhard Speiser\Desktop\Defogger.exe 2013-08-31 11:03 - 2013-08-31 11:03 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking 2013-08-31 11:02 - 2013-08-31 14:38 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2 2013-08-31 11:02 - 2013-08-31 12:32 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-08-31 10:57 - 2013-08-31 10:58 - 37672592 _____ (Safer-Networking Ltd. ) C:\Users\Bernhard Speiser\Downloads\spybotsd-2.1.21-SR2.exe 2013-08-31 09:31 - 2013-08-31 09:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-08-29 12:59 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-08-29 12:59 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-08-29 12:59 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-08-29 12:59 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-08-29 12:59 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-08-29 12:59 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-08-29 12:59 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-08-29 12:59 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-08-29 12:59 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-08-29 12:59 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-08-29 12:59 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-08-29 12:59 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-08-29 12:59 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-08-29 12:59 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-08-29 12:08 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL 2013-08-29 12:08 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL 2013-08-29 12:08 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2013-08-29 12:08 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2013-08-29 12:08 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2013-08-29 12:08 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2013-08-29 12:08 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2013-08-29 12:08 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2013-08-29 12:08 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll 2013-08-29 12:08 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2013-08-29 12:08 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2013-08-29 12:08 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2013-08-29 12:08 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2013-08-29 12:08 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll 2013-08-29 12:08 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys 2013-08-29 12:07 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys ==================== One Month Modified Files and Folders ======= 2013-09-01 18:10 - 2012-04-01 18:06 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-09-01 18:03 - 2009-07-14 06:45 - 00010096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-09-01 18:03 - 2009-07-14 06:45 - 00010096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-09-01 17:59 - 2011-03-17 00:02 - 01795255 _____ C:\Windows\WindowsUpdate.log 2013-09-01 17:58 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\inetsrv 2013-09-01 17:56 - 2011-05-24 21:03 - 00000000 ___RD C:\Users\Bernhard Speiser\Dropbox 2013-09-01 17:56 - 2011-05-24 21:01 - 00000000 ____D C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox 2013-09-01 17:56 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-09-01 17:56 - 2009-07-14 06:51 - 00116812 _____ C:\Windows\setupact.log 2013-09-01 17:55 - 2012-06-22 00:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-09-01 17:55 - 2010-11-29 15:52 - 00094170 _____ C:\Windows\PFRO.log 2013-09-01 17:50 - 2013-09-01 17:50 - 00891115 _____ C:\Users\Bernhard Speiser\Downloads\SecurityCheck(1).exe 2013-09-01 17:50 - 2013-09-01 17:50 - 00891115 _____ C:\Users\Bernhard Speiser\Desktop\SecurityCheck(1).exe 2013-09-01 15:29 - 2010-11-25 18:28 - 00777172 _____ C:\Windows\system32\perfh007.dat 2013-09-01 15:29 - 2010-11-25 18:28 - 00176608 _____ C:\Windows\system32\perfc007.dat 2013-09-01 15:29 - 2009-07-14 07:13 - 01814270 _____ C:\Windows\system32\PerfStringBackup.INI 2013-09-01 15:22 - 2013-09-01 15:22 - 00891115 _____ C:\Users\Bernhard Speiser\Downloads\SecurityCheck.exe 2013-09-01 15:18 - 2013-09-01 15:22 - 02347384 _____ (ESET) C:\Users\Bernhard Speiser\Desktop\esetsmartinstaller_enu.exe 2013-09-01 15:18 - 2013-09-01 15:18 - 02347384 _____ (ESET) C:\Users\Bernhard Speiser\Downloads\esetsmartinstaller_enu.exe 2013-09-01 13:13 - 2013-09-01 11:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird 2013-09-01 13:01 - 2013-09-01 13:01 - 01590206 _____ (Farbar) C:\Users\Bernhard Speiser\Downloads\FRST64(1).exe 2013-09-01 13:01 - 2013-09-01 13:01 - 01590206 _____ (Farbar) C:\Users\Bernhard Speiser\Desktop\FRST64(1).exe 2013-09-01 12:56 - 2013-09-01 12:54 - 00000978 _____ C:\Users\Bernhard Speiser\Desktop\JRT.txt 2013-09-01 12:49 - 2013-09-01 12:49 - 00000000 ____D C:\Windows\ERUNT 2013-09-01 12:47 - 2013-09-01 12:47 - 00003450 _____ C:\Users\Bernhard Speiser\Desktop\AdwCleaner[S0].txt 2013-09-01 12:44 - 2013-09-01 12:43 - 00000000 ____D C:\AdwCleaner 2013-09-01 12:44 - 2013-07-27 23:26 - 00000000 ____D C:\Users\Gast\AppData\Roaming\CheckPoint 2013-09-01 11:53 - 2013-09-01 11:53 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-09-01 11:53 - 2013-09-01 11:53 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-09-01 11:46 - 2013-09-01 11:46 - 00000000 ____D C:\Users\Bernhard Speiser\AppData\Roaming\Malwarebytes 2013-09-01 11:40 - 2013-09-01 11:40 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-09-01 11:36 - 2013-09-01 11:36 - 00001787 _____ C:\Users\Public\Desktop\iTunes.lnk 2013-09-01 11:36 - 2013-09-01 11:36 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-09-01 11:36 - 2013-09-01 11:36 - 00000000 ____D C:\Program Files\iTunes 2013-09-01 11:36 - 2013-09-01 11:36 - 00000000 ____D C:\Program Files\iPod 2013-09-01 11:36 - 2013-09-01 11:36 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-09-01 11:32 - 2013-09-01 11:32 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Bernhard Speiser\Downloads\mbam-setup-1.75.0.1300.exe 2013-09-01 11:32 - 2013-09-01 11:32 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Bernhard Speiser\Desktop\mbam-setup-1.75.0.1300.exe 2013-08-31 16:30 - 2013-08-31 16:30 - 00020017 _____ C:\ComboFix.txt 2013-08-31 16:30 - 2013-08-31 16:20 - 00000000 ____D C:\Qoobox 2013-08-31 16:29 - 2013-08-31 15:55 - 00000000 ____D C:\Windows\erdnt 2013-08-31 16:28 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini 2013-08-31 16:17 - 2011-03-17 00:45 - 00000000 ____D C:\ProgramData\AVAST Software 2013-08-31 14:38 - 2013-08-31 11:02 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2 2013-08-31 14:35 - 2013-08-31 14:35 - 01027511 _____ (Thisisu) C:\Users\Bernhard Speiser\Desktop\JRT.exe 2013-08-31 14:35 - 2013-08-31 14:34 - 05117322 ____R (Swearware) C:\Users\Bernhard Speiser\Desktop\ComboFix.exe 2013-08-31 14:35 - 2013-08-31 14:34 - 00994642 _____ C:\Users\Bernhard Speiser\Desktop\adwcleaner.exe 2013-08-31 14:22 - 2013-08-31 14:22 - 00062464 _____ C:\Users\Bernhard Speiser\Desktop\Fragebogen Gehalt 09-2012_mit IBAN_11072013.xls 2013-08-31 13:53 - 2013-08-31 13:53 - 00027577 _____ C:\Users\Bernhard Speiser\Desktop\Logfiles.zip 2013-08-31 13:53 - 2013-08-31 13:50 - 00000000 ____D C:\Users\Bernhard Speiser\AppData\Roaming\WinRAR 2013-08-31 13:50 - 2013-08-31 13:50 - 01758824 _____ C:\Users\Bernhard Speiser\Downloads\winrar-x64-420d.exe 2013-08-31 13:50 - 2013-08-31 13:50 - 00000000 ____D C:\Users\Bernhard Speiser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR 2013-08-31 13:50 - 2013-08-31 13:50 - 00000000 ____D C:\Program Files\WinRAR 2013-08-31 13:18 - 2013-08-31 13:18 - 00456968 _____ C:\Windows\Minidump\083113-20311-01.dmp 2013-08-31 13:18 - 2011-05-26 07:57 - 1006322187 _____ C:\Windows\MEMORY.DMP 2013-08-31 13:18 - 2011-05-26 07:57 - 00000000 ____D C:\Windows\Minidump 2013-08-31 13:02 - 2013-08-31 13:02 - 00165091 _____ C:\Users\Bernhard Speiser\Desktop\Gmerlog.log 2013-08-31 12:40 - 2013-08-31 12:40 - 00000494 _____ C:\Users\Bernhard Speiser\Desktop\defogger_disable.log 2013-08-31 12:40 - 2013-08-31 12:40 - 00000000 ____D C:\FRST 2013-08-31 12:40 - 2013-08-31 12:40 - 00000000 _____ C:\Users\Bernhard Speiser\defogger_reenable 2013-08-31 12:40 - 2011-03-17 00:05 - 00000000 ____D C:\Users\Bernhard Speiser 2013-08-31 12:37 - 2013-08-31 12:37 - 00377856 _____ C:\Users\Bernhard Speiser\Desktop\gmer_2.1.19163.exe 2013-08-31 12:35 - 2013-08-31 12:35 - 00050477 _____ C:\Users\Bernhard Speiser\Desktop\Defogger.exe 2013-08-31 12:32 - 2013-08-31 11:02 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-08-31 12:12 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache 2013-08-31 11:03 - 2013-08-31 11:03 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking 2013-08-31 10:58 - 2013-08-31 10:57 - 37672592 _____ (Safer-Networking Ltd. ) C:\Users\Bernhard Speiser\Downloads\spybotsd-2.1.21-SR2.exe 2013-08-31 09:31 - 2013-08-31 09:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-08-29 12:52 - 2013-07-27 16:56 - 00000000 ____D C:\Windows\system32\MRT 2013-08-29 12:49 - 2010-11-26 19:57 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-08-29 12:10 - 2012-04-01 18:06 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-08-29 12:10 - 2012-04-01 18:06 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2013-08-29 12:10 - 2011-06-03 15:30 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-08-07 04:22 - 2010-11-26 19:22 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe Files to move or delete: ==================== C:\Users\BERNHA~1\AppData\Local\Temp\Quarantine.exe C:\Users\BERNHA~1\AppData\Local\Temp\RarSFX0\SecurityCheck\Objlist.exe C:\Users\BERNHA~1\AppData\Local\Temp\RarSFX0\SecurityCheck\runprocesses.exe C:\Users\BERNHA~1\AppData\Local\Temp\RarSFX0\SecurityCheck\uninstalllist.exe C:\Users\BERNHA~1\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\cmdinfo.exe C:\Users\BERNHA~1\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\nircmdc.exe C:\Users\BERNHA~1\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\sed.exe C:\Users\BERNHA~1\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\swreg.exe C:\Users\BERNHA~1\AppData\Local\Temp\MozUpdater\updater.exe C:\Users\BERNHA~1\AppData\Local\Temp\jrt\erunt\ERUNT.EXE ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-09-01 12:14 ==================== End Of Log ============================ Und die Addition.txt: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-09-2013 Ran by Bernhard Speiser at 2013-09-01 18:33:53 Running from C:\Users\Bernhard Speiser\Desktop Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Acrobat.com (x32 Version: 1.6.65) Adobe AIR (x32 Version: 3.7.0.1530) Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94) Adobe Reader X (10.1.7) - Deutsch (x32 Version: 10.1.7) Apple Application Support (x32 Version: 2.3.4) Apple Mobile Device Support (Version: 6.1.0.13) Apple Software Update (x32 Version: 2.1.3.127) ATI Catalyst Install Manager (Version: 3.0.795.0) BioShock (x32 Version: 2.62.0000) Bonjour (Version: 3.0.0.10) Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0930.2237.38732) Catalyst Control Center InstallProxy (x32 Version: 2010.0930.2237.38732) Catalyst Control Center Localization All (x32 Version: 2010.0930.2237.38732) CCC Help Danish (x32 Version: 2010.0930.2236.38732) CCC Help Dutch (x32 Version: 2010.0930.2236.38732) CCC Help English (x32 Version: 2010.0930.2236.38732) CCC Help Finnish (x32 Version: 2010.0930.2236.38732) CCC Help French (x32 Version: 2010.0930.2236.38732) CCC Help German (x32 Version: 2010.0930.2236.38732) CCC Help Italian (x32 Version: 2010.0930.2236.38732) CCC Help Japanese (x32 Version: 2010.0930.2236.38732) CCC Help Norwegian (x32 Version: 2010.0930.2236.38732) CCC Help Spanish (x32 Version: 2010.0930.2236.38732) CCC Help Swedish (x32 Version: 2010.0930.2236.38732) ccc-core-static (x32 Version: 2010.0930.2237.38732) ccc-utility64 (Version: 2010.0930.2237.38732) Control ActiveX de Windows Live Mesh para conexiones remotas (x32 Version: 15.4.5722.2) Contrôle ActiveX Windows Live Mesh pour connexions à distance (x32 Version: 15.4.5722.2) Controlo ActiveX do Windows Live Mesh para Ligações Remotas (x32 Version: 15.4.5722.2) CyberLink LabelPrint (x32 Version: 2.5.2602) CyberLink Power2Go (x32 Version: 6.1.3802) CyberLink PowerDirector (x32 Version: 8.0.2815) CyberLink PowerDVD 9 (x32 Version: 9.0.2519.50) CyberLink PowerDVD Copy (x32 Version: 1.5.1306) CyberLink PowerProducer (x32 Version: 5.0.2.2326) D3DX10 (x32 Version: 15.4.2368.0902) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32) Dropbox (HKCU Version: 2.0.22) Fotogalerija Windows Live (x32 Version: 15.4.3502.0922) Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922) Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922) Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922) Galerie de photos Windows Live (x32 Version: 15.4.3502.0922) Intel(R) Management Engine Components (x32 Version: 7.0.0.1118) Intel(R) Network Connections 15.6.25.0 (Version: 15.6.25.0) Intel(R) Rapid Storage Technology (x32 Version: 10.0.0.1046) iTunes (Version: 11.0.5.5) Java Auto Updater (x32 Version: 2.0.7.1) Java(TM) 6 Update 31 (x32 Version: 6.0.310) Junk Mail filter update (x32 Version: 15.4.3502.0922) Kontrolnik Windows Live Mesh ActiveX za oddaljene povezave (x32 Version: 15.4.5722.2) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Medion Home Cinema (x32 Version: 8.0.1517) Mesh Runtime (x32 Version: 15.4.5722.2) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Office 2010 Service Pack 1 (SP1) (x32) Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Home and Student 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000) Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000) Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Single Image 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1) Mozilla Maintenance Service (x32 Version: 17.0.8) Mozilla Thunderbird 17.0.8 (x86 de) (x32 Version: 17.0.8) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT_amd64 (x32 Version: 15.4.2862.0708) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) MSXML 4.0 SP3 Parser (KB2721691) (x32 Version: 4.30.2114.0) MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0) MSXML 4.0 SP3 Parser (KB973685) (x32 Version: 4.30.2107.0) NVIDIA PhysX (x32 Version: 9.10.0222) PlayReady PC Runtime amd64 (Version: 1.3.0) Poczta usługi Windows Live (x32 Version: 15.4.3502.0922) Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922) Pošta Windows Live (x32 Version: 15.4.3502.0922) QuickTime (x32 Version: 7.74.80.86) Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922) Realtek High Definition Audio Driver (x32 Version: 6.0.1.6225) Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.26.0) rosoft .NET Framework 4 Client Profile (Version: 4.0.30319) Skype Click to Call (x32 Version: 5.6.8442) Skype™ 5.10 (x32 Version: 5.10.116) swMSM (x32 Version: 12.0.0.1) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1) Update for Microsoft Office 2010 (KB2494150) (x32) Update for Microsoft Office 2010 (KB2553065) (x32) Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2566458) (x32) Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32) Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32) Update for Microsoft Outlook 2010 (KB2597090) 32-Bit Edition (x32) Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32) Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32) Update for Microsoft PowerPoint 2010 (KB2598240) 32-Bit Edition (x32) Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32) VLC media player 1.1.7 (x32 Version: 1.1.7) Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3502.0922) Windows Live Fotogalerie (x32 Version: 15.4.3502.0922) Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922) Windows Live Fotótár (x32 Version: 15.4.3502.0922) Windows Live ID Sign-in Assistant (Version: 7.250.4225.0) Windows Live Installer (x32 Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3502.0922) Windows Live Mail (x32 Version: 15.4.3502.0922) Windows Live Mesh (x32 Version: 15.4.3502.0922) Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2) Windows Live Messenger (x32 Version: 15.4.3502.0922) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Movie Maker (x32 Version: 15.4.3502.0922) Windows Live Photo Common (x32 Version: 15.4.3502.0922) Windows Live Photo Gallery (x32 Version: 15.4.3502.0922) Windows Live PIMT Platform (x32 Version: 15.4.3502.0922) Windows Live Remote Client (Version: 15.4.5722.2) Windows Live Remote Client Resources (Version: 15.4.5722.2) Windows Live Remote Service (Version: 15.4.5722.2) Windows Live Remote Service Resources (Version: 15.4.5722.2) Windows Live SOXE (x32 Version: 15.4.3502.0922) Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922) Windows Live UX Platform (x32 Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922) Windows Live Writer (x32 Version: 15.4.3502.0922) Windows Live Writer Resources (x32 Version: 15.4.3502.0922) WinRAR 4.20 (64-Bit) (Version: 4.20.0) Yahoo! Detect (x32) Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922) ==================== Restore Points ========================= 17-07-2013 18:46:02 Windows Update 17-07-2013 21:45:55 Windows Update 22-07-2013 20:22:11 Windows Update 27-07-2013 09:46:25 Windows Update 27-07-2013 14:55:49 Windows Update 29-08-2013 10:07:31 Windows Update 29-08-2013 10:48:15 Windows Update 31-08-2013 14:13:03 avast! Free Antivirus Setup 31-08-2013 15:19:59 Windows Update ==================== Hosts content: ========================== 2009-07-14 04:34 - 2013-08-31 16:28 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= Task: {2054264E-29A2-4F78-9CE8-390498C6EFF9} - System32\Tasks\{236C362C-4AAA-47B0-B5B5-7E635C71CF60} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2012-07-13] (Skype Technologies S.A.) Task: {22A89512-1B3B-4F7B-8561-34B7D87EED9D} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation) Task: {77D903ED-A9EA-43BF-93B1-F0D2BD3067CC} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation) Task: {7E361E09-42F3-4EFE-BACA-5DF606A86C11} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task Task: {A35C0DD6-2375-4838-9A7A-377581035B7E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-29] (Adobe Systems Incorporated) Task: {AA4C3CFE-FC3F-4CFC-94F0-F1C424120D4F} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe ==================== Loaded Modules (whitelisted) ============= 2010-11-25 18:07 - 2010-09-29 03:14 - 00039936 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiuxp64.dll 2010-11-25 18:07 - 2010-09-29 03:54 - 00628224 _____ (ATI Technologies Inc. ) C:\Windows\system32\aticfx64.dll 2010-11-25 18:07 - 2010-09-29 03:37 - 04660224 _____ (ATI Technologies Inc. ) C:\Windows\system32\atidxx64.dll 2013-05-25 02:36 - 2013-05-25 02:36 - 00164016 _____ (Dropbox, Inc.) C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll 2009-07-14 02:17 - 2009-07-14 03:40 - 00024576 _____ (Microsoft Corporation) C:\Windows\System32\drprov.dll 2011-07-01 21:21 - 2010-11-20 15:27 - 00129536 _____ (Microsoft Corporation) C:\Windows\System32\ntlanman.dll 2011-07-01 21:22 - 2010-11-20 15:26 - 00100864 _____ (Microsoft Corporation) C:\Windows\System32\davclnt.dll 2013-08-31 13:50 - 2012-06-09 19:20 - 00196096 _____ (Alexander Roshal) C:\Program Files\WinRAR\rarext.dll 2011-03-20 22:42 - 2011-03-20 22:42 - 00178800 _____ (Sony DADC Austria AG.) c:\windows\SysWOW64\cmdlineext_x64.dll 2011-07-01 21:22 - 2010-11-20 15:26 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\hgprint.dll 2010-11-26 18:42 - 2010-10-22 10:26 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll 2010-11-26 18:42 - 2010-10-22 10:26 - 02651240 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkAPO64.dll 2013-07-11 20:47 - 2013-04-24 00:56 - 09991832 _____ (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll 2013-07-17 20:43 - 2013-07-17 20:43 - 15577088 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\88744044294787b99dd4a8704ab75a79\mscorlib.ni.dll 2013-01-22 22:11 - 2012-10-05 12:52 - 01574496 _____ (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll 2013-08-31 09:28 - 2013-08-31 09:28 - 10655744 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System\af0a0b96a02f9925eb84392ee65a5cfa\System.ni.dll 2013-08-31 09:29 - 2013-08-31 09:29 - 02320384 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Drawing\868d117286ad259249f31d3fe813d39a\System.Drawing.ni.dll 2013-08-31 09:29 - 2013-08-31 09:29 - 17383424 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Windows.Forms\95674cb72317e3a5380ea450b913786f\System.Windows.Forms.ni.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00106496 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.Implementation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00032768 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\LOG.Foundation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00036864 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\LOG.Foundation.Private.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00065536 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\LOG.Foundation.Implementation.dll 2011-07-08 18:26 - 2010-11-13 02:08 - 00315392 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00005632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.Foundation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00020480 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\LOG.Foundation.Implementation.Private.dll 2013-08-31 09:30 - 2013-08-31 09:30 - 01022976 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Runtime.Remo#\5d7208467b0ffffee644a83f4e76fa12\System.Runtime.Remoting.ni.dll 2013-08-31 09:30 - 2013-08-31 09:30 - 15362048 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Web\1223cf3c9fcc905300e20364b7a26097\System.Web.ni.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00032768 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.Implementation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00015360 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\NEWAEM.Foundation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00098304 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Foundation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00057344 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.SkinFactory.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00028672 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Foundation.XManifest.dll 2013-08-31 09:28 - 2013-08-31 09:28 - 06964736 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Xml\3975acf49313ceea1280da91f0383480\System.Xml.ni.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00061440 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Runtime.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00049152 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Runtime.Shared.Private.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00040960 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Foundation.Private.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00005632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Runtime.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00032768 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\ATICCCom.dll 2010-04-29 13:30 - 2010-04-29 13:30 - 00066048 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\ADL.Foundation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00045056 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Server.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00006144 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Server.Shared.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00045056 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.Source.Kit.Server.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00006656 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.DPPE.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00007168 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.Hotkeys.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00006144 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.WinMessages.Shared.dll 2009-04-22 22:13 - 2009-04-22 22:13 - 00045056 _____ (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0601.dll 2010-03-04 10:27 - 2010-03-04 10:27 - 00016384 _____ (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Foundation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00006656 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.dll 2010-08-18 13:28 - 2010-08-18 13:28 - 00450560 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\ATIDEMGX.dll 2013-08-31 09:28 - 2013-08-31 09:28 - 01320448 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Configuration\1031b311ee568364d4ca1c4db634eaf0\System.Configuration.ni.dll 2010-11-25 18:07 - 2010-09-29 03:49 - 00421376 _____ (ATI Technologies, Inc.) C:\Windows\system32\atipdl64.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00385024 _____ (Advanced Mirco Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Runtime.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00155648 _____ (Advanced Mirco Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Shared.dll 2009-06-17 15:27 - 2009-06-17 15:27 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0709.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00005632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.GD.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00008192 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Actions.CCAA.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00007168 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\ResourceManagement.Foundation.Private.dll 2008-04-04 02:29 - 2008-04-04 02:29 - 00020480 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0804.dll 2010-10-01 08:32 - 2010-10-01 08:32 - 00040960 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00040960 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00036864 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00008704 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Runtime.Shared.Private.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00045056 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00032768 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceLCD.Graphics.Shared.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00028672 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll 2010-10-01 08:32 - 2010-10-01 08:32 - 00065536 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00077824 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.OverDrive5.Graphics.Runtime.dll 2010-10-01 08:36 - 2010-10-01 08:36 - 00013824 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.TransCode.Graphics.Runtime.dll 2010-10-01 08:36 - 2010-10-01 08:36 - 00013312 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Welcome.Graphics.Runtime.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00073728 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Radeon3D.Graphics.Runtime.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00065536 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Radeon3D.Graphics.Shared.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00053248 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceDFP.Graphics.Shared.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00020480 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00028672 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CustomFormats.Graphics.Shared.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00102400 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.MMVideo.Graphics.Runtime.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00069632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCV.Graphics.Runtime.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00024576 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysOptions.Graphics.shared.dll 2010-10-01 08:32 - 2010-10-01 08:32 - 00065536 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.MMVideo.Graphics.Shared.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00053248 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCRT.Graphics.shared.dll 2009-06-17 20:24 - 2009-06-17 20:24 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0906.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00077824 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceTV.Graphics.Runtime.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00061440 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.OverDrive5.Graphics.shared.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00045056 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.TransCode.Graphics.shared.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00040960 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCV.Graphics.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00020480 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00009728 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Welcome.Graphics.shared.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00065536 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceTV.Graphics.shared.dll 2009-12-08 16:49 - 2009-12-08 16:49 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0912.dll 2007-08-10 02:58 - 2007-08-10 02:58 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0706.dll 2009-06-17 20:24 - 2009-06-17 20:24 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0712.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00049152 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceProperty.Graphics.Shared.dll 2010-10-01 08:32 - 2010-10-01 08:32 - 00053248 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll 2008-12-30 21:04 - 2008-12-30 21:04 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0812.dll 2009-04-22 22:13 - 2009-04-22 22:13 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0805.dll 2007-05-03 03:44 - 2007-05-03 03:44 - 00020480 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0703.dll 2009-01-20 23:51 - 2009-01-20 23:51 - 00007168 _____ ( ) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atixclib.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00011776 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.HydraVision.Runtime.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00008704 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.HydraVision.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00061440 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\APM.Server.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00020480 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\APM.Foundation.dll 2011-07-10 08:37 - 2010-11-13 02:08 - 00434176 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00007168 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Runtime.Extension.EEU.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00005632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.REG.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00005632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.EEU.Shared.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00581632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Systemtray.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00040960 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Client.Shared.Private.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00405504 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Wizard.dll 2010-10-01 08:36 - 2010-10-01 08:36 - 00741376 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\ResourceManagement.Foundation.Implementation.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00007680 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Client.Shared.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00020480 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Wizard.Shared.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00011776 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Wizard.Shared.Private.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00040960 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Wizard.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00016384 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Wizard.Shared.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00094208 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Radeon3D.Graphics.Wizard.dll 2010-10-01 08:34 - 2010-10-01 08:34 - 00409600 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.MMVideo.Graphics.Wizard.dll 2010-10-01 08:36 - 2010-10-01 08:36 - 01708032 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysManager2.Graphics.Wizard.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00204800 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.InfoCentre.Graphics.Wizard.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00007680 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.HydraVision.Wizard.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 01220608 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Dashboard.dll 2010-10-01 08:30 - 2010-10-01 08:30 - 00024576 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Dashboard.Shared.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00010240 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Dashboard.Shared.Private.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00073728 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Dashboard.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00016384 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Dashboard.Shared.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00065536 _____ (Advanced Mirco Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Welcome.Graphics.Dashboard.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00196608 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll 2010-10-01 08:36 - 2010-10-01 08:36 - 01306624 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysManager2.Graphics.Dashboard.dll 2010-10-01 08:36 - 2010-10-01 08:36 - 00270336 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00094208 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00397312 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll 2010-10-01 08:32 - 2010-10-01 08:32 - 00376832 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00397312 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll 2010-10-01 08:31 - 2010-10-01 08:31 - 00573440 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll 2010-10-01 08:33 - 2010-10-01 08:33 - 00880640 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.MMVideo.Graphics.Dashboard.dll 2010-10-01 08:36 - 2010-10-01 08:36 - 00184320 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.TransCode.Graphics.Dashboard.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00655360 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.OverDrive5.Graphics.Dashboard.dll 2010-10-01 08:35 - 2010-10-01 08:35 - 00007680 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.HydraVision.Dashboard.dll 2011-08-31 00:05 - 2011-08-31 00:05 - 00132968 _____ (Apple Inc.) C:\Program Files\Bonjour\mdnsNSP.dll ==================== Alternate Data Streams (whitelisted) ========== ==================== Faulty Device Manager Devices ============= Name: Realtek RTL8191SU Wireless LAN 802.11n USB 2.0 Network Adapter Description: Realtek RTL8191SU Wireless LAN 802.11n USB 2.0 Network Adapter Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Realtek Semiconductor Corp. Service: RTL8192su Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. Name: Microsoft PS/2-Maus Description: Microsoft PS/2-Maus Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: i8042prt Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. ==================== Event log errors: ========================= Application errors: ================== Error: (09/01/2013 05:49:33 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Error: (09/01/2013 03:27:31 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Error: (09/01/2013 03:25:52 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Error: (09/01/2013 03:23:34 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Error: (09/01/2013 03:22:17 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Error: (09/01/2013 03:22:17 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Error: (09/01/2013 03:20:40 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Error: (09/01/2013 03:20:40 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Error: (09/01/2013 03:20:40 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Error: (09/01/2013 03:20:40 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. System errors: ============= Error: (09/01/2013 05:56:10 PM) (Source: SNMP) (User: ) Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten. Microsoft Office Sessions: ========================= Error: (09/01/2013 05:49:33 PM) (Source: SideBySide)(User: ) Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe Error: (09/01/2013 03:27:31 PM) (Source: SideBySide)(User: ) Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Bernhard Speiser\Desktop\esetsmartinstaller_enu.exe Error: (09/01/2013 03:25:52 PM) (Source: SideBySide)(User: ) Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Bernhard Speiser\Desktop\esetsmartinstaller_enu.exe Error: (09/01/2013 03:23:34 PM) (Source: SideBySide)(User: ) Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Bernhard Speiser\Desktop\esetsmartinstaller_enu.exe Error: (09/01/2013 03:22:17 PM) (Source: SideBySide)(User: ) Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Bernhard Speiser\Desktop\esetsmartinstaller_enu.exe Error: (09/01/2013 03:22:17 PM) (Source: SideBySide)(User: ) Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Bernhard Speiser\Desktop\esetsmartinstaller_enu.exe Error: (09/01/2013 03:20:40 PM) (Source: SideBySide)(User: ) Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Bernhard Speiser\Downloads\esetsmartinstaller_enu(2).exe Error: (09/01/2013 03:20:40 PM) (Source: SideBySide)(User: ) Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Bernhard Speiser\Downloads\esetsmartinstaller_enu(2).exe Error: (09/01/2013 03:20:40 PM) (Source: SideBySide)(User: ) Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Bernhard Speiser\Downloads\esetsmartinstaller_enu.exe Error: (09/01/2013 03:20:40 PM) (Source: SideBySide)(User: ) Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Bernhard Speiser\Downloads\esetsmartinstaller_enu.exe CodeIntegrity Errors: =================================== Date: 2013-08-31 16:27:41.270 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2013-08-31 16:27:41.177 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2013-08-31 16:07:18.807 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-31 15:56:08.006 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-31 14:33:05.220 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-31 14:17:55.951 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-31 13:49:56.000 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-31 13:02:19.846 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-31 12:40:39.144 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-31 12:32:28.672 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Percentage of memory in use: 30% Total physical RAM: 6125.64 MB Available physical RAM: 4228.55 MB Total Pagefile: 12249.47 MB Available Pagefile: 10113.88 MB Total Virtual: 8192 MB Available Virtual: 8191.82 MB ==================== Drives ================================ Drive c: (Boot) (Fixed) (Total:900.41 GB) (Free:773.33 GB) NTFS Drive d: (Recover) (Fixed) (Total:30 GB) (Free:9.48 GB) NTFS Drive i: (Elements) (Fixed) (Total:149.01 GB) (Free:69.18 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 932 GB) (Disk ID: 2BD2C32A) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=900 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=30 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=1 GB) - (Type=12) ======================================================== Disk: 4 (Size: 149 GB) (Disk ID: 8F9C798A) Partition 1: (Not Active) - (Size=149 GB) - (Type=0C) ==================== End Of Log ============================ Danke Dir. Gruß Bernhard |
01.09.2013, 18:39 | #12 |
/// the machine /// TB-Ausbilder | 2ter Rechner mit Win32.downloader.gen (Win 7) Java und Adobe updaten. Die Funde sind nur in der Systemwiederherstellung, die bereinigen wir jetzt. Fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
01.09.2013, 19:22 | #13 |
| 2ter Rechner mit Win32.downloader.gen (Win 7) Ok, hat alles geklappt. Ich habe keine Befunde mehr in den Scannern. Vielen vielen Dank für die Hilfe. Das hat mir jede Menge Ärger gespart. Ich werde deine Tips berücksichtigen. Grüße Bernhard |
02.09.2013, 07:41 | #14 |
/// the machine /// TB-Ausbilder | 2ter Rechner mit Win32.downloader.gen (Win 7) Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu 2ter Rechner mit Win32.downloader.gen (Win 7) |
dateien, files, helft, hoffe, infiziert., kriege, rechner, sauber, win, win 7, win32.downloader.gen, wisst, zweiter |