| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Webseiten werden auf Werbung umgeleitet.Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
11.11.2014, 20:15
| #1 |
| |  Windows 7: Webseiten werden auf Werbung umgeleitet. Hallo, seid etwa 2 Wochen öffnen sich ca. alle 10 Minuten Webseiten wie z.B. addcash.com , tuneup.com. Als Browser benutzte ich Google Chrome mit dem Addon Adblock Plus. defogger_disable by jpshortstuff (23.02.10.1) Log created at 19:41 on 11/11/2014 (Daniel) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- \Windows\system32\MRT.exe 2014-10-13 18:21 - 2013-05-23 12:45 - 00000000 ____D () C:\ProgramData\Origin Some content of TEMP: ==================== C:\Users\Daniel\AppData\Local\Temp\avgnt.exe C:\Users\Daniel\AppData\Local\Temp\sfamcc00001.dll C:\Users\Daniel\AppData\Local\Temp\sfareca00001.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-11-05 00:15 ==================== End Of Log ============================ (HRESULT : 0xc0041801) (0xc0041801) The catalog is corrupt ==================== Memory info =========================== Processor: Intel(R) Core(TM) i5-3570K CPU @ 3.40GHz Percentage of memory in use: 31% Total physical RAM: 8079.17 MB Available physical RAM: 5566.52 MB Total Pagefile: 16156.52 MB Available Pagefile: 13243.81 MB Total Virtual: 8192 MB Available Virtual: 8191.82 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:119.24 GB) (Free:4.88 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive e: (Volume) (Fixed) (Total:931.51 GB) (Free:566.75 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: 61D1FDAA) Partition 1: (Active) - (Size=119.2 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 931.5 GB) (Disk ID: 9072F7AD) Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS) ==================== End Of Log ============================ GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2014-11-11 19:47:13 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 M4-CT128M4SSD2 rev.040H 119,24GB Running: Gmer-19357.exe; Driver: C:\Users\Daniel\AppData\Local\Temp\uwdirpod.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1736] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074fe1401 2 bytes JMP 75c6b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1736] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074fe1419 2 bytes JMP 75c6b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1736] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074fe1431 2 bytes JMP 75ce8ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1736] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074fe144a 2 bytes CALL 75c448ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1736] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074fe14dd 2 bytes JMP 75ce87a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1736] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074fe14f5 2 bytes JMP 75ce8978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1736] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074fe150d 2 bytes JMP 75ce8698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1736] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074fe1525 2 bytes JMP 75ce8a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1736] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074fe153d 2 bytes JMP 75c5fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1736] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074fe1555 2 bytes JMP 75c668ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1736] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074fe156d 2 bytes JMP 75ce8f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1736] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074fe1585 2 bytes JMP 75ce8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1736] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074fe159d 2 bytes JMP 75ce865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1736] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074fe15b5 2 bytes JMP 75c5fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1736] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074fe15cd 2 bytes JMP 75c6b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1736] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074fe16b2 2 bytes JMP 75ce8e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1736] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074fe16bd 2 bytes JMP 75ce85f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\LuckyTab\LuckyTab.exe[2520] C:\Windows\SysWOW64\ntdll.dll!LdrAccessResource 00000000775e1fc0 5 bytes JMP 000000010051c7a0 .text C:\Program Files (x86)\LuckyTab\LuckyTab.exe[2520] C:\Windows\SysWOW64\ntdll.dll!LdrFindResource_U 00000000775e1fdd 5 bytes JMP 000000010051c710 .text C:\Program Files (x86)\LuckyTab\LuckyTab.exe[2520] C:\Windows\syswow64\USER32.dll!LoadStringW 0000000075a78eb9 5 bytes JMP 000000010051c6b0 .text C:\Program Files (x86)\LuckyTab\LuckyTab.exe[2520] C:\Windows\syswow64\USER32.dll!LoadStringA 0000000075a7db21 5 bytes JMP 000000010051c620 .text C:\Program Files (x86)\LuckyTab\LuckyTab.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074fe1401 2 bytes JMP 75c6b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\LuckyTab\LuckyTab.exe[2520] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074fe1419 2 bytes JMP 75c6b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\LuckyTab\LuckyTab.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074fe1431 2 bytes JMP 75ce8ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\LuckyTab\LuckyTab.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074fe144a 2 bytes CALL 75c448ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\LuckyTab\LuckyTab.exe[2520] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074fe14dd 2 bytes JMP 75ce87a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\LuckyTab\LuckyTab.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074fe14f5 2 bytes JMP 75ce8978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\LuckyTab\LuckyTab.exe[2520] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074fe150d 2 bytes JMP 75ce8698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\LuckyTab\LuckyTab.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074fe1525 2 bytes JMP 75ce8a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\LuckyTab\LuckyTab.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074fe153d 2 bytes JMP 75c5fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\LuckyTab\LuckyTab.exe[2520] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074fe1555 2 bytes JMP 75c668ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\LuckyTab\LuckyTab.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074fe156d 2 bytes JMP 75ce8f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\LuckyTab\LuckyTab.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074fe1585 2 bytes JMP 75ce8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\LuckyTab\LuckyTab.exe[2520] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074fe159d 2 bytes JMP 75ce865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\LuckyTab\LuckyTab.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074fe15b5 2 bytes JMP 75c5fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\LuckyTab\LuckyTab.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074fe15cd 2 bytes JMP 75c6b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\LuckyTab\LuckyTab.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074fe16b2 2 bytes JMP 75ce8e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\LuckyTab\LuckyTab.exe[2520] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074fe16bd 2 bytes JMP 75ce85f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074fe1401 2 bytes JMP 75c6b21b C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2556] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074fe1419 2 bytes JMP 75c6b346 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074fe1431 2 bytes JMP 75ce8ea9 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074fe144a 2 bytes CALL 75c448ad C:\Windows\syswow64\KERNEL32.dll .text ... * 9 .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2556] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074fe14dd 2 bytes JMP 75ce87a2 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074fe14f5 2 bytes JMP 75ce8978 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2556] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074fe150d 2 bytes JMP 75ce8698 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074fe1525 2 bytes JMP 75ce8a62 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074fe153d 2 bytes JMP 75c5fca8 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2556] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074fe1555 2 bytes JMP 75c668ef C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074fe156d 2 bytes JMP 75ce8f61 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074fe1585 2 bytes JMP 75ce8ac2 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2556] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074fe159d 2 bytes JMP 75ce865c C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074fe15b5 2 bytes JMP 75c5fd41 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074fe15cd 2 bytes JMP 75c6b2dc C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074fe16b2 2 bytes JMP 75ce8e24 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074fe16bd 2 bytes JMP 75ce85f1 C:\Windows\syswow64\KERNEL32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2924] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074fe1401 2 bytes JMP 75c6b21b C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2924] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074fe1419 2 bytes JMP 75c6b346 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2924] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074fe1431 2 bytes JMP 75ce8ea9 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2924] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074fe144a 2 bytes CALL 75c448ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2924] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074fe14dd 2 bytes JMP 75ce87a2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2924] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074fe14f5 2 bytes JMP 75ce8978 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2924] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074fe150d 2 bytes JMP 75ce8698 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2924] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074fe1525 2 bytes JMP 75ce8a62 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2924] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074fe153d 2 bytes JMP 75c5fca8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2924] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074fe1555 2 bytes JMP 75c668ef C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2924] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074fe156d 2 bytes JMP 75ce8f61 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2924] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074fe1585 2 bytes JMP 75ce8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2924] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074fe159d 2 bytes JMP 75ce865c C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2924] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074fe15b5 2 bytes JMP 75c5fd41 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2924] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074fe15cd 2 bytes JMP 75c6b2dc C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2924] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074fe16b2 2 bytes JMP 75ce8e24 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2924] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074fe16bd 2 bytes JMP 75ce85f1 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2052] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074fe1401 2 bytes JMP 75c6b21b C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2052] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074fe1419 2 bytes JMP 75c6b346 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2052] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074fe1431 2 bytes JMP 75ce8ea9 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2052] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074fe144a 2 bytes CALL 75c448ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2052] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074fe14dd 2 bytes JMP 75ce87a2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2052] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074fe14f5 2 bytes JMP 75ce8978 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2052] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074fe150d 2 bytes JMP 75ce8698 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2052] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074fe1525 2 bytes JMP 75ce8a62 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2052] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074fe153d 2 bytes JMP 75c5fca8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2052] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074fe1555 2 bytes JMP 75c668ef C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2052] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074fe156d 2 bytes JMP 75ce8f61 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2052] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074fe1585 2 bytes JMP 75ce8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2052] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074fe159d 2 bytes JMP 75ce865c C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2052] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074fe15b5 2 bytes JMP 75c5fd41 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2052] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074fe15cd 2 bytes JMP 75c6b2dc C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2052] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074fe16b2 2 bytes JMP 75ce8e24 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2052] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074fe16bd 2 bytes JMP 75ce85f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074fe1401 2 bytes JMP 75c6b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2284] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074fe1419 2 bytes JMP 75c6b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074fe1431 2 bytes JMP 75ce8ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074fe144a 2 bytes CALL 75c448ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2284] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074fe14dd 2 bytes JMP 75ce87a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074fe14f5 2 bytes JMP 75ce8978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2284] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074fe150d 2 bytes JMP 75ce8698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074fe1525 2 bytes JMP 75ce8a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074fe153d 2 bytes JMP 75c5fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2284] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074fe1555 2 bytes JMP 75c668ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074fe156d 2 bytes JMP 75ce8f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074fe1585 2 bytes JMP 75ce8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2284] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074fe159d 2 bytes JMP 75ce865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074fe15b5 2 bytes JMP 75c5fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074fe15cd 2 bytes JMP 75c6b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074fe16b2 2 bytes JMP 75ce8e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Secure Search\vprot.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074fe16bd 2 bytes JMP 75ce85f1 C:\Windows\syswow64\kernel32.dll ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToSnapshot@OfficeODC ???t?????r????*??|?????????????n????.NT??????????????????k???????s??????????????t????t??nk??usbccgp???????????????????????~??~???\???????N??????t????? ???#?????r?????s???????????????????????????.??????????????????t???system32\drivers\msahci.sys??????j?j?o?o?j?r?j???r??.NT?????????????????? ???????????????????????????????$??? ???????n?????r?????r??????????x?????????????????????????????????????????????????T??r????????h?????\SystemRoot\system32\DRIVERS\gagp30kx.sys?????x??r?? ???????e????Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms??????????r??????p???PnP Filter???????r?r?r?r?r?r?r????N??r???????????d??agp.inf_amd64_neutral_22cdceb61fbafb43??????? ???????r???????????r?????????????? ????????????????r??????????? ???????n?????s?????s?0??????$?????????c???@gpapi.dll,-112??????r???s?s?s???r???s??????????????????@s??????p???ProfSvc_Group?????X??s????????h?????%windir%\system32\svchost.exe -k GPSvcGroup??????? ??s?????????n????@gpapi.dll,-113?????????????????? ???s??????????????LocalSystem???????????????? Reg HKLM\SYSTEM\ControlSet002\Control\BackupRestore\FilesNotToSnapshot@OfficeODC ???j?k????X??l???4??????? "??j???e??????? ??? j?????????????????????????????????oem27.inf???????????System32\Drivers\dfsc.sys???drmkaud?????????????avkmgr???????j???n????????????????????????????t? ? ????:??????0?g?4???????????????????????????-???9???d?j?j?k?k???k???k?k?k???j?j?????????j?????????e??????????????????s?????volsnap???????????????<????????g??????????????????????N??k????????D????? oem31.inf???????ro????X??l??? ??????? ???????j?????j?????/?,??(?????????????????????????HIDClass????*pnp0c02????0 1 2 3 4???mshdc.inf???? ???????j?????j???????3???????????????????????????????j????? ???????j???????????j?3?????????????????????y?????????????????????????j?????j?k?l??????????????????????.NT?????Cisco??????j????????? ???????j?????????????,?????????????????f???j?jc.???j??? ???????j?????j???????0??L????????? ??????????????j???j???j??g%;I??? ???????j?????j???????0????????????&???????????????????????? ???????j?????j???????0????????????????????? ???????j???????????f?0?????????????????????????????????????????j????????? ---- EOF - GMER 2.1 ---- |
| Themen zu Windows 7: Webseiten werden auf Werbung umgeleitet. |
| auf werbung umgeleitet, avg, avira, explorer.exe, fehlercode 0x80070490, fehlercode 0xc0000005, fehlercode 126, fehlercode 28, fehlercode 490@01010004, fehlercode windows, harddisk, registry, secure search, service.exe, services.exe, svchost.exe, system, system32, webseiten werden auf werbung umgeleitet., werbung, win32/luckytab.a, windows, winlogon.exe |
Baum-Darstellung