| |
| |||||||
Log-Analyse und Auswertung: Infizierte Datei auf windows xpWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
12.09.2013, 11:50
| #1 |
 |  Infizierte Datei auf windows xp Hallo liebe Leute vom Trojaner Board! Malware Bytes Anti Malware hat ein infizierte Datei festgestellt. Hier die Logs: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.09.06 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 mine :: PC-MINE [Administrator] 11.09.2013 18:46:47 MBAM-log-2013-09-11 (20-41-00).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 219777 Laufzeit: 1 Stunde(n), 6 Minute(n), 51 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Dokumente und Einstellungen\mine\Anwendungsdaten\speedanalysis.ico (PUP.Optional.SpeedAnalysis2.A) -> Keine Aktion durchgeführt. (Ende) Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 09-09-2013 01
Ran by mine (administrator) on PC-MINE on 11-09-2013 21:19:31
Running from C:\Dokumente und Einstellungen\mine\Desktop
Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(ArcSoft Inc.) C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe
(Kaspersky Lab) C:\Programme\Kaspersky Lab\Kaspersky PURE\avp.exe
(Infowatch) C:\Programme\Gemeinsame Dateien\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe
(Malwarebytes Corporation) C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
() C:\WINDOWS\tsnp325.exe
(Kaspersky Lab) C:\Programme\Kaspersky Lab\Kaspersky PURE\avp.exe
() C:\WINDOWS\vsnp325.exe
(ArcSoft Inc.) C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACDaemon.exe
(ArcSoft Inc.) C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ArcCon.ac
(Deutsche Telekom AG) C:\Dokumente und Einstellungen\mine\Anwendungsdaten\Telekom\MediencenterSync\Mediencenter.exe
(Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Microsoft Corporation) C:\WINDOWS\system32\SNDVOL32.EXE
(Google Inc.) C:\Programme\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Programme\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [tsnp325] - C:\WINDOWS\tsnp325.exe [270336 2007-04-21] ()
HKLM\...\Run: [pdfFactory Pro Dispatcher v3] - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe [606208 2009-06-12] (FinePrint Software, LLC)
HKLM\...\Run: [AVP] - C:\Programme\Kaspersky Lab\Kaspersky PURE\avp.exe [348760 2010-10-01] (Kaspersky Lab)
HKLM\...\Run: [BluetoothAuthenticationAgent] - rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
HKLM\...\Run: [snp325] - C:\WINDOWS\vsnp325.exe [835584 2007-05-10] ()
HKLM\...\Run: [ArcSoft Connection Service] - C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
Winlogon\Notify\klogon: C:\WINDOWS\system32\klogon.dll (Kaspersky Lab)
HKLM\...\Policies\Explorer: [NoDrives] 0
HKCU\...\Run: [swg] - C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-07-26] (Google Inc.)
HKCU\...\Run: [Facebook Update] - C:\Dokumente und Einstellungen\mine\Lokale Einstellungen\Anwendungsdaten\Facebook\Update\FacebookUpdate.exe [138096 2013-06-25] (Facebook Inc.)
HKCU\...\Policies\Explorer: [NoDrives] 0
HKU\Default User\...\RunOnce: [NeroHomeFirstStart] - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMFirstStart.exe [ 2006-02-01] (Nero AG)
Startup: C:\Dokumente und Einstellungen\mine\Startmenü\Programme\Autostart\Mediencenter.lnk
ShortcutTarget: Mediencenter.lnk -> C:\Dokumente und Einstellungen\mine\Anwendungsdaten\Telekom\MediencenterSync\Mediencenter.exe (Deutsche Telekom AG)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
BHO: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Lab\Kaspersky PURE\ievkbd.dll (Kaspersky Lab)
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll No File
BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
BHO: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Programme\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll (Kaspersky Lab)
BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll No File
BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Programme\Gemeinsame Dateien\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKLM - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKCU -&Adresse - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\Windows\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU -&Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} hxxp://game.zylom.com/activex/zylomgamesplayer.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\GEMEIN~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\GEMEIN~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\GEMEIN~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\GEMEIN~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\GEMEIN~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\GEMEIN~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\PROGRA~1\GEMEIN~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Dokumente und Einstellungen\mine\Anwendungsdaten\Mozilla\Firefox\Profiles\gc4tyh60.default
FF SelectedSearchEngine: Google
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Programme\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pack.google.com/Google Updater;version=14 - C:\Programme\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Programme\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Programme\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Google.com/GoogleEarthPlugin - C:\Dokumente und Einstellungen\mine\Lokale Einstellungen\Anwendungsdaten\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Dokumente und Einstellungen\mine\Lokale Einstellungen\Anwendungsdaten\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Dokumente und Einstellungen\mine\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Dokumente und Einstellungen\mine\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Programme\mozilla firefox\searchplugins\seekservice125.xml
FF SearchPlugin: C:\Programme\mozilla firefox\searchplugins\seekservice127.xml
FF SearchPlugin: C:\Programme\mozilla firefox\searchplugins\seekservice133.xml
FF SearchPlugin: C:\Programme\mozilla firefox\searchplugins\seekservice135.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Dokumente und Einstellungen\mine\Anwendungsdaten\Mozilla\Firefox\Profiles\gc4tyh60.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF Extension: Yahoo! Toolbar - C:\Dokumente und Einstellungen\mine\Anwendungsdaten\Mozilla\Firefox\Profiles\gc4tyh60.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF Extension: facebookchatbar - C:\Dokumente und Einstellungen\mine\Anwendungsdaten\Mozilla\Firefox\Profiles\gc4tyh60.default\Extensions\{d7ba87f4-c901-47b7-af80-18d75313aad1}
FF Extension: amznUWL2 - C:\Dokumente und Einstellungen\mine\Anwendungsdaten\Mozilla\Firefox\Profiles\gc4tyh60.default\Extensions\amznUWL2@amazon.com.xpi
FF Extension: No Name - C:\Dokumente und Einstellungen\mine\Anwendungsdaten\Mozilla\Firefox\Profiles\gc4tyh60.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
FF Extension: No Name - C:\Dokumente und Einstellungen\mine\Anwendungsdaten\Mozilla\Firefox\Profiles\gc4tyh60.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Kaspersky URL Advisor - C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru
FF Extension: SeekService - C:\Programme\Mozilla Firefox\extensions\{86009AEF-9162-4EBC-B698-FF71D7B6B049}
FF Extension: No Name - C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [jqs@sun.com] - C:\Programme\Java\jre6\lib\deploy\jqs\ff
FF HKLM\...\Thunderbird\Extensions: [{eea12ec4-729d-4703-bc37-106ce9879ce2}] - C:\Programme\Kaspersky Lab\Kaspersky PURE\THBExt
FF Extension: Kaspersky Anti-Spam Extension - C:\Programme\Kaspersky Lab\Kaspersky PURE\THBExt
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "https://www.google.de/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Programme\Google\Chrome\Application\29.0.1547.66\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Programme\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Programme\Google\Chrome\Application\29.0.1547.66\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Programme\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (QuickTime Plug-in 6.3) - C:\Programme\Mozilla Firefox\plugins\npqtplugin.dll (Apple Computer, Inc.)
CHR Plugin: (QuickTime Plug-in 6.3) - C:\Programme\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Computer, Inc.)
CHR Plugin: (QuickTime Plug-in 6.3) - C:\Programme\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Computer, Inc.)
CHR Plugin: (QuickTime Plug-in 6.3) - C:\Programme\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Computer, Inc.)
CHR Plugin: (QuickTime Plug-in 6.3) - C:\Programme\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Computer, Inc.)
CHR Plugin: (Microsoft\u00AE DRM) - C:\Programme\Windows Media Player\npdrmv2.dll (Microsoft Corporation)
CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - C:\Programme\Windows Media Player\npdsplay.dll (Microsoft Corporation (written by Digital Renaissance Inc.))
CHR Plugin: (Microsoft\u00AE DRM) - C:\Programme\Windows Media Player\npwmsdrm.dll (Microsoft Corporation)
CHR Plugin: (Google Earth Plugin) - C:\Dokumente und Einstellungen\mine\Lokale Einstellungen\Anwendungsdaten\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Dokumente und Einstellungen\mine\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (AVG SiteSafety plugin) - C:\Programme\Gemeinsame Dateien\AVG Secure Search\SiteSafetyInstaller\13.0.0\\npsitesafety.dll No File
CHR Plugin: (Google Updater) - C:\Programme\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Programme\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (VLC Web Plugin) - C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Programme\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_5_502_149.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Programme\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Google Docs) - C:\DOKUME~1\mine\LOKALE~1\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\DOKUME~1\mine\LOKALE~1\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\DOKUME~1\mine\LOKALE~1\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\DOKUME~1\mine\LOKALE~1\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Chrome In-App Payments service) - C:\DOKUME~1\mine\LOKALE~1\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR Extension: (Gmail) - C:\DOKUME~1\mine\LOKALE~1\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM\...\Chrome\Extension: [cfcbmgbfdbijmjgjihagbomfbjfjmgon] - C:\Dokumente und Einstellungen\mine\Anwendungsdaten\SpeedanAlysis\speedanalysis.crx
CHR HKLM\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVG Secure Search\ChromeExt\13.0.0.7\avg.crx
========================== Services (Whitelisted) =================
R2 ACDaemon; C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AVP; C:\Programme\Kaspersky Lab\Kaspersky PURE\avp.exe [348760 2010-10-01] (Kaspersky Lab)
R2 CSObjectsSrv; C:\Programme\Gemeinsame Dateien\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe [743992 2009-12-21] (Infowatch)
S4 fsssvc; C:\Programme\Windows Live\Family Safety\fsssvc.exe [704872 2010-04-28] (Microsoft Corporation)
S2 gupdate1ca1a82881e5670; C:\Programme\Google\Update\GoogleUpdate.exe [133104 2009-08-11] (Google Inc.)
S3 gupdatem; C:\Programme\Google\Update\GoogleUpdate.exe [133104 2009-08-11] (Google Inc.)
S2 gusvc; C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe [194104 2011-09-05] (Google)
R2 MBAMScheduler; C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S4 Sony PC Companion; C:\Programme\Sony\Sony PC Companion\PCCService.exe [155320 2012-01-18] (Avanquest Software)
S3 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-11-03] (Microsoft Corporation)
S4 vToolbarUpdater13.0.0; C:\Programme\Gemeinsame Dateien\AVG Secure Search\vToolbarUpdater\13.0.0\ToolbarUpdater.exe [x]
==================== Drivers (Whitelisted) ====================
S3 AF15BDA; C:\Windows\System32\Drivers\AF15BDA.sys [283776 2006-09-28] (AfaTech )
R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
R3 ati2mtaa; C:\Windows\System32\DRIVERS\ati2mtaa.sys [327168 2008-04-14] (ATI Technologies Inc.)
R1 avgtp; C:\WINDOWS\system32\drivers\avgtpx86.sys [26984 2012-09-23] (AVG Technologies)
R3 cmigameport; C:\Windows\System32\drivers\cmigameport.sys [3712 2002-02-07] ()
R3 cmpci; C:\Windows\System32\drivers\cmaudio.sys [373952 2004-10-01] (C-Media Inc)
R0 CSCrySec; C:\Windows\System32\DRIVERS\CSCrySec.sys [88632 2009-12-14] (Infowatch)
R1 CSVirtualDiskDrv; C:\Windows\System32\DRIVERS\CSVirtualDiskDrv.sys [39352 2009-12-14] (Infowatch)
R3 FETNDIS; C:\Windows\System32\DRIVERS\fetnd5.sys [27165 2001-08-17] (VIA Technologies, Inc. )
R2 fssfltr; C:\Windows\System32\DRIVERS\fssfltr_tdi.sys [54752 2009-08-05] (Microsoft Corporation)
R1 kl1; C:\WINDOWS\system32\drivers\kl1.sys [128016 2009-09-01] (Kaspersky Lab)
R0 KLBG; C:\Windows\System32\DRIVERS\klbg.sys [36880 2009-10-14] (Kaspersky Lab)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [315408 2009-11-26] (Kaspersky Lab)
R3 klim5; C:\Windows\System32\DRIVERS\klim5.sys [32272 2009-09-14] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [19472 2009-10-02] (Kaspersky Lab)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
S3 MPE; C:\Windows\System32\DRIVERS\MPE.sys [15232 2008-04-14] (Microsoft Corporation)
R3 ms_mpu401; C:\Windows\System32\drivers\msmpu401.sys [2944 2001-08-17] (Microsoft Corporation)
S3 NdisIP; C:\Windows\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] (Microsoft Corporation)
S3 PID_0928; C:\Windows\System32\DRIVERS\LV561AV.SYS [495768 2009-04-30] (Logitech Inc.)
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [89256 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [15016 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [120744 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [114216 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [25512 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [110632 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [115752 2008-05-16] (MCCI Corporation)
R3 SiS7012; C:\Windows\System32\drivers\sis7012.sys [166656 2002-01-17] (Silicon Integrated Systems Corporation)
R3 SNP325; C:\Windows\System32\DRIVERS\snp325.sys [10343168 2007-05-07] (Sonix Co. Ltd.)
R2 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5504 2012-06-03] ()
S3 catchme; \??\C:\DOKUME~1\mine\LOKALE~1\Temp\catchme.sys [x]
S3 esgiguard; \??\C:\Programme\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S3 filtertdidriver; system32\drivers\ewfiltertdidriver.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [x]
S4 IntelIde; No ImagePath
U3 TlntSvr;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-11 18:34 - 2013-09-11 18:34 - 00114688 _____ C:\WINDOWS\Minidump\Mini091113-01.dmp
2013-09-11 18:31 - 2013-09-11 18:31 - 00377856 _____ C:\Programme\gmer_2.1.19163 (1).exe
2013-09-10 18:22 - 2013-09-10 18:22 - 00377856 _____ C:\Programme\gmer_2.1.19163.exe
2013-09-10 18:02 - 2013-09-10 18:06 - 00056965 _____ C:\Programme\Addition.txt
2013-09-10 17:52 - 2013-09-10 17:52 - 00000000 ____D C:\FRST
2013-09-10 17:47 - 2013-09-10 17:47 - 00050477 _____ C:\Programme\Defogger (2).exe
2013-09-10 17:47 - 2013-09-10 17:47 - 00000000 _____ C:\Dokumente und Einstellungen\mine\defogger_reenable
2013-08-28 14:05 - 2013-08-28 14:06 - 00005262 _____ C:\WINDOWS\KB2834904-v2.log
2013-08-28 14:05 - 2013-08-28 14:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$
2013-08-14 14:24 - 2013-08-14 14:28 - 00014730 _____ C:\WINDOWS\KB2862772-IE8.log
2013-08-14 14:21 - 2013-08-14 14:21 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2850869$
2013-08-14 14:17 - 2013-08-14 14:17 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2859537$
2013-08-14 14:14 - 2013-08-14 14:15 - 00005804 _____ C:\WINDOWS\KB2863058.log
2013-08-14 14:14 - 2013-08-14 14:14 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2863058$
2013-08-14 14:13 - 2013-08-14 14:13 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2849470$
2013-08-14 12:15 - 2013-08-14 14:21 - 00011315 _____ C:\WINDOWS\KB2850869.log
2013-08-14 12:14 - 2013-08-14 14:18 - 00012206 _____ C:\WINDOWS\KB2859537.log
==================== One Month Modified Files and Folders =======
2013-09-11 21:08 - 2013-09-11 21:08 - 01082195 _____ (Farbar) C:\Dokumente und Einstellungen\mine\Desktop\FRST.exe
2013-09-11 21:05 - 2009-07-24 14:27 - 00000000 ____D C:\Programme
2013-09-11 21:03 - 2013-04-11 14:51 - 00032404 _____ C:\WINDOWS\SchedLgU.Txt
2013-09-11 21:03 - 2012-11-26 19:22 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2013-09-11 21:03 - 2011-04-30 10:07 - 00001206 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-1078145449-1708537768-1004UA.job
2013-09-11 21:03 - 2011-04-30 10:07 - 00001154 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1715567821-1078145449-1708537768-1004Core.job
2013-09-11 20:53 - 2011-08-15 11:36 - 00001086 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-11 20:14 - 2009-07-24 13:45 - 01692474 _____ C:\WINDOWS\WindowsUpdate.log
2013-09-11 18:49 - 2013-06-25 21:44 - 00001014 _____ C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-1715567821-1078145449-1708537768-1004UA.job
2013-09-11 18:41 - 2013-05-07 20:29 - 00000000 ___RD C:\Programme\Mediencenter
2013-09-11 18:35 - 2011-08-15 11:36 - 00001082 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-11 18:35 - 2009-07-24 14:30 - 00000159 _____ C:\WINDOWS\wiadebug.log
2013-09-11 18:35 - 2009-07-24 14:30 - 00000050 _____ C:\WINDOWS\wiaservc.log
2013-09-11 18:34 - 2013-09-11 18:34 - 00114688 _____ C:\WINDOWS\Minidump\Mini091113-01.dmp
2013-09-11 18:34 - 2009-08-10 07:13 - 00000000 ____D C:\WINDOWS\Minidump
2013-09-11 18:34 - 2009-07-24 13:52 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-09-11 18:34 - 2006-02-28 16:00 - 00002422 _____ C:\WINDOWS\system32\wpa.dbl
2013-09-11 18:31 - 2013-09-11 18:31 - 00377856 _____ C:\Programme\gmer_2.1.19163 (1).exe
2013-09-11 16:05 - 2012-11-26 19:22 - 00692616 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2013-09-11 16:05 - 2011-12-08 15:53 - 00071048 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2013-09-11 11:32 - 2010-11-20 17:15 - 00000966 _____ C:\WINDOWS\Tasks\Google Software Updater.job
2013-09-10 21:49 - 2013-06-25 21:44 - 00000992 _____ C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-1715567821-1078145449-1708537768-1004Core.job
2013-09-10 18:22 - 2013-09-10 18:22 - 00377856 _____ C:\Programme\gmer_2.1.19163.exe
2013-09-10 18:06 - 2013-09-10 18:02 - 00056965 _____ C:\Programme\Addition.txt
2013-09-10 17:52 - 2013-09-10 17:52 - 00000000 ____D C:\FRST
2013-09-10 17:49 - 2013-04-13 15:33 - 00000470 _____ C:\Programme\defogger_disable.log
2013-09-10 17:47 - 2013-09-10 17:47 - 00050477 _____ C:\Programme\Defogger (2).exe
2013-09-10 17:47 - 2013-09-10 17:47 - 00000000 _____ C:\Dokumente und Einstellungen\mine\defogger_reenable
2013-09-10 17:47 - 2009-07-24 13:53 - 00000000 ____D C:\Dokumente und Einstellungen\mine
2013-09-10 17:02 - 2009-08-14 08:40 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB971557$
2013-09-10 17:02 - 2009-07-24 13:53 - 00000190 ___SH C:\Dokumente und Einstellungen\mine\ntuser.ini
2013-09-09 11:44 - 2013-02-08 23:42 - 00001777 _____ C:\Dokumente und Einstellungen\All Users\Desktop\Google Chrome.lnk
2013-08-28 14:06 - 2013-08-28 14:05 - 00005262 _____ C:\WINDOWS\KB2834904-v2.log
2013-08-28 14:06 - 2013-08-28 14:05 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$
2013-08-28 14:06 - 2012-12-02 14:48 - 00535211 _____ C:\WINDOWS\setupapi.log
2013-08-28 14:06 - 2012-12-02 14:48 - 00275567 _____ C:\WINDOWS\FaxSetup.log
2013-08-28 14:06 - 2012-12-02 14:48 - 00149906 _____ C:\WINDOWS\ocgen.log
2013-08-28 14:06 - 2012-12-02 14:48 - 00109333 _____ C:\WINDOWS\tsoc.log
2013-08-28 14:06 - 2012-12-02 14:48 - 00092121 _____ C:\WINDOWS\comsetup.log
2013-08-28 14:06 - 2012-12-02 14:48 - 00058215 _____ C:\WINDOWS\ntdtcsetup.log
2013-08-28 14:06 - 2012-12-02 14:48 - 00042551 _____ C:\WINDOWS\iis6.log
2013-08-28 14:06 - 2012-12-02 14:48 - 00015792 _____ C:\WINDOWS\ocmsn.log
2013-08-28 14:06 - 2012-12-02 14:48 - 00014332 _____ C:\WINDOWS\msgsocm.log
2013-08-28 14:06 - 2012-12-02 14:48 - 00001374 _____ C:\WINDOWS\imsins.log
2013-08-23 11:31 - 2013-05-07 20:21 - 00001151 _____ C:\Dokumente und Einstellungen\mine\Startmenü\Programme\Mediencenter.lnk
2013-08-23 11:31 - 2013-05-07 20:21 - 00001145 _____ C:\Dokumente und Einstellungen\mine\Desktop\Mediencenter.lnk
2013-08-23 11:31 - 2010-07-10 11:59 - 00000664 _____ C:\WINDOWS\system32\d3d9caps.dat
2013-08-21 19:06 - 2009-07-24 13:52 - 00000000 __SHD C:\Dokumente und Einstellungen\LocalService
2013-08-16 15:31 - 2009-07-24 23:11 - 00000000 ____D C:\WINDOWS\Microsoft.NET
2013-08-16 14:44 - 2013-07-26 14:06 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-08-16 14:32 - 2009-07-24 16:20 - 75778376 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2013-08-16 14:13 - 2009-07-24 14:27 - 01366804 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2013-08-16 08:20 - 2009-07-24 14:51 - 00000000 ____D C:\Programme\Sony Ericsson
2013-08-14 14:28 - 2013-08-14 14:24 - 00014730 _____ C:\WINDOWS\KB2862772-IE8.log
2013-08-14 14:28 - 2012-12-02 14:48 - 00001374 _____ C:\WINDOWS\imsins.BAK
2013-08-14 14:27 - 2012-12-14 15:18 - 00027261 _____ C:\WINDOWS\updspapi.log
2013-08-14 14:21 - 2013-08-14 14:21 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2850869$
2013-08-14 14:21 - 2013-08-14 12:15 - 00011315 _____ C:\WINDOWS\KB2850869.log
2013-08-14 14:18 - 2013-08-14 12:14 - 00012206 _____ C:\WINDOWS\KB2859537.log
2013-08-14 14:17 - 2013-08-14 14:17 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2859537$
2013-08-14 14:15 - 2013-08-14 14:14 - 00005804 _____ C:\WINDOWS\KB2863058.log
2013-08-14 14:15 - 2009-07-24 16:54 - 00261906 _____ C:\WINDOWS\system32\TZLog.log
2013-08-14 14:14 - 2013-08-14 14:14 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2863058$
2013-08-14 14:13 - 2013-08-14 14:13 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2849470$
Files to move or delete:
====================
C:\DOKUME~1\mine\LOKALE~1\Temp\Mediencenter_3.8.0.2907.exe
C:\DOKUME~1\mine\LOKALE~1\Temp\Mediencenter_3.8.1.2208.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe
[2008-04-14 09:52] - [2008-04-14 09:52] - 1036800 ____A (Microsoft Corporation) 418045a93cd87a352098ab7dabe1b53e
C:\Windows\System32\winlogon.exe
[2008-04-14 09:53] - [2008-04-14 09:53] - 0513024 ____A (Microsoft Corporation) f09a527b422e25c478e38caa0e44417a
C:\Windows\System32\svchost.exe
[2008-04-14 09:53] - [2008-04-14 09:53] - 0014336 ____A (Microsoft Corporation) 4fbc75b74479c7a6f829e0ca19df3366
C:\Windows\System32\services.exe
[2008-04-14 09:53] - [2009-02-09 13:21] - 0111104 ____A (Microsoft Corporation) a3edbe9053889fb24ab22492472b39dc
C:\Windows\System32\User32.dll
[2008-04-14 09:52] - [2008-04-14 09:52] - 0580096 ____A (Microsoft Corporation) b0050cc5340e3a0760dd8b417ff7aebd
C:\Windows\System32\userinit.exe
[2008-04-14 09:53] - [2008-04-14 09:53] - 0026624 ____A (Microsoft Corporation) 788f95312e26389d596c0fa55834e106
C:\Windows\System32\Drivers\volsnap.sys
[2008-04-14 09:22] - [2008-04-14 09:22] - 0053760 ____A (Microsoft Corporation) a5a712f4e880874a477af790b5186e1d
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-12 11:37:01
Windows 5.1.2600 Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 Hitachi_HDT725025VLAT80 rev.V5DOA42A 232,89GB
Running: gmer_2.1.19163 (1).exe; Driver: C:\DOKUME~1\mine\LOKALE~1\Temp\pxldapoc.sys
---- System - GMER 2.1 ----
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwAdjustPrivilegesToken [0xB57DD598]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwClose [0xB57DDE18]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwConnectPort [0xB57DE92E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateEvent [0xB57DEEA0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateFile [0xB57DE0FA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateKey [0xB57DC442]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateMutant [0xB57DED78]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateNamedPipeFile [0xB57DD19E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreatePort [0xB57DEC34]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateSection [0xB57DD35A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateSemaphore [0xB57DEFD2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateSymbolicLinkObject [0xB57E0C14]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateThread [0xB57DDAB6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateWaitablePort [0xB57DECD6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDebugActiveProcess [0xB57E0606]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDeleteKey [0xB57DCA06]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDeleteValueKey [0xB57DCD94]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDeviceIoControlFile [0xB57DE582]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDuplicateObject [0xB57E15D6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateKey [0xB57DCED6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwEnumerateValueKey [0xB57DCF80]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwFsControlFile [0xB57DE38E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadDriver [0xB57E0698]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadKey [0xB57DC41E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadKey2 [0xB57DC430]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwMapViewOfSection [0xB57E0CC8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwNotifyChangeKey [0xB57DD0CC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenEvent [0xB57DEF42]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenFile [0xB57DDE9A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenKey [0xB57DC5E8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenMutant [0xB57DEE10]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenProcess [0xB57DD79E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenSection [0xB57E0C3E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenSemaphore [0xB57DF074]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenThread [0xB57DD6C2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryKey [0xB57DD02A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryMultipleValueKey [0xB57DCC52]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQuerySection [0xB57E0FE0]
SSDT \??\C:\WINDOWS\system32\drivers\avgtpx86.sys (AVG Technologies) ZwQueryValueKey [0xB13401EA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueueApcThread [0xB57E092E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRenameKey [0xB57DCB1A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplaceKey [0xB57DC2BC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplyPort [0xB57DF3FE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplyWaitReceivePort [0xB57DF2C4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRequestWaitReplyPort [0xB57E03A6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRestoreKey [0xB57E3E38]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwResumeThread [0xB57E14B8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSaveKey [0xB57DC254]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSecureConnectPort [0xB57DE668]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetContextThread [0xB57DDCD4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetInformationToken [0xB57DFC56]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetSecurityObject [0xB57E0792]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetSystemInformation [0xB57E1120]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetValueKey [0xB57DC72A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSuspendProcess [0xB57E1204]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSuspendThread [0xB57E132C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSystemDebugControl [0xB57E0532]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwTerminateProcess [0xB57DD916]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwTerminateThread [0xB57DD86C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwUnmapViewOfSection [0xB57E0E96]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwWriteVirtualMemory [0xB57DD9F6]
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) IoIsOperationSynchronous
---- Kernel code sections - GMER 2.1 ----
.text ntoskrnl.exe!_abnormal_termination + C8 804E269C 4 Bytes JMP 9FB8DC1E
.text ntoskrnl.exe!_abnormal_termination + 114 804E26E8 16 Bytes [5A, D3, 7D, B5, D2, EF, 7D, ...] {POP EDX; SAR [EBP-0x4b], CL; SHR BH, CL; JGE 0xffffffbd; ADC AL, 0xc; JLE 0xffffffc1; MOV DH, 0xda; JGE 0xffffffc5}
.text ntoskrnl.exe!_abnormal_termination + 12D 804E2701 7 Bytes [EC, 7D, B5, 06, 06, 7E, B5] {IN AL, DX; JGE 0xffffffb8; PUSH ES; PUSH ES; JLE 0xffffffbc}
.text ntoskrnl.exe!_abnormal_termination + 1D0 804E27A4 12 Bytes [98, 06, 7E, B5, 1E, C4, 7D, ...] {CWDE ; PUSH ES; JLE 0xffffffb9; PUSH DS; LES EDI, [EBP-0x4b]; XOR AH, AL; JGE 0xffffffc1}
.text ntoskrnl.exe!_abnormal_termination + 228 804E27FC 8 Bytes CALL 9103A5C6
.text ...
.text ntoskrnl.exe!IoIsOperationSynchronous 804E86AA 5 Bytes JMP B57D28B6 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)
.text ntoskrnl.exe!FsRtlCheckLockForReadAccess 80512921 5 Bytes JMP B57D24DC \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)
init C:\WINDOWS\system32\drivers\cmigameport.sys entry point in "init" section [0xF7A62892]
---- User code sections - GMER 2.1 ----
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtCreateFile + 6 7C91D0B4 4 Bytes [28, 2C, FB, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtCreateFile + B 7C91D0B9 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtMapViewOfSection + 6 7C91D524 4 Bytes [28, 2F, FB, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtMapViewOfSection + B 7C91D529 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtOpenFile + 6 7C91D5A4 4 Bytes [68, 2C, FB, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtOpenFile + B 7C91D5A9 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtOpenProcess + 6 7C91D604 4 Bytes [A8, 2D, FB, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtOpenProcess + B 7C91D609 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtOpenProcessToken + 6 7C91D614 4 Bytes CALL 7B92D146
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtOpenProcessToken + B 7C91D619 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtOpenProcessTokenEx + 6 7C91D624 4 Bytes [A8, 2E, FB, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtOpenProcessTokenEx + B 7C91D629 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtOpenThread + 6 7C91D664 4 Bytes [68, 2D, FB, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtOpenThread + B 7C91D669 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtOpenThreadToken + 6 7C91D674 4 Bytes [68, 2E, FB, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtOpenThreadToken + B 7C91D679 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtOpenThreadTokenEx + 6 7C91D684 4 Bytes CALL 7B92D1B7
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtOpenThreadTokenEx + B 7C91D689 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtQueryAttributesFile + 6 7C91D714 4 Bytes [A8, 2C, FB, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtQueryAttributesFile + B 7C91D719 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtQueryFullAttributesFile + 6 7C91D7B4 4 Bytes CALL 7B92D2E5
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtQueryFullAttributesFile + B 7C91D7B9 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtSetInformationFile + 6 7C91DC64 4 Bytes [28, 2D, FB, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtSetInformationFile + B 7C91DC69 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtSetInformationThread + 6 7C91DCB4 4 Bytes [28, 2E, FB, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtSetInformationThread + B 7C91DCB9 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtUnmapViewOfSection + 6 7C91DF14 4 Bytes [68, 2F, FB, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[472] ntdll.dll!NtUnmapViewOfSection + B 7C91DF19 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtCreateFile + 6 7C91D0B4 4 Bytes [28, 28, B2, 00] {SUB [EAX], CH; MOV DL, 0x0}
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtCreateFile + B 7C91D0B9 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtMapViewOfSection + 6 7C91D524 4 Bytes [28, 2B, B2, 00] {SUB [EBX], CH; MOV DL, 0x0}
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtMapViewOfSection + B 7C91D529 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtOpenFile + 6 7C91D5A4 4 Bytes [68, 28, B2, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtOpenFile + B 7C91D5A9 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtOpenProcess + 6 7C91D604 4 Bytes [A8, 29, B2, 00] {TEST AL, 0x29; MOV DL, 0x0}
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtOpenProcess + B 7C91D609 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtOpenProcessToken + 6 7C91D614 4 Bytes CALL 7B928842
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtOpenProcessToken + B 7C91D619 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtOpenProcessTokenEx + 6 7C91D624 4 Bytes [A8, 2A, B2, 00] {TEST AL, 0x2a; MOV DL, 0x0}
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtOpenProcessTokenEx + B 7C91D629 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtOpenThread + 6 7C91D664 4 Bytes [68, 29, B2, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtOpenThread + B 7C91D669 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtOpenThreadToken + 6 7C91D674 4 Bytes [68, 2A, B2, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtOpenThreadToken + B 7C91D679 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtOpenThreadTokenEx + 6 7C91D684 4 Bytes CALL 7B9288B3
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtOpenThreadTokenEx + B 7C91D689 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtQueryAttributesFile + 6 7C91D714 4 Bytes [A8, 28, B2, 00] {TEST AL, 0x28; MOV DL, 0x0}
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtQueryAttributesFile + B 7C91D719 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtQueryFullAttributesFile + 6 7C91D7B4 4 Bytes CALL 7B9289E1
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtQueryFullAttributesFile + B 7C91D7B9 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtSetInformationFile + 6 7C91DC64 4 Bytes [28, 29, B2, 00] {SUB [ECX], CH; MOV DL, 0x0}
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtSetInformationFile + B 7C91DC69 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtSetInformationThread + 6 7C91DCB4 4 Bytes [28, 2A, B2, 00] {SUB [EDX], CH; MOV DL, 0x0}
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtSetInformationThread + B 7C91DCB9 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtUnmapViewOfSection + 6 7C91DF14 4 Bytes [68, 2B, B2, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[1196] ntdll.dll!NtUnmapViewOfSection + B 7C91DF19 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtCreateFile + 6 7C91D0B4 4 Bytes [28, 4C, 5F, 00] {SUB [EDI+EBX*2+0x0], CL}
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtCreateFile + B 7C91D0B9 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtMapViewOfSection + 6 7C91D524 4 Bytes [28, 4F, 5F, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtMapViewOfSection + B 7C91D529 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtOpenFile + 6 7C91D5A4 4 Bytes [68, 4C, 5F, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtOpenFile + B 7C91D5A9 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtOpenProcess + 6 7C91D604 4 Bytes [A8, 4D, 5F, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtOpenProcess + B 7C91D609 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtOpenProcessToken + 6 7C91D614 4 Bytes CALL 7B923566
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtOpenProcessToken + B 7C91D619 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtOpenProcessTokenEx + 6 7C91D624 4 Bytes [A8, 4E, 5F, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtOpenProcessTokenEx + B 7C91D629 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtOpenThread + 6 7C91D664 4 Bytes [68, 4D, 5F, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtOpenThread + B 7C91D669 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtOpenThreadToken + 6 7C91D674 4 Bytes [68, 4E, 5F, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtOpenThreadToken + B 7C91D679 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtOpenThreadTokenEx + 6 7C91D684 4 Bytes CALL 7B9235D7
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtOpenThreadTokenEx + B 7C91D689 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtQueryAttributesFile + 6 7C91D714 4 Bytes [A8, 4C, 5F, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtQueryAttributesFile + B 7C91D719 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtQueryFullAttributesFile + 6 7C91D7B4 4 Bytes CALL 7B923705
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtQueryFullAttributesFile + B 7C91D7B9 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtSetInformationFile + 6 7C91DC64 4 Bytes [28, 4D, 5F, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtSetInformationFile + B 7C91DC69 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtSetInformationThread + 6 7C91DCB4 4 Bytes [28, 4E, 5F, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtSetInformationThread + B 7C91DCB9 1 Byte [E2]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtUnmapViewOfSection + 6 7C91DF14 4 Bytes [68, 4F, 5F, 00]
.text C:\Programme\Google\Chrome\Application\chrome.exe[3452] ntdll.dll!NtUnmapViewOfSection + B 7C91DF19 1 Byte [E2]
---- Devices - GMER 2.1 ----
AttachedDevice \Driver\Tcpip \Device\Ip kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice \Driver\Tcpip \Device\RawIp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
---- EOF - GMER 2.1 ----
Ich hoffe, Ihr könnt mir helfen. Liebe grüße mine-leo |
| Themen zu Infizierte Datei auf windows xp |
| administrator, browser, computer, dvdvideosoft ltd., explorer, farbar, farbar recovery scan tool, flash player, homepage, infizierte, kaspersky, minidump, nodrives, ntdll.dll, plug-in, pup.optional.speedanalysis, pup.optional.speedanalysis2.a, registry, rundll, secure search, software, spyhunter, spyhunter entfernen, trojaner, trojaner board, vtoolbarupdater, win32/adware.cidhelp, windows, windows xp |
Baum-Darstellung