| |
| |||||||
Log-Analyse und Auswertung: HTML:Bankfraud-BYL durch Avast gefundenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
23.10.2013, 12:35
| #1 |
| |  HTML:Bankfraud-BYL durch Avast gefunden Als ich eben mit meinem Internet Explorer 11 auf meine GMails zugreifen wollte (Ich benutze eigentlich Chrome, verwende aber für ein zweites GMail-Konto den IE um parallel die Mails abzurufen), meldete mir Avast einen Trojaner gefunden zu haben. Und zwar HTML:Bankfraud-BYL. defogger: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:39 on 23/10/2013 (Garcia)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-10-23 13:02:41
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST500DM002-1BD142 rev.KC45 465,76GB
Running: ue0dlzgo.exe; Driver: C:\Users\Garcia\AppData\Local\Temp\fwldapow.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\wininit.exe[576] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\services.exe[636] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\winlogon.exe[732] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[816] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\atiesrxx.exe[1004] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[284] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[392] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[520] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[628] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1216] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\System32\spoolsv.exe[1640] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1804] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007710a30a 1 byte [62]
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1848] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007710a30a 1 byte [62]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 00000001001f075c
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001001f03a4
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 00000001001f0b14
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 00000001001f0ecc
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 00000001001f163c
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 00000001001f1284
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001001f19f4
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 000000010021075c
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001002103a4
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 0000000100210b14
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 0000000100210ecc
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 000000010021163c
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 0000000100211284
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001002119f4
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Windows\System32\WUDFHost.exe[2608] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\System32\WUDFHost.exe[2608] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\System32\WUDFHost.exe[2608] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\System32\WUDFHost.exe[2608] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\System32\WUDFHost.exe[2608] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\System32\WUDFHost.exe[2608] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\System32\WUDFHost.exe[2608] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\System32\WUDFHost.exe[2608] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 00000001003a075c
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001003a03a4
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 00000001003a0b14
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 00000001003a0ecc
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 00000001003a163c
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 00000001003a1284
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001003a19f4
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2744] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2744] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2744] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2744] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2744] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2744] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2744] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2744] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 000000010042075c
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001004203a4
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 0000000100420b14
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 0000000100420ecc
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 000000010042163c
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 0000000100421284
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001004219f4
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2476] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 00000001003a075c
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001003a03a4
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 00000001003a0b14
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 00000001003a0ecc
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 00000001003a163c
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 00000001003a1284
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001003a19f4
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 000000010051075c
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001005103a4
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 0000000100510b14
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 0000000100510ecc
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 000000010051163c
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 0000000100511284
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001005119f4
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 00000001001f075c
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001001f03a4
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 00000001001f0b14
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 00000001001f0ecc
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 00000001001f163c
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 00000001001f1284
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001001f19f4
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 000000010033075c
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001003303a4
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 0000000100330b14
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 0000000100330ecc
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 000000010033163c
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 0000000100331284
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001003319f4
.text C:\Windows\Explorer.EXE[2280] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 00000001002d075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001002d03a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 00000001002d0b14
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 00000001002d0ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 00000001002d163c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 00000001002d1284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001002d19f4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 00000000776afaa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 00000000776afb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 00000000776afc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 00000000776b0018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000776b1900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000776cc45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000776d1217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\syswow64\KERNEL32.dll!SetUnhandledExceptionFilter 00000000770e87b1 5 bytes [33, C0, C2, 04, 00]
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007710a30a 1 byte [62]
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075b35181 5 bytes JMP 0000000100251014
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075b35254 5 bytes JMP 0000000100250804
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 0000000075b353d5 5 bytes JMP 0000000100250a08
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 0000000075b354c2 5 bytes JMP 0000000100250c0c
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 0000000075b355e2 5 bytes JMP 0000000100250e10
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 0000000075b3567c 5 bytes JMP 00000001002501f8
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 0000000075b3589f 5 bytes JMP 00000001002503fc
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075b35a22 5 bytes JMP 0000000100250600
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\syswow64\USER32.dll!SetWinEventHook 00000000762aee09 5 bytes JMP 00000001002601f8
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 00000000762b3982 5 bytes JMP 00000001002603fc
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 00000000762b7603 5 bytes JMP 0000000100260804
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 00000000762b835c 5 bytes JMP 0000000100260600
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 00000000762cf52b 5 bytes JMP 0000000100260a08
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000756d1465 2 bytes [6D, 75]
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000756d14bb 2 bytes [6D, 75]
.text ... * 2
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 00000000776afaa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 00000000776afb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 00000000776afc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 00000000776b0018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000776b1900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000776cc45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000776d1217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007710a30a 1 byte [62]
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\syswow64\USER32.dll!SetWinEventHook 00000000762aee09 5 bytes JMP 00000001001d01f8
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 00000000762b3982 5 bytes JMP 00000001001d03fc
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 00000000762b7603 5 bytes JMP 00000001001d0804
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 00000000762b835c 5 bytes JMP 00000001001d0600
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 00000000762cf52b 5 bytes JMP 00000001001d0a08
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075b35181 5 bytes JMP 00000001001e1014
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075b35254 5 bytes JMP 00000001001e0804
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 0000000075b353d5 5 bytes JMP 00000001001e0a08
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 0000000075b354c2 5 bytes JMP 00000001001e0c0c
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 0000000075b355e2 5 bytes JMP 00000001001e0e10
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 0000000075b3567c 5 bytes JMP 00000001001e01f8
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 0000000075b3589f 5 bytes JMP 00000001001e03fc
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075b35a22 5 bytes JMP 00000001001e0600
.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[3192] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007710a30a 1 byte [62]
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 00000000776afaa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 00000000776afb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 00000000776afc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 00000000776b0018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000776b1900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000776cc45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000776d1217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007710a30a 1 byte [62]
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075b35181 5 bytes JMP 0000000100101014
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075b35254 5 bytes JMP 0000000100100804
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 0000000075b353d5 5 bytes JMP 0000000100100a08
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 0000000075b354c2 5 bytes JMP 0000000100100c0c
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 0000000075b355e2 5 bytes JMP 0000000100100e10
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 0000000075b3567c 5 bytes JMP 00000001001001f8
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 0000000075b3589f 5 bytes JMP 00000001001003fc
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075b35a22 5 bytes JMP 0000000100100600
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\syswow64\USER32.dll!SetWinEventHook 00000000762aee09 5 bytes JMP 00000001001101f8
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 00000000762b3982 5 bytes JMP 00000001001103fc
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 00000000762b7603 5 bytes JMP 0000000100110804
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 00000000762b835c 5 bytes JMP 0000000100110600
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 00000000762cf52b 5 bytes JMP 0000000100110a08
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 00000000776afaa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 00000000776afb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 00000000776afc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 00000000776b0018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000776b1900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000776cc45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000776d1217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007710a30a 1 byte [62]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075b35181 5 bytes JMP 0000000100251014
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075b35254 5 bytes JMP 0000000100250804
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 0000000075b353d5 5 bytes JMP 0000000100250a08
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 0000000075b354c2 5 bytes JMP 0000000100250c0c
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 0000000075b355e2 5 bytes JMP 0000000100250e10
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 0000000075b3567c 5 bytes JMP 00000001002501f8
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 0000000075b3589f 5 bytes JMP 00000001002503fc
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075b35a22 5 bytes JMP 0000000100250600
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\syswow64\USER32.dll!SetWinEventHook 00000000762aee09 5 bytes JMP 00000001002601f8
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 00000000762b3982 5 bytes JMP 00000001002603fc
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 00000000762b7603 5 bytes JMP 0000000100260804
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 00000000762b835c 5 bytes JMP 0000000100260600
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 00000000762cf52b 5 bytes JMP 0000000100260a08
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 000000010036075c
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001003603a4
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 0000000100360b14
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 0000000100360ecc
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 000000010036163c
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 0000000100361284
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001003619f4
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 000000010045075c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001004503a4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 0000000100450b14
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 0000000100450ecc
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 000000010045163c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 0000000100451284
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001004519f4
.text C:\Windows\System32\svchost.exe[4080] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\System32\svchost.exe[4080] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\System32\svchost.exe[4080] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\System32\svchost.exe[4080] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\System32\svchost.exe[4080] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\System32\svchost.exe[4080] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\System32\svchost.exe[4080] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\System32\svchost.exe[4080] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 00000001002c075c
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001002c03a4
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 00000001002c0b14
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 00000001002c0ecc
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 00000001002c163c
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 00000001002c1284
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001002c19f4
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 000000010015075c
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001001503a4
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 0000000100150b14
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 0000000100150ecc
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 000000010015163c
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 0000000100151284
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001001519f4
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3808] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 000000010040075c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3808] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001004003a4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3808] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 0000000100400b14
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3808] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 0000000100400ecc
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3808] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 000000010040163c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3808] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 0000000100401284
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3808] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001004019f4
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 000000010019075c
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001001903a4
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 0000000100190b14
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 0000000100190ecc
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 000000010019163c
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 0000000100191284
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001001919f4
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 000000010033075c
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001003303a4
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 0000000100330b14
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 0000000100330ecc
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 000000010033163c
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 0000000100331284
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001003319f4
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Windows\system32\AUDIODG.EXE[4260] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Users\Garcia\Downloads\Chrome Downloads\ue0dlzgo.exe[5820] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007710a30a 1 byte [62]
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [1176:2636] 000007fef6bd9688
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Tag 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@DisplayName aswRvrt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Description avast! Revert
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@BootCounter 170
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@TickCounter 2883459
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Tag 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@BehavShield 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@NoWelcomeScreen 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DisplayName avast! Network Shield Support
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Description avast! Network Shield TDI driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Tag 9
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@DisplayName aswVmm
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Type 32
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Description Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Tag 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@DisplayName aswRvrt
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Description avast! Revert
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@BootCounter 170
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@TickCounter 2883459
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Tag 2
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@BehavShield 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@NoWelcomeScreen 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DisplayName avast! Network Shield Support
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Description avast! Network Shield TDI driver
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Tag 9
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@DisplayName aswVmm
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Type 32
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Description Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.
---- EOF - GMER 2.1 ----
Wäre super wenn mir auch jemand erläutern könnte was genau ich mir da eingefangen habe. Laut meiner kleinen Recherchen habe ich, oder jemand in meinem Netzwerk, mir das ganze über Mails eingefangen. Ich bekomme schon länger eine Menge Spam an meine eMail-Adresse. Sollte ich mich von dem Konto verabschieden? |
|
23.10.2013, 14:10
| #2 |
| /// the machine /// TB-Ausbilder    | HTML:Bankfraud-BYL durch Avast gefunden Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
23.10.2013, 14:12
| #3 |
| | HTML:Bankfraud-BYL durch Avast gefunden Entschuldige; hatte das dann wohl missverstanden in der Anleitung wie man einen Thread erstellt.
__________________FRST: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-10-2013
Ran by Garcia (administrator) on EVA-01 on 23-10-2013 12:41:04
Running from C:\Users\Garcia\Downloads\Chrome Downloads
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunes.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\Garcia\Downloads\Chrome Downloads\Defogger.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11101800 2010-07-28] (Realtek Semiconductor)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKCU\...\Run: [Google Update] - C:\Users\Garcia\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-07-06] (Google Inc.)
HKCU\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [4287536 2013-07-27] ()
HKCU\...\Run: [AdobeBridge] - [x]
HKCU\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2010-11-25] (AMD)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-10-01] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xEB113FAC8D81CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - X:\Program Files (x86)\Java\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - X:\Program Files (x86)\Java\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://google.de/"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\pdf.dll ()
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.149\npGoogleUpdate3.dll No File
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Extension: (Google Docs) - C:\Users\Garcia\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\Garcia\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (Vimeo\u2122) - C:\Users\Garcia\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfimiibpomebbdeomajcknhccgpkjmlh\2.0.3_0
CHR Extension: (YouTube) - C:\Users\Garcia\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Adblock Plus) - C:\Users\Garcia\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.6.1_0
CHR Extension: (Google Search) - C:\Users\Garcia\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Google Calendar) - C:\Users\Garcia\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn\4.5.3_0
CHR Extension: (Minimal) - C:\Users\Garcia\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnfhcmjkebafbfikmbkhdpbmfpfjgiog\1.0_0
CHR Extension: (SoundCloud) - C:\Users\Garcia\AppData\Local\Google\Chrome\User Data\Default\Extensions\ipebkipbeggmmkjjljenoblnfaenambp\1_0
CHR Extension: (Google Play) - C:\Users\Garcia\AppData\Local\Google\Chrome\User Data\Default\Extensions\komhbcfkdcgmcdoenjcjheifdiabikfi\3.0_0
CHR Extension: (Google Maps) - C:\Users\Garcia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh\5.2.7_0
CHR Extension: (Google Mail Checker) - C:\Users\Garcia\AppData\Local\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff\4.4.0_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\Garcia\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR Extension: (LEO W\u00F6rterbuchsuche) - C:\Users\Garcia\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojniiiidjmoaiehegaedmfdclmgmmpdp\1.4_0
CHR Extension: (deviantART\u2122) - C:\Users\Garcia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbppfiakkcakldnnhcfncfmclhkhhdcp\2.0.3_0
CHR Extension: (Gmail) - C:\Users\Garcia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
==================== Services (Whitelisted) =================
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [484592 2013-09-29] (BitRaider, LLC)
S3 COMSysApp; C:\Windows\SysWow64\dllhost.exe [7168 2009-07-14] (Microsoft Corporation)
S3 IEEtwCollectorService; C:\Windows\system32\IEEtwCollector.exe [111616 2013-10-07] (Microsoft Corporation)
S3 msiserver; C:\Windows\SysWow64\msiexec.exe [73216 2010-11-20] (Microsoft Corporation)
S3 npggsvc; C:\Windows\SysWow64\GameMon.des [4763048 2013-02-12] (INCA Internet Co., Ltd.)
R2 WSearch; C:\Windows\SysWow64\SearchIndexer.exe [427520 2011-05-04] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-07-06] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-07-06] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-07-06] ()
S3 BRDriver64; C:\ProgramData\BitRaider\BRDriver64.sys [75048 2013-10-01] (BitRaider)
R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-07-13] (Disc Soft Ltd)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-23 12:40 - 2013-10-23 12:40 - 00000000 ____D C:\FRST
2013-10-23 12:39 - 2013-10-23 12:39 - 00000168 _____ C:\Users\Garcia\defogger_reenable
2013-10-21 17:06 - 2013-10-21 17:06 - 00000000 ____D C:\Users\Garcia\AppData\Local\Wizards of the Coast
2013-10-21 17:05 - 2013-10-21 17:05 - 00000320 _____ C:\Users\Garcia\Desktop\Magic The Gathering Online .appref-ms
2013-10-21 17:05 - 2013-10-21 17:05 - 00000000 ____D C:\Users\Garcia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wizards of the Coast
2013-10-20 16:39 - 2013-10-20 16:39 - 00000767 _____ C:\Users\Public\Desktop\Democracy 3.lnk
2013-10-19 21:53 - 2013-10-19 22:15 - 00000000 ____D C:\Users\Garcia\Documents\democracy2
2013-10-19 21:53 - 2013-10-19 21:53 - 00004096 _____ C:\Windows\d3dx.dat
2013-10-19 21:41 - 2013-10-19 21:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-17 16:32 - 2009-11-27 18:09 - 00000923 _____ C:\Users\Garcia\Desktop\# Installation Guide.txt
2013-10-17 16:32 - 2008-10-17 18:57 - 30344675 _____ C:\Users\Garcia\Desktop\Kudos 2 Setup.exe
2013-10-17 15:07 - 2013-10-17 15:07 - 00000000 ____D C:\ProgramData\Oracle
2013-10-17 15:07 - 2013-10-08 07:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-17 15:07 - 2013-10-08 07:46 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-10-17 15:07 - 2013-10-08 07:46 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-10-17 15:07 - 2013-10-08 07:46 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-10-17 15:06 - 2013-10-17 15:07 - 00004936 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-10-07 17:56 - 2013-10-07 17:56 - 00000000 ____D C:\Users\Garcia\Desktop\THQ-Support
2013-10-07 10:39 - 2013-10-07 10:39 - 23157248 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 17074176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 12946944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 11180032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 04195328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 02761728 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-10-07 10:39 - 2013-10-07 10:39 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-07 10:39 - 2013-10-07 10:39 - 02328064 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 02165760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-10-07 10:39 - 2013-10-07 10:39 - 01926144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-10-07 10:39 - 2013-10-07 10:39 - 01815552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 01392640 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 01227776 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 01152512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 01050112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00644608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-10-07 10:39 - 2013-10-07 10:39 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-10-07 10:39 - 2013-10-07 10:39 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-10-07 10:39 - 2013-10-07 10:39 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-10-07 10:39 - 2013-10-07 10:39 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00263360 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00238784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-10-07 10:39 - 2013-10-07 10:39 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-10-07 10:39 - 2013-10-07 10:39 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-10-07 10:37 - 2013-10-07 10:43 - 00011798 _____ C:\Windows\IE11_main.log
2013-10-07 10:07 - 2013-10-07 10:07 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-10-07 10:03 - 2013-10-07 10:04 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-10-07 10:03 - 2013-10-07 10:04 - 00000000 ____D C:\Program Files\iTunes
2013-10-07 10:03 - 2013-10-07 10:04 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-10-07 10:03 - 2013-10-07 10:03 - 00000000 ____D C:\Program Files\iPod
2013-10-01 16:39 - 2013-10-01 16:39 - 00000000 ____D C:\Users\Garcia\AppData\Local\SWTOR
2013-09-30 10:06 - 2013-10-16 13:09 - 00000000 ____D C:\Users\Garcia\Desktop\Proxies
2013-09-30 09:15 - 2013-09-30 09:15 - 00000000 ____D C:\Users\Garcia\Documents\Guild Wars 2
2013-09-30 09:15 - 2013-09-30 09:15 - 00000000 ____D C:\Users\Garcia\AppData\Roaming\Guild Wars 2
2013-09-29 18:35 - 2013-10-01 16:39 - 00000000 ____D C:\ProgramData\BitRaider
2013-09-29 18:35 - 2013-09-29 18:35 - 00000000 ____D C:\Users\Public\Documents\BitRaider
2013-09-29 18:35 - 2013-09-29 18:35 - 00000000 ____D C:\Users\Garcia\AppData\Local\SWTORPerf
2013-09-29 16:15 - 2013-09-29 18:34 - 00015322 _____ C:\Users\Garcia\Documents\Install STAR WARS The Old Republic.log
2013-09-29 16:15 - 2013-09-29 16:15 - 00000000 ____D C:\Users\hedev
2013-09-27 22:57 - 2013-09-27 22:57 - 00000000 ____D C:\Users\Garcia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-09-27 22:05 - 2013-09-27 22:05 - 00000981 _____ C:\Users\Garcia\Desktop\Vampires - The Masquerade Bloodlines Spielen.lnk
2013-09-27 22:05 - 2013-09-27 22:05 - 00000000 ____D C:\Users\Garcia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Activision
2013-09-27 20:25 - 2013-09-27 20:25 - 00000000 ____D C:\Users\Garcia\AppData\Roaming\runic games
2013-09-24 18:15 - 2013-09-24 18:15 - 00000000 ____D C:\Users\Garcia\AppData\Local\2K Games
2013-09-24 18:15 - 2013-09-24 18:15 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-09-23 09:52 - 2013-09-23 09:52 - 00000000 ____D C:\Users\Garcia\AppData\Local\EA Games
==================== One Month Modified Files and Folders =======
2013-10-23 12:41 - 2013-07-27 11:29 - 00000000 ____D C:\Users\Garcia\AppData\Local\PMB Files
2013-10-23 12:40 - 2013-10-23 12:40 - 00000000 ____D C:\FRST
2013-10-23 12:39 - 2013-10-23 12:39 - 00000168 _____ C:\Users\Garcia\defogger_reenable
2013-10-23 12:39 - 2013-07-06 00:00 - 00000000 ____D C:\Users\Garcia
2013-10-23 12:25 - 2013-07-06 14:10 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3385325856-1774502413-2545405777-1000UA.job
2013-10-23 12:20 - 2013-07-06 00:43 - 00000000 ____D C:\Users\Garcia\AppData\Local\Deployment
2013-10-23 11:58 - 2013-07-06 00:43 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-23 11:51 - 2013-07-06 00:04 - 01389496 _____ C:\Windows\WindowsUpdate.log
2013-10-23 11:05 - 2013-07-06 00:43 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-23 11:03 - 2009-07-14 06:45 - 00017136 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-23 11:03 - 2009-07-14 06:45 - 00017136 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-23 10:55 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-23 10:55 - 2009-07-14 06:51 - 00040060 _____ C:\Windows\setupact.log
2013-10-22 16:25 - 2013-07-06 14:10 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3385325856-1774502413-2545405777-1000Core.job
2013-10-22 15:46 - 2013-07-06 01:48 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-10-22 12:45 - 2013-07-06 01:37 - 00491808 _____ C:\Windows\DirectX.log
2013-10-21 17:06 - 2013-10-21 17:06 - 00000000 ____D C:\Users\Garcia\AppData\Local\Wizards of the Coast
2013-10-21 17:05 - 2013-10-21 17:05 - 00000320 _____ C:\Users\Garcia\Desktop\Magic The Gathering Online .appref-ms
2013-10-21 17:05 - 2013-10-21 17:05 - 00000000 ____D C:\Users\Garcia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wizards of the Coast
2013-10-20 16:39 - 2013-10-20 16:39 - 00000767 _____ C:\Users\Public\Desktop\Democracy 3.lnk
2013-10-20 16:39 - 2013-07-12 22:03 - 00000000 ____D C:\Users\Garcia\Documents\My Games
2013-10-20 16:30 - 2013-07-06 18:19 - 00000000 ____D C:\Users\Garcia\AppData\Roaming\uTorrent
2013-10-20 15:12 - 2013-07-06 01:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-10-19 22:15 - 2013-10-19 21:53 - 00000000 ____D C:\Users\Garcia\Documents\democracy2
2013-10-19 21:53 - 2013-10-19 21:53 - 00004096 _____ C:\Windows\d3dx.dat
2013-10-19 21:42 - 2013-10-19 21:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-17 16:51 - 2013-07-15 12:00 - 00472322 _____ C:\Windows\system32\perfh00B.dat
2013-10-17 16:51 - 2013-07-15 12:00 - 00100756 _____ C:\Windows\system32\perfc00B.dat
2013-10-17 16:51 - 2009-07-14 19:58 - 00698124 _____ C:\Windows\system32\perfh007.dat
2013-10-17 16:51 - 2009-07-14 19:58 - 00148820 _____ C:\Windows\system32\perfc007.dat
2013-10-17 16:51 - 2009-07-14 07:13 - 02187726 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-17 16:49 - 2013-07-07 12:55 - 00000000 ____D C:\Users\Garcia\AppData\Roaming\vlc
2013-10-17 15:07 - 2013-10-17 15:07 - 00000000 ____D C:\ProgramData\Oracle
2013-10-17 15:07 - 2013-10-17 15:06 - 00004936 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-10-17 13:37 - 2013-08-20 17:43 - 00000000 ____D C:\Users\Garcia\AppData\Roaming\Skype
2013-10-16 13:09 - 2013-09-30 10:06 - 00000000 ____D C:\Users\Garcia\Desktop\Proxies
2013-10-16 12:32 - 2013-07-07 00:21 - 00000000 ____D C:\ProgramData\Adobe
2013-10-15 16:20 - 2013-07-06 14:10 - 00004096 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3385325856-1774502413-2545405777-1000UA
2013-10-15 16:20 - 2013-07-06 14:10 - 00003700 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3385325856-1774502413-2545405777-1000Core
2013-10-15 12:13 - 2013-08-20 17:43 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-10-15 12:13 - 2013-08-20 17:43 - 00000000 ____D C:\ProgramData\Skype
2013-10-13 15:28 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-10-12 14:53 - 2013-07-06 00:43 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-10-12 14:53 - 2013-07-06 00:43 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-09 15:38 - 2013-07-22 22:28 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-10-09 15:38 - 2013-07-16 20:28 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-10-08 14:10 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-10-08 12:01 - 2013-07-06 00:00 - 00001425 _____ C:\Users\Garcia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-10-08 07:50 - 2013-10-17 15:07 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-08 07:46 - 2013-10-17 15:07 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-10-08 07:46 - 2013-10-17 15:07 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-10-08 07:46 - 2013-10-17 15:07 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-10-07 19:09 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-10-07 17:56 - 2013-10-07 17:56 - 00000000 ____D C:\Users\Garcia\Desktop\THQ-Support
2013-10-07 10:43 - 2013-10-07 10:37 - 00011798 _____ C:\Windows\IE11_main.log
2013-10-07 10:39 - 2013-10-07 10:39 - 23157248 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 17074176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 12946944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 11180032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 04195328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 02761728 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-10-07 10:39 - 2013-10-07 10:39 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-07 10:39 - 2013-10-07 10:39 - 02328064 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 02165760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-10-07 10:39 - 2013-10-07 10:39 - 01926144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-10-07 10:39 - 2013-10-07 10:39 - 01815552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 01392640 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 01227776 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 01152512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 01050112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00644608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-10-07 10:39 - 2013-10-07 10:39 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-10-07 10:39 - 2013-10-07 10:39 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-10-07 10:39 - 2013-10-07 10:39 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-10-07 10:39 - 2013-10-07 10:39 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00263360 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00238784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-10-07 10:39 - 2013-10-07 10:39 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-10-07 10:39 - 2013-10-07 10:39 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-10-07 10:39 - 2013-10-07 10:39 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-10-07 10:39 - 2013-10-07 10:39 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-10-07 10:07 - 2013-10-07 10:07 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-10-07 10:04 - 2013-10-07 10:03 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-10-07 10:04 - 2013-10-07 10:03 - 00000000 ____D C:\Program Files\iTunes
2013-10-07 10:04 - 2013-10-07 10:03 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-10-07 10:03 - 2013-10-07 10:03 - 00000000 ____D C:\Program Files\iPod
2013-10-02 18:51 - 2013-07-06 00:47 - 00000000 ____D C:\ProgramData\Apple Computer
2013-10-01 16:39 - 2013-10-01 16:39 - 00000000 ____D C:\Users\Garcia\AppData\Local\SWTOR
2013-10-01 16:39 - 2013-09-29 18:35 - 00000000 ____D C:\ProgramData\BitRaider
2013-10-01 16:12 - 2013-07-06 00:58 - 00171546 _____ C:\Windows\PFRO.log
2013-09-30 09:15 - 2013-09-30 09:15 - 00000000 ____D C:\Users\Garcia\Documents\Guild Wars 2
2013-09-30 09:15 - 2013-09-30 09:15 - 00000000 ____D C:\Users\Garcia\AppData\Roaming\Guild Wars 2
2013-09-29 18:35 - 2013-09-29 18:35 - 00000000 ____D C:\Users\Public\Documents\BitRaider
2013-09-29 18:35 - 2013-09-29 18:35 - 00000000 ____D C:\Users\Garcia\AppData\Local\SWTORPerf
2013-09-29 18:34 - 2013-09-29 16:15 - 00015322 _____ C:\Users\Garcia\Documents\Install STAR WARS The Old Republic.log
2013-09-29 16:15 - 2013-09-29 16:15 - 00000000 ____D C:\Users\hedev
2013-09-27 22:57 - 2013-09-27 22:57 - 00000000 ____D C:\Users\Garcia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-09-27 22:20 - 2013-07-06 01:16 - 00000000 ____D C:\Users\Garcia\AppData\Roaming\Mozilla
2013-09-27 22:05 - 2013-09-27 22:05 - 00000981 _____ C:\Users\Garcia\Desktop\Vampires - The Masquerade Bloodlines Spielen.lnk
2013-09-27 22:05 - 2013-09-27 22:05 - 00000000 ____D C:\Users\Garcia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Activision
2013-09-27 20:25 - 2013-09-27 20:25 - 00000000 ____D C:\Users\Garcia\AppData\Roaming\runic games
2013-09-26 19:09 - 2013-07-03 01:26 - 00000000 ____D C:\Users\Garcia\Documents\Tutorials
2013-09-24 18:15 - 2013-09-24 18:15 - 00000000 ____D C:\Users\Garcia\AppData\Local\2K Games
2013-09-24 18:15 - 2013-09-24 18:15 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-09-23 15:18 - 2013-09-18 10:49 - 00000132 _____ C:\Users\Garcia\AppData\Roaming\Adobe CS6-PNG-Format - Voreinstellungen
2013-09-23 09:52 - 2013-09-23 09:52 - 00000000 ____D C:\Users\Garcia\AppData\Local\EA Games
2013-09-23 09:52 - 2013-09-22 13:07 - 00000000 ____D C:\Users\Garcia\Documents\EA Games
2013-09-23 09:52 - 2013-08-15 09:49 - 00000000 ____D C:\Users\Garcia\AppData\Local\Origin
2013-09-23 09:52 - 2013-08-15 09:48 - 00000000 ____D C:\ProgramData\Origin
2013-09-23 09:52 - 2013-08-15 09:48 - 00000000 ____D C:\ProgramData\Electronic Arts
Some content of TEMP:
====================
C:\Users\Garcia\AppData\Local\Temp\13-9_win7_win8_64_dd_ccc_whql.exe
C:\Users\Garcia\AppData\Local\Temp\Creative Cloud Helper.exe
C:\Users\Garcia\AppData\Local\Temp\drm_dyndata_7370014.dll
C:\Users\Garcia\AppData\Local\Temp\drm_dyndata_7380014.dll
C:\Users\Garcia\AppData\Local\Temp\drm_dyndata_7410004.dll
C:\Users\Garcia\AppData\Local\Temp\Gw2.exe
C:\Users\Garcia\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Garcia\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe
C:\Users\Garcia\AppData\Local\Temp\swt-win32-3740.dll
C:\Users\Garcia\AppData\Local\Temp\vlc-2.0.8-win32.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-21 19:21
==================== End Of Log ============================
Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-10-2013
Ran by Garcia at 2013-10-23 12:42:18
Running from C:\Users\Garcia\Downloads\Chrome Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: avast! Antivirus (Enabled - Up to date) {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AS: avast! Antivirus (Enabled - Up to date) {904CF271-6431-DA47-5FCE-A87D98DFB681}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
µTorrent (HKCU Version: 3.3.2.30180)
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.175)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Photoshop CS6 (x32 Version: 13.0)
Adobe Photoshop Lightroom 4.3 64-bit (Version: 4.3.1)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
Alan Wake (x32)
Alan Wake's American Nightmare (x32)
Alpha Protocol (x32)
AMD Accelerated Video Transcoding (Version: 13.15.100.30830)
AMD Catalyst Control Center (x32 Version: 2013.0830.1944.33589)
AMD Catalyst Install Manager (Version: 8.0.915.0)
AMD Drag and Drop Transcoding (Version: 2.00.0000)
AMD Media Foundation Decoders (Version: 1.0.80830.1925)
Apple Application Support (x32 Version: 2.3.6)
Apple Mobile Device Support (Version: 7.0.0.117)
Apple Software Update (x32 Version: 2.1.3.127)
ATI AVIVO64 Codecs (Version: 11.6.0.51125)
Audacity 2.0.3 (x32 Version: 2.0.3)
avast! Free Antivirus (x32 Version: 8.0.1489.0)
Back to the Future: Ep 1 - It's About Time (x32)
Bastion (x32)
BioShock Infinite (x32)
BitRaider Web Client (x32 Version: 1.1.9.4)
Bonjour (Version: 3.0.0.10)
Braid (x32)
Brütal Legend (x32)
Bully: Scholarship Edition (x32)
Canon Utilities EOS Utility (x32 Version: 2.13.20.0)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0830.1944.33589)
Catalyst Control Center InstallProxy (x32 Version: 2013.0830.1944.33589)
Catalyst Control Center Localization All (x32 Version: 2013.0830.1944.33589)
CCC Help Chinese Standard (x32 Version: 2013.0830.1943.33589)
CCC Help Chinese Traditional (x32 Version: 2013.0830.1943.33589)
CCC Help Czech (x32 Version: 2013.0830.1943.33589)
CCC Help Danish (x32 Version: 2013.0830.1943.33589)
CCC Help Dutch (x32 Version: 2013.0830.1943.33589)
CCC Help English (x32 Version: 2013.0830.1943.33589)
CCC Help Finnish (x32 Version: 2013.0830.1943.33589)
CCC Help French (x32 Version: 2013.0830.1943.33589)
CCC Help German (x32 Version: 2013.0830.1943.33589)
CCC Help Greek (x32 Version: 2013.0830.1943.33589)
CCC Help Hungarian (x32 Version: 2013.0830.1943.33589)
CCC Help Italian (x32 Version: 2013.0830.1943.33589)
CCC Help Japanese (x32 Version: 2013.0830.1943.33589)
CCC Help Korean (x32 Version: 2013.0830.1943.33589)
CCC Help Norwegian (x32 Version: 2013.0830.1943.33589)
CCC Help Polish (x32 Version: 2013.0830.1943.33589)
CCC Help Portuguese (x32 Version: 2013.0830.1943.33589)
CCC Help Russian (x32 Version: 2013.0830.1943.33589)
CCC Help Spanish (x32 Version: 2013.0830.1943.33589)
CCC Help Swedish (x32 Version: 2013.0830.1943.33589)
CCC Help Thai (x32 Version: 2013.0830.1943.33589)
CCC Help Turkish (x32 Version: 2013.0830.1943.33589)
ccc-utility64 (Version: 2013.0830.1944.33589)
DAEMON Tools Lite (x32 Version: 4.47.1.0335)
Dead Space™ 3 (x32 Version: 1.0.0.0)
Dear Esther (x32)
Democracy 3 (x32 Version: 2.0.0.3)
Dota 2 (x32)
Dust: An Elysian Tail (x32)
Fallout 3 (x32 Version: 1.00.0000)
Google Chrome (x32 Version: 30.0.1599.101)
Google Talk Plugin (x32 Version: 4.7.0.15362)
Google Update Helper (x32 Version: 1.3.21.165)
Grand Theft Auto IV (x32)
Grand Theft Auto: Episodes from Liberty City (x32)
Guild Wars 2 (x32)
Half-Life (x32)
Half-Life 2 (x32)
Half-Life 2: Episode One (x32)
Half-Life 2: Episode Two (x32)
Half-Life 2: Lost Coast (x32)
Half-Life: Blue Shift (x32)
Half-Life: Opposing Force (x32)
HydraVision (x32 Version: 4.2.184.0)
ImgBurn (x32 Version: 2.5.8.0)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)
iTunes (Version: 11.1.1.11)
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
JDownloader 0.9 (x32 Version: 0.9)
Kane & Lynch: Dead Men (x32)
L.A. Noire (x32)
Left 4 Dead 2 (x32)
LibreOffice 4.0.4.2 (x32 Version: 4.0.4.2)
LIMBO (x32)
Mafia II (x32)
Magic The Gathering Online (HKCU Version: 3.4.78.338)
Mark of the Ninja (x32)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.92.0)
Microsoft Games for Windows Marketplace (x32 Version: 3.5.50.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (x32 Version: 9.0.30411)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (x32 Version: 11.0.50727.1)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (x32 Version: 11.0.50727.1)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727)
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727)
Microsoft XNA Framework Redistributable 3.1 (x32 Version: 3.1.10527.0)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000)
Mirror's Edge (x32)
Monaco (x32)
Mozilla Maintenance Service (x32 Version: 24.0.1)
Mozilla Thunderbird 24.0.1 (x86 de) (x32 Version: 24.0.1)
Mp3tag v2.57 (x32 Version: v2.57)
NVIDIA PhysX (x32 Version: 9.10.0513)
Origin (x32 Version: 9.3.1.4482)
Pando Media Booster (x32 Version: 2.6.0.9)
PAP 4.0 (x32)
PAP project files (x32)
Papers, Please (x32 Version: 2.0.0.4)
PCSX2 - Playstation 2 Emulator (x32)
PDF Settings CS6 (x32 Version: 11.0)
QuickTime (x32 Version: 7.74.80.86)
RAW - Realms of Ancient War (x32)
Realtek Ethernet Controller Driver For Windows 7 (x32 Version: 7.23.623.2010)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6167)
Rockstar Games Social Club (x32 Version: 1.1.0.6)
Skype™ 6.9 (x32 Version: 6.9.106)
Star Wars The Old Republic (x32 Version: 7.0.0.14)
Star Wars: The Old Republic (x32 Version: 1.00)
Steam (x32 Version: 1.0.0.0)
The Walking Dead (x32)
The Witcher 2: Assassins of Kings Enhanced Edition (x32)
Titan Quest (x32)
Titan Quest: Immortal Throne (x32)
Tomb Raider: Legend (x32)
Torchlight (x32)
Total War: SHOGUN 2 (x32)
Trine (x32)
TVPaint Animation 10.0 Professional Edition (32bits) (DEMO) (remove only) (x32)
Unity (x32 Version: )
Unity Web Player (HKCU Version: )
Unreal Development Kit: 2013-07
Vampires - The Masquerade Bloodlines (x32 Version: 1.0)
VLC media player 2.0.8 (x32 Version: 2.0.8)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
Worlds of Ultima - Martian Dreams (x32 Version: 2.0.0.17)
==================== Restore Points =========================
09-10-2013 16:15:59 DirectX wurde installiert
11-10-2013 12:01:18 DirectX wurde installiert
17-10-2013 13:06:13 Installed Java 7 Update 45
22-10-2013 10:43:42 DirectX wurde installiert
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {57A7EC2D-D515-4286-9EDE-5062AE1BD951} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-06] (Google Inc.)
Task: {782D242B-7C01-4316-A5F5-6A9F57347082} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {AFA4F55D-5FFF-4227-A46D-1EA76C787A14} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3385325856-1774502413-2545405777-1000Core => C:\Users\Garcia\AppData\Local\Google\Update\GoogleUpdate.exe [2013-07-06] (Google Inc.)
Task: {B699B473-C92E-44FB-A77B-82F8D746181F} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software)
Task: {C6512C90-DD5A-45F7-B887-8CD2BAF4B7F0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-06] (Google Inc.)
Task: {D3A190A0-52FB-47FB-803F-365963B4D8C4} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3385325856-1774502413-2545405777-1000UA => C:\Users\Garcia\AppData\Local\Google\Update\GoogleUpdate.exe [2013-07-06] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3385325856-1774502413-2545405777-1000Core.job => C:\Users\Garcia\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3385325856-1774502413-2545405777-1000UA.job => C:\Users\Garcia\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2013-10-23 12:33 - 2013-10-23 09:33 - 02105856 _____ () C:\Program Files\AVAST Software\Avast\defs\13102300\algo.dll
2013-04-21 21:44 - 2013-04-21 21:44 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2013-04-21 21:44 - 2013-04-21 21:44 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-10-16 20:01 - 2013-10-09 02:01 - 00698832 _____ () C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\libglesv2.dll
2013-10-16 20:01 - 2013-10-09 02:01 - 00099792 _____ () C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\libegl.dll
2013-10-16 20:01 - 2013-10-09 02:02 - 04055504 _____ () C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\pdf.dll
2013-10-16 20:01 - 2013-10-09 02:02 - 00415184 _____ () C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll
2013-10-16 20:01 - 2013-10-09 02:01 - 01604560 _____ () C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\ffmpegsumo.dll
2013-10-16 20:01 - 2013-10-09 02:02 - 13584336 _____ () C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\PepperFlash\pepflashplayer.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (10/22/2013 11:51:41 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: MTGO.exe, Version: 3.4.78.338, Zeitstempel: 0x523a5790
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18015, Zeitstempel: 0x50b8479b
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000000000009e5d
ID des fehlerhaften Prozesses: 0x1038
Startzeit der fehlerhaften Anwendung: 0xMTGO.exe0
Pfad der fehlerhaften Anwendung: MTGO.exe1
Pfad des fehlerhaften Moduls: MTGO.exe2
Berichtskennung: MTGO.exe3
Error: (10/22/2013 11:51:41 AM) (Source: .NET Runtime) (User: )
Description: Application: MTGO.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.InvalidOperationException
Stack:
at System.Windows.Application.GetResourcePackage(System.Uri)
at System.Windows.Application.LoadComponent(System.Object, System.Uri)
at Shiny.App.ShowErrorDialog(WotC.MtGO.Client.Common.Diagnostics.MagicException, System.Windows.Window, System.Windows.Controls.UserControl)
at Shiny.App.DisplayError(System.Exception, System.Windows.Window, System.Windows.Controls.UserControl)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
at MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
at System.Windows.Threading.DispatcherOperation.InvokeImpl()
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
at System.Windows.Threading.DispatcherOperation.Invoke()
at System.Windows.Threading.Dispatcher.ProcessQueue()
at System.Windows.Threading.Dispatcher.WndProcHook(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
at MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
at System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
at System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
at Shiny.App.Main()
Error: (10/15/2013 01:41:30 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16384, Zeitstempel: 0x52157231
Name des fehlerhaften Moduls: MSHTML.dll, Version: 11.0.9600.16384, Zeitstempel: 0x5215965d
Ausnahmecode: 0xc0000005
Fehleroffset: 0x003c86ea
ID des fehlerhaften Prozesses: 0x3bb8
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
Error: (10/15/2013 01:17:22 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16384, Zeitstempel: 0x52157231
Name des fehlerhaften Moduls: MSHTML.dll, Version: 11.0.9600.16384, Zeitstempel: 0x5215965d
Ausnahmecode: 0xc0000005
Fehleroffset: 0x003c86ea
ID des fehlerhaften Prozesses: 0x144c
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
Error: (10/15/2013 03:30:44 AM) (Source: Application Hang) (User: )
Description: Programm GTAIV.exe, Version 1.0.7.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1ab0
Startzeit: 01cec90f6fdedb70
Endzeit: 720
Anwendungspfad: Y:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto IV\GTAIV\GTAIV.exe
Berichts-ID:
Error: (10/15/2013 03:30:16 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: GTAIV.exe, Version: 1.0.7.0, Zeitstempel: 0x4bd9efbe
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec49b8f
Ausnahmecode: 0xc0000264
Fehleroffset: 0x000a2495
ID des fehlerhaften Prozesses: 0x1ab0
Startzeit der fehlerhaften Anwendung: 0xGTAIV.exe0
Pfad der fehlerhaften Anwendung: GTAIV.exe1
Pfad des fehlerhaften Moduls: GTAIV.exe2
Berichtskennung: GTAIV.exe3
Error: (10/13/2013 07:40:09 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16384, Zeitstempel: 0x52157231
Name des fehlerhaften Moduls: MSHTML.dll, Version: 11.0.9600.16384, Zeitstempel: 0x5215965d
Ausnahmecode: 0xc0000005
Fehleroffset: 0x003c86ea
ID des fehlerhaften Prozesses: 0xbb4
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
Error: (10/06/2013 01:50:13 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Fallout3ng.exe, Version: 1.7.0.3, Zeitstempel: 0x4a40f3d0
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec49b8f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00038dc9
ID des fehlerhaften Prozesses: 0x6f4
Startzeit der fehlerhaften Anwendung: 0xFallout3ng.exe0
Pfad der fehlerhaften Anwendung: Fallout3ng.exe1
Pfad des fehlerhaften Moduls: Fallout3ng.exe2
Berichtskennung: Fallout3ng.exe3
Error: (10/05/2013 03:15:17 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Fallout3ng.exe, Version: 1.7.0.3, Zeitstempel: 0x4a40f3d0
Name des fehlerhaften Moduls: Fallout3ng.exe, Version: 1.7.0.3, Zeitstempel: 0x4a40f3d0
Ausnahmecode: 0xc0000005
Fehleroffset: 0x007ce2a8
ID des fehlerhaften Prozesses: 0x41c
Startzeit der fehlerhaften Anwendung: 0xFallout3ng.exe0
Pfad der fehlerhaften Anwendung: Fallout3ng.exe1
Pfad des fehlerhaften Moduls: Fallout3ng.exe2
Berichtskennung: Fallout3ng.exe3
Error: (10/05/2013 11:44:02 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Fallout3ng.exe, Version: 1.7.0.3, Zeitstempel: 0x4a40f3d0
Name des fehlerhaften Moduls: Fallout3ng.exe, Version: 1.7.0.3, Zeitstempel: 0x4a40f3d0
Ausnahmecode: 0xc0000005
Fehleroffset: 0x007ce2a8
ID des fehlerhaften Prozesses: 0x17d0
Startzeit der fehlerhaften Anwendung: 0xFallout3ng.exe0
Pfad der fehlerhaften Anwendung: Fallout3ng.exe1
Pfad des fehlerhaften Moduls: Fallout3ng.exe2
Berichtskennung: Fallout3ng.exe3
System errors:
=============
Error: (10/23/2013 11:06:17 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%-2140993535
Error: (10/23/2013 11:06:17 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2140993535
Error: (10/23/2013 11:06:17 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%-2140993535
Error: (10/23/2013 11:06:17 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2140993535
Error: (10/23/2013 11:06:17 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%-2140993535
Error: (10/23/2013 11:06:17 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2140993535
Error: (10/23/2013 11:06:17 AM) (Source: PNRPSvc) (User: )
Description: 0x80630801
Error: (10/23/2013 11:06:17 AM) (Source: PNRPSvc) (User: )
Description: 0x80630801
Error: (10/23/2013 11:06:17 AM) (Source: PNRPSvc) (User: )
Description: 0x80630801
Error: (10/23/2013 11:06:07 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%-2140993535
Microsoft Office Sessions:
=========================
Error: (10/22/2013 11:51:41 AM) (Source: Application Error)(User: )
Description: MTGO.exe3.4.78.338523a5790KERNELBASE.dll6.1.7601.1801550b8479be04343520000000000009e5d103801cecf0c321c2b69C:\Users\Garcia\AppData\Local\Apps\2.0\X3OWTO5J.T4V\LNEE1GL5.DGB\mtgo..tion_1ad988e60282d0d8_0003.0004_d385d8ff31bf1bda\MTGO.exeC:\Windows\system32\KERNELBASE.dll8cf145ac-3aff-11e3-a97b-002522ce128d
Error: (10/22/2013 11:51:41 AM) (Source: .NET Runtime)(User: )
Description: Application: MTGO.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.InvalidOperationException
Stack:
at System.Windows.Application.GetResourcePackage(System.Uri)
at System.Windows.Application.LoadComponent(System.Object, System.Uri)
at Shiny.App.ShowErrorDialog(WotC.MtGO.Client.Common.Diagnostics.MagicException, System.Windows.Window, System.Windows.Controls.UserControl)
at Shiny.App.DisplayError(System.Exception, System.Windows.Window, System.Windows.Controls.UserControl)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
at MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
at System.Windows.Threading.DispatcherOperation.InvokeImpl()
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
at System.Windows.Threading.DispatcherOperation.Invoke()
at System.Windows.Threading.Dispatcher.ProcessQueue()
at System.Windows.Threading.Dispatcher.WndProcHook(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
at MS.Internal.Threading.ExceptionFilterHelper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
at System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
at System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
at Shiny.App.Main()
Error: (10/15/2013 01:41:30 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE11.0.9600.1638452157231MSHTML.dll11.0.9600.163845215965dc0000005003c86ea3bb801cec9982218b9d7C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\system32\MSHTML.dllbb23b8dc-358e-11e3-910b-002522ce128d
Error: (10/15/2013 01:17:22 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE11.0.9600.1638452157231MSHTML.dll11.0.9600.163845215965dc0000005003c86ea144c01cec98352a2e367C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\system32\MSHTML.dll5c403f1f-358b-11e3-910b-002522ce128d
Error: (10/15/2013 03:30:44 AM) (Source: Application Hang)(User: )
Description: GTAIV.exe1.0.7.01ab001cec90f6fdedb70720Y:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto IV\GTAIV\GTAIV.exe
Error: (10/15/2013 03:30:16 AM) (Source: Application Error)(User: )
Description: GTAIV.exe1.0.7.04bd9efbentdll.dll6.1.7601.177254ec49b8fc0000264000a24951ab001cec90f6fdedb70Y:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto IV\GTAIV\GTAIV.exeC:\Windows\SysWOW64\ntdll.dll579f6b81-3539-11e3-8951-002522ce128d
Error: (10/13/2013 07:40:09 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE11.0.9600.1638452157231MSHTML.dll11.0.9600.163845215965dc0000005003c86eabb401cec820a6ddcde9C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\system32\MSHTML.dll80b54f2b-342e-11e3-8f01-002522ce128d
Error: (10/06/2013 01:50:13 PM) (Source: Application Error)(User: )
Description: Fallout3ng.exe1.7.0.34a40f3d0ntdll.dll6.1.7601.177254ec49b8fc000000500038dc96f401cec26eb09baef5Y:\Program Files (x86)\Bethesda Softworks\Fallout 3\Fallout3ng.exeC:\Windows\SysWOW64\ntdll.dll758f9b68-2e7d-11e3-92bf-002522ce128d
Error: (10/05/2013 03:15:17 PM) (Source: Application Error)(User: )
Description: Fallout3ng.exe1.7.0.34a40f3d0Fallout3ng.exe1.7.0.34a40f3d0c0000005007ce2a841c01cec1af7a8bbc49Y:\Program Files (x86)\Bethesda Softworks\Fallout 3\Fallout3ng.exeY:\Program Files (x86)\Bethesda Softworks\Fallout 3\Fallout3ng.exe2cfcd589-2dc0-11e3-9376-002522ce128d
Error: (10/05/2013 11:44:02 AM) (Source: Application Error)(User: )
Description: Fallout3ng.exe1.7.0.34a40f3d0Fallout3ng.exe1.7.0.34a40f3d0c0000005007ce2a817d001cec1a980585869Y:\Program Files (x86)\Bethesda Softworks\Fallout 3\Fallout3ng.exeY:\Program Files (x86)\Bethesda Softworks\Fallout 3\Fallout3ng.exeaa2401cb-2da2-11e3-9376-002522ce128d
==================== Memory info ===========================
Percentage of memory in use: 29%
Total physical RAM: 8174.69 MB
Available physical RAM: 5773.2 MB
Total Pagefile: 16347.57 MB
Available Pagefile: 13358.07 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:265.66 GB) (Free:44.69 GB) NTFS
Drive d: (Fallout 3) (CDROM) (Total:5.6 GB) (Free:0 GB) UDF
Drive e: () (Removable) (Total:0.96 GB) (Free:0.07 GB) FAT
Drive x: (Programme) (Fixed) (Total:200 GB) (Free:192.74 GB) NTFS
Drive y: (Spiele) (Fixed) (Total:400 GB) (Free:94.11 GB) NTFS
Drive z: (Projekte) (Fixed) (Total:298.63 GB) (Free:274.59 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: C5FD02E1)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=266 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=200 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 699 GB) (Disk ID: 6F0F1824)
Partition 1: (Not Active) - (Size=400 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=299 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (Size: 982 MB) (Disk ID: 8F2D76FE)
Partition 1: (Not Active) - (Size=982 MB) - (Type=06)
==================== End Of Log ============================
|
|
24.10.2013, 06:42
| #4 |
| /// the machine /// TB-Ausbilder | HTML:Bankfraud-BYL durch Avast gefunden Wo hat Avast den gefunden? Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
24.10.2013, 15:02
| #5 |
| | HTML:Bankfraud-BYL durch Avast gefunden Gefunden hat Avast den als ich mit dem IE auf GMail ging, und zwar im folgenden Pfad: C:\Users\Garcia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\C8A7T0O0 Heute kam keine Meldung von Avast als ich das nochmal ausprobieren wollte. Hier das Malwarebytes Logfile: Code:
ATTFilter ---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1007
(c) Malwarebytes Corporation 2011-2012
OS version: 6.1.7601 Windows 7 Service Pack 1 x64
Account is Administrative
Internet Explorer version: 11.0.9600.16411
File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, X:\ DRIVE_FIXED, Y:\ DRIVE_FIXED, Z:\ DRIVE_FIXED
CPU speed: 3.292000 GHz
Memory total: 8571785216, free: 6356566016
Downloaded database version: v2013.10.24.04
Downloaded database version: v2013.10.11.02
=======================================
Initializing...
------------ Kernel report ------------
10/24/2013 15:39:10
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\vmbus.sys
\SystemRoot\system32\drivers\winhv.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\vmstorfl.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\System32\Drivers\aswVmm.sys
\SystemRoot\System32\Drivers\aswRvrt.sys
\SystemRoot\system32\drivers\cdrom.sys
\??\C:\Windows\system32\drivers\aswSnx.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\??\C:\Windows\system32\drivers\aswTdi.sys
\SystemRoot\system32\drivers\afd.sys
\??\C:\Windows\system32\drivers\aswRdr2.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\??\C:\Windows\system32\drivers\aswSP.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\atikmpag.sys
\SystemRoot\system32\DRIVERS\atikmdag.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\drivers\HDAudBus.sys
\SystemRoot\system32\DRIVERS\HECIx64.sys
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\drivers\USBPORT.SYS
\SystemRoot\system32\DRIVERS\Rt64win7.sys
\SystemRoot\system32\DRIVERS\fdc.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\drivers\CompositeBus.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\drivers\swenum.sys
\SystemRoot\system32\drivers\ks.sys
\SystemRoot\system32\DRIVERS\dtsoftbus01.sys
\SystemRoot\system32\drivers\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\AtihdW76.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\drivers\RTKVHD64.sys
\SystemRoot\system32\DRIVERS\udfs.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\xusb21.sys
\SystemRoot\system32\drivers\hidusb.sys
\SystemRoot\system32\drivers\HIDCLASS.SYS
\SystemRoot\system32\drivers\HIDPARSE.SYS
\SystemRoot\system32\drivers\USBD.SYS
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_msahci.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\drivers\luafv.sys
\??\C:\Windows\system32\drivers\aswMonFlt.sys
\??\C:\Windows\system32\drivers\aswFsBlk.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\wininet.dll
\Windows\System32\ws2_32.dll
\Windows\System32\Wldap32.dll
\Windows\System32\iertutil.dll
\Windows\System32\gdi32.dll
\Windows\System32\lpk.dll
\Windows\System32\difxapi.dll
\Windows\System32\kernel32.dll
\Windows\System32\clbcatq.dll
\Windows\System32\imm32.dll
\Windows\System32\advapi32.dll
\Windows\System32\shlwapi.dll
\Windows\System32\nsi.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xfffffa8007e03060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP3T0L0-3\
Lower Device Object: 0xfffffa8007b4a680
Lower Device Driver Name: \Driver\atapi\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa8007e02060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\
Lower Device Object: 0xfffffa8007b23680
Lower Device Driver Name: \Driver\atapi\
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa8007e02060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8007e02b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8007e02060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8007b27520, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa8007b23680, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: C5FD02E1
Partition information:
Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 2048 Numsec = 204800
Partition file system is NTFS
Partition is bootable
Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 206848 Numsec = 557133824
Partition 2 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 557340672 Numsec = 419428352
Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Disk Size: 500107862016 bytes
Sector size: 512 bytes
Scanning physical sectors of unpartitioned space on drive 0 (1-2047-976753168-976773168)...
Done!
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xfffffa8007e03060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8007e03b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8007e03060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8007b4a680, DeviceName: \Device\Ide\IdeDeviceP3T0L0-3\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 6F0F1824
Partition information:
Partition 0 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 838860800
Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 838862848 Numsec = 626280448
Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Disk Size: 750156374016 bytes
Sector size: 512 bytes
Done!
Scan finished
=======================================
Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_0_i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\Bootstrap_0_0_2048_i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_0_r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_1_i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_1_r.mbam...
Removal finished
|
|
25.10.2013, 09:22
| #6 |
| /// the machine /// TB-Ausbilder | HTML:Bankfraud-BYL durch Avast gefunden Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Temps löschen mit TFC, dann sollte alles gut sein.
__________________ --> HTML:Bankfraud-BYL durch Avast gefunden |
|
25.10.2013, 12:04
| #7 |
| | HTML:Bankfraud-BYL durch Avast gefunden Hat problemlos alles gelöscht. Vielen Dank. Hoffentlich muss ich mir nun wirklich keine sorgen mehr machen. Ich wüsste zu gern woher ich das habe. Könnten meine Mitbewohner auch befallen sein, wenn wir in einem Netzwerk sind? |
|
26.10.2013, 11:39
| #8 |
| /// the machine /// TB-Ausbilder | HTML:Bankfraud-BYL durch Avast gefunden Das waren nur Tempfiles, also nein 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu HTML:Bankfraud-BYL durch Avast gefunden |
| .dll, adobe, antivirus, avast, bankfraud-byl, bonjour, explorer, hook, internet, internet explorer, internet explorer 11, netzwerk, ntdll.dll, programm, realtek, registry, scan, security, services.exe, software, spam, super, svchost.exe, system, taskhost.exe, temp, trojaner, winlogon.exe, wmp, wuauclt.exe |
Linear-Darstellung
