| |
| |||||||
Log-Analyse und Auswertung: Fetty hat Probleme mit seiner BlechkisteWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
25.06.2014, 18:54
| #1 |
| |  Fetty hat Probleme mit seiner Blechkiste Hallo liebes Forum, Ich habe Probleme.Ich bitte hiermit um Hilfe bei euch, mein Computer ist scheinbar total verseucht.Hier das FRST: [CODE] Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-06-2014 Ran by Andreas (administrator) on ANDREAS-PC on 25-06-2014 13:28:32 Running from C:\Users\Andreas\Downloads Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (AMD) C:\Windows\System32\atiesrxx.exe (Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (ArcSoft, Inc.) C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe () C:\Program Files (x86)\Gigabyte\EasySaver\essvr.exe (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe (AMD) C:\Windows\System32\atieclxx.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (ArcSoft Inc.) C:\Program Files (x86)\ArcSoft\TotalMedia Theatre 5\TotalMedia Server\TM Server.exe (CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe (cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe (Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11101800 2010-07-28] (Realtek Semiconductor) HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1580368 2010-11-03] (Logitech, Inc.) HKLM\...\Run: [ISW] => C:\Program Files\CheckPoint\ZAForceField\ForceField.exe [1125504 2011-11-03] (Check Point Software Technologies) HKLM-x32\...\Run: [UpdateLBPShortCut] => C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM-x32\...\Run: [MDS_Menu] => C:\Program Files (x86)\CyberLink\MediaShow4\MUITransfer\MUIStartMenu.exe [218408 2009-02-25] (CyberLink Corp.) HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-12-15] (CyberLink) HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM-x32\...\Run: [RemoteControl9] => C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe [87336 2009-07-06] (CyberLink Corp.) HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2010-05-14] (cyberlink) HKLM-x32\...\Run: [UpdatePPShortCut] => C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.) HKLM-x32\...\Run: [UCam_Menu] => C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [218408 2009-02-17] (CyberLink Corp.) HKLM-x32\...\Run: [UpdatePSTShortCut] => C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe [222504 2010-06-02] (CyberLink Corp.) HKLM-x32\...\Run: [ZoneAlarm] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [73360 2011-11-09] (Check Point Software Technologies LTD) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-24] (Avira Operations GmbH & Co. KG) HKU\S-1-5-21-1380574359-2315062586-461180227-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [1825984 2014-04-24] (Valve Corporation) HKU\S-1-5-21-1380574359-2315062586-461180227-1000\...\MountPoints2: {3f956e18-9094-11e0-ad04-806e6f6e6963} - E:\wubi.exe HKU\S-1-5-21-1380574359-2315062586-461180227-1000\...\MountPoints2: {54e24818-9091-11e0-89ea-806e6f6e6963} - E:\Run.exe Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TotalMedia Server.lnk ShortcutTarget: TotalMedia Server.lnk -> C:\Program Files (x86)\ArcSoft\TotalMedia Theatre 5\TotalMedia Server\TM Server.exe (ArcSoft Inc.) ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPHRo0PyGG1_Kxr4dEqi2tMc9XvzeUiwAdwAQWGgALDuCGviMidcPwr_eD47aHZ5ZXtahvKI_pvUrnLe2GNYMo7EUzHJt-fpo7cXrau6BwHY0SgwJhpmVaKDj0Iyze3PLUhNEQZ2Fu73eHHg97nxaXpYdmydD6PNjMDgLqD&q={searchTerms} HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/ HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x224FBE099B43CF01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPHRo0PyGG1_Kxr4dEqi2tMc9XvzeUiwAdwAQWGgALDuCGviMidcPwr_eD47aHZ5ZXtahvKI_pvUrnLe2GNYMo7EUzHJt-fpo7cXrau6BwHY0SgwJhpmVaKDj0Iyze3PLUhNEQZ2Fu73eHHg97nxaXpYdmydD6PNjMDgLqD&q={searchTerms} URLSearchHook: HKLM-x32 - (No Name) - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - No File URLSearchHook: HKLM-x32 - (No Name) - {04a8dd1a-4754-48fe-a703-99846646ef04} - No File SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPHRo0PyGG1_Kxr4dEqi2tMc9XvzeUiwAdwAQWGgALDuCGviMidcPwr_eD47aHZ5ZXtahvKI_pvUrnLe2GNYMo7EUzHJt-fpo7cXrau6BwHY0SgwJhpmVaKDj0Iyze3PLUhNEQZ2Fu73eHHg97nxaXpYdmydD6PNjMDgLqE&q={searchTerms} SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPHRo0PyGG1_Kxr4dEqi2tMc9XvzeUiwAdwAQWGgALDuCGviMidcPwr_eD47aHZ5ZXtahvKI_pvUrnLe2GNYMo7EUzHJt-fpo7cXrau6BwHY0SgwJhpmVaKDj0Iyze3PLUhNEQZ2Fu73eHHg97nxaXpYdmydD6PNjMDgLqE&q={searchTerms} SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPHRo0PyGG1_Kxr4dEqi2tMc9XvzeUiwAdwAQWGgALDuCGviMidcPwr_eD47aHZ5ZXtahvKI_pvUrnLe2GNYMo7EUzHJt-fpo7cXrau6BwHY0SgwJhpmVaKDj0Iyze3PLUhNEQZ2Fu73eHHg97nxaXpYdmydD6PNjMDgLqD&q={searchTerms} SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPHRo0PyGG1_Kxr4dEqi2tMc9XvzeUiwAdwAQWGgALDuCGviMidcPwr_eD47aHZ5ZXtahvKI_pvUrnLe2GNYMo7EUzHJt-fpo7cXrau6BwHY0SgwJhpmVaKDj0Iyze3PLUhNEQZ2Fu73eHHg97nxaXpYdmydD6PNjMDgLqD&q={searchTerms} BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies) BHO-x32: No Name - {04a8dd1a-4754-48fe-a703-99846646ef04} - No File BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies) BHO-x32: No Name - {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - No File Toolbar: HKLM - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies) Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File Toolbar: HKLM-x32 - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies) Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File Toolbar: HKCU - No Name - {FC2B76FC-2132-4D80-A9A3-1F5C6E49066B} - No File Toolbar: HKCU - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies) DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\7olcn1oe.default-1395251451120 FF Homepage: https://www.google.de/ FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin-x32: @checkpoint.com/FFApi - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll () FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Adblock Plus - C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\7olcn1oe.default-1395251451120\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-04-09] FF HKLM\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] - C:\Program Files\CheckPoint\ZAForceField\TrustChecker FF Extension: No Name - C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2011-12-20] FF HKLM\...\Firefox\Extensions: [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}] - C:\Program Files\V-bates\Firefox FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker FF Extension: ZoneAlarm Security Engine - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker [2011-12-20] FF HKLM-x32\...\Firefox\Extensions: [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}] - C:\Program Files\V-bates\Firefox ==================== Services (Whitelisted) ================= R2 ADExchange; C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe [43624 2012-08-14] (ArcSoft, Inc.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1039440 2014-06-24] (Avira Operations GmbH & Co. KG) S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] () S2 CLKMSVC10_9EC60124; C:\Program Files (x86)\CyberLink\PowerDVD9\NavFilter\kmsvc.exe [246256 2010-05-14] (CyberLink) R2 ES lite Service; C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE [68136 2009-08-24] () R2 IswSvc; C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [827520 2011-11-03] (Check Point Software Technologies) R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-04-22] (Hewlett-Packard Company) [File not signed] R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-07-02] () [File not signed] R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2420616 2011-11-09] (Check Point Software Technologies LTD) ==================== Drivers (Whitelisted) ==================== R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21544 2010-04-27] () R1 ArcSec; C:\Windows\System32\drivers\ArcSec.sys [311872 2011-11-10] () R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-06-24] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-24] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG) R2 ISWKL; C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33672 2011-11-03] (Check Point Software Technologies) R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [454232 2011-05-07] (Check Point Software Technologies LTD) S1 archlp; system32\drivers\archlp.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-25 13:28 - 2014-06-25 13:28 - 00014806 _____ () C:\Users\Andreas\Downloads\FRST.txt 2014-06-25 13:28 - 2014-06-25 13:28 - 00000000 ____D () C:\FRST 2014-06-25 13:27 - 2014-06-25 13:27 - 02082816 _____ (Farbar) C:\Users\Andreas\Downloads\FRST64.exe 2014-06-24 08:13 - 2014-06-24 08:13 - 01058200 _____ (Adobe) C:\Users\Andreas\Downloads\install_flashplayer14x32au_mssa_aaa_aih.exe 2014-06-24 03:28 - 2014-06-24 03:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-06-24 01:18 - 2014-05-30 12:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-06-24 01:18 - 2014-05-30 12:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-06-24 01:18 - 2014-05-30 12:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-06-24 01:18 - 2014-05-30 11:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-06-24 01:18 - 2014-05-30 11:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-06-24 01:18 - 2014-05-30 11:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-06-24 01:18 - 2014-05-30 11:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-06-24 01:18 - 2014-05-30 11:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-06-24 01:18 - 2014-05-30 11:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-06-24 01:18 - 2014-05-30 11:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-06-24 01:18 - 2014-05-30 11:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-06-24 01:18 - 2014-05-30 11:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-06-24 01:18 - 2014-05-30 11:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-06-24 01:18 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-06-24 01:18 - 2014-05-30 11:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-06-24 01:18 - 2014-05-30 11:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-06-24 01:18 - 2014-05-30 11:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-06-24 01:18 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-06-24 01:18 - 2014-05-30 10:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-06-24 01:18 - 2014-05-30 10:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-06-24 01:18 - 2014-05-30 10:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-06-24 01:18 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-06-24 01:18 - 2014-05-30 10:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-06-24 01:18 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-06-24 01:18 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-06-24 01:18 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-06-24 01:18 - 2014-05-30 10:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-06-24 01:18 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-06-24 01:18 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-06-24 01:18 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-06-24 01:18 - 2014-05-30 10:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-06-24 01:18 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-06-24 01:18 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-06-24 01:18 - 2014-05-30 10:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-06-24 01:18 - 2014-05-30 10:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-06-24 01:18 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-06-24 01:18 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-06-24 01:18 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-06-24 01:18 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-06-24 01:18 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-06-24 01:18 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-06-24 01:18 - 2014-05-30 09:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-06-24 01:18 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-06-24 01:18 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-06-24 01:18 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-06-24 01:18 - 2014-05-30 09:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-06-24 01:18 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-06-24 01:18 - 2014-05-30 09:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-06-24 01:18 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-06-24 01:18 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-06-24 01:18 - 2014-05-30 09:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-06-24 01:18 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-06-24 01:18 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll 2014-06-24 01:18 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll 2014-06-24 01:18 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2014-06-24 01:18 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS 2014-06-24 01:18 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll 2014-06-24 01:18 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-06-24 01:18 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll 2014-06-24 01:18 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll 2014-06-24 01:18 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll 2014-06-24 01:18 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2014-06-24 01:18 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll 2014-06-24 01:18 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll 2014-06-24 01:17 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-06-24 01:17 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll ==================== One Month Modified Files and Folders ======= 2014-06-25 13:28 - 2014-06-25 13:28 - 00014806 _____ () C:\Users\Andreas\Downloads\FRST.txt 2014-06-25 13:28 - 2014-06-25 13:28 - 00000000 ____D () C:\FRST 2014-06-25 13:27 - 2014-06-25 13:27 - 02082816 _____ (Farbar) C:\Users\Andreas\Downloads\FRST64.exe 2014-06-25 13:26 - 2011-06-07 01:39 - 00069112 _____ () C:\Users\Andreas\AppData\Local\GDIPFONTCACHEV1.DAT 2014-06-25 13:15 - 2014-04-17 14:30 - 00000000 ____D () C:\Users\Andreas\Documents\rechnungen 2014-06-25 13:02 - 2012-05-02 18:38 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-06-25 02:45 - 2011-06-07 01:20 - 00000199 _____ () C:\service.log 2014-06-25 01:10 - 2011-06-07 01:07 - 01931938 _____ () C:\Windows\WindowsUpdate.log 2014-06-24 22:20 - 2012-12-22 14:11 - 00000000 ____D () C:\Program Files (x86)\Steam 2014-06-24 20:57 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-06-24 20:25 - 2009-07-14 19:58 - 00728180 _____ () C:\Windows\system32\perfh007.dat 2014-06-24 20:25 - 2009-07-14 19:58 - 00158272 _____ () C:\Windows\system32\perfc007.dat 2014-06-24 20:25 - 2009-07-14 07:13 - 01675428 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-06-24 20:25 - 2009-07-14 06:45 - 00014816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-24 20:25 - 2009-07-14 06:45 - 00014816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-06-24 20:20 - 2011-06-07 01:25 - 00025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys 2014-06-24 20:20 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-06-24 20:19 - 2011-06-19 00:30 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-06-24 20:19 - 2009-07-14 06:51 - 00051889 _____ () C:\Windows\setupact.log 2014-06-24 20:03 - 2013-08-08 20:00 - 00000000 ____D () C:\Windows\system32\MRT 2014-06-24 20:02 - 2011-06-07 03:37 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-06-24 20:00 - 2014-05-06 17:13 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-06-24 08:13 - 2014-06-24 08:13 - 01058200 _____ (Adobe) C:\Users\Andreas\Downloads\install_flashplayer14x32au_mssa_aaa_aih.exe 2014-06-24 07:54 - 2012-05-02 21:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-06-24 07:51 - 2013-08-03 12:15 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2014-06-24 07:51 - 2013-08-03 12:15 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2014-06-24 03:28 - 2014-06-24 03:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-06-08 11:13 - 2014-06-24 01:17 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-06-08 11:08 - 2014-06-24 01:17 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-30 12:21 - 2014-06-24 01:18 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-30 12:02 - 2014-06-24 01:18 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-30 12:02 - 2014-06-24 01:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-05-30 11:45 - 2014-06-24 01:18 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-05-30 11:39 - 2014-06-24 01:18 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-05-30 11:39 - 2014-06-24 01:18 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-05-30 11:38 - 2014-06-24 01:18 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-05-30 11:28 - 2014-06-24 01:18 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-05-30 11:27 - 2014-06-24 01:18 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-05-30 11:24 - 2014-06-24 01:18 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-05-30 11:21 - 2014-06-24 01:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-05-30 11:21 - 2014-06-24 01:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-05-30 11:20 - 2014-06-24 01:18 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-05-30 11:18 - 2014-06-24 01:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-30 11:11 - 2014-06-24 01:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-05-30 11:08 - 2014-06-24 01:18 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-05-30 11:06 - 2014-06-24 01:18 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-05-30 11:02 - 2014-06-24 01:18 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-30 10:55 - 2014-06-24 01:18 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-05-30 10:49 - 2014-06-24 01:18 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-05-30 10:46 - 2014-06-24 01:18 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-30 10:44 - 2014-06-24 01:18 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-05-30 10:44 - 2014-06-24 01:18 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-05-30 10:43 - 2014-06-24 01:18 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-05-30 10:42 - 2014-06-24 01:18 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-05-30 10:38 - 2014-06-24 01:18 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-05-30 10:35 - 2014-06-24 01:18 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-05-30 10:34 - 2014-06-24 01:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-05-30 10:33 - 2014-06-24 01:18 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-05-30 10:30 - 2014-06-24 01:18 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-05-30 10:29 - 2014-06-24 01:18 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-05-30 10:28 - 2014-06-24 01:18 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-05-30 10:27 - 2014-06-24 01:18 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-05-30 10:24 - 2014-06-24 01:18 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-05-30 10:23 - 2014-06-24 01:18 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-05-30 10:16 - 2014-06-24 01:18 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-05-30 10:10 - 2014-06-24 01:18 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-05-30 10:06 - 2014-06-24 01:18 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-05-30 10:04 - 2014-06-24 01:18 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-05-30 10:02 - 2014-06-24 01:18 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-05-30 09:56 - 2014-06-24 01:18 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-05-30 09:56 - 2014-06-24 01:18 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-05-30 09:54 - 2014-06-24 01:18 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-05-30 09:50 - 2014-06-24 01:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-05-30 09:49 - 2014-06-24 01:18 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-05-30 09:43 - 2014-06-24 01:18 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-05-30 09:40 - 2014-06-24 01:18 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-05-30 09:30 - 2014-06-24 01:18 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-05-30 09:21 - 2014-06-24 01:18 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-05-30 09:15 - 2014-06-24 01:18 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-05-30 09:13 - 2014-06-24 01:18 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-05-30 09:13 - 2014-06-24 01:18 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll Some content of TEMP: ==================== C:\Users\Andreas\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-06-24 08:32 ==================== End Of Log ===============[CODE] Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-06-2014
Ran by Andreas at 2014-06-25 13:29:11
Running from C:\Users\Andreas\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: ZoneAlarm Free Firewall (Enabled) {E6380B7E-D4B2-19F1-083E-56486607704B}
==================== Installed Programs ======================
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader X (10.1.0) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.0 - Adobe Systems Incorporated)
AMD USB Filter Driver (x32 Version: 1.0.15.94 - Advanced Micro Devices, Inc.) Hidden
ANNO 2070 (HKLM-x32\...\{B48E264C-C8CD-4617-B0BE-46E977BAD694}) (Version: 1.0.0.0 - Ubisoft)
ArcSoft TotalMedia Theatre 5 (HKLM-x32\...\InstallShield_{9A2CE5D4-0A1E-42EB-9CE0-ABD5DD79E94E}) (Version: 5.3.1.172 - ArcSoft)
ArcSoft TotalMedia Theatre 5 (x32 Version: 5.3.1.172 - ArcSoft) Hidden
Audiograbber 1.83 SE (HKLM-x32\...\Audiograbber) (Version: 1.83 SE - Audiograbber)
Audiograbber MP3-Plugin (HKLM-x32\...\Audiograbber-Lame) (Version: 1.0 - AG)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.4.672 - Avira)
Call of Duty: Black Ops II - Multiplayer (HKLM-x32\...\Steam App 202990) (Version: - )
Call of Duty: Black Ops II - Zombies (HKLM-x32\...\Steam App 212910) (Version: - )
Call of Duty: Black Ops II (HKLM-x32\...\Steam App 202970) (Version: - )
Call of Duty: Modern Warfare 3 - Multiplayer (HKLM-x32\...\Steam App 42690) (Version: - Infinity Ward - Sledgehammer Games)
Call of Duty: Modern Warfare 3 (HKLM-x32\...\Steam App 42680) (Version: - Infinity Ward - Sledgehammer Games)
Crysis® 2 (HKLM-x32\...\{6033673D-2530-4587-8AD0-EB059FC263F9}) (Version: 1.0.0.0 - Electronic Arts)
CyberLink Blu-ray Disc Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.3226 - CyberLink Corp.)
CyberLink Blu-ray Disc Suite (x32 Version: 6.0.3226 - CyberLink Corp.) Hidden
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1916 - CyberLink Corp.)
CyberLink LabelPrint (x32 Version: 2.5.1916 - CyberLink Corp.) Hidden
CyberLink LG Burning Tool (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.2.3714 - CyberLink Corp.)
CyberLink LG Burning Tool (x32 Version: 6.2.3714 - CyberLink Corp.) Hidden
CyberLink MediaShow (HKLM-x32\...\InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}) (Version: 4.1.3402 - CyberLink Corp.)
CyberLink MediaShow (x32 Version: 4.1.3402 - CyberLink Corp.) Hidden
CyberLink PowerDVD 9 (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.2919.52 - CyberLink Corp.)
CyberLink PowerDVD 9 (x32 Version: 9.0.2919.52 - CyberLink Corp.) Hidden
CyberLink PowerProducer (HKLM-x32\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.0.1.1520 - CyberLink Corp.)
CyberLink PowerProducer (x32 Version: 5.0.1.1520 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 1.0.2609 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 1.0.2609 - CyberLink Corp.) Hidden
Dropbox (HKCU\...\Dropbox) (Version: 2.0.22 - Dropbox, Inc.)
DVDvideoSoft 2.0 Toolbar for IE (HKLM-x32\...\IECT3279453) (Version: 6.17.0.33 - DVDvideoSoft 2.0)
EasySaver B9.1214.1 (HKLM-x32\...\{07300F01-89CA-4CF8-92BD-2A605EB83C95}) (Version: 1.00.0000 - Gigabyte)
HD Tune 2.55 (HKLM-x32\...\HD Tune_is1) (Version: - EFD Software)
Homefront (HKLM-x32\...\Steam App 55100) (Version: - THQ)
LightScribe System Software (HKLM-x32\...\{A8F1CA85-C713-4B1F-B3B4-B2B7A6824146}) (Version: 1.18.14.1 - LightScribe)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 30.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
Mozilla Thunderbird (3.1.10) (HKLM-x32\...\Mozilla Thunderbird (3.1.10)) (Version: 3.1.10 (de) - Mozilla)
NVIDIA 3D Vision Controller Driver (x32 Version: 275.33 - NVIDIA Corporation) Hidden
NVIDIA 3D Vision Controller-Treiber 275.33 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 275.33 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 311.06 - NVIDIA Corporation)
NVIDIA Grafiktreiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.06 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.2.23.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.2.23.3 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.108.688 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.10.0514 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.10.0514 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.10.0514 - NVIDIA Corporation)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1106 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 311.06 (Version: 311.06 - NVIDIA Corporation) Hidden
NVIDIA Update 1.11.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.11.3 - NVIDIA Corporation) Hidden
ON_OFF Charge B10.0427.1 (HKLM-x32\...\{3DECD372-76A1-4483-BF10-B547790A3261}) (Version: 1.00.0001 - GIGABYTE)
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Origin (HKLM-x32\...\Origin) (Version: 8.1.2.444 - Electronic Arts, Inc.)
Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.18.322.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6167 - Realtek Semiconductor Corp.)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Total War: SHOGUN 2 (HKLM-x32\...\Steam App 34330) (Version: - The Creative Assembly)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
VC 9.0 Runtime (x32 Version: 1.0.0 - Check Point Software Technologies Ltd) Hidden
ZoneAlarm Firewall (x32 Version: 10.1.065.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Free (HKLM-x32\...\ZoneAlarm Free) (Version: 10.1.065.000 - Check Point)
ZoneAlarm Security (x32 Version: 10.1.065.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Toolbar (Version: - Check Point Software Technologies) Hidden
ZoneAlarm-Sicherheit Toolbar (HKLM-x32\...\ZoneAlarm-Sicherheit Toolbar) (Version: 6.9.0.16 - ZoneAlarm-Sicherheit)
==================== Restore Points =========================
07-05-2014 18:00:11 Windows Update
14-05-2014 18:00:16 Windows Update
21-05-2014 22:00:02 Geplanter Prüfpunkt
24-06-2014 14:49:59 Geplanter Prüfpunkt
24-06-2014 18:00:12 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {68D4C92F-0291-4A1C-BB13-C9EACD761EB7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)
Task: {71052300-005E-440B-9055-E5BDEB1D7FB1} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2011-06-06] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2011-06-07 01:20 - 2009-08-24 14:38 - 00068136 _____ () C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE
2011-06-07 01:59 - 2009-07-02 16:02 - 00244904 ____N () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2012-11-18 21:02 - 2013-01-18 17:00 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2011-06-07 01:20 - 2009-03-13 11:30 - 00109096 _____ () C:\Program Files (x86)\Gigabyte\EasySaver\YCC.DLL
2009-12-15 13:46 - 2009-12-15 13:46 - 00619816 ____N () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2009-12-15 13:49 - 2009-12-15 13:49 - 00013096 ____N () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2014-06-24 03:28 - 2014-06-24 03:28 - 03852912 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"
==================== EXE Association (whitelisted) =============
==================== MSCONFIG/TASK MANAGER disabled items =========
MSCONFIG\startupreg: LGODDFU => "C:\Program Files (x86)\lg_fwupdate\fwupdate.exe" blrun
==================== Faulty Device Manager Devices =============
Name: archlp
Description: archlp
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: archlp
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (05/08/2014 10:25:29 PM) (Source: VSS) (EventID: 12298) (User: )
Description: Volumeschattenkopie-Dienstfehler: Die E/A-Schreibvorgänge können während des Schattenkopie-Erstellungszeitraums auf Volume "C:\" nicht gespeichert werden.
Der Volumeindex im Schattenkopiesatz ist 0. Fehlerdetails: Offen[0x00000000, Der Vorgang wurde erfolgreich beendet.
], Leerung[0x00000000, Der Vorgang wurde erfolgreich beendet.
], Freigabe[0x80042314, Der Schattenkopieanbieter hat beim Warten auf den Schreibvorgang auf das Volume, von dem eine Schattenkopie erstellt wird, das Zeitlimit überschritten. Ursache hierfür könnte eine durch eine Anwendung oder einen Systemdienst verursachte hohe Aktivität auf dem Volume sein. Wiederholen Sie den Vorgang später, wenn das Volume nicht so stark ausgelastet ist.
], Ausführung[0x00000000, Der Vorgang wurde erfolgreich beendet.
].
Vorgang:
Asynchroner Vorgang wird ausgeführt
Kontext:
Aktueller Status: DoSnapshotSet
Error: (05/08/2014 10:25:29 PM) (Source: VSS) (EventID: 12310) (User: )
Description: Volumeschattenkopie-Dienstfehler: Die Schattenkopie kann nicht zugesichert werden - Vorgang hat das Zeitlimit überschritten.
Fehlerkontext: DeviceIoControl(\\?\Volume{54e24814-9091-11e0-89ea-806e6f6e6963} - 0000000000000154,0x0053c010,000000000059EB30,0,00000000001CBFD0,4096,[0]).
Vorgang:
Schattenkopien werden übertragen
Kontext:
Ausführungskontext: System Provider
Error: (05/08/2014 08:32:11 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Steam.exe, Version 2.19.72.18 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1648
Startzeit: 01cf6aebbe68c037
Endzeit: 16
Anwendungspfad: C:\Program Files (x86)\Steam\Steam.exe
Berichts-ID: 09661cde-d6df-11e3-ab45-1c6f65b72766
Error: (05/08/2014 08:21:50 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Steam.exe, Version 2.19.72.18 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 11a4
Startzeit: 01cf6aea2c7de8d3
Endzeit: 0
Anwendungspfad: C:\Program Files (x86)\Steam\Steam.exe
Berichts-ID: 97720666-d6dd-11e3-bbe1-1c6f65b72766
Error: (05/08/2014 08:19:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000001290
ID des fehlerhaften Prozesses: 0xa9c
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
System errors:
=============
Error: (06/24/2014 08:22:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (06/24/2014 08:22:46 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (06/24/2014 08:20:44 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
archlp
Error: (06/24/2014 07:58:01 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (06/24/2014 07:58:01 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (06/24/2014 07:55:59 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
archlp
Error: (06/24/2014 01:23:11 AM) (Source: BROWSER) (EventID: 8032) (User: )
Description: Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport "\Device\NetBT_Tcpip_{0EF66823-B466-45EC-96A4-5FA429DB0ADD}" zu oft fehl.
Der Sicherungssuchdienst wird beendet.
Error: (06/24/2014 01:09:34 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (06/24/2014 01:09:34 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (06/24/2014 01:07:31 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
archlp
Microsoft Office Sessions:
=========================
Error: (05/08/2014 10:25:29 PM) (Source: VSS) (EventID: 12298) (User: )
Description: C:\00x00000000, Der Vorgang wurde erfolgreich beendet.
0x00000000, Der Vorgang wurde erfolgreich beendet.
0x80042314, Der Schattenkopieanbieter hat beim Warten auf den Schreibvorgang auf das Volume, von dem eine Schattenkopie erstellt wird, das Zeitlimit überschritten. Ursache hierfür könnte eine durch eine Anwendung oder einen Systemdienst verursachte hohe Aktivität auf dem Volume sein. Wiederholen Sie den Vorgang später, wenn das Volume nicht so stark ausgelastet ist.
0x00000000, Der Vorgang wurde erfolgreich beendet.
Vorgang:
Asynchroner Vorgang wird ausgeführt
Kontext:
Aktueller Status: DoSnapshotSet
Error: (05/08/2014 10:25:29 PM) (Source: VSS) (EventID: 12310) (User: )
Description: DeviceIoControl(\\?\Volume{54e24814-9091-11e0-89ea-806e6f6e6963} - 0000000000000154,0x0053c010,000000000059EB30,0,00000000001CBFD0,4096,[0])
Vorgang:
Schattenkopien werden übertragen
Kontext:
Ausführungskontext: System Provider
Error: (05/08/2014 08:32:11 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Steam.exe2.19.72.18164801cf6aebbe68c03716C:\Program Files (x86)\Steam\Steam.exe09661cde-d6df-11e3-ab45-1c6f65b72766
Error: (05/08/2014 08:21:50 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Steam.exe2.19.72.1811a401cf6aea2c7de8d30C:\Program Files (x86)\Steam\Steam.exe97720666-d6dd-11e3-bbe1-1c6f65b72766
Error: (05/08/2014 08:19:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.1.7601.175674d672ee4Explorer.EXE6.1.7601.175674d672ee4c00000050000000000001290a9c01cf6aea0ef7a75cC:\Windows\Explorer.EXEC:\Windows\Explorer.EXE5aacbf2e-d6dd-11e3-bbe1-1c6f65b72766
CodeIntegrity Errors:
===================================
Date: 2014-06-25 13:26:51.850
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-06-25 13:12:52.452
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-06-25 13:06:32.491
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-06-25 06:57:10.218
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-06-25 05:14:49.938
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-06-24 22:18:57.759
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-06-24 08:51:54.251
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-06-24 08:12:58.649
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-06-24 02:30:14.848
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-06-24 02:17:48.567
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 38%
Total physical RAM: 4092.16 MB
Available physical RAM: 2509.1 MB
Total Pagefile: 8182.49 MB
Available Pagefile: 6257.69 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:232.79 GB) (Free:103.97 GB) NTFS
Drive d: () (Fixed) (Total:931.51 GB) (Free:920.21 GB) NTFS
Drive f: (08 Mai 2014) (CDROM) (Total:0.69 GB) (Free:0.07 GB) UDF
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: AF7D8C44)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=233 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: AF7D8C57)
Partition 1: (Not Active) - (Size=932 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Rootkit scan 2014-06-25 14:06:50 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000005c ST325031 rev.CC38 232,89GB Running: Gmer-19357.exe; Driver: C:\Users\Andreas\AppData\Local\Temp\uwtiqfob.sys ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800033bd000 45 bytes [00, 00, 15, 02, 46, 69, 6C, ...] INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff800033bd02f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...] ---- User code sections - GMER 2.1 ---- .text C:\Windows\system32\wininit.exe[496] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Windows\system32\wininit.exe[496] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Windows\system32\wininit.exe[496] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Windows\system32\wininit.exe[496] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Windows\system32\wininit.exe[496] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Windows\system32\wininit.exe[496] C:\Windows\system32\USER32.dll!FindWindowW 0000000077a3d264 5 bytes JMP 00000001222ff174 .text C:\Windows\system32\wininit.exe[496] C:\Windows\system32\USER32.dll!FindWindowA 0000000077a58270 5 bytes JMP 00000001222ff1c4 .text C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Windows\system32\services.exe[560] C:\Windows\system32\USER32.dll!FindWindowW 0000000077a3d264 5 bytes JMP 00000001222ff174 .text C:\Windows\system32\services.exe[560] C:\Windows\system32\USER32.dll!FindWindowA 0000000077a58270 5 bytes JMP 00000001222ff1c4 .text C:\Windows\system32\lsass.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Windows\system32\lsass.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Windows\system32\lsass.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Windows\system32\lsass.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Windows\system32\lsass.exe[620] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Windows\system32\lsass.exe[620] C:\Windows\system32\ADVAPI32.dll!ImpersonateNamedPipeClient + 1 000007fefe41b521 3 bytes [5D, 4B, D2] .text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Windows\system32\svchost.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Windows\system32\svchost.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Windows\system32\svchost.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Windows\system32\svchost.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Windows\system32\svchost.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Windows\system32\nvvsvc.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Windows\system32\nvvsvc.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Windows\system32\nvvsvc.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Windows\system32\nvvsvc.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Windows\system32\nvvsvc.exe[800] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[824] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess 0000000077e4fb28 5 bytes JMP 0000000120cb89ab .text C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[824] C:\Windows\SysWOW64\ntdll.dll!NtImpersonateClientOfPort 0000000077e4fb70 5 bytes JMP 0000000120cb8d58 .text C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[824] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheckByType 0000000077e50240 5 bytes JMP 0000000120cb8791 .text C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[824] C:\Windows\SysWOW64\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077e504c0 5 bytes JMP 0000000120cb8dd9 .text C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[824] C:\Windows\syswow64\kernel32.dll!OpenProcess 00000000766f1952 5 bytes JMP 0000000120cb846c .text C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[824] C:\Windows\syswow64\ADVAPI32.dll!SetThreadToken 0000000076bdc76e 5 bytes JMP 0000000120cb9036 .text C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[824] C:\Windows\syswow64\ADVAPI32.dll!ImpersonateNamedPipeClient 0000000076c13475 5 bytes JMP 0000000120cb8e5d .text C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[824] C:\Windows\syswow64\USER32.dll!FindWindowW 00000000775798fd 5 bytes JMP 0000000120cb825a .text C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[824] C:\Windows\syswow64\USER32.dll!FindWindowA 000000007757ffe6 5 bytes JMP 0000000120cb828f .text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Windows\system32\svchost.exe[868] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Windows\system32\svchost.exe[868] C:\Windows\system32\ADVAPI32.dll!ImpersonateNamedPipeClient + 1 000007fefe41b521 3 bytes [5D, 4B, D2] .text C:\Windows\system32\atiesrxx.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Windows\system32\atiesrxx.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Windows\system32\atiesrxx.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Windows\system32\atiesrxx.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Windows\system32\atiesrxx.exe[932] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Windows\System32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Windows\System32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Windows\System32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Windows\System32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Windows\System32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Windows\System32\svchost.exe[316] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Windows\System32\svchost.exe[316] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Windows\System32\svchost.exe[316] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Windows\System32\svchost.exe[316] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Windows\System32\svchost.exe[316] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Windows\System32\svchost.exe[316] C:\Windows\system32\ADVAPI32.dll!ImpersonateNamedPipeClient + 1 000007fefe41b521 3 bytes [5D, 4B, D2] .text C:\Windows\system32\svchost.exe[340] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Windows\system32\svchost.exe[340] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Windows\system32\svchost.exe[340] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Windows\system32\svchost.exe[340] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Windows\system32\svchost.exe[340] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Windows\system32\svchost.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Windows\system32\svchost.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Windows\system32\svchost.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Windows\system32\svchost.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Windows\system32\svchost.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Windows\system32\svchost.exe[520] C:\Windows\system32\ADVAPI32.dll!ImpersonateNamedPipeClient + 1 000007fefe41b521 3 bytes [5D, 4B, D2] .text C:\Windows\system32\svchost.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Windows\system32\svchost.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Windows\system32\svchost.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Windows\system32\svchost.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Windows\system32\svchost.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Windows\System32\spoolsv.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Windows\system32\svchost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Windows\system32\svchost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Windows\system32\svchost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Windows\system32\svchost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Windows\system32\svchost.exe[1696] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Windows\system32\svchost.exe[1696] C:\Windows\system32\ADVAPI32.dll!ImpersonateNamedPipeClient + 1 000007fefe41b521 3 bytes [5D, 4B, D2] .text C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1816] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess 0000000077e4fb28 5 bytes JMP 0000000120cb89ab .text C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1816] C:\Windows\SysWOW64\ntdll.dll!NtImpersonateClientOfPort 0000000077e4fb70 5 bytes JMP 0000000120cb8d58 .text C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1816] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheckByType 0000000077e50240 5 bytes JMP 0000000120cb8791 .text C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1816] C:\Windows\SysWOW64\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077e504c0 5 bytes JMP 0000000120cb8dd9 .text C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1816] C:\Windows\syswow64\kernel32.dll!OpenProcess 00000000766f1952 5 bytes JMP 0000000120cb846c .text C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1816] C:\Windows\syswow64\USER32.dll!FindWindowW 00000000775798fd 5 bytes JMP 0000000120cb825a .text C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1816] C:\Windows\syswow64\USER32.dll!FindWindowA 000000007757ffe6 5 bytes JMP 0000000120cb828f .text C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1816] C:\Windows\syswow64\ADVAPI32.dll!SetThreadToken 0000000076bdc76e 5 bytes JMP 0000000120cb9036 .text C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1816] C:\Windows\syswow64\ADVAPI32.dll!ImpersonateNamedPipeClient 0000000076c13475 5 bytes JMP 0000000120cb8e5d .text C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1816] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771e1465 2 bytes [1E, 77] .text C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1816] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771e14bb 2 bytes [1E, 77] .text ... * 2 .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1868] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess 0000000077e4fb28 5 bytes JMP 0000000120cb89ab .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1868] C:\Windows\SysWOW64\ntdll.dll!NtImpersonateClientOfPort 0000000077e4fb70 5 bytes JMP 0000000120cb8d58 .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1868] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheckByType 0000000077e50240 5 bytes JMP 0000000120cb8791 .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1868] C:\Windows\SysWOW64\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077e504c0 5 bytes JMP 0000000120cb8dd9 .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1868] C:\Windows\syswow64\kernel32.dll!OpenProcess 00000000766f1952 5 bytes JMP 0000000120cb846c .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1868] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771e1465 2 bytes [1E, 77] .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1868] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771e14bb 2 bytes [1E, 77] .text ... * 2 .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1868] C:\Windows\syswow64\USER32.dll!FindWindowW 00000000775798fd 5 bytes JMP 0000000120cb825a .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1868] C:\Windows\syswow64\USER32.dll!FindWindowA 000000007757ffe6 5 bytes JMP 0000000120cb828f .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1868] C:\Windows\syswow64\ADVAPI32.dll!SetThreadToken 0000000076bdc76e 5 bytes JMP 0000000120cb9036 .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1868] C:\Windows\syswow64\ADVAPI32.dll!ImpersonateNamedPipeClient 0000000076c13475 5 bytes JMP 0000000120cb8e5d .text C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE[1948] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess 0000000077e4fb28 5 bytes JMP 0000000120cb89ab .text C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE[1948] C:\Windows\SysWOW64\ntdll.dll!NtImpersonateClientOfPort 0000000077e4fb70 5 bytes JMP 0000000120cb8d58 .text C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE[1948] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheckByType 0000000077e50240 5 bytes JMP 0000000120cb8791 .text C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE[1948] C:\Windows\SysWOW64\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077e504c0 5 bytes JMP 0000000120cb8dd9 .text C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE[1948] C:\Windows\syswow64\kernel32.dll!OpenProcess 00000000766f1952 5 bytes JMP 0000000120cb846c .text C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE[1948] C:\Windows\syswow64\ADVAPI32.dll!SetThreadToken 0000000076bdc76e 5 bytes JMP 0000000120cb9036 .text C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE[1948] C:\Windows\syswow64\ADVAPI32.dll!ImpersonateNamedPipeClient 0000000076c13475 5 bytes JMP 0000000120cb8e5d .text C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE[1948] C:\Windows\syswow64\USER32.dll!FindWindowW 00000000775798fd 5 bytes JMP 0000000120cb825a .text C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE[1948] C:\Windows\syswow64\USER32.dll!FindWindowA 000000007757ffe6 5 bytes JMP 0000000120cb828f .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1976] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess 0000000077e4fb28 5 bytes JMP 0000000120cb89ab .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1976] C:\Windows\SysWOW64\ntdll.dll!NtImpersonateClientOfPort 0000000077e4fb70 5 bytes JMP 0000000120cb8d58 .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1976] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheckByType 0000000077e50240 5 bytes JMP 0000000120cb8791 .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1976] C:\Windows\SysWOW64\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077e504c0 5 bytes JMP 0000000120cb8dd9 .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1976] C:\Windows\syswow64\kernel32.dll!OpenProcess 00000000766f1952 5 bytes JMP 0000000120cb846c .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1976] C:\Windows\syswow64\ADVAPI32.dll!SetThreadToken 0000000076bdc76e 5 bytes JMP 0000000120cb9036 .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1976] C:\Windows\syswow64\ADVAPI32.dll!ImpersonateNamedPipeClient 0000000076c13475 5 bytes JMP 0000000120cb8e5d .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1976] C:\Windows\syswow64\USER32.dll!FindWindowW 00000000775798fd 5 bytes JMP 0000000120cb825a .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1976] C:\Windows\syswow64\USER32.dll!FindWindowA 000000007757ffe6 5 bytes JMP 0000000120cb828f .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1976] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771e1465 2 bytes [1E, 77] .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1976] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771e14bb 2 bytes [1E, 77] .text ... * 2 .text C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[1036] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess 0000000077e4fb28 5 bytes JMP 0000000120cb89ab .text C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[1036] C:\Windows\SysWOW64\ntdll.dll!NtImpersonateClientOfPort 0000000077e4fb70 5 bytes JMP 0000000120cb8d58 .text C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[1036] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheckByType 0000000077e50240 5 bytes JMP 0000000120cb8791 .text C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[1036] C:\Windows\SysWOW64\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077e504c0 5 bytes JMP 0000000120cb8dd9 .text C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[1036] C:\Windows\syswow64\kernel32.dll!OpenProcess 00000000766f1952 5 bytes JMP 0000000120cb846c .text C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[1036] C:\Windows\syswow64\USER32.dll!FindWindowW 00000000775798fd 5 bytes JMP 0000000120cb825a .text C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[1036] C:\Windows\syswow64\USER32.dll!FindWindowA 000000007757ffe6 5 bytes JMP 0000000120cb828f .text C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[1036] C:\Windows\syswow64\ADVAPI32.dll!SetThreadToken 0000000076bdc76e 5 bytes JMP 0000000120cb9036 .text C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[1036] C:\Windows\syswow64\ADVAPI32.dll!ImpersonateNamedPipeClient 0000000076c13475 5 bytes JMP 0000000120cb8e5d .text C:\Windows\system32\svchost.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Windows\system32\svchost.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Windows\system32\svchost.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Windows\system32\svchost.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Windows\system32\svchost.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2780] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Windows\system32\SearchIndexer.exe[332] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Windows\system32\SearchIndexer.exe[332] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Windows\system32\SearchIndexer.exe[332] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Windows\system32\SearchIndexer.exe[332] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Windows\system32\SearchIndexer.exe[332] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Windows\system32\svchost.exe[2672] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Windows\system32\svchost.exe[2672] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Windows\system32\svchost.exe[2672] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Windows\system32\svchost.exe[2672] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Windows\system32\svchost.exe[2672] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2472] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2472] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2472] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2472] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2472] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Program Files (x86)\ArcSoft\TotalMedia Theatre 5\TotalMedia Server\TM Server.exe[3172] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess 0000000077e4fb28 5 bytes JMP 0000000120cb89ab .text C:\Program Files (x86)\ArcSoft\TotalMedia Theatre 5\TotalMedia Server\TM Server.exe[3172] C:\Windows\SysWOW64\ntdll.dll!NtImpersonateClientOfPort 0000000077e4fb70 5 bytes JMP 0000000120cb8d58 .text C:\Program Files (x86)\ArcSoft\TotalMedia Theatre 5\TotalMedia Server\TM Server.exe[3172] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheckByType 0000000077e50240 5 bytes JMP 0000000120cb8791 .text C:\Program Files (x86)\ArcSoft\TotalMedia Theatre 5\TotalMedia Server\TM Server.exe[3172] C:\Windows\SysWOW64\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077e504c0 5 bytes JMP 0000000120cb8dd9 .text C:\Program Files (x86)\ArcSoft\TotalMedia Theatre 5\TotalMedia Server\TM Server.exe[3172] C:\Windows\syswow64\kernel32.dll!OpenProcess 00000000766f1952 5 bytes JMP 0000000120cb846c .text C:\Program Files (x86)\ArcSoft\TotalMedia Theatre 5\TotalMedia Server\TM Server.exe[3172] C:\Windows\syswow64\USER32.dll!FindWindowW 00000000775798fd 5 bytes JMP 0000000120cb825a .text C:\Program Files (x86)\ArcSoft\TotalMedia Theatre 5\TotalMedia Server\TM Server.exe[3172] C:\Windows\syswow64\USER32.dll!FindWindowA 000000007757ffe6 5 bytes JMP 0000000120cb828f .text C:\Program Files (x86)\ArcSoft\TotalMedia Theatre 5\TotalMedia Server\TM Server.exe[3172] C:\Windows\syswow64\ADVAPI32.dll!SetThreadToken 0000000076bdc76e 5 bytes JMP 0000000120cb9036 .text C:\Program Files (x86)\ArcSoft\TotalMedia Theatre 5\TotalMedia Server\TM Server.exe[3172] C:\Windows\syswow64\ADVAPI32.dll!ImpersonateNamedPipeClient 0000000076c13475 5 bytes JMP 0000000120cb8e5d .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[3364] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess 0000000077e4fb28 5 bytes JMP 0000000120cb89ab .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[3364] C:\Windows\SysWOW64\ntdll.dll!NtImpersonateClientOfPort 0000000077e4fb70 5 bytes JMP 0000000120cb8d58 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[3364] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheckByType 0000000077e50240 5 bytes JMP 0000000120cb8791 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[3364] C:\Windows\SysWOW64\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077e504c0 5 bytes JMP 0000000120cb8dd9 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[3364] C:\Windows\syswow64\kernel32.dll!OpenProcess 00000000766f1952 5 bytes JMP 0000000120cb846c .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[3364] C:\Windows\syswow64\USER32.dll!FindWindowW 00000000775798fd 5 bytes JMP 0000000120cb825a .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[3364] C:\Windows\syswow64\USER32.dll!FindWindowA 000000007757ffe6 5 bytes JMP 0000000120cb828f .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[3364] C:\Windows\syswow64\ADVAPI32.dll!SetThreadToken 0000000076bdc76e 5 bytes JMP 0000000120cb9036 .text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[3364] C:\Windows\syswow64\ADVAPI32.dll!ImpersonateNamedPipeClient 0000000076c13475 5 bytes JMP 0000000120cb8e5d .text C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3384] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess 0000000077e4fb28 5 bytes JMP 0000000120cb89ab .text C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3384] C:\Windows\SysWOW64\ntdll.dll!NtImpersonateClientOfPort 0000000077e4fb70 5 bytes JMP 0000000120cb8d58 .text C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3384] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheckByType 0000000077e50240 5 bytes JMP 0000000120cb8791 .text C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3384] C:\Windows\SysWOW64\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077e504c0 5 bytes JMP 0000000120cb8dd9 .text C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3384] C:\Windows\syswow64\kernel32.dll!OpenProcess 00000000766f1952 5 bytes JMP 0000000120cb846c .text C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3384] C:\Windows\syswow64\USER32.dll!FindWindowW 00000000775798fd 5 bytes JMP 0000000120cb825a .text C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3384] C:\Windows\syswow64\USER32.dll!FindWindowA 000000007757ffe6 5 bytes JMP 0000000120cb828f .text C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3384] C:\Windows\syswow64\ADVAPI32.dll!SetThreadToken 0000000076bdc76e 5 bytes JMP 0000000120cb9036 .text C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe[3384] C:\Windows\syswow64\ADVAPI32.dll!ImpersonateNamedPipeClient 0000000076c13475 5 bytes JMP 0000000120cb8e5d .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3392] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess 0000000077e4fb28 5 bytes JMP 0000000120cb89ab .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3392] C:\Windows\SysWOW64\ntdll.dll!NtImpersonateClientOfPort 0000000077e4fb70 5 bytes JMP 0000000120cb8d58 .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3392] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheckByType 0000000077e50240 5 bytes JMP 0000000120cb8791 .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3392] C:\Windows\SysWOW64\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077e504c0 5 bytes JMP 0000000120cb8dd9 .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3392] C:\Windows\syswow64\kernel32.dll!OpenProcess 00000000766f1952 5 bytes JMP 0000000120cb846c .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3392] C:\Windows\syswow64\USER32.dll!FindWindowW 00000000775798fd 5 bytes JMP 0000000120cb825a .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3392] C:\Windows\syswow64\USER32.dll!FindWindowA 000000007757ffe6 5 bytes JMP 0000000120cb828f .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3392] C:\Windows\syswow64\ADVAPI32.dll!SetThreadToken 0000000076bdc76e 5 bytes JMP 0000000120cb9036 .text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[3392] C:\Windows\syswow64\ADVAPI32.dll!ImpersonateNamedPipeClient 0000000076c13475 5 bytes JMP 0000000120cb8e5d .text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3432] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess 0000000077e4fb28 5 bytes JMP 0000000120cb89ab .text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3432] C:\Windows\SysWOW64\ntdll.dll!NtImpersonateClientOfPort 0000000077e4fb70 5 bytes JMP 0000000120cb8d58 .text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3432] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheckByType 0000000077e50240 5 bytes JMP 0000000120cb8791 .text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3432] C:\Windows\SysWOW64\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077e504c0 5 bytes JMP 0000000120cb8dd9 .text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[3432] C:\Windows\syswow64\kernel32.dll!OpenProcess 00000000766f1952 5 bytes JMP 0000000120cb846c .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Windows\System32\svchost.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Windows\System32\svchost.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Windows\System32\svchost.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Windows\System32\svchost.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Windows\System32\svchost.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Windows\System32\svchost.exe[608] C:\Windows\system32\ADVAPI32.dll!ImpersonateNamedPipeClient + 1 000007fefe41b521 3 bytes [5D, 4B, D2] .text C:\Windows\system32\taskhost.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess 0000000077ca1470 5 bytes JMP 00000001222ffe7c .text C:\Windows\system32\taskhost.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort 0000000077ca14a0 1 byte JMP 0000000122300530 .text C:\Windows\system32\taskhost.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtImpersonateClientOfPort + 2 0000000077ca14a2 3 bytes {JMP 0xffffffffaa65f090} .text C:\Windows\system32\taskhost.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtAccessCheckByType 0000000077ca1900 5 bytes JMP 00000001222ffab8 .text C:\Windows\system32\taskhost.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077ca1aa0 5 bytes JMP 00000001223005e8 .text C:\Users\Andreas\Downloads\Gmer-19357.exe[1108] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess 0000000077e4fb28 5 bytes JMP 0000000120cb89ab .text C:\Users\Andreas\Downloads\Gmer-19357.exe[1108] C:\Windows\SysWOW64\ntdll.dll!NtImpersonateClientOfPort 0000000077e4fb70 5 bytes JMP 0000000120cb8d58 .text C:\Users\Andreas\Downloads\Gmer-19357.exe[1108] C:\Windows\SysWOW64\ntdll.dll!NtAccessCheckByType 0000000077e50240 5 bytes JMP 0000000120cb8791 .text C:\Users\Andreas\Downloads\Gmer-19357.exe[1108] C:\Windows\SysWOW64\ntdll.dll!NtAlpcImpersonateClientOfPort 0000000077e504c0 5 bytes JMP 0000000120cb8dd9 .text C:\Users\Andreas\Downloads\Gmer-19357.exe[1108] C:\Windows\syswow64\kernel32.dll!OpenProcess 00000000766f1952 5 bytes JMP 0000000120cb846c .text C:\Users\Andreas\Downloads\Gmer-19357.exe[1108] C:\Windows\syswow64\USER32.dll!FindWindowW 00000000775798fd 5 bytes JMP 0000000120cb825a .text C:\Users\Andreas\Downloads\Gmer-19357.exe[1108] C:\Windows\syswow64\USER32.dll!FindWindowA 000000007757ffe6 5 bytes JMP 0000000120cb828f .text C:\Users\Andreas\Downloads\Gmer-19357.exe[1108] C:\Windows\syswow64\ADVAPI32.dll!SetThreadToken 0000000076bdc76e 5 bytes JMP 0000000120cb9036 .text C:\Users\Andreas\Downloads\Gmer-19357.exe[1108] C:\Windows\syswow64\ADVAPI32.dll!ImpersonateNamedPipeClient 0000000076c13475 5 bytes JMP 0000000120cb8e5d ---- EOF - GMER 2.1 ---- |
Baum-Darstellung