| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Webseiten werden auf Werbung umgeleitetWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
21.04.2014, 14:51
| #1 |
 |  Webseiten werden auf Werbung umgeleitet Hallo, ich habe ein sehr nerviges Problem was mich langsam aber sicher zur Verzweifelung treibt. Ich surfe im Internet mit Chrome und seit ein paar Wochen tritt dort ein Werbeproblem auf was merkwürdigerweise nicht alle Webseiten betrifft, aber leider viele. Wenn ich eine neue Seite öffne wird diese ganz normal geladen, sobald ich jedoch einen Link auf der Seite anklicke öffnet sich statt des normalen Links ein neuer Tab mit nerviger Werbung ( die vorzugsweise in koreanisch ist... ) Wenn ich auf einer der betroffenen Webseiten einfach nur auf eine freie Fläche auf der Seite klicke öffnet sich ebenfalls ein neuer Tab mit Werbung. Ab und zu erscheint rechts unten auf der Seite ein weiser Balken wo nur der Balken und X zum schließen zu sehen ist. Nahezu alle diese Werbetabs haben übrigens extrem nervige Hintergrundmusik. Teilweise ist die Werbung nicht mal zu sehen und man hat nur den Sound. Stoppen kann man ihn nur wenn man die komplette Seite zumacht obwohl dort nichtmal Werbung zu sehen ist. Das passiert wie gesagt nicht bei allen Seiten ( Twitter ist zum Beispiel nicht betroffen ) aber leider doch bei vielen Seiten. Zum Beispiel auch bei diesem Board hier.  Ich hab mir die Anleitung durchgelesen und die Schritte alle ausgeführt. Hier sind die Scans. Ich hoffe wirklich das mir hier jemand helfen kann. Vielen Dank im Vorraus. Scan FRST Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-04-2014 02
Ran by PC1 (administrator) on PC1-PC-NE on 21-04-2014 15:00:10
Running from C:\Users\PC1\Downloads
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe
() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Spotify Ltd) C:\Users\PC1\AppData\Roaming\Spotify\spotify.exe
(Spotify Ltd) C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe
(ASUSTeK Computer Inc.) C:\Program Files\ASUS\Turbo Key\TurboKey.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files (x86)\Gaming Mouse\Monitor.exe
(Game Inc.) C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
() C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
() C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Windows\SysWOW64\WinMsgBalloonServer.exe
() C:\Windows\SysWOW64\WinMsgBalloonClient.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\PC1\Downloads\FRST64 (1).exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7560296 2011-12-12] (Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)
HKLM-x32\...\Run: [RUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe [115048 2011-09-20] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Cpu Level Up help] => C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe [887936 2009-12-28] ()
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Turbo Key] => C:\Program Files\ASUS\Turbo Key\TurboKey.exe [1874432 2009-11-24] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Gaming mouse] => C:\Program Files (x86)\Gaming Mouse\Monitor.exe [761856 2013-07-17] ()
HKLM-x32\...\Run: [GamingKeyboard] => C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe [1803264 2012-06-07] (Game Inc.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify] => C:\Users\PC1\AppData\Roaming\Spotify\Spotify.exe [6087224 2014-04-09] (Spotify Ltd)
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\Run: [Spotify Web Helper] => C:\Users\PC1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-09] (Spotify Ltd)
HKU\S-1-5-21-196019333-3621520618-2838316431-1000\...\MountPoints2: {b3c3e069-3042-11e3-b41d-806e6f6e6963} - D:\autorun.exe
Startup: C:\Users\PC1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
Startup: C:\Users\PC1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trillian.lnk
ShortcutTarget: Trillian.lnk -> C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)
==================== Internet (Whitelisted) ====================
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Tcpip\Parameters: [DhcpNameServer] 121.157.39.117 114.114.114.114
FireFox:
========
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR StartupUrls: "hxxp://www.google.com"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\gcswf32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\pdf.dll ()
CHR Plugin: (Chrome NaCl) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Google Gears 0.5.33.0) - C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.116\gears.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.57\npGoogleUpdate3.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (ProxTube) - C:\Users\PC1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-02-25]
CHR Extension: (Adblock Plus) - C:\Users\PC1\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-12-19]
CHR Extension: (Google Wallet) - C:\Users\PC1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-09]
==================== Services (Whitelisted) =================
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-20] (Avira Operations GmbH & Co. KG)
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-29] (ASUSTeK Computer Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
S2 MDM; "C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" [X]
==================== Drivers (Whitelisted) ====================
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-07] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 GameKB; C:\Windows\System32\drivers\GameKB.sys [27648 2012-05-11] ()
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-18] ()
R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [806400 2011-02-11] (Realtek Semiconductor Corporation )
R3 rusb3hub; C:\Windows\System32\DRIVERS\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)
R3 rusb3xhc; C:\Windows\System32\DRIVERS\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]
S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\PC1\Downloads\FRST64 (1).exe
2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\PC1\Documents\ProcAlyzer Dumps
2014-04-21 13:27 - 2014-04-21 13:33 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-21 13:27 - 2014-04-21 13:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-21 13:27 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (3).zip
2014-04-21 12:50 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-21 12:50 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-21 12:50 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-21 12:50 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-21 12:49 - 2014-04-21 12:50 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-20 22:03 - 2014-04-20 22:04 - 00188383 _____ () C:\Users\PC1\Downloads\Malkorok.zip
2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (2).zip
2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (1).zip
2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe
2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe
2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe
2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe
2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe
2014-04-16 16:03 - 2014-04-16 16:06 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-16 15:57 - 2014-04-16 15:57 - 585078025 _____ () C:\Windows\MEMORY.DMP
2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp
2014-04-16 15:57 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump
2014-04-15 18:01 - 2014-04-15 18:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe
2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe
2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe
2014-04-12 17:16 - 2014-04-13 22:07 - 00000000 ____D () C:\Users\PC1\AppData\Roaming\TS3Client
2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-04-12 17:15 - 2014-04-12 17:16 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe
2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe
2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe
2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999.zip
2014-04-09 19:03 - 2014-03-31 03:16 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-09 19:03 - 2014-03-31 03:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-09 19:03 - 2014-03-31 02:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-09 19:03 - 2014-03-31 01:57 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 18:59 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 18:59 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 18:59 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 18:59 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 18:59 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 18:59 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 18:59 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 18:59 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 18:59 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 18:59 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 18:59 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 18:59 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 18:59 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\PC1\Downloads\SecurityCheck.exe
2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\PC1\Downloads\adwcleaner.exe
2014-04-09 18:30 - 2014-04-21 15:00 - 00014824 _____ () C:\Users\PC1\Downloads\FRST.txt
2014-04-09 18:30 - 2014-04-21 15:00 - 00000000 ____D () C:\FRST
2014-04-09 18:30 - 2014-04-09 18:32 - 00028207 _____ () C:\Users\PC1\Downloads\Addition.txt
2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\PC1\Downloads\FRST64.exe
2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
2014-04-03 00:03 - 2014-04-21 13:22 - 00000000 ____D () C:\Users\PC1\Documents\Anti-Malware
2014-04-03 00:03 - 2014-04-21 13:22 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-04-02 23:43 - 2014-04-02 23:46 - 223568888 _____ (Emsisoft GmbH ) C:\Users\PC1\Downloads\EmsisoftAntiMalwareSetup_81040.exe
2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\PC1\Downloads\chromeinstall-7u51.exe
2014-03-27 14:53 - 2014-03-27 14:55 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-27 14:13 - 2014-04-20 21:41 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-27 14:07 - 2014-03-27 14:08 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000 (2).exe
2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000 (1).exe
2014-03-27 01:18 - 2014-04-03 01:14 - 00000016 _____ () C:\Windows\system32\config\software.szfi
2014-03-27 00:45 - 2014-03-27 17:22 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg
2014-03-27 00:44 - 2014-03-27 00:45 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\PC1\Downloads\SZSetup_AID10121_AV.exe
2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\AdwCleaner - CHIP-Downloader (1).exe
2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-23 20:20 - 2014-03-23 20:20 - 03352726 _____ () C:\Users\PC1\Downloads\elvui-6.995 (1).zip
2014-03-23 18:13 - 2014-03-23 18:13 - 03352726 _____ () C:\Users\PC1\Downloads\elvui-6.995.zip
==================== One Month Modified Files and Folders =======
2014-04-21 15:00 - 2014-04-09 18:30 - 00014824 _____ () C:\Users\PC1\Downloads\FRST.txt
2014-04-21 15:00 - 2014-04-09 18:30 - 00000000 ____D () C:\FRST
2014-04-21 14:59 - 2014-04-21 14:59 - 02056704 _____ (Farbar) C:\Users\PC1\Downloads\FRST64 (1).exe
2014-04-21 14:42 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\PC1\AppData\Roaming\Spotify
2014-04-21 14:20 - 2013-10-08 21:40 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-21 14:17 - 2013-10-08 19:57 - 01151524 _____ () C:\Windows\WindowsUpdate.log
2014-04-21 14:14 - 2013-10-14 14:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-21 13:33 - 2014-04-21 13:27 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-04-21 13:32 - 2014-04-21 13:27 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-21 13:30 - 2014-04-21 13:30 - 00000000 ____D () C:\Users\PC1\Documents\ProcAlyzer Dumps
2014-04-21 13:27 - 2014-04-21 13:27 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-04-21 13:27 - 2014-04-21 13:27 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-04-21 13:25 - 2014-04-21 13:25 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Users\PC1\Documents\Anti-Malware
2014-04-21 13:22 - 2014-04-03 00:03 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-04-21 13:15 - 2014-04-21 13:15 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (3).zip
2014-04-21 13:06 - 2013-10-09 17:30 - 00001098 _____ () C:\Users\Public\Desktop\TeamViewer 8.lnk
2014-04-21 12:50 - 2014-04-21 12:49 - 00004253 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-21 12:50 - 2013-10-22 20:12 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-21 12:50 - 2013-10-22 20:11 - 00000000 ____D () C:\Program Files (x86)\Java
2014-04-21 12:49 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-21 12:49 - 2009-07-14 06:45 - 00025280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-21 12:42 - 2013-10-08 22:34 - 00000330 _____ () C:\Windows\Tasks\RtlNICDiagVistaStart.job
2014-04-21 12:41 - 2013-10-08 21:40 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-21 12:41 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-21 12:41 - 2009-07-14 06:51 - 00036998 _____ () C:\Windows\setupact.log
2014-04-20 23:18 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\PC1\AppData\Local\Battle.net
2014-04-20 22:04 - 2014-04-20 22:03 - 00188383 _____ () C:\Users\PC1\Downloads\Malkorok.zip
2014-04-20 21:41 - 2014-03-27 14:13 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-20 21:38 - 2013-10-09 19:48 - 00000000 ____D () C:\Users\PC1\AppData\Local\Deployment
2014-04-20 17:29 - 2014-04-20 17:29 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (2).zip
2014-04-20 15:01 - 2014-04-20 15:01 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999 (1).zip
2014-04-20 14:34 - 2011-04-12 09:43 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2014-04-20 14:34 - 2011-04-12 09:43 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2014-04-20 14:34 - 2009-07-14 07:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-20 14:33 - 2014-04-20 14:33 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (8).exe
2014-04-19 23:17 - 2014-04-19 23:17 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (7).exe
2014-04-19 16:48 - 2014-04-19 16:48 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (6).exe
2014-04-18 22:02 - 2013-10-09 13:41 - 00000000 ____D () C:\World of Warcraft
2014-04-18 17:53 - 2014-04-18 17:53 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (5).exe
2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files\Google
2014-04-17 19:39 - 2013-10-08 21:40 - 00000000 ____D () C:\Program Files (x86)\Google
2014-04-17 19:39 - 2010-11-21 05:47 - 00281792 _____ () C:\Windows\PFRO.log
2014-04-16 17:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-16 16:07 - 2014-04-16 16:07 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (4).exe
2014-04-16 16:06 - 2014-04-16 16:03 - 00000000 ____D () C:\Windows\system32\appmgmt
2014-04-16 16:01 - 2013-10-08 21:40 - 00000000 ____D () C:\Users\PC1\AppData\Local\Google
2014-04-16 15:59 - 2013-11-26 19:49 - 00000000 ____D () C:\Users\PC1\AppData\Local\Spotify
2014-04-16 15:57 - 2014-04-16 15:57 - 585078025 _____ () C:\Windows\MEMORY.DMP
2014-04-16 15:57 - 2014-04-16 15:57 - 00275592 _____ () C:\Windows\Minidump\041614-20826-01.dmp
2014-04-16 15:57 - 2014-04-16 15:57 - 00000000 ____D () C:\Windows\Minidump
2014-04-15 18:02 - 2014-04-15 18:01 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (3).exe
2014-04-14 20:13 - 2014-04-21 12:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-14 20:05 - 2014-04-21 12:50 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-14 20:05 - 2014-04-21 12:50 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-14 20:04 - 2014-04-21 12:50 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-13 22:07 - 2014-04-12 17:16 - 00000000 ____D () C:\Users\PC1\AppData\Roaming\TS3Client
2014-04-13 21:02 - 2014-04-13 21:02 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (2).exe
2014-04-13 16:44 - 2014-04-13 16:44 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14 (1).exe
2014-04-12 17:16 - 2014-04-12 17:16 - 00000975 _____ () C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2014-04-12 17:16 - 2014-04-12 17:16 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client
2014-04-12 17:16 - 2014-04-12 17:15 - 29498592 _____ (TeamSpeak Systems GmbH) C:\Users\PC1\Downloads\TeamSpeak3-Client-win64-3.0.14.exe
2014-04-12 17:14 - 2014-04-12 17:14 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\TeamSpeak 3 64 Bit - CHIP-Downloader.exe
2014-04-12 17:11 - 2014-04-12 17:11 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\TeamSpeak 3 32 Bit - CHIP-Downloader.exe
2014-04-11 18:35 - 2013-11-27 19:23 - 00000000 ____D () C:\Program Files (x86)\Hearthstone
2014-04-11 00:00 - 2013-10-09 19:48 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-04-10 19:52 - 2014-04-10 19:52 - 03355407 _____ () C:\Users\PC1\Downloads\elvui-6.999.zip
2014-04-10 19:29 - 2014-01-04 16:13 - 00000000 ____D () C:\Program Files (x86)\Diablo III
2014-04-09 18:55 - 2014-04-09 18:55 - 00987448 _____ () C:\Users\PC1\Downloads\SecurityCheck.exe
2014-04-09 18:47 - 2013-10-10 01:00 - 00000000 ____D () C:\AdwCleaner
2014-04-09 18:44 - 2014-04-09 18:44 - 01426178 _____ () C:\Users\PC1\Downloads\adwcleaner.exe
2014-04-09 18:32 - 2014-04-09 18:30 - 00028207 _____ () C:\Users\PC1\Downloads\Addition.txt
2014-04-09 18:29 - 2014-04-09 18:29 - 02157056 _____ (Farbar) C:\Users\PC1\Downloads\FRST64.exe
2014-04-09 18:24 - 2013-10-08 21:41 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-08 17:42 - 2014-04-08 17:42 - 00000360 _____ () C:\Windows\SysWOW64\Drivers\kgpcpy.cfg
2014-04-03 17:55 - 2013-10-14 14:04 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-03 17:55 - 2013-10-14 14:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-03 17:55 - 2013-10-14 14:04 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-03 01:14 - 2014-03-27 01:18 - 00000016 _____ () C:\Windows\system32\config\software.szfi
2014-04-02 23:46 - 2014-04-02 23:43 - 223568888 _____ (Emsisoft GmbH ) C:\Users\PC1\Downloads\EmsisoftAntiMalwareSetup_81040.exe
2014-04-01 18:15 - 2013-10-08 21:40 - 00004112 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-01 18:15 - 2013-10-08 21:40 - 00003860 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-03-31 09:35 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-03-31 03:16 - 2014-04-09 19:03 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-31 03:13 - 2014-04-09 19:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-31 02:13 - 2014-04-09 19:03 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-31 01:57 - 2014-04-09 19:03 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-28 02:05 - 2014-03-28 02:05 - 00293036 _____ () C:\Windows\msxml4-KB954430-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00288076 _____ () C:\Windows\msxml4-KB973688-enu.LOG
2014-03-28 02:05 - 2014-03-28 02:05 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0
2014-03-27 18:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\Resources
2014-03-27 17:22 - 2014-03-27 00:45 - 00020272 _____ () C:\Windows\SysWOW64\Drivers\kgpfr2.cfg
2014-03-27 15:13 - 2014-03-27 15:13 - 00921000 _____ (Oracle Corporation) C:\Users\PC1\Downloads\chromeinstall-7u51.exe
2014-03-27 14:55 - 2014-03-27 14:53 - 00005327 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-03-27 14:13 - 2014-03-27 14:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-27 14:08 - 2014-03-27 14:07 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000 (2).exe
2014-03-27 14:00 - 2014-03-27 14:00 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000 (1).exe
2014-03-27 00:45 - 2014-03-27 00:44 - 17523384 _____ (Malwarebytes Corporation ) C:\Users\PC1\Downloads\mbam-setup-2.0.0.1000.exe
2014-03-27 00:40 - 2014-03-27 00:40 - 00707664 _____ (iS3, Inc.) C:\Users\PC1\Downloads\SZSetup_AID10121_AV.exe
2014-03-26 01:42 - 2014-03-26 01:42 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\AdwCleaner - CHIP-Downloader (1).exe
2014-03-26 01:30 - 2014-03-26 01:30 - 00613200 _____ (Chip Digital GmbH) C:\Users\PC1\Downloads\AdwCleaner - CHIP-Downloader.exe
2014-03-23 20:20 - 2014-03-23 20:20 - 03352726 _____ () C:\Users\PC1\Downloads\elvui-6.995 (1).zip
2014-03-23 18:13 - 2014-03-23 18:13 - 03352726 _____ () C:\Users\PC1\Downloads\elvui-6.995.zip
Some content of TEMP:
====================
C:\Users\PC1\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-21 14:43
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-04-21 15:23:07
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 WDC_WD10EALX-009BA0 rev.15.01H15 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\Username~1\AppData\Local\Temp\agecyuoc.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe[1920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000765c1465 2 bytes [5C, 76]
.text C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe[1920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000765c14bb 2 bytes [5C, 76]
.text ... * 2
.text C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text C:\Windows\system32\taskhost.exe[2816] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text C:\Windows\system32\taskhost.exe[2816] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}
.text C:\Windows\system32\taskhost.exe[2816] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd359055 3 bytes [B5, 6F, 06]
.text C:\Windows\system32\taskhost.exe[2816] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 000007fefd6b55c8 6 bytes {JMP QWORD [RIP+0xfaa68]}
.text C:\Windows\system32\taskhost.exe[2816] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 000007fefd6cb85c 6 bytes {JMP QWORD [RIP+0xc47d4]}
.text C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text C:\Windows\system32\taskeng.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text C:\Windows\system32\taskeng.exe[2892] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}
.text C:\Windows\system32\taskeng.exe[2892] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd359055 3 bytes CALL 9000027
.text C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text C:\Windows\system32\Dwm.exe[2908] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text C:\Windows\system32\Dwm.exe[2908] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}
.text C:\Windows\system32\Dwm.exe[2908] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd359055 3 bytes CALL 9000027
.text C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd359055 3 bytes [B5, 6F, 29]
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\msi.dll!MsiSetInternalUI 000007fef6285cd0 6 bytes JMP 23f
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\msi.dll!MsiInstallProductA 000007fef6300f20 6 bytes {JMP QWORD [RIP+0x2cf110]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\msi.dll!MsiInstallProductW 000007fef630faa8 6 bytes JMP 0
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA 000007fef7f67b34 6 bytes JMP 300030
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW 000007fef7f703c0 6 bytes JMP 610048
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW 000007feff283030 6 bytes {JMP QWORD [RIP+0x2dd000]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\WS2_32.dll!connect + 1 000007feff2845c1 5 bytes {JMP QWORD [RIP+0x28ba70]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\WS2_32.dll!listen 000007feff288290 6 bytes {JMP QWORD [RIP+0x2b7da0]}
.text C:\Windows\Explorer.EXE[2980] C:\Windows\system32\RASAPI32.dll!RasDialW + 1 000007fee8e296f5 5 bytes JMP 4d004d
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd359055 3 bytes [B5, 6F, 41]
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA 000007fef7f67b34 6 bytes {JMP QWORD [RIP+0x884fc]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2824] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW 000007fef7f703c0 6 bytes {JMP QWORD [RIP+0x9fc70]}
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 00000000773ffc20 3 bytes JMP 7181000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 00000000773ffc24 2 bytes JMP 7181000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 00000000773ffd64 3 bytes JMP 717b000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 00000000773ffd68 2 bytes JMP 717b000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 00000000774000b4 3 bytes JMP 717e000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 00000000774000b8 2 bytes JMP 717e000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 00000000774001c4 3 bytes JMP 7187000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 00000000774001c8 2 bytes JMP 7187000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000077400a44 3 bytes JMP 7184000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000077400a48 2 bytes JMP 7184000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077401920 3 bytes JMP 7178000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000077401924 2 bytes JMP 7178000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 00000000766c3bbb 3 bytes JMP 7175000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 00000000766c3bbf 2 bytes JMP 7175000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076cf2c91 4 bytes CALL 71af0000
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076ef9679 6 bytes JMP 7196000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!PostMessageW 0000000076f012a5 6 bytes JMP 7190000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076f03baa 6 bytes JMP 7193000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!SendMessageA 0000000076f0612e 6 bytes JMP 7199000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!SendInput 0000000076f1ff4a 3 bytes JMP 719c000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!SendInput + 4 0000000076f1ff4e 2 bytes JMP 719c000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!mouse_event 0000000076f5027b 6 bytes JMP 71a2000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\USER32.dll!keybd_event 0000000076f502bf 6 bytes JMP 719f000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000076ae70c4 6 bytes JMP 718a000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000076b03264 6 bytes JMP 718d000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\WS2_32.dll!WSALookupServiceBeginW 000000007685575a 6 bytes JMP 71a5000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\WS2_32.dll!connect 0000000076856bdd 6 bytes JMP 71ab000a
.text C:\Users\Usernameine\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[1284] C:\Windows\syswow64\WS2_32.dll!listen 000000007685b001 6 bytes JMP 71a8000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 00000000773ffc20 3 bytes JMP 718a000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 00000000773ffc24 2 bytes JMP 718a000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 00000000773ffd64 3 bytes JMP 7184000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 00000000773ffd68 2 bytes JMP 7184000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 00000000774000b4 3 bytes JMP 7187000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 00000000774000b8 2 bytes JMP 7187000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 00000000774001c4 3 bytes JMP 7190000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 00000000774001c8 2 bytes JMP 7190000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000077400a44 3 bytes JMP 718d000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000077400a48 2 bytes JMP 718d000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077401920 3 bytes JMP 7181000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000077401924 2 bytes JMP 7181000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 00000000766c3bbb 3 bytes JMP 717e000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 00000000766c3bbf 2 bytes JMP 717e000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076cf2c91 4 bytes CALL 71af0000
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076ef9679 6 bytes JMP 719f000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!PostMessageW 0000000076f012a5 6 bytes JMP 7199000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076f03baa 6 bytes JMP 719c000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!SendMessageA 0000000076f0612e 6 bytes JMP 71a2000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!SendInput 0000000076f1ff4a 3 bytes JMP 71a5000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!SendInput + 4 0000000076f1ff4e 2 bytes JMP 71a5000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!mouse_event 0000000076f5027b 6 bytes JMP 71ab000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\USER32.dll!keybd_event 0000000076f502bf 6 bytes JMP 71a8000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000076ae70c4 6 bytes JMP 7193000a
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe[2260] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000076b03264 6 bytes JMP 7196000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 00000000773ffc20 3 bytes JMP 718a000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 00000000773ffc24 2 bytes JMP 718a000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 00000000773ffd64 3 bytes JMP 7184000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 00000000773ffd68 2 bytes JMP 7184000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 00000000774000b4 3 bytes JMP 7187000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 00000000774000b8 2 bytes JMP 7187000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 00000000774001c4 3 bytes JMP 7190000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 00000000774001c8 2 bytes JMP 7190000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000077400a44 3 bytes JMP 718d000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000077400a48 2 bytes JMP 718d000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077401920 3 bytes JMP 7181000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000077401924 2 bytes JMP 7181000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 00000000766c3bbb 3 bytes JMP 717e000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 00000000766c3bbf 2 bytes JMP 717e000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076cf2c91 4 bytes CALL 71af0000
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076ef9679 6 bytes JMP 719f000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!PostMessageW 0000000076f012a5 6 bytes JMP 7199000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076f03baa 6 bytes JMP 719c000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!SendMessageA 0000000076f0612e 6 bytes JMP 71a2000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!SendInput 0000000076f1ff4a 3 bytes JMP 71a5000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!SendInput + 4 0000000076f1ff4e 2 bytes JMP 71a5000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!mouse_event 0000000076f5027b 6 bytes JMP 71ab000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\USER32.dll!keybd_event 0000000076f502bf 6 bytes JMP 71a8000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000076ae70c4 6 bytes JMP 7193000a
.text C:\Program Files\ASUS\Turbo Key\TurboKey.exe[3128] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000076b03264 6 bytes JMP 7196000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 00000000773ffc20 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 00000000773ffc24 2 bytes [89, 71]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 00000000773ffd64 3 bytes JMP 7184000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 00000000773ffd68 2 bytes JMP 7184000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 00000000774000b4 3 bytes JMP 7187000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 00000000774000b8 2 bytes JMP 7187000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 00000000774001c4 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 00000000774001c8 2 bytes [8F, 71]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000077400a44 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000077400a48 2 bytes [8C, 71]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077401920 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000077401924 2 bytes [80, 71]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 00000000766c3bbb 3 bytes JMP 717e000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 00000000766c3bbf 2 bytes JMP 717e000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3148] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076cf2c91 4 bytes CALL 71af0000
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 00000000773ffc20 3 bytes JMP 7184000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 00000000773ffc24 2 bytes JMP 7184000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 00000000773ffd64 3 bytes JMP 717e000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 00000000773ffd68 2 bytes JMP 717e000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 00000000774000b4 3 bytes JMP 7181000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 00000000774000b8 2 bytes JMP 7181000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 00000000774001c4 3 bytes JMP 718a000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 00000000774001c8 2 bytes JMP 718a000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000077400a44 3 bytes JMP 7187000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000077400a48 2 bytes JMP 7187000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077401920 3 bytes JMP 717b000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000077401924 2 bytes JMP 717b000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 00000000766c3bbb 3 bytes JMP 7178000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 00000000766c3bbf 2 bytes JMP 7178000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076cf2c91 4 bytes CALL 71af0000
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076ef9679 6 bytes JMP 7199000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!PostMessageW 0000000076f012a5 6 bytes JMP 7193000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076f03baa 6 bytes JMP 7196000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!SendMessageA 0000000076f0612e 6 bytes JMP 719c000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!SendInput 0000000076f1ff4a 3 bytes JMP 719f000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!SendInput + 4 0000000076f1ff4e 2 bytes JMP 719f000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!mouse_event 0000000076f5027b 6 bytes JMP 71a5000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\USER32.dll!keybd_event 0000000076f502bf 6 bytes JMP 71a2000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000076ae70c4 6 bytes JMP 718d000a
.text C:\Program Files (x86)\Gaming Mouse\Monitor.exe[3224] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000076b03264 6 bytes JMP 7190000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 00000000773ffc20 3 bytes JMP 7184000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 00000000773ffc24 2 bytes JMP 7184000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 00000000773ffd64 3 bytes JMP 717e000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 00000000773ffd68 2 bytes JMP 717e000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 00000000774000b4 3 bytes JMP 7181000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 00000000774000b8 2 bytes JMP 7181000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 00000000774001c4 3 bytes JMP 718a000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 00000000774001c8 2 bytes JMP 718a000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000077400a44 3 bytes JMP 7187000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000077400a48 2 bytes JMP 7187000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077401920 3 bytes JMP 717b000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000077401924 2 bytes JMP 717b000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 00000000766c3bbb 3 bytes JMP 7178000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 00000000766c3bbf 2 bytes JMP 7178000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076cf2c91 4 bytes CALL 71af0000
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076ef9679 6 bytes JMP 7199000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!PostMessageW 0000000076f012a5 6 bytes JMP 7193000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076f03baa 6 bytes JMP 7196000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!SendMessageA 0000000076f0612e 6 bytes JMP 719c000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!SendInput 0000000076f1ff4a 3 bytes JMP 719f000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!SendInput + 4 0000000076f1ff4e 2 bytes JMP 719f000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!mouse_event 0000000076f5027b 6 bytes JMP 71a5000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\USER32.dll!keybd_event 0000000076f502bf 6 bytes JMP 71a2000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000076ae70c4 6 bytes JMP 718d000a
.text C:\Program Files (x86)\SHARKOON Skiller\GameMon.exe[3300] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000076b03264 6 bytes JMP 7190000a
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3348] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd359055 3 bytes [B5, 6F, 06]
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3836] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd359055 3 bytes [B5, 6F, 06]
.text C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000077251510 6 bytes {JMP QWORD [RIP+0x8eeeb20]}
.text C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 00000000772515e0 6 bytes {JMP QWORD [RIP+0x8f2ea50]}
.text C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000077251800 6 bytes {JMP QWORD [RIP+0x8f0e830]}
.text C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 00000000772518b0 6 bytes {JMP QWORD [RIP+0x8eae780]}
.text C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000077251e40 6 bytes {JMP QWORD [RIP+0x8ece1f0]}
.text C:\Windows\system32\wuauclt.exe[7664] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000772527e0 6 bytes {JMP QWORD [RIP+0x8f4d850]}
.text C:\Windows\system32\wuauclt.exe[7664] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076ffdb80 6 bytes {JMP QWORD [RIP+0x91c24b0]}
.text C:\Windows\system32\wuauclt.exe[7664] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefd359055 3 bytes CALL 9000027
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4648] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000765c1465 2 bytes [5C, 76]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4648] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000765c14bb 2 bytes [5C, 76]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6076] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000765c1465 2 bytes [5C, 76]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6076] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000765c14bb 2 bytes [5C, 76]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [5572:7688] 000007feec939688
---- EOF - GMER 2.1 ----
|
| Themen zu Webseiten werden auf Werbung umgeleitet |
| adobe, antivir, auf werbung umgeleitet, avira, browser, chrome, cpu, desktop, explorer, flash player, google, homepage, internet, langsam, links, minidump, neue seite, problem, realtek, registry, safer networking, services.exe, spotify web helper, svchost.exe, system, teamspeak, temp, usb, werbung, winlogon.exe, wuauclt.exe, öffnet |
Baum-Darstellung