falsche Telekomrechnung versehentlich geöffnet

Sehr geehrte Kundin, sehr geehrter Kunde, 	 
 
  	anbei erhalten Sie Ihre aktuelle Rechnung. Die Gesamtsumme für November 2014 beträgt: 217,96 Euro. 	 
  	
Im Anhang finden Sie die gewünschten Dokumente zu Ihrer Mobilfunk RechnungOnline für November 2014. 2014_11rechnung_175520079_17_552_04008345 - Adobe PDF Format. 	 
 
  	Dies ist eine im automatischen Modus generierte E-Mail. Bitte nicht darauf antworten. 	 
 
 
  	Mit freundlichen Grüßen

Ralf Hoßbach
Leiter Kundenservice
         

SHA256: 	20946cafe4c2b4462948fed6999067a1907ba32f339831220f4babfa61daaec9
File name: 	rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899...
Detection ratio: 	10 / 53
Analysis date: 	2014-11-19 11:53:42 UTC ( 0 minutes ago )

	
Antivirus 		Result 				Update
Avast 			Win32:Malware-gen 		20141119
Baidu-International 	Trojan.Win32.Kryptik.bCQRJ 	20141107
Bkav 			HW32.Packed.F01F 		20141119
CMC 			Packed.Win32.Obfuscated.10!O 	20141118
ESET-NOD32 		a variant of Win32/Kryptik.CQRJ 20141119
Ikarus 			Trojan-Spy.Zbot 		20141119
Norman 			Androm.V 			20141119
Qihoo-360 		HEUR/QVM20.1.Malware.Gen 	20141119
Sophos 			Troj/Agent-AKEA 		20141119
Tencent 		Win32.Trojan.Inject.Auto 	20141119
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-11-2014
Ran by Peter (administrator) on PC3A on 19-11-2014 12:37:05
Running from C:\Users\Peter\Downloads
Loaded Profile: Peter (Available profiles: Peter & xpmuser & Gast)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices) C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\BBSvc.EXE
(HP) C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\HP\Digital Imaging\Fax\Fax Driver 0.6 Base\hppfaxprintersrv.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Hewlett-Packard Company) C:\Program Files (x86)\HP\StatusAlerts\bin\HPStatusAlerts.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
() C:\Users\Peter\AppData\Roaming\install\server.exe
(Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\System32\WerFault.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [HP LaserJet 200 color MFP M276 Series Fax] => C:\Program Files (x86)\HP\Digital Imaging\Fax\Fax Driver 0.6 Base\hppfaxprintersrv.exe [3706424 2011-10-09] (Hewlett-Packard Company)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-01-26] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StatusAlerts] => C:\Program Files (x86)\HP\StatusAlerts\bin\HPStatusAlerts.exe [313248 2012-07-18] (Hewlett-Packard Company)
HKU\S-1-5-21-4052085264-2727961840-2346101326-1000\...\Run: [HKCU] => C:\Users\Peter\AppData\Roaming\install\server.exe [85142268 2012-04-13] ()
HKU\S-1-5-21-4052085264-2727961840-2346101326-1000\...\Run: [giaguwho.exe] => C:\Users\Peter\AppData\Roaming\Identities\giaguwho.exe [180292 2009-07-14] ()
HKU\S-1-5-21-4052085264-2727961840-2346101326-1000\...\MountPoints2: {1b116999-9ab9-11e3-b7e7-1c6f65bfde9b} - J:\LaunchU3.exe -a
HKU\S-1-5-21-4052085264-2727961840-2346101326-1000\...\MountPoints2: {5d26aba4-1f56-11e2-b914-1c6f65bfde9b} - J:\IronKey.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-4052085264-2727961840-2346101326-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://192.168.1.201/
HKU\S-1-5-21-4052085264-2727961840-2346101326-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-4052085264-2727961840-2346101326-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xF00F5E0D5566CD01
HKU\S-1-5-21-4052085264-2727961840-2346101326-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
URLSearchHook: HKCU - (No Name) - {d46d0a6c-fab1-45a4-997e-030450e41de5} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\BingExt.dll (Microsoft Corporation.)
Tcpip\..\Interfaces\{8DE01DE1-2EEC-4BDA-8440-038CD8864F01}: [NameServer] 192.168.1.123

FireFox:
========
FF ProfilePath: C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\bj8vt4fd.default-1355396150825
FF Homepage: https://www.google.de/
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: RSS Ticker - C:\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\bj8vt4fd.default-1355396150825\Extensions\{1f91cde0-c040-11da-a94d-0800200c9a66}.xpi [2014-03-21]

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD Reservation Manager; C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [194496 2010-06-17] (Advanced Micro Devices)
S3 HP DS Service; C:\Program Files (x86)\HP\HPBDSService\HPBDSService.exe [13824 2011-10-17] (Hewlett-Packard Company) [File not signed]
R2 HP LaserJet Service; C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [164864 2012-05-02] (HP) [File not signed]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [50688 2011-04-13] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [66048 2011-04-13] (Hewlett-Packard) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [19968 2009-07-14] (Microsoft Corporation)
S3 motmodem; system32\DRIVERS\motmodem.sys [X]
S3 MSICDSetup; \??\E:\CDriver64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-19 12:37 - 2014-11-19 12:37 - 00008249 _____ () C:\Users\Peter\Downloads\FRST.txt
2014-11-19 12:36 - 2014-11-19 12:37 - 00000000 ____D () C:\FRST
2014-11-19 12:36 - 2014-11-19 12:36 - 02117120 _____ (Farbar) C:\Users\Peter\Downloads\FRST64.exe
2014-11-19 12:34 - 2014-11-19 12:34 - 00050477 _____ () C:\Users\Peter\Downloads\Defogger.exe
2014-11-19 12:34 - 2014-11-19 12:34 - 00000472 _____ () C:\Users\Peter\Downloads\defogger_disable.log
2014-11-19 12:34 - 2014-11-19 12:34 - 00000000 _____ () C:\Users\Peter\defogger_reenable
2014-11-19 10:21 - 2014-11-19 10:21 - 00000000 ____D () C:\Users\Peter\AppData\Local\GHISLER
2014-11-19 10:14 - 2014-11-19 10:14 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\Hewlett-Packard Company
2014-11-19 09:54 - 2014-11-19 09:54 - 00000000 ____D () C:\Users\Peter\AppData\Roaming\Thinstall
2014-11-11 12:00 - 2014-11-11 12:00 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-10-31 09:56 - 2014-10-31 09:56 - 00001030 _____ () C:\Users\Peter\Desktop\tischlerei material 2013.lnk

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-19 12:36 - 2011-04-12 08:43 - 00656044 _____ () C:\Windows\system32\perfh007.dat
2014-11-19 12:36 - 2011-04-12 08:43 - 00130676 _____ () C:\Windows\system32\perfc007.dat
2014-11-19 12:36 - 2009-07-14 06:13 - 01498742 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-19 12:34 - 2011-12-21 12:56 - 01457010 _____ () C:\Windows\WindowsUpdate.log
2014-11-19 12:34 - 2011-12-21 12:56 - 00000000 ____D () C:\Users\Peter
2014-11-19 12:31 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-19 12:31 - 2009-07-14 05:51 - 00082879 _____ () C:\Windows\setupact.log
2014-11-19 12:25 - 2005-04-08 03:16 - 02502333 ____H () C:\Users\Peter\AppData\Roaming\Peterlog.dat
2014-11-19 10:28 - 2012-04-24 10:45 - 00003914 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{A2EB4234-0025-484D-A985-B4E893DB728C}
2014-11-19 10:14 - 2012-05-07 06:17 - 00084592 _____ () C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-19 10:14 - 2012-05-07 06:17 - 00000000 ___RD () C:\Users\Gast\Virtual Machines
2014-11-19 09:16 - 2014-10-14 07:32 - 00000615 _____ () C:\Users\Peter\AppData\Roaming\bietermodul.ini
2014-11-19 08:21 - 2011-12-21 13:23 - 00000000 ___RD () C:\Users\Peter\Virtual Machines
2014-11-19 07:13 - 2013-06-14 07:27 - 00270336 _____ () C:\Users\Peter\Desktop\Diesel.xls
2014-11-19 06:39 - 2009-07-14 05:45 - 00022096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-19 06:39 - 2009-07-14 05:45 - 00022096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-18 07:48 - 2012-05-02 14:21 - 00025600 _____ () C:\Users\Peter\Desktop\Zeitvertrag.xls
2014-11-12 06:40 - 2012-05-03 05:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-10-31 09:56 - 2012-12-18 10:13 - 00000968 _____ () C:\Users\Peter\Desktop\tischlerei material 2014.lnk
2014-10-28 05:34 - 2010-11-21 04:27 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-27 09:03 - 2012-07-13 10:43 - 00000000 ____D () C:\Users\Peter\Desktop\Formulare

Files to move or delete:
====================
C:\Users\Peter\avasign_update.exe


Some content of TEMP:
====================
C:\Users\Peter\AppData\Local\Temp\20392uninstall.exe
C:\Users\Peter\AppData\Local\Temp\AskPIP_FF_.exe
C:\Users\Peter\AppData\Local\Temp\AskSLib.dll
C:\Users\Peter\AppData\Local\Temp\contentDATs.exe
C:\Users\Peter\AppData\Local\Temp\FreemakeVideoConverter_4.1.2.2.exe
C:\Users\Peter\AppData\Local\Temp\MSIAFTERBURNERSETUP.EXE
C:\Users\Peter\AppData\Local\Temp\ose00000.exe
C:\Users\Peter\AppData\Local\Temp\Quarantine.exe
C:\Users\Peter\AppData\Local\Temp\rechnung_11_2014_3280000236_telekom_de_002839300002_11_0000352899_000005.exe
C:\Users\Peter\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\Peter\AppData\Local\Temp\SETUP_AFTERBURNER.EXE
C:\Users\Peter\AppData\Local\Temp\Sqlite3.dll
C:\Users\Peter\AppData\Local\Temp\tbmySy.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-17 08:25

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-11-2014
Ran by Peter at 2014-11-19 12:37:49
Running from C:\Users\Peter\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 8.2.4 - Hewlett-Packard) Hidden
Adobe Reader X (10.1.12) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
ATI AVIVO64 Codecs (Version: 11.6.0.10126 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{7DE8BAC9-CAF4-FFAD-081A-6D74412E28A6}) (Version: 3.0.812.0 - ATI Technologies, Inc.)
ava-sign 4.5.2.2040                                        - (HKLM\...\ava-sign 4.5.2.2040_is1) (Version: 4.5.2.2040 - RIB Software AG)
ava-sign 4.6.2.2082                                        - (HKLM\...\ava-sign 4.6.2.2082_is1) (Version: 4.6.2.2082 - RIB Software AG)
Bing Bar (HKLM-x32\...\{3611CA6C-5FCA-4900-A329-6A118123CCFC}) (Version: 7.1.355.0 - Microsoft Corporation)
ccc-core-static (x32 Version: 2011.0126.1749.31909 - Ihr Firmenname) Hidden
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4478 - CDBurnerXP)
Easy 7-Zip v0.1 (HKLM\...\{661BB54F-5E4A-45F0-8153-DDF10C2E3FB7}_is1) (Version: 0.1 - James Hoo)
Foxit Reader 5.1 (HKLM-x32\...\Foxit Reader_is1) (Version: 5.1.3.1201 - Foxit Corporation)
Free Video Converter V 3.2 (HKLM-x32\...\Free Video Converter_is1) (Version: 3.2.0.0 - Koyote Soft)
HP LaserJet 200 color MFP M276 (HKLM-x32\...\{CC38C23C-7824-4DBB-AC73-997CD0BBFEC7}) (Version: 5.0.12201.1116 - Hewlett-Packard)
hpbDSService (x32 Version: 002.002.07399 - Hewlett-Packard) Hidden
hpbM276DSService (x32 Version: 001.001.05874 - Hewlett-Packard) Hidden
HPDXP (x32 Version: 3.0.26.8 - HP) Hidden
HPLaserJet200color-MFPM276_HelpLearnCenter_SI (HKLM-x32\...\{0F044C7A-6EE1-4F03-90AC-329AAF2FCF12}) (Version: 1.01.0000 - Hewlett-Packard)
HPLJDXPHelper (x32 Version: 020.021.004 - HP) Hidden
HPLJUTCore (x32 Version: 004.005.0001 - HP) Hidden
HPLJUTM276 (x32 Version: 3.00.0003 - HP) Hidden
hppFaxDrvM276 (x32 Version: 003.000.00002 - Hewlett-Packard) Hidden
hppLaserJetService (x32 Version: 009.027.00856 - Hewlett-Packard) Hidden
hppM276LaserJetService (x32 Version: 001.019.00639 - Hewlett-Packard) Hidden
hppSendFaxM276 (x32 Version: 003.000.00002 - Hewlett-Packard) Hidden
hpStatusAlerts (x32 Version: 050.037.00142 - Hewlett Packard) Hidden
hpStatusAlertsM276 (x32 Version: 050.034.00131 - Hewlett-Packard) Hidden
HydraVision (x32 Version: 4.2.184.0 - ATI Technologies Inc.) Hidden
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
LJDXPHelperUI (x32 Version: 020.021.004 - HP) Hidden
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Mozilla Firefox 33.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.1 (x86 de)) (Version: 33.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
Mozilla Thunderbird 24.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.6.0 (x86 de)) (Version: 24.6.0 - Mozilla)
MSI Afterburner 2.1.0 (HKLM-x32\...\Afterburner) (Version: 2.1.0 - MSI Co., LTD)
RUBiN-HWP® 8.40 (HKLM-x32\...\RUBiN-HWP® 8.40) (Version: 8.40.0.0 - RUBiN Software)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.3.2300.0 - SAMSUNG Electronics Co., Ltd.)
Technische Baubestimmungen 08-2012 (HKLM-x32\...\Technische Baubestimmungen_is1) (Version:  - )
Video Converter Packages (HKU\S-1-5-21-4052085264-2727961840-2346101326-1000\...\Video Converter Packages) (Version:  - ) <==== ATTENTION
Welcome Home To Windows Phone Version 2.0 (HKLM-x32\...\{4B5EBB2A-A55C-40E9-A48F-AEBFBAA90EC1}_is1) (Version: 2.0 - )
Windows XP Mode (HKLM\...\{1374CC63-B520-4f3f-98E8-E9020BF01CFF}) (Version: 1.3.7600.16422 - Microsoft Corporation)
WMV9/VC-1 Video Playback (Version: 1.00.0000 - ATI Technologies Inc.) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

07-10-2014 08:46:58 Geplanter Prüfpunkt
15-10-2014 07:00:54 Geplanter Prüfpunkt
17-10-2014 04:30:37 Windows Update
22-10-2014 04:34:31 Windows Update
29-10-2014 10:00:43 Geplanter Prüfpunkt
05-11-2014 05:30:25 Windows Update
09-11-2014 08:55:40 Windows Update
18-11-2014 09:44:47 Geplanter Prüfpunkt

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {2BA631D5-4AB7-4CAD-AB5A-723E02DE55E8} - System32\Tasks\{19D09D9C-2BEF-4827-BD6B-2FE5264D7C77} => D:\CRKASSE4\MENUE.exe [2008-05-15] ()
Task: {3172F2E3-075B-4910-B000-DF11F805866A} - System32\Tasks\{AC68B6EA-0F53-4ED0-8F73-C2D5519A8211} => D:\CRKASSE4\MENUE.exe [2008-05-15] ()
Task: {96CAEA7B-3278-4EFA-8DF5-771CDF3944A9} - System32\Tasks\HP AR Program Upload - 148df8a2dbab4352aba4e222a7290faa94b80075a66842ba8eb086a6e2dade8f => C:\Program Files\HP\HP Officejet Pro 8600\bin\HPRewards.exe
Task: {CF7D0FD3-AE19-4AA8-8582-B1477D8DBB18} - System32\Tasks\HPLJCustParticipation => C:\Program Files (x86)\HP\HPLJUT\HPLJUTSCH.exe [2012-06-14] (Hewlett Packard)
Task: {F038258B-D057-4D98-B0CD-F9E07A6D59A9} - System32\Tasks\{C9803A09-86F6-4D5C-A489-F100E1D0A1E3} => D:\CRKASSE4\MENUE.exe [2008-05-15] ()
Task: {F8FBC6EC-3079-457F-9698-A73062ACA36C} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc

==================== Loaded Modules (whitelisted) =============

2012-10-29 09:54 - 2012-04-13 00:13 - 85142268 _____ () C:\Users\Peter\AppData\Roaming\install\server.exe
2011-01-26 17:48 - 2011-01-26 17:48 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-11-11 12:00 - 2014-11-11 12:00 - 03649648 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Peter\Desktop\Möbelfertigteile für Tischler- & Schreinerprofis - Top Leistungen zu unschlagbaren Konditionen - ...noch heute anfragen - http _fertigteile.mk-objekt.de - HOTLINE 05238 - 1360.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-4052085264-2727961840-2346101326-500 - Administrator - Disabled)
Gast (S-1-5-21-4052085264-2727961840-2346101326-501 - Limited - Enabled) => C:\Users\Gast
Peter (S-1-5-21-4052085264-2727961840-2346101326-1000 - Administrator - Enabled) => C:\Users\Peter
xpmuser (S-1-5-21-4052085264-2727961840-2346101326-1002 - Administrator - Enabled) => C:\Users\xpmuser

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/19/2014 00:33:34 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/19/2014 00:32:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: CCC.exe, Version: 3.5.0.0, Zeitstempel: 0x4ca242ed
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e
Ausnahmecode: 0xc0000409
Fehleroffset: 0x00000000001478d0
ID des fehlerhaften Prozesses: 0x870
Startzeit der fehlerhaften Anwendung: 0xCCC.exe0
Pfad der fehlerhaften Anwendung: CCC.exe1
Pfad des fehlerhaften Moduls: CCC.exe2
Berichtskennung: CCC.exe3

Error: (11/19/2014 10:47:29 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: procexp64.exe, Version: 16.4.0.0, Zeitstempel: 0x5404afa3
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000146a40
ID des fehlerhaften Prozesses: 0xbc
Startzeit der fehlerhaften Anwendung: 0xprocexp64.exe0
Pfad der fehlerhaften Anwendung: procexp64.exe1
Pfad des fehlerhaften Moduls: procexp64.exe2
Berichtskennung: procexp64.exe3

Error: (11/19/2014 09:55:01 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: X-Ways Forensics.exe, Version: 11.6.5.0, Zeitstempel: 0x2a425e19
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x021bea5f
ID des fehlerhaften Prozesses: 0x11e8
Startzeit der fehlerhaften Anwendung: 0xX-Ways Forensics.exe0
Pfad der fehlerhaften Anwendung: X-Ways Forensics.exe1
Pfad des fehlerhaften Moduls: X-Ways Forensics.exe2
Berichtskennung: X-Ways Forensics.exe3

Error: (11/19/2014 08:58:46 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 33.1.0.5423, Zeitstempel: 0x545c0a37
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x003e5c2d
ID des fehlerhaften Prozesses: 0x11f8
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3

Error: (11/19/2014 07:49:01 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: vmsal.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b30f
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000156a6a
ID des fehlerhaften Prozesses: 0x1148
Startzeit der fehlerhaften Anwendung: 0xvmsal.exe0
Pfad der fehlerhaften Anwendung: vmsal.exe1
Pfad des fehlerhaften Moduls: vmsal.exe2
Berichtskennung: vmsal.exe3

Error: (11/19/2014 07:48:39 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: vmsal.exe, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b30f
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec4aa8e
Ausnahmecode: 0xc0000374
Fehleroffset: 0x00000000000c40f2
ID des fehlerhaften Prozesses: 0x107c
Startzeit der fehlerhaften Anwendung: 0xvmsal.exe0
Pfad der fehlerhaften Anwendung: vmsal.exe1
Pfad des fehlerhaften Moduls: vmsal.exe2
Berichtskennung: vmsal.exe3

Error: (11/19/2014 06:34:00 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/18/2014 11:39:33 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: thunderbird.exe, Version: 24.6.0.5274, Zeitstempel: 0x5396c4a8
Name des fehlerhaften Moduls: xul.dll, Version: 24.6.0.5274, Zeitstempel: 0x5396c38c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00a4970d
ID des fehlerhaften Prozesses: 0x1084
Startzeit der fehlerhaften Anwendung: 0xthunderbird.exe0
Pfad der fehlerhaften Anwendung: thunderbird.exe1
Pfad des fehlerhaften Moduls: thunderbird.exe2
Berichtskennung: thunderbird.exe3

Error: (11/18/2014 06:38:38 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (11/17/2014 08:44:14 AM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "VIRTUALXP",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{8DE01DE1-2EEC-4BDA-8440-038CD8864F01}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (11/14/2014 08:21:18 AM) (Source: Microsoft-Windows-HAL) (EventID: 12) (User: )
Description: Der Speicher wurde beim letzten Leistungsübergang des Systems von der Plattformfirmware beschädigt. Überprüfen Sie, ob für Ihr System aktualisierte Firmware verfügbar ist.

Error: (11/14/2014 07:29:07 AM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "VIRTUALXP",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{8DE01DE1-2EEC-4BDA-8440-038CD8864F01}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (11/13/2014 06:45:52 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.

Error: (11/13/2014 06:45:51 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.

Error: (11/13/2014 06:44:11 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.

Error: (11/13/2014 06:44:11 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.

Error: (11/11/2014 08:25:47 AM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "VIRTUALXP",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{8DE01DE1-2EEC-4BDA-8440-038CD8864F01}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (11/10/2014 08:59:07 AM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "VIRTUALXP",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{8DE01DE1-2EEC-4BDA-8440-038CD8864F01}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (11/07/2014 00:34:25 PM) (Source: Microsoft-Windows-HAL) (EventID: 12) (User: )
Description: Der Speicher wurde beim letzten Leistungsübergang des Systems von der Plattformfirmware beschädigt. Überprüfen Sie, ob für Ihr System aktualisierte Firmware verfügbar ist.


Microsoft Office Sessions:
=========================
Error: (11/19/2014 00:33:34 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/19/2014 00:32:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: CCC.exe3.5.0.04ca242edntdll.dll6.1.7601.177254ec4aa8ec000040900000000001478d087001d003ec7342c040C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exeC:\Windows\SYSTEM32\ntdll.dllbe5cc350-6fdf-11e4-87ac-1c6f65bfde9b

Error: (11/19/2014 10:47:29 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: procexp64.exe16.4.0.05404afa3unknown0.0.0.000000000c00000050000000000146a40bc01d003ddd546d448C:\Users\Peter\AppData\Local\Temp\ProcessExplorerPortableTemp\procexp64.exeunknown130d8e48-6fd1-11e4-b60b-1c6f65bfde9b

Error: (11/19/2014 09:55:01 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: X-Ways Forensics.exe11.6.5.02a425e19unknown0.0.0.000000000c0000005021bea5f11e801d003d67dd10398J:\specialApps\Datenanalyse\X-WAYS\X-Ways Forensics.exeunknownbeb9ecf8-6fc9-11e4-b60b-1c6f65bfde9b

Error: (11/19/2014 08:58:46 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: firefox.exe33.1.0.5423545c0a37unknown0.0.0.000000000c0000005003e5c2d11f801d003cea3d59818C:\Program Files (x86)\Mozilla Firefox\firefox.exeunknowne316ccb8-6fc1-11e4-b60b-1c6f65bfde9b

Error: (11/19/2014 07:49:01 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: vmsal.exe6.1.7601.175144ce7b30funknown0.0.0.000000000c00000050000000000156a6a114801d003c4e6c54268C:\Windows\System32\vmsal.exeunknown247a6868-6fb8-11e4-b60b-1c6f65bfde9b

Error: (11/19/2014 07:48:39 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: vmsal.exe6.1.7601.175144ce7b30fntdll.dll6.1.7601.177254ec4aa8ec000037400000000000c40f2107c01d003c4d8c3bfc8C:\Windows\System32\vmsal.exeC:\Windows\SYSTEM32\ntdll.dll1787e4c8-6fb8-11e4-b60b-1c6f65bfde9b

Error: (11/19/2014 06:34:00 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (11/18/2014 11:39:33 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: thunderbird.exe24.6.0.52745396c4a8xul.dll24.6.0.52745396c38cc000000500a4970d108401d0031bef6cd40cC:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exeC:\Program Files (x86)\Mozilla Thunderbird\xul.dll2e85b85c-6f0f-11e4-b62d-1c6f65bfde9b

Error: (11/18/2014 06:38:38 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Processor: AMD Athlon(tm) II X2 250 Processor
Percentage of memory in use: 28%
Total physical RAM: 4094.46 MB
Available physical RAM: 2924.21 MB
Total Pagefile: 8187.12 MB
Available Pagefile: 6798.49 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:1201.95 GB) (Free:1091.09 GB) NTFS
Drive d: () (Fixed) (Total:195.21 GB) (Free:194.46 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1397.3 GB) (Disk ID: 09523028)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=195.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=1202 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-11-19 13:08:32
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000005c Hitachi_ rev.ML5O 1397,27GB
Running: Gmer-19357.exe; Driver: C:\Users\Peter\AppData\Local\Temp\pxldapow.sys


---- User code sections - GMER 2.1 ----

.text    C:\Windows\system32\taskhost.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                            0000000077747a90 5 bytes JMP 0000000137730158
.text    C:\Windows\system32\taskhost.exe[2468] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread                                                        0000000077771830 8 bytes JMP 0000000137760158
.text    C:\Windows\system32\Dwm.exe[2648] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                 0000000077747a90 5 bytes JMP 0000000137730158
.text    C:\Windows\system32\Dwm.exe[2648] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread                                                             0000000077771830 8 bytes JMP 0000000137760158
.text    C:\Windows\Explorer.EXE[2672] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                     0000000077747a90 5 bytes JMP 0000000137730158
.text    C:\Windows\Explorer.EXE[2672] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread                                                                 0000000077771830 8 bytes JMP 0000000137760158
.text    C:\Program Files (x86)\HP\Digital Imaging\Fax\Fax Driver 0.6 Base\hppfaxprintersrv.exe[2764] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll      0000000077747a90 5 bytes JMP 0000000137730158
.text    C:\Program Files (x86)\HP\Digital Imaging\Fax\Fax Driver 0.6 Base\hppfaxprintersrv.exe[2764] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread  0000000077771830 8 bytes JMP 0000000137760158
.text    C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[2848] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                               0000000077747a90 5 bytes JMP 0000000137730158
.text    C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[2848] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread                           0000000077771830 8 bytes JMP 0000000137760158
.text    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2956] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                          0000000077920048 5 bytes JMP 000000010098e1e0
.text    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2956] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                              000000007793c45a 5 bytes JMP 00000001009a1af0
.text    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2956] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69               00000000750a1465 2 bytes [0A, 75]
.text    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2956] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155              00000000750a14bb 2 bytes [0A, 75]
.text    ...                                                                                                                                        * 2
.text    C:\Program Files (x86)\HP\StatusAlerts\bin\HPStatusAlerts.exe[2964] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                           0000000077920048 5 bytes JMP 000000010075e1e0
.text    C:\Program Files (x86)\HP\StatusAlerts\bin\HPStatusAlerts.exe[2964] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                               000000007793c45a 5 bytes JMP 0000000100951af0
.text    C:\Program Files (x86)\HP\StatusAlerts\bin\HPStatusAlerts.exe[2964] C:\Windows\syswow64\WS2_32.dll!closesocket                             0000000075473918 5 bytes JMP 000000010095c020
.text    C:\Program Files (x86)\HP\StatusAlerts\bin\HPStatusAlerts.exe[2964] C:\Windows\syswow64\WS2_32.dll!WSASend                                 0000000075474406 5 bytes JMP 000000010095bf30
.text    C:\Program Files (x86)\HP\StatusAlerts\bin\HPStatusAlerts.exe[2964] C:\Windows\syswow64\WS2_32.dll!connect                                 0000000075476bdd 5 bytes JMP 000000010095bee0
.text    C:\Program Files (x86)\HP\StatusAlerts\bin\HPStatusAlerts.exe[2964] C:\Windows\syswow64\WS2_32.dll!send                                    0000000075476f01 5 bytes JMP 000000010095bfc0
.text    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2996] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                         0000000077747a90 5 bytes JMP 0000000137730158
.text    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2996] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread                     0000000077771830 8 bytes JMP 0000000137760158
.text    C:\Program Files (x86)\Internet Explorer\iexplore.exe[2164] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                                   0000000077920048 5 bytes JMP 000000010012e1e0
.text    C:\Program Files (x86)\Internet Explorer\iexplore.exe[2164] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                       000000007793c45a 5 bytes JMP 00000001002e1af0
.text    C:\Users\Peter\AppData\Roaming\install\server.exe[2492] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                                       0000000077920048 5 bytes JMP 00000001001be1e0
.text    C:\Users\Peter\AppData\Roaming\install\server.exe[2492] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                           000000007793c45a 5 bytes JMP 0000000100241af0
.text    C:\Users\Peter\AppData\Roaming\install\server.exe[2492] C:\Windows\syswow64\WS2_32.dll!closesocket                                         0000000075473918 5 bytes JMP 000000010024c020
.text    C:\Users\Peter\AppData\Roaming\install\server.exe[2492] C:\Windows\syswow64\WS2_32.dll!WSASend                                             0000000075474406 5 bytes JMP 000000010024bf30
.text    C:\Users\Peter\AppData\Roaming\install\server.exe[2492] C:\Windows\syswow64\WS2_32.dll!connect                                             0000000075476bdd 5 bytes JMP 000000010024bee0
.text    C:\Users\Peter\AppData\Roaming\install\server.exe[2492] C:\Windows\syswow64\WS2_32.dll!send                                                0000000075476f01 5 bytes JMP 000000010024bfc0
.text    C:\Windows\SysWOW64\explorer.exe[2904] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread                                                        0000000077920048 5 bytes JMP 00000001000be1e0
.text    C:\Windows\SysWOW64\explorer.exe[2904] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                            000000007793c45a 5 bytes JMP 00000001002c1af0
.text    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3688] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                         0000000077747a90 5 bytes JMP 0000000137730158
.text    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3688] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread                     0000000077771830 8 bytes JMP 0000000137760158

---- Threads - GMER 2.1 ----

Thread   C:\Windows\system32\taskhost.exe [2468:2256]                                                                                               00000000021dc5a0
Thread   C:\Windows\system32\taskhost.exe [2468:264]                                                                                                00000000021dced0
Thread   C:\Windows\system32\taskhost.exe [2468:2340]                                                                                               0000000002274230
Thread   C:\Windows\system32\Dwm.exe [2648:2252]                                                                                                    0000000001d8c5a0
Thread   C:\Windows\system32\Dwm.exe [2648:2332]                                                                                                    0000000001d8ced0
Thread   C:\Windows\system32\Dwm.exe [2648:2328]                                                                                                    0000000001f34230
Thread   C:\Windows\Explorer.EXE [2672:2196]                                                                                                        00000000046ec5a0
Thread   C:\Windows\Explorer.EXE [2672:2212]                                                                                                        00000000046eced0
Thread   C:\Windows\Explorer.EXE [2672:2208]                                                                                                        00000000046ee400
Thread   C:\Windows\Explorer.EXE [2672:2224]                                                                                                        0000000004704230
Thread   C:\Windows\Explorer.EXE [2672:2220]                                                                                                        000000000470aaf0
Thread   C:\Windows\Explorer.EXE [2672:2216]                                                                                                        0000000004701c00
Thread   C:\Program Files (x86)\Internet Explorer\iexplore.exe [2164:2384]                                                                          000000000012dd80
Thread   C:\Program Files (x86)\Internet Explorer\iexplore.exe [2164:2596]                                                                          000000000012e560
Thread   C:\Program Files (x86)\Internet Explorer\iexplore.exe [2164:2568]                                                                          00000000002e3060
Thread   C:\Windows\SysWOW64\explorer.exe [2904:1156]                                                                                               00000000000a0000
Thread   C:\Windows\SysWOW64\explorer.exe [2904:2540]                                                                                               0000000000100000
Thread   C:\Windows\SysWOW64\explorer.exe [2904:2816]                                                                                               00000000000bdd80
Thread   C:\Windows\SysWOW64\explorer.exe [2904:1012]                                                                                               00000000000be560
Thread   C:\Windows\SysWOW64\explorer.exe [2904:2412]                                                                                               00000000000bf200
Thread   C:\Windows\SysWOW64\explorer.exe [2904:2388]                                                                                               00000000002c3060
Thread   C:\Windows\SysWOW64\explorer.exe [2904:1088]                                                                                               00000000002caf80
Thread   C:\Windows\SysWOW64\explorer.exe [2904:1384]                                                                                               00000000002c16f0
Thread   C:\Windows\System32\svchost.exe [1868:3052]                                                                                                000007feebfc9688
Thread   C:\Windows\splwow64.exe [3308:3428]                                                                                                        000000000005c5a0
Thread   C:\Windows\splwow64.exe [3308:1872]                                                                                                        000000000005ced0
Thread   C:\Windows\splwow64.exe [3308:3388]                                                                                                        0000000000184230
---- Processes - GMER 2.1 ----

Process  C:\Users\Peter\AppData\Roaming\install\server.exe (*** suspicious ***) @ C:\Users\Peter\AppData\Roaming\install\server.exe [2492](2        0000000000400000

---- EOF - GMER 2.1 ----