| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Browser öffnet Seiten von alleine und Windows Hostprozess konnte nicht ausgeführt werdenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
30.10.2010, 23:04
| #1 |
 |  Browser öffnet Seiten von alleine und Windows Hostprozess konnte nicht ausgeführt werden Hallo, ich habe seit einiger Zeit das Problem, dass sich Seiten im Browser von alleine öffnen. Es sind jedesmal andere Seiten und in der Eingabeleiste wechselt die Adresse mehrere mal bis sich dann eine öffnet. Außerdem hab ich seit kurzem das Problem, dass wenn ich den Pc anschalte und auf meinen Benutzer drücke, es anfängt zu laden, dann aber der Bildschirm schwarz wird. Dann kann ich nur noch über den Taskmanager neu starten. Und wenn ich einen Browser öffnen will kommt manchmal nur kurz die Sanduhr aber es passiert nichts. Wenn ich dann im Taskmanager meine Prozesse anschaue steht da der Browser drin, aber nur mit einem geringen Arbeitsspeicher angegeben. Wenn ich dann diese Prozesse beende geht der Browser wieder. Außerdem kommt manchmal die Meldung Windows Hostprozess konnte nicht ausgeführt werden. Avira, Spybot und Malwarebytes haben nichts gefunden. Ich habe Vista 32-bit mit den neuesten Updates. Ich weiß das ist viel, aber ich hoffe mir kann hier jemand helfen, denn ich bin mit meinem Latein am Ende. Vielen Dank im voraus. |
|
31.10.2010, 04:52
| #2 | ||||
| /// Helfer-Team    |  Browser öffnet Seiten von alleine und Windows Hostprozess konnte nicht ausgeführt werden Hallo und Herzlich Willkommen!
__________________ Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]: Zitat:
Zitat:
Zitat:
(drücke beim Hochfahren des Rechners [F8] solange, bis du eine Auswahlmöglichkeit hast, da "abgesicherten Modus " wählen) - Berichte ob die SWH funktioniert hat, bzw ob Du das System auf einen früheren Wiederherstellungspunkt zurückstellen können? ► Da die SWH nur ein Notlösung ist und/oder die Systemwiederherstellung ist nicht durchführbar, arbeite die aufgeführten Schritte bitte vollständig ab: 1. - Lade dir RSIT - Random's System Information Tool (RSIT) von random/random herunter - an einen Ort deiner Wahl und führe die rsit.exe aus - wird "Hijackthis" auch von RSIT installiert und ausgeführt - RSIT erstellt 2 Logfiles (C:\rsit\log.txt und C:\rsit\info.txt) mit erweiterten Infos von deinem System - diese beide bitte komplett hier posten 2. Bitte Versteckte - und Systemdateien sichtbar machen den Link hier anklicken: System-Dateien und -Ordner unter XP und Vista sichtbar machen Am Ende unserer Arbeit, kannst wieder rückgängig machen! 3. → Lade Dir HJTscanlist.zip herunter → entpacke die Datei auf deinem Desktop → Bei WindowsXP Home musst vor dem Scan zusätzlich tasklist.zip installieren → per Doppelklick starten → Wähle dein Betriebsystem aus - bei Win7 wähle Vista → Wenn Du gefragt wirst, die Option "Einstellung" (1) - scanlist" wählen → Nach kurzer Zeit sollte sich Dein Editor öffnen und die Datei hjtscanlist.txt präsentieren → Bitte kopiere den Inhalt hier in Deinen Thread. 4. Ich würde gerne noch all deine installierten Programme sehen: Lade dir das Tool "Ccleaner" herunter installieren (Software-Lizenzvereinbarung lesen, falls angeboten wird "Füge CCleaner Yahoo! Toolbar hinzu" abwählen)→ starten→ falls nötig - unter Options settings-> "german" einstellen dann klick auf "Extra (um die installierten Programme auch anzuzeigen)→ weiter auf "Als Textdatei speichern..." wird eine Textdatei (*.txt) erstellt, kopiere dazu den Inhalt und füge ihn da ein 5. läuft unter XP, Vista mit (32Bit) und Windows 7 (32Bit) Achtung!: WENN GMER NICHT AUSGEFÜHRT WERDEN KANN ODER PROBMLEME VERURSACHT, fahre mit dem nächsten Punkt fort!- Es ist NICHT sinnvoll einen zweiten Versuch zu starten! Um einen tieferen Einblick in dein System, um eine mögliche Infektion mit einem Rootkit/Info v.wikipedia.org) aufzuspüren, werden wir ein Tool - Gmer - einsetzen :
** keine Verbindung zu einem Netzwerk und Internet - WLAN nicht vergessen Wenn der Scan beendet ist, bitte alle Programme und Tools wieder aktivieren! 6. läuft unter XP, Vista mit (32Bit) und Windows 7 (32Bit) Lade und installiere das Tool RootRepeal herunter
Zitat:
** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw grußCoverflow |
|
31.10.2010, 14:11
| #3 |
| | Browser öffnet Seiten von alleine und Windows Hostprozess konnte nicht ausgeführt werden Hi,
__________________danke für die schnelle Antwort! Das mit der Systemwiederherstellung geht leider nicht, da das ausgeschaltet war und ich keine gespeicherten Punkte habe. hier zu 1. info.txtRSIT Logfile: Code:
ATTFilter logfile of random's system information tool 1.08 2010-10-31 10:01:39
======Uninstall list======
-->MsiExec /X{5DB65884-C963-4454-AABA-4CA3089281FA}
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2638924D-DC58-4C40-BB1C-48C2B24B7B1B}\Setup.exe" -L0x7
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{52739387-B81C-4C55-9593-EB7A1044A657}\Setup.exe" -L0x7
ActiveCheck component for HP Active Support Library-->MsiExec.exe /X{254C37AA-6B72-4300-84F6-98A82419187E}
Adobe Download Manager-->"C:\Windows\system32\rundll32.exe" "C:\Program Files\NOS\bin\getPlus_Helper_3004.dll",Uninstall /IE2883E8F-472F-4fb0-9522-AC9BF37916A7 /Get1
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\FlashUtil10k_Plugin.exe -maintain plugin
Adobe Reader 9.4.0 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A94000000001}
Adobe Shockwave Player 11.5-->"C:\Windows\system32\Adobe\Shockwave 11\uninstaller.exe"
Apple Application Support-->MsiExec.exe /I{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}
Apple Mobile Device Support-->MsiExec.exe /I{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Auto Shutdown 8.11-->"E:\programme\8.11\unins000.exe"
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
AVS Update Manager 1.0-->"C:\Program Files\AVS4YOU\AVSUpdateManager\unins000.exe"
AVS Video Converter 6-->"E:\programme\AVSVideoConverter6\unins000.exe"
AVS4YOU Software Navigator 1.3-->"C:\Program Files\AVS4YOU\AVSSoftwareNavigator\unins000.exe"
CCleaner-->"E:\programme\CCleaner\uninst.exe"
Defraggler-->"E:\programme\uninst.exe"
DivX-Setup-->C:\ProgramData\DivX\Setup\DivXSetup.exe /uninstall /bundleGroupId divx.com
DVD Flick 1.3.0.7-->"E:\programme\DVD Flick\unins000.exe"
EASEUS Partition Master 5.0.1 Home Edition-->"C:\Program Files\EASEUS\EASEUS Partition Master 5.0.1 Home Edition\unins000.exe"
Free Audio CD Burner version 1.4-->"C:\Program Files\DVDVideoSoft\Free Audio CD Burner\unins000.exe"
Free DVD Video Burner version 2.1-->"C:\Program Files\DVDVideoSoft\Free DVD Video Burner\unins000.exe"
Free Video to DVD Converter version 1.2-->"E:\programme\Free Video to DVD Converter\unins000.exe"
Free Video to iPhone Converter version 3.0-->"C:\Program Files\DVDVideoSoft\Free Video to iPhone Converter\unins000.exe"
Free Video to MP3 Converter version 4.0-->"E:\programme\Free Video to MP3 Converter\unins000.exe"
Free YouTube to iPhone Converter version 2.5-->"E:\programme\Free YouTube to iPhone Converter\unins000.exe"
Free YouTube to MP3 Converter version 3.8-->"C:\Program Files\DVDVideoSoft\Free YouTube to MP3 Converter\unins000.exe"
GIMP 2.6.8-->"C:\Program Files\GIMP-2.0\setup\unins000.exe"
Glary Utilities 2.29.0.1032-->"E:\programme\Glary Utilities\unins000.exe"
Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
Hardware Diagnose Tools-->C:\Program Files\PC-Doctor 5 for Windows\uninst.exe
Hauppauge MCE XP/Vista Software Encoder (2.0.25149)-->C:\PROGRA~1\WinTV\UNSftMCE.EXE C:\PROGRA~1\WinTV\softMCE.LOG
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
HP Active Support Library 32 bit components-->MsiExec.exe /I{6D3DB611-D5E8-4E4B-8952-0D3F549F9CC6}
HP Active Support Library-->C:\Program Files\InstallShield Installation Information\{0A47BAFF-D4FF-4BD3-96CA-02A22EA62722}\setup.exe -runfromtemp -l0x0409
HP Customer Feedback-->MsiExec.exe /I{9DBA770F-BF73-4D39-B1DF-6035D95268FC}
HP On-Screen Cap/Num/Scroll Lock Indicator-->C:\Windows\system32\OsdRemove.exe
HP Picasso Media Center Add-In-->MsiExec.exe /I{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}
HP Update-->MsiExec.exe /X{8C6027FD-53DC-446D-BB75-CACD7028A134}
HPAsset component for HP Active Support Library-->MsiExec.exe /X{669D4A35-146B-4314-89F1-1AC3D7B88367}
Intel(R) Network Connections Drivers-->Prounstl.exe
Intel® Viiv™ Software-->MsiExec.exe /X{6E7BF6EC-C3E7-43A7-8A03-0D204E3EC01B} /qb!
iPhoneBrowser-->MsiExec.exe /I{C1FCDCA1-2759-4E5E-84EE-3A665BB2F513}
iTunes-->MsiExec.exe /I{2CE5A2E7-3437-4CE7-BCF4-85ED6EEFF9E4}
iWisoft Free Video Converter 1.2-->"E:\programme\iWisoft Free Video Converter\unins000.exe"
Java(TM) 6 Update 22-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216022FF}
KhalSetup-->MsiExec.exe /I{EE7B9A8D-19F0-450D-8E94-3E391E6044CD}
Logitech SetPoint-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}\setup.exe" -l0x9 -removeonly
Malwarebytes' Anti-Malware-->"E:\programme\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - deu\setup.exe
Microsoft .NET Framework 3.5 Language Pack SP1 - deu-->MsiExec.exe /I{052FDD78-A6EA-3187-8386-C82F4CA3A929}
Microsoft .NET Framework 3.5 SP1-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00BA-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0114-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}
Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}
Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Enterprise 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Groove MUI (English) 2007-->MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}
Microsoft Office Groove Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2007-->MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
Microsoft Works-->MsiExec.exe /I{4EA2F95F-A537-4D17-9E7F-6B3FF8D9BBE3}
Mozilla Firefox (3.6.12)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
muvee autoProducer 6.0-->C:\Program Files\InstallShield Installation Information\{775B9052-3517-47FA-817D-1BB28363D43A}\setup.exe -runfromtemp -l0x0007 -removeonly
Need For Speed™ World-->"E:\programme\Need For Speed World\unins000.exe"
Norton Internet Security-->C:\Program Files\NortonInstaller\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS\562C4DD5\17.8.0.5\InstStub.exe /X
Norton Security Scan-->C:\Program Files\NortonInstaller\{397E31AA-0D78-4649-A01C-339D73A2ED35}\NSS\LicenseType\2.7.3.34\InstStub.exe /X
NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI
NVIDIA PhysX-->MsiExec.exe /X{5DB65884-C963-4454-AABA-4CA3089281FA}
Opera 10.63-->MsiExec.exe /X{87CC8013-56D1-43E1-A0A5-AD406B4EBA95}
Optimierte Multimedia-Tastatur-Lösung-->C:\HP\KBD\Install.exe /u
oZone3D.Net FurMark v1.8.0-->"E:\programme\FurMark_v1.8.0\unins000.exe"
Pinball-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5F647107-C2BA-11D3-9A6D-0000B455B172}\setup.exe"
Python 2.5-->MsiExec.exe /I{0A2C5854-557E-48C8-835A-3B9F074BDCAA}
QuickTime-->MsiExec.exe /I{E7004147-2CCA-431C-AA05-2AB166B9785D}
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
Roxio Activation Module-->MsiExec.exe /I{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}
Roxio Creator Audio-->MsiExec.exe /X{83FFCFC7-88C6-41c6-8752-958A45325C82}
Roxio Creator Basic v9-->MsiExec.exe /X{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}
Roxio Creator Copy-->MsiExec.exe /X{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}
Roxio Creator Data-->MsiExec.exe /X{0D397393-9B50-4c52-84D5-77E344289F87}
Roxio Creator EasyArchive-->MsiExec.exe /X{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}
Roxio Creator Tools-->MsiExec.exe /X{0394CDC8-FABD-4ed8-B104-03393876DFDF}
Roxio Express Labeler 3-->MsiExec.exe /X{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Roxio MyDVD Basic v9-->MsiExec.exe /X{938B1CD7-7C60-491E-AA90-1F1888168240}
Safari-->MsiExec.exe /I{20ACB2F8-3BCA-45A8-80A2-9D3CB5C25F43}
Secunia PSI-->"E:\programme\PSI\uninstall.exe"
Security Update for 2007 Microsoft Office System (KB2288621)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {5C497F0B-2061-4CC9-A61C-6B45B867354D}
Security Update for 2007 Microsoft Office System (KB2344875)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {6FC5C4C1-D7AE-44C3-94B7-6424FC3E752F}
Security Update for 2007 Microsoft Office System (KB2345043)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {536FB502-775F-4494-BACE-C02CC90B7A5B}
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB976321)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {7F207DCA-3399-40CB-A968-6E5991B1421A}
Security Update for 2007 Microsoft Office System (KB982312)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {B0EC5722-241F-4CDA-83B4-AA5846B6F9F4}
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A8894F19-59C8-38D2-8A75-36C0CCE56A5B} /qb+ REBOOTPROMPT=""
Security Update for Microsoft Office Access 2007 (KB979440)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {1142CCEC-ACA9-484B-BA90-C3A5CA1988C5}
Security Update for Microsoft Office Access 2007 (KB979440)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {5A4E43D5-858F-49BD-BA72-8F30E1793060}
Security Update for Microsoft Office Excel 2007 (KB2345035)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {B23002DD-34EC-4988-B810-A5E2A0BF04F1}
Security Update for Microsoft Office InfoPath 2007 (KB979441)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {1109D0B3-EFA3-4553-AAED-4C3E9AD130E8}
Security Update for Microsoft Office InfoPath 2007 (KB979441)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {8CCB781A-CF6B-4FCB-B6D8-59C64DF5C6DB}
Security Update for Microsoft Office Outlook 2007 (KB2288953)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {8B772E1C-7C05-42D2-839D-3EC2D39EFF22}
Security Update for Microsoft Office PowerPoint 2007 (KB982158)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F5B70033-E79C-4569-90BF-BC9B4E4F3F46}
Security Update for Microsoft Office Publisher 2007 (KB982124)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {289FA8BC-6A8E-4341-B194-EB26B49E9F5D}
Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
Security Update for Microsoft Office Word 2007 (KB2344993)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {7A5B74FA-7A92-4FC9-821A-2DD5D4E73E48}
SiSoftware Sandra Lite 2010c-->"E:\programme\SiSoftware Sandra Lite 2010c\unins000.exe"
SopCast 3.2.4-->E:\programme\SopCast\uninst.exe
Testversion von Microsoft Office Home and Student 2007-->c:\hp\bin\MSOffice\uninst2.cmd
T-Online WLAN-Access Finder-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{295C31E5-3F91-498E-9623-DA24D2FA2B6A}\Setup.exe" -L0x7
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update for Microsoft Office OneNote 2007 (KB980729)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {329050A9-EF80-40F9-B633-74508F54C1FF}
Update for Outlook 2007 Junk Email Filter (kb2410711)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {BB5A2EB0-4515-4C6B-A618-A6F6B0AB7BAA}
VC80CRTRedist - 8.0.50727.4053-->MsiExec.exe /I{5EE7D259-D137-4438-9A5F-42F432EC0421}
Veetle TV 0.9.17-->C:\Program Files\Veetle\UninstallVeetleTV.exe
VLC media player 1.1.4-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Live Anmelde-Assistent-->MsiExec.exe /I{52B97218-98CB-4B8B-9283-D213C85E1AA4}
Windows Live Call-->MsiExec.exe /I{5FC68772-6D56-41C6-9DF1-24E868198AE6}
Windows Live Communications Platform-->MsiExec.exe /I{ED00D08A-3C5F-488D-93A0-A04F21F23956}
Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}
Windows Live Messenger-->MsiExec.exe /X{41E654A9-26D0-4EAC-854B-0FA824FFFABB}
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
WinRAR-->C:\Program Files\WinRAR\uninstall.exe
======Security center information======
AS: Spybot - Search and Destroy (disabled) (outdated)
AS: Windows-Defender (disabled) (outdated)
======System event log======
Computer Name: hp-PC
Event Code: 4371
Message: Windows-Wartung hat begonnen, den Status des Pakets KB2347290(Security Update) von Installiert(Installed) in Installiert(Installed) zu ändern.
Record Number: 106158
Source Name: Microsoft-Windows-Servicing
Time Written: 20101021145103.000000-000
Event Type: Informationen
User: hp-PC\Nico
Computer Name: hp-PC
Event Code: 4371
Message: Windows-Wartung hat begonnen, den Status des Pakets KB2347290(Security Update) von Installiert(Installed) in Installiert(Installed) zu ändern.
Record Number: 106157
Source Name: Microsoft-Windows-Servicing
Time Written: 20101021145103.000000-000
Event Type: Informationen
User: hp-PC\Nico
Computer Name: hp-PC
Event Code: 4371
Message: Windows-Wartung hat begonnen, den Status des Pakets KB2347290(Security Update) von Installiert(Installed) in Installiert(Installed) zu ändern.
Record Number: 106156
Source Name: Microsoft-Windows-Servicing
Time Written: 20101021145103.000000-000
Event Type: Informationen
User: hp-PC\Nico
Computer Name: hp-PC
Event Code: 4371
Message: Windows-Wartung hat begonnen, den Status des Pakets KB2347290(Security Update) von Installiert(Installed) in Installiert(Installed) zu ändern.
Record Number: 106155
Source Name: Microsoft-Windows-Servicing
Time Written: 20101021145103.000000-000
Event Type: Informationen
User: hp-PC\Nico
Computer Name: hp-PC
Event Code: 4371
Message: Windows-Wartung hat begonnen, den Status des Pakets KB2347290(Security Update) von Installiert(Installed) in Installiert(Installed) zu ändern.
Record Number: 106154
Source Name: Microsoft-Windows-Servicing
Time Written: 20101021145103.000000-000
Event Type: Informationen
User: hp-PC\Nico
=====Application event log=====
Computer Name: LH-U0G07K6VOU2J
Event Code: 36
Message:
Record Number: 376
Source Name: ccSvcHst
Time Written: 20020208005928.000000-000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM
Computer Name: LH-U0G07K6VOU2J
Event Code: 36
Message:
Record Number: 375
Source Name: ccSvcHst
Time Written: 20020208005928.000000-000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM
Computer Name: LH-U0G07K6VOU2J
Event Code: 1
Message: Der Windows-Sicherheitscenterdienst wurde gestartet.
Record Number: 374
Source Name: SecurityCenter
Time Written: 20020208005922.000000-000
Event Type: Informationen
User:
Computer Name: LH-U0G07K6VOU2J
Event Code: 0
Message: Der Dienst wurde gestartet.
Record Number: 373
Source Name: HP Health Check Service
Time Written: 20020208005922.000000-000
Event Type: Informationen
User:
Computer Name: LH-U0G07K6VOU2J
Event Code: 1013
Message: Der Windows-Suchdienst wurde normal beendet.
Record Number: 372
Source Name: Microsoft-Windows-Search
Time Written: 20020208005916.000000-000
Event Type: Informationen
User:
=====Security event log=====
Computer Name: hp-PC
Event Code: 4647
Message: Benutzerinitiierte Abmeldung:
Antragsteller:
Sicherheits-ID: S-1-5-21-1520337693-1879009250-3396951402-500
Kontoname: Administrator
Kontodomäne: LH-U0G07K6VOU2J
Anmelde-ID: 0x4211f
Dieses Ereignis wird generiert, wenn eine Abmeldung initiiert wird, aber die Anzahl der Tokenreferenzen nicht Null ist und die Anmeldesitzung nicht zerstört werden kann. Es kann keiner Benutzerinitiierte Aktion erfolgen. Dieses Ereignis kann als Abmeldeereignis interpretiert werden.
Record Number: 262
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20020208005930.526600-000
Event Type: Überwachung erfolgreich
User:
Computer Name: hp-PC
Event Code: 4634
Message: Ein Konto wurde abgemeldet.
Antragsteller:
Sicherheits-ID: S-1-5-7
Kontoname: ANONYMOUS-ANMELDUNG
Kontodomäne: NT-AUTORITÄT
Anmelde-ID: 0x27937
Anmeldetyp: 3
Dieses Ereignis wird generiert, wenn eine Anmeldesitzung zerstört wird. Es kann anhand des Wertes der Anmelde-ID positiv mit einem Anmeldeereignis korreliert werden. Anmelde-IDs sind nur zwischen Neustarts auf demselben Computer eindeutig.
Record Number: 261
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20020208005929.091400-000
Event Type: Überwachung erfolgreich
User:
Computer Name: LH-U0G07K6VOU2J
Event Code: 4616
Message: Die Systemzeit wurde geändert.
Antragsteller:
Sicherheits-ID: S-1-5-19
Kontoname: LOKALER DIENST
Kontodomäne: NT-AUTORITÄT
Anmelde-ID: 0x3e5
Prozessinformationen:
Prozess-ID: 0x474
Name: C:\Windows\System32\svchost.exe
Vorherige Zeit: 01:59:28 08.02.2002
Neue Zeit: 01:59:28 08.02.2002
Dieses Ereignis wird generiert, wenn die Systemzeit geändert wird. Es ist normal, dass der mit Systemberechtigung ausgeführte Windows-Zeitdienst die Systemzeit regelmäßig ändert. Andere Änderungen der Systemzeit können darauf hinweisen, dass der Computer manipuliert wird.
Record Number: 260
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20020208005928.888600-000
Event Type: Überwachung erfolgreich
User:
Computer Name: LH-U0G07K6VOU2J
Event Code: 1100
Message: Der Ereignisprotokollierungsdienst wurde heruntergefahren.
Record Number: 259
Source Name: Microsoft-Windows-Eventlog
Time Written: 20020208005928.919800-000
Event Type: Überwachung erfolgreich
User:
Computer Name: LH-U0G07K6VOU2J
Event Code: 1102
Message: Das Überwachungsprotokoll wurde gelöscht.
Subjekt:
Sicherheits- ID: S-1-5-21-1520337693-1879009250-3396951402-500
Kontoname: Administrator
Domänenname: LH-U0G07K6VOU2J
Logon-ID: 0x4211f
Record Number: 258
Source Name: Microsoft-Windows-Eventlog
Time Written: 20020208005911.719608-000
Event Type: Überwachung erfolgreich
User:
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\hp\bin\Python;c:\Program Files\Common Files\Roxio Shared\DLLShared\;c:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\;E:\programme\T-Online_Software_6\Basis-Software\Basis2\;E:\programme\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 11, GenuineIntel
"PROCESSOR_REVISION"=0f0b
"NUMBER_OF_PROCESSORS"=4
"RoxioCentral"=c:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\
"PLATFORM"=HPD
"PCBRAND"=Pavilion
"OnlineServices"=Online-Dienste
"SAN_DIR"=E:\programme\SiSoftware Sandra Lite 2010c
"asl.log"=Destination=file;OnFirstLog=command,environment
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip
-----------------EOF-----------------
RSIT Logfile: Code:
ATTFilter Logfile of random's system information tool 1.08 (written by random/random) Run by Nico at 2010-10-31 10:01:13 Microsoft® Windows Vista™ Home Premium Service Pack 2 System drive C: has 408 GB (87%) free of 469 GB Total RAM: 3071 MB (59% free) Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 10:01:37, on 31.10.2010 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v9.00 (9.00.7930.16406) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\WINDOWS\RtHDVCpl.exe C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\rundll32.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\DivX\DivX Update\DivXUpdate.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE C:\Program Files\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe C:\Windows\System32\mobsync.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\Taskmgr.exe C:\Program Files\Opera\opera.exe C:\Users\Nico\AppData\Local\Opera\Opera\temporary_downloads\RSIT.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files\trend micro\Nico.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=74&bd=Pavilion&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=74&bd=Pavilion&pf=desktop R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 93.174.138.218:3128 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.8.0.5\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.8.0.5\IPSBHO.DLL O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.8.0.5\coIEPlg.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW O4 - HKLM\..\Run: [SunJavaUpdateReg] "C:\Windows\system32\jureg.exe" -delete O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [T-Online_Software_6\WLAN-Access Finder] C:\Program Files\T-Online\WLAN-Access Finder\ToWLaAcF.exe /StartMinimized (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [T-Online_Software_6\WLAN-Access Finder] C:\Program Files\T-Online\WLAN-Access Finder\ToWLaAcF.exe /StartMinimized (User 'Default user') O4 - Global Startup: Logitech SetPoint.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Nico\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: Automatisches LiveUpdate - Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing) O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe O23 - Service: HP Chasis Button Service (HPBtnSrv) - Unknown owner - c:\hp\HPEZBTN\HPBtnSrv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Intel DH Service (IntelDHSvcConf) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - E:\programme\SiSoftware Sandra Lite 2010c\RpcAgentSrv.exe O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 9680 bytes ======Scheduled tasks folder====== C:\Windows\tasks\GlaryInitialize.job C:\Windows\tasks\Norton Security Scan for Nico.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-09-22 75200] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}] Symantec NCO BHO - C:\Program Files\Norton Internet Security\Engine\17.8.0.5\coIEPlg.dll [2010-09-04 396144] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}] Symantec Intrusion Prevention - C:\Program Files\Norton Internet Security\Engine\17.8.0.5\IPSBHO.DLL [2010-05-14 79224] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}] Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Windows Live Anmelde-Hilfsprogramm - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}] Google Toolbar Helper - c:\program files\google\googletoolbar1.dll [2002-02-08 2217856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-10-18 41760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar1.dll [2002-02-08 2217856] {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Norton Toolbar - C:\Program Files\Norton Internet Security\Engine\17.8.0.5\coIEPlg.dll [2010-09-04 396144] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-18 1008184] "RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-07-06 4669440] "NvSvc"=C:\Windows\system32\nvsvc.dll [2008-01-10 92704] "NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-01-10 8530464] "NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-01-10 88608] "avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2010-03-02 282792] "DivXUpdate"=C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-09-16 1164584] "SunJavaUpdateReg"=C:\Windows\system32\jureg.exe [2007-04-07 54936] "SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-09-23 35760] "Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288] "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2010-09-24 421160] "AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [2010-09-21 47904] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920] "msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883840] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-09-20 932288] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe [2010-09-16 1164584] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2007-05-24 71176] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2005-02-16 49152] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv] c:\hp\support\hpsysdrv.exe [2007-04-18 65536] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe [2010-09-24 421160] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD] C:\HP\KBD\KbdStub.EXE [2006-12-08 65536] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer] C:\Windows\KHALMNPR.EXE [2006-03-28 94208] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OsdMaestro] C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe [2007-02-15 118784] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PanelApp] [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] E:\programme\QTTask.exe [2010-09-08 421888] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetPoint] C:\Program Files\Logitech\SetPoint\SetPoint.EXE [2006-05-05 565248] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateReg] C:\Windows\system32\jureg.exe [2007-04-07 54936] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-05-14 248552] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tvncontrol] E:\programme\TightVNC\tvnserver.exe -controlservice -slave [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-18 202240] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Nico^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk] C:\PROGRA~1\MICROS~3\Office12\ONENOTEM.EXE [2009-02-26 97680] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Nico^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Secunia PSI.lnk] E:\PROGRA~1\PSI\psi.exe [2010-07-21 965176] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "EnableLUA"=0 "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "FilterAdministratorToken"=1 "EnableUIADesktopToggle"=0 "SoftwareSASGeneration"=1 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "BindDirectlyToPropertySetStorage"=0 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] ======File associations====== .js - edit - C:\Windows\System32\Notepad.exe %1 .js - open - C:\Windows\System32\WScript.exe "%1" %* ======List of files/folders created in the last 1 months====== 2010-10-31 10:01:13 ----D---- C:\rsit 2010-10-31 10:01:13 ----D---- C:\Program Files\trend micro 2010-10-28 19:00:51 ----D---- C:\Program Files\Safari 2010-10-24 16:30:46 ----D---- C:\Windows\Profiles 2010-10-24 16:30:43 ----SHD---- C:\Windows\system32\%APPDATA% 2010-10-21 15:25:12 ----A---- C:\lopR.txt 2010-10-21 15:19:21 ----D---- C:\Lop SD 2010-10-19 20:16:22 ----D---- C:\ProgramData\Kaspersky Lab Setup Files 2010-10-19 19:51:55 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys 2010-10-19 19:51:52 ----A---- C:\Windows\system32\drivers\mbam.sys 2010-10-19 17:19:16 ----D---- C:\Program Files\Adobe 2010-10-19 13:21:42 ----D---- C:\ProgramData\NOS 2010-10-19 13:21:42 ----D---- C:\Program Files\NOS 2010-10-18 19:13:31 ----D---- C:\Users\Nico\AppData\Roaming\Malwarebytes 2010-10-18 19:13:18 ----D---- C:\ProgramData\Malwarebytes 2010-10-18 17:39:41 ----A---- C:\ping.txt 2010-10-18 17:14:41 ----A---- C:\Windows\system32\javaws.exe 2010-10-18 17:14:41 ----A---- C:\Windows\system32\javaw.exe 2010-10-18 17:14:41 ----A---- C:\Windows\system32\java.exe 2010-10-17 19:07:33 ----D---- C:\Users\Nico\AppData\Roaming\Vidalia 2010-10-17 18:57:47 ----D---- C:\Users\Nico\AppData\Roaming\GlarySoft 2010-10-16 13:06:49 ----D---- C:\Users\Nico\AppData\Roaming\Need for Speed World 2010-10-16 11:49:50 ----A---- C:\Windows\system32\D3DX9_40.dll 2010-10-16 11:49:50 ----A---- C:\Windows\system32\d3dx10_40.dll 2010-10-16 11:49:50 ----A---- C:\Windows\system32\D3DCompiler_40.dll 2010-10-16 11:45:21 ----D---- C:\Windows\system32\AGEIA 2010-10-16 11:45:21 ----D---- C:\Program Files\AGEIA Technologies 2010-10-16 11:29:12 ----A---- C:\Windows\system32\drivers\sptd.sys 2010-10-16 11:28:47 ----D---- C:\Users\Nico\AppData\Roaming\DAEMON Tools Lite 2010-10-16 11:28:45 ----D---- C:\ProgramData\DAEMON Tools Lite 2010-10-13 17:07:06 ----A---- C:\Windows\system32\wmp.dll 2010-10-13 17:07:05 ----A---- C:\Windows\system32\wmploc.DLL 2010-10-13 17:06:45 ----A---- C:\Windows\system32\srvsvc.dll 2010-10-13 17:06:45 ----A---- C:\Windows\system32\netevent.dll 2010-10-13 17:06:45 ----A---- C:\Windows\system32\drivers\srvnet.sys 2010-10-13 17:06:45 ----A---- C:\Windows\system32\drivers\srv2.sys 2010-10-13 17:06:45 ----A---- C:\Windows\system32\drivers\srv.sys 2010-10-13 17:06:40 ----A---- C:\Windows\system32\schannel.dll 2010-10-13 17:06:39 ----A---- C:\Windows\system32\ole32.dll 2010-10-13 17:06:38 ----A---- C:\Windows\system32\t2embed.dll 2010-10-13 17:06:37 ----A---- C:\Windows\system32\mfc40.dll 2010-10-13 17:06:36 ----A---- C:\Windows\system32\mfc40u.dll 2010-10-13 17:06:35 ----A---- C:\Windows\system32\win32k.sys 2010-10-13 17:06:33 ----A---- C:\Windows\system32\msshsq.dll 2010-10-13 17:05:41 ----A---- C:\Windows\system32\wmpmde.dll 2010-10-13 17:05:40 ----A---- C:\Windows\system32\comctl32.dll 2010-10-09 18:09:49 ----D---- C:\Windows\Sun 2010-10-07 17:58:25 ----D---- C:\Program Files\iPod 2010-10-01 19:52:33 ----D---- C:\ProgramData\TVU Networks 2010-10-01 19:51:17 ----D---- C:\Windows\system32\TVUAx ======List of files/folders modified in the last 1 months====== 2010-10-31 10:01:26 ----D---- C:\Windows\Prefetch 2010-10-31 10:01:13 ----RD---- C:\Program Files 2010-10-31 09:59:41 ----D---- C:\WINDOWS 2010-10-31 09:55:18 ----D---- C:\Windows\System32 2010-10-31 09:55:18 ----D---- C:\Windows\inf 2010-10-31 09:55:18 ----A---- C:\Windows\system32\PerfStringBackup.INI 2010-10-31 09:54:30 ----D---- C:\Windows\Temp 2010-10-30 22:56:14 ----SHD---- C:\System Volume Information 2010-10-29 17:29:17 ----D---- C:\Windows\Tasks 2010-10-29 14:17:24 ----D---- C:\Program Files\Mozilla Firefox 2010-10-28 19:14:57 ----D---- C:\Users\Nico\AppData\Roaming\vlc 2010-10-28 19:01:19 ----SHD---- C:\Windows\Installer 2010-10-28 19:01:19 ----SHD---- C:\Config.Msi 2010-10-28 19:00:39 ----D---- C:\Program Files\Common Files\Apple 2010-10-27 19:35:39 ----D---- C:\Windows\pss 2010-10-27 19:34:06 ----D---- C:\Windows\Minidump 2010-10-26 14:23:34 ----D---- C:\Windows\system32\Tasks 2010-10-25 17:31:06 ----D---- C:\Windows\system32\drivers 2010-10-24 16:30:55 ----SD---- C:\ProgramData\Microsoft 2010-10-24 16:30:46 ----D---- C:\Program Files\Windows Media Player 2010-10-23 08:57:21 ----D---- C:\Program Files\Common Files\Steam 2010-10-21 16:00:42 ----D---- C:\Windows\rescache 2010-10-21 15:52:59 ----D---- C:\Windows\winsxs 2010-10-21 15:52:58 ----D---- C:\Windows\ShellNew 2010-10-21 15:29:24 ----HD---- C:\ProgramData 2010-10-20 15:01:16 ----D---- C:\ProgramData\Adobe 2010-10-19 20:53:51 ----A---- C:\Windows\system32\AU8Settings.ini 2010-10-19 17:19:30 ----D---- C:\Program Files\Common Files\Adobe 2010-10-19 14:18:58 ----D---- C:\Windows\system32\drivers\etc 2010-10-19 13:26:17 ----D---- C:\Windows\system32\Adobe 2010-10-19 13:19:19 ----D---- C:\Windows\system32\Macromed 2010-10-18 18:44:31 ----D---- C:\Program Files\Viewpoint 2010-10-18 18:44:14 ----D---- C:\ProgramData\Viewpoint 2010-10-18 17:14:30 ----A---- C:\Windows\system32\deployJava1.dll 2010-10-18 17:12:13 ----D---- C:\Program Files\Common Files\Java 2010-10-18 16:06:48 ----D---- C:\Windows\system32\catroot2 2010-10-17 19:13:22 ----D---- C:\ProgramData\NortonInstaller 2010-10-17 19:13:22 ----D---- C:\ProgramData\Norton 2010-10-17 19:13:22 ----D---- C:\Program Files\Windows Sidebar 2010-10-17 19:13:22 ----D---- C:\Program Files\PC-Doctor 5 for Windows 2010-10-17 19:13:22 ----D---- C:\Program Files\Microsoft Visual Studio 8 2010-10-17 19:13:22 ----D---- C:\Program Files\HP 2010-10-17 19:09:09 ----D---- C:\ProgramData\DivX 2010-10-17 19:09:09 ----D---- C:\Program Files\DivX 2010-10-17 18:51:33 ----D---- C:\Windows\SMINST 2010-10-17 14:55:48 ----D---- C:\Program Files\Common Files\DVDVideoSoft 2010-10-17 14:12:54 ----D---- C:\Windows\Debug 2010-10-16 18:43:25 ----D---- C:\Program Files\Java 2010-10-16 11:49:43 ----RSD---- C:\Windows\assembly 2010-10-16 08:18:04 ----D---- C:\Program Files\Opera 2010-10-14 14:49:45 ----D---- C:\Windows\system32\de-DE 2010-10-13 20:46:47 ----D---- C:\ProgramData\Microsoft Help 2010-10-13 20:43:41 ----A---- C:\Windows\system32\mrt.exe 2010-10-13 17:05:30 ----D---- C:\Windows\system32\catroot 2010-10-07 17:58:49 ----D---- C:\Program Files\iTunes 2010-10-07 16:25:13 ----D---- C:\Windows\Microsoft.NET 2010-10-01 12:48:20 ----D---- C:\Program Files\Microsoft Silverlight ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R0 PxHelp20;PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [2010-07-12 45648] R0 sptd;sptd; C:\Windows\System32\Drivers\sptd.sys [2010-10-16 691696] R0 SymDS;Symantec Data Store; C:\Windows\system32\drivers\NIS\1108000.005\SYMDS.SYS [2010-02-04 328752] R0 SymEFA;Symantec Extended File Attributes; C:\Windows\system32\drivers\NIS\1108000.005\SYMEFA.SYS [2010-04-22 173104] R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2010-03-01 124784] R1 BHDrvx86;BHDrvx86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\BASHDefs\20100429.001\BHDrvx86.sys [2010-04-29 537136] R1 ccHP;Symantec Hash Provider; C:\Windows\system32\drivers\NIS\1108000.005\ccHPx86.sys [2010-02-26 501888] R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [2010-05-27 371248] R1 IDSVix86;IDSVix86; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\IPSDefs\20100520.001\IDSvix86.sys [2009-10-28 343088] R1 SRTSPX;Symantec Real Time Storage Protection (PEL); C:\Windows\system32\drivers\NIS\1108000.005\SRTSPX.SYS [2010-04-22 43696] R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520] R1 SymIRON;Symantec Iron Driver; C:\Windows\system32\drivers\NIS\1108000.005\Ironx86.SYS [2010-04-29 116784] R1 SYMTDIv;Symantec Vista Network Dispatch Driver; C:\Windows\System32\Drivers\NIS\1108000.005\SYMTDIV.SYS [2010-05-06 339504] R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2010-02-16 60936] R3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:\Windows\system32\DRIVERS\e1e6032.sys [2008-01-15 218752] R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600] R3 HCW85BDA;Hauppauge WinTV 885 Video Capture; C:\Windows\system32\drivers\HCW85BDA.sys [2007-06-11 968064] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-07-11 1793880] R3 LHidKe;Logitech SetPoint HID Mouse Filter Driver; C:\Windows\system32\DRIVERS\LHidKE.Sys [2006-03-28 27008] R3 LMouKE;Logitech SetPoint Mouse Filter Driver; C:\Windows\System32\Drivers\LMouKE.sys [2006-03-28 69760] R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-01-10 8237120] R3 SymEvent;SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT.SYS [2010-05-18 124976] R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-18 83328] S3 apkaqhr4;apkaqhr4; C:\Windows\system32\drivers\apkaqhr4.sys [] S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-18 5632] S3 epmntdrv;epmntdrv; \??\C:\Windows\system32\epmntdrv.sys [2010-01-20 14216] S3 EuGdiDrv;EuGdiDrv; \??\C:\Windows\system32\EuGdiDrv.sys [2010-01-20 8456] S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520] S3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\Windows\System32\Drivers\L8042Kbd.sys [] S3 L8042mou;Logitech SetPoint PS/2 Mouse Filter Driver; C:\Windows\System32\Drivers\L8042mou.sys [2006-03-28 55808] S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-18 8192] S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-18 5888] S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2008-01-18 5504] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2008-01-18 6016] S3 NAVENG;NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\VirusDefs\20100601.023\NAVENG.SYS [2010-05-18 85552] S3 NAVEX15;NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\VirusDefs\20100601.023\NAVEX15.SYS [2010-05-18 1347504] S3 netr73;USB Wireless 802.11 b/g Adaptor Driver for Vista; C:\Windows\system32\DRIVERS\netr73.sys [2008-02-26 493568] S3 Ps2;PS2; C:\Windows\system32\DRIVERS\PS2.sys [2005-12-12 19072] S3 PSI;PSI; C:\Windows\system32\DRIVERS\psi_mf.sys [2010-07-07 14904] S3 SANDRA;SANDRA; \??\E:\programme\SiSoftware Sandra Lite 2010c\WNt500x86\Sandra.sys [2009-08-07 23112] S3 SRTSP;Symantec Real Time Storage Protection; C:\Windows\System32\Drivers\NIS\1108000.005\SRTSP.SYS [2010-04-22 325680] S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2010-04-19 41984] S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-18 39936] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336] R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2010-04-19 267432] R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-08-13 144672] R2 DQLWinService;DQLWinService; C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [2006-09-03 208896] R2 HP Health Check Service;HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [2007-05-24 61440] R2 HPBtnSrv;HP Chasis Button Service; c:\hp\HPEZBTN\HPBtnSrv.exe [2007-05-29 198240] R2 LightScribeService;LightScribeService Direct Disc Labeling Service; c:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-06-28 79136] R2 NIS;Norton Internet Security; C:\Program Files\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe [2010-02-26 126392] R2 Viewpoint Manager Service;Viewpoint Manager Service; C:\Program Files\Viewpoint\Common\ViewpointService.exe [2008-09-08 24652] R3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-18 21504] R3 iPod Service;iPod-Dienst; C:\Program Files\iPod\bin\iPodService.exe [2010-09-24 820008] S2 Automatisches LiveUpdate - Scheduler;Automatisches LiveUpdate - Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [] S2 IntelDHSvcConf;Intel DH Service; C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe [2006-05-10 29696] S3 AlertService;Intel(R) Alert Service; C:\Program Files\Intel\IntelDH\CCU\AlertService.exe [2006-09-11 188416] S3 IDriverT;InstallDriver Table Manager; c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728] S3 ISSM;Intel(R) Software Services Manager; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe [2006-09-11 75264] S3 M1 Server;Intel(R) Viiv(TM) Media Server; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe [2006-08-31 26624] S3 MCLServiceATL;Intel(R) Application Tracker; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe [2006-09-11 167936] S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888] S3 nosGetPlusHelper;getPlus(R) Helper 3004; C:\Windows\System32\svchost.exe [2008-01-18 21504] S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184] S3 Remote UI Service;Intel(R) Remoting Service; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe [2006-09-11 544256] S3 RoxMediaDB9;RoxMediaDB9; c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [2007-05-11 887544] S3 SandraAgentSrv;SiSoftware Deployment Agent Service; E:\programme\SiSoftware Sandra Lite 2010c\RpcAgentSrv.exe [2009-08-24 93336] S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2010-07-23 407336] S3 stllssvr;stllssvr; c:\Program Files\Common Files\SureThing Shared\stllssvr.exe [2007-05-03 74656] -----------------EOF----------------- hier zu 4. Code:
ATTFilter Adobe Download Manager NOS Microsystems Ltd. 18.10.2010 0,45MB 1.6.2.91
Adobe Flash Player 10 Plugin Adobe Systems Incorporated 24.10.2010 10.1.85.3
Adobe Reader 9.4.0 - Deutsch Adobe Systems Incorporated 18.10.2010 242,3MB 9.4.0
Adobe Shockwave Player 11.5 Adobe Systems, Inc. 18.10.2010 8,67MB 11.5.8.612
Apple Application Support Apple Inc. 27.10.2010 42,8MB 1.3.2
Apple Mobile Device Support Apple Inc. 16.09.2010 20,1MB 3.2.0.47
Apple Software Update Apple Inc. 24.02.2010 2,16MB 2.1.1.116
Auto Shutdown 8.11 Explora.Pc´s Software 13.03.2010 5,14MB
Avira AntiVir Personal - Free Antivirus Avira GmbH 21.04.2010 100,2MB 10.0.0.567
AVS Update Manager 1.0 Online Media Technologies Ltd. 12.03.2010 9,64MB
AVS Video Converter 6 Online Media Technologies Ltd. 12.03.2010 34,0MB
AVS4YOU Software Navigator 1.3 Online Media Technologies Ltd. 12.03.2010 8,72MB
CCleaner Piriform 24.10.2010 2,96MB 2.36
Defraggler Piriform 28.09.2010 12.739,8MB 1.21
DivX-Setup DivX, Inc. 16.10.2010 1,91MB 2.1.2.2
DVD Flick 1.3.0.7 Dennis Meuwissen 13.03.2010 43,2MB 1.3.0.7
EASEUS Partition Master 5.0.1 Home Edition EASEUS 02.02.2010 42,3MB
Free Audio CD Burner version 1.4 DVDVideoSoft Limited. 30.09.2010 3,14MB
Free DVD Video Burner version 2.1 DVDVideoSoft Limited. 11.03.2010 4,80MB
Free Video to DVD Converter version 1.2 DVDVideoSoft Limited. 11.03.2010 2,66MB
Free Video to iPhone Converter version 3.0 DVDVideoSoft Limited. 31.07.2010 2,58MB
Free Video to MP3 Converter version 4.0 DVDVideoSoft Limited. 27.06.2010 2,53MB
Free YouTube to iPhone Converter version 2.5 DVDVideoSoft Limited. 20.06.2010 3,19MB
Free YouTube to MP3 Converter version 3.8 DVDVideoSoft Limited. 30.09.2010 6,70MB
GIMP 2.6.8 12.04.2010 98,6MB
Glary Utilities 2.29.0.1032 Glarysoft Ltd 28.10.2010 18,1MB 2.29.0.1032
Google Toolbar for Internet Explorer 07.02.2002 2,59MB
Hardware Diagnose Tools PC-Doctor, Inc. 07.02.2002 129,6MB 5.00.4558.05
Hauppauge MCE XP/Vista Software Encoder (2.0.25149) Hauppauge Computer Works, Inc. 07.02.2002 0,15MB 2.0.25149
HP On-Screen Cap/Num/Scroll Lock Indicator Hewlett-Packard 07.02.2002
HP Update Hewlett-Packard 07.02.2002 3,57MB 4.000.005.007
Intel(R) Network Connections Drivers 07.02.2010
Intel® Viiv™ Software Intel Corporation 07.02.2002 22,3MB 1.6.361.6
iPhoneBrowser Cranium Consulting and Custom Software 23.03.2010 0,41MB 1.9.3
iTunes Apple Inc. 06.10.2010 138,7MB 10.0.1.22
iWisoft Free Video Converter 1.2 www.easy-video-converter.com 13.03.2010 21,4MB 1.2
Java(TM) 6 Update 22 Oracle 17.10.2010 95,0MB 6.0.220
Logitech SetPoint Logitech 01.02.2010 42,5MB 2.60
Malwarebytes' Anti-Malware Malwarebytes Corporation 18.10.2010 3,90MB
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU Microsoft Corporation 07.02.2010 37,0MB
Microsoft .NET Framework 3.5 SP1 Microsoft Corporation 03.02.2010 37,0MB
Microsoft Office Enterprise 2007 Microsoft Corporation 17.04.2010 633,0MB 12.0.6425.1000
Microsoft Silverlight Microsoft Corporation 29.09.2010 34,5MB 4.0.50917.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Corporation 03.02.2010 0,25MB 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 15.10.2010 2,38MB 8.0.59193
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 02.04.2010 0,58MB 9.0.30729.4148
Microsoft Works Microsoft Corporation 03.02.2010 292,7MB 08.05.0822
MobileMe Control Panel Apple Inc. 27.10.2010 11,8MB 3.1.3.0
Mozilla Firefox (3.6.12) Mozilla 28.10.2010 29,8MB 3.6.12 (de)
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 03.02.2010 35,00KB 4.20.9870.0
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 03.02.2010 1,34MB 4.20.9876.0
muvee autoProducer 6.0 muvee Technologies 07.02.2002 154,5MB 6.00.050
Need For Speed™ World Electronic Arts 15.10.2010 15,4MB 1.0.0.131
Norton Internet Security Symantec Corporation 17.05.2010 68,1MB 17.8.0.5
Norton Security Scan Symantec Corporation 24.05.2010 11,6MB 2.7.3.34
NVIDIA Drivers 07.02.2010
NVIDIA PhysX NVIDIA Corporation 15.10.2010 120,1MB 9.09.0720
Opera 10.63 Opera Software ASA 15.10.2010 23,3MB 10.63
Optimierte Multimedia-Tastatur-Lösung Hewlett-Packard 07.02.2002 8,34MB
oZone3D.Net FurMark v1.8.0 oZone3D.Net 15.02.2010 3,97MB
Pinball 28.05.2010 3,14MB
QuickTime Apple Inc. 16.09.2010 73,7MB 7.68.75.0
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 07.02.2002 14,4MB 6.0.1.5444
Roxio Creator Audio Roxio 07.02.2002 4,55MB 3.4.0
Roxio Creator Basic v9 Roxio 07.02.2002 30,5MB 3.4.0
Roxio Creator Copy Roxio 07.02.2002 0,65MB 3.4.0
Roxio Creator Data Roxio 07.02.2002 0,84MB 3.4.0
Roxio Creator EasyArchive Roxio 07.02.2002 1,49MB 3.4.0
Roxio Creator Tools Roxio 07.02.2002 0,35MB 3.4.0
Roxio Express Labeler 3 Roxio 07.02.2002 19,6MB 3.2.1
Roxio MyDVD Basic v9 Roxio 07.02.2002 327,6MB 9.0.572
Safari Apple Inc. 27.10.2010 41,3MB 5.33.18.5
Secunia PSI 24.10.2010 1,53MB
SiSoftware Sandra Lite 2010c SiSoftware 15.02.2010 65,9MB 16.26.2010.1
SopCast 3.2.4 SopCast.com 05.02.2010 9,05MB 3.2.4
T-Online WLAN-Access Finder 01.02.2010 0,95MB
Testversion von Microsoft Office Home and Student 2007 07.02.2002 348,4MB
Veetle TV 0.9.17 Veetle, Inc 09.04.2010 36,3MB 0.9.17
VLC media player 1.1.4 VideoLAN 30.08.2010 75,7MB 1.1.4
Windows Live Anmelde-Assistent Microsoft Corporation 02.02.2010 1,93MB 5.000.818.5
Windows Live Essentials Microsoft Corporation 02.02.2010 44,0MB 14.0.8089.0726
Windows Media Player Firefox Plugin Microsoft Corp 22.09.2010 0,29MB 1.0.0.8
WinRAR 21.02.2010 3,78MB
hier zu 5. Code:
ATTFilter GMER 1.0.15.15477 - hxxp://www.gmer.net
Rootkit scan 2010-10-31 10:40:46
Windows 6.0.6002 Service Pack 2
Running: 1bytlit0.exe; Driver: C:\Users\Nico\AppData\Local\Temp\pxldipoc.sys
---- System - GMER 1.0.15 ----
SSDT 88B0CED0 ZwAlertResumeThread
SSDT 88B0A850 ZwAlertThread
SSDT 88B74900 ZwAllocateVirtualMemory
SSDT 8816E890 ZwAlpcConnectPort
SSDT 88B488F0 ZwAssignProcessToJobObject
SSDT 88B808C0 ZwCreateMutant
SSDT 88B85158 ZwCreateSymbolicLinkObject
SSDT 88B726D0 ZwCreateThread
SSDT 88AF7D10 ZwDebugActiveProcess
SSDT 88B74B18 ZwDuplicateObject
SSDT 88B71CB0 ZwFreeVirtualMemory
SSDT 88B21070 ZwImpersonateAnonymousToken
SSDT 88B12048 ZwImpersonateThread
SSDT 8816E230 ZwLoadDriver
SSDT 88B71B50 ZwMapViewOfSection
SSDT 88B260B0 ZwOpenEvent
SSDT 88B74D78 ZwOpenProcess
SSDT 88A9B068 ZwOpenProcessToken
SSDT 88B3B938 ZwOpenSection
SSDT 88B74C28 ZwOpenThread
SSDT 88B84070 ZwProtectVirtualMemory
SSDT 88B0B048 ZwResumeThread
SSDT 88A01988 ZwSetContextThread
SSDT 88B718F8 ZwSetInformationProcess
SSDT 88B30048 ZwSetSystemInformation
SSDT 88B28048 ZwSuspendProcess
SSDT 88AFF048 ZwSuspendThread
SSDT 88A7D108 ZwTerminateProcess
SSDT 88AE6A68 ZwTerminateThread
SSDT 88AD80D0 ZwUnmapViewOfSection
SSDT 88B71FC0 ZwWriteVirtualMemory
SSDT 88B85728 ZwCreateThreadEx
INT 0x51 ? 8640BBF8
INT 0x51 ? 8640BBF8
INT 0x51 ? 8781AF00
INT 0x51 ? 8640BBF8
INT 0x62 ? 8781AF00
INT 0x71 ? 8781AF00
INT 0x71 ? 8781AF00
INT 0x71 ? 8781AF00
INT 0x72 ? 8781AF00
INT 0x82 ? 8781AF00
INT 0xA2 ? 8640BBF8
INT 0xB2 ? 8640BBF8
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!KeSetEvent + 11D 824E9880 8 Bytes [D0, CE, B0, 88, 50, A8, B0, ...]
.text ntkrnlpa.exe!KeSetEvent + 131 824E9894 4 Bytes [00, 49, B7, 88]
.text ntkrnlpa.exe!KeSetEvent + 191 824E98F4 4 Bytes [F0, 88, B4, 88]
.text ntkrnlpa.exe!KeSetEvent + 1F5 824E9958 4 Bytes [C0, 08, B8, 88]
.text ntkrnlpa.exe!KeSetEvent + 21D 824E9980 8 Bytes [58, 51, B8, 88, D0, 26, B7, ...]
.text ...
? System32\Drivers\spvl.sys Das System kann den angegebenen Pfad nicht finden. !
.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8E80A340, 0x3A0147, 0xE8000020]
.text USBPORT.SYS!DllUnload 82DA741B 5 Bytes JMP 8781A4E0
.text apkaqhr4.SYS 82DB6000 22 Bytes [82, 13, 41, 82, 6C, 12, 41, ...]
.text apkaqhr4.SYS 82DB6017 181 Bytes [00, 32, 77, 78, 80, 3D, 75, ...]
.text apkaqhr4.SYS 82DB60CE 10 Bytes [00, 00, 00, 00, 00, 00, C9, ...] {ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; LEAVE ; HLT ; POP ESP; DEC EDX}
.text apkaqhr4.SYS 82DB60DA 12 Bytes [00, 00, 02, 00, 00, 00, 24, ...]
.text apkaqhr4.SYS 82DB60E7 714 Bytes [00, F0, 0E, 00, 00, 00, 00, ...]
.text ...
---- User code sections - GMER 1.0.15 ----
.text C:\Windows\Explorer.EXE[1052] ntdll.dll!NtProtectVirtualMemory 77104D34 5 Bytes JMP 0058000A
.text C:\Windows\Explorer.EXE[1052] ntdll.dll!NtWriteVirtualMemory 77105674 5 Bytes JMP 0172000A
.text C:\Windows\Explorer.EXE[1052] ntdll.dll!KiUserExceptionDispatcher 77105DC8 5 Bytes JMP 0057000A
.text C:\Windows\system32\svchost.exe[4508] ntdll.dll!NtProtectVirtualMemory 77104D34 3 Bytes JMP 0011000A
.text C:\Windows\system32\svchost.exe[4508] ntdll.dll!NtProtectVirtualMemory + 4 77104D38 1 Byte [89]
.text C:\Windows\system32\svchost.exe[4508] ntdll.dll!NtWriteVirtualMemory 77105674 5 Bytes JMP 0067000A
.text C:\Windows\system32\svchost.exe[4508] ntdll.dll!KiUserExceptionDispatcher 77105DC8 5 Bytes JMP 000B000A
.text C:\Windows\system32\svchost.exe[4508] ole32.dll!CoCreateInstance 76719F3E 5 Bytes JMP 009C000A
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [8068B6D6] \SystemRoot\System32\Drivers\spvl.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [8068B042] \SystemRoot\System32\Drivers\spvl.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [8068B800] \SystemRoot\System32\Drivers\spvl.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort] [8068B0C0] \SystemRoot\System32\Drivers\spvl.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [8068B13E] \SystemRoot\System32\Drivers\spvl.sys
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortNotification] CC358B04
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortWritePortUchar] 8382DDCF
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortWritePortUlong] 458B38C6
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortGetPhysicalAddress] A5A5A514
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortConvertPhysicalAddressToUlong] [100D8BA5] \programme\DAEMON Tools Lite\Engine.dll
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortGetScatterGatherList] 5F82DDA0
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortReadPortUchar] 30810889
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortStallExecution] 54771129
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortGetParentBusType] 10C25D5E
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortRequestCallback] 8B55CC00
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortWritePortBufferUshort] 084D8BEC
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortGetUnCachedExtension] 0CF0918B
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortCompleteRequest] 458B0000
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortMoveMemory] 8B108910
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortCompleteAllActiveRequests] 000CF491
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortReleaseRequestSenseIrb] 04508900
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortBuildRequestSenseIrb] 053C7980
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortReadPortUshort] 560C558B
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortReadPortBufferUshort] C6127557
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortInitialize] B18D0502
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortGetDeviceBase] 00000CF8
IAT \SystemRoot\System32\Drivers\apkaqhr4.SYS[ataport.SYS!AtaPortDeviceStateChange] A508788D
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Windows\Explorer.EXE[1052] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [73C77817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1052] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [73CCA86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1052] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [73C7BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1052] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [73C6F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1052] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [73C775E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1052] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [73C6E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1052] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [73CA8395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1052] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [73C7DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1052] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [73C6FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1052] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [73C6FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1052] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [73C671CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1052] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [73CFCAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1052] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [73C9C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1052] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [73C6D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1052] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [73C66853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1052] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [73C6687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1052] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [73C72AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs 864101F8
Device \Driver\volmgr \Device\VolMgrControl 8640D1F8
Device \Driver\usbuhci \Device\USBPDO-0 878631F8
Device \Driver\usbuhci \Device\USBPDO-1 878631F8
Device \Driver\usbehci \Device\USBPDO-2 878641F8
Device \Driver\PCI_PNP5981 \Device\00000054 spvl.sys
Device \Driver\usbuhci \Device\USBPDO-3 878631F8
Device \Driver\usbuhci \Device\USBPDO-4 878631F8
Device \Driver\sptd \Device\2450251992 spvl.sys
AttachedDevice \Driver\tdx \Device\Tcp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
Device \Driver\usbuhci \Device\USBPDO-5 878631F8
Device \Driver\usbuhci \Device\USBPDO-6 878631F8
Device \Driver\volmgr \Device\HarddiskVolume1 8640D1F8
Device \Driver\usbehci \Device\USBPDO-7 878641F8
Device \Driver\volmgr \Device\HarddiskVolume2 8640D1F8
Device \Driver\cdrom \Device\CdRom0 877F91F8
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 8738A292
Device \Driver\atapi \Device\Ide\IdePort0 8640F1F8
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 8738A292
Device \Driver\atapi \Device\Ide\IdePort1 8640F1F8
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort2 8738A292
Device \Driver\atapi \Device\Ide\IdePort2 8640F1F8
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort3 8738A292
Device \Driver\atapi \Device\Ide\IdePort3 8640F1F8
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T0L0-1 8738A292
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-1 8640F1F8
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP0T1L0-4 8738A292
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-4 8640F1F8
Device \Driver\volmgr \Device\HarddiskVolume3 8640D1F8
Device \Driver\cdrom \Device\CdRom1 877F91F8
Device \Driver\volmgr \Device\HarddiskVolume4 8640D1F8
Device \Driver\volmgr \Device\HarddiskVolume5 8640D1F8
Device \Driver\volmgr \Device\HarddiskVolume6 8640D1F8
Device \Driver\volmgr \Device\HarddiskVolume7 8640D1F8
Device \Driver\netbt \Device\NetBt_Wins_Export 881741F8
Device \Driver\volmgr \Device\HarddiskVolume8 8640D1F8
Device \Driver\Smb \Device\NetbiosSmb 87FC51F8
Device \Driver\USBSTOR \Device\00000088 88EEC1F8
Device \Driver\iScsiPrt \Device\RaidPort0 879EF1F8
AttachedDevice \Driver\tdx \Device\Udp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
Device \Driver\USBSTOR \Device\00000089 88EEC1F8
AttachedDevice \Driver\tdx \Device\RawIp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
Device \Driver\usbuhci \Device\USBFDO-0 878631F8
Device \Driver\usbuhci \Device\USBFDO-1 878631F8
Device \Driver\usbehci \Device\USBFDO-2 878641F8
Device \Driver\usbuhci \Device\USBFDO-3 878631F8
Device \Driver\usbuhci \Device\USBFDO-4 878631F8
Device \Driver\USBSTOR \Device\0000008a 88EEC1F8
Device \Driver\usbuhci \Device\USBFDO-5 878631F8
Device \Driver\USBSTOR \Device\0000008b 88EEC1F8
Device \Driver\usbuhci \Device\USBFDO-6 878631F8
Device \Driver\USBSTOR \Device\0000008c 88EEC1F8
Device \Driver\usbehci \Device\USBFDO-7 878641F8
Device \Driver\apkaqhr4 \Device\Scsi\apkaqhr41Port5Path0Target0Lun0 878D71F8
Device \Driver\apkaqhr4 \Device\Scsi\apkaqhr41 878D71F8
Device \FileSystem\cdfs \Cdfs 88F241F8
Device \Device\Ide\IdeDeviceP0T0L0-0 -> \??\IDE#DiskSAMSUNG_HD501LJ_________________________CR100-10#5&1eaea11c&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 E:\programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x1D 0x55 0x7C 0xE8 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x12 0x16 0x01 0x09 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x4C 0x20 0x00 0x65 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 E:\programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x1D 0x55 0x7C 0xE8 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x12 0x16 0x01 0x09 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x4C 0x20 0x00 0x65 ...
---- Disk sectors - GMER 1.0.15 ----
Disk \Device\Harddisk0\DR0 sector 00 (MBR): rootkit-like behavior; TDL4 <-- ROOTKIT !!!
Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sectors 976772930 (+237): rootkit-like behavior;
---- EOF - GMER 1.0.15 ----
|
|
31.10.2010, 14:13
| #4 |
| | Browser öffnet Seiten von alleine und Windows Hostprozess konnte nicht ausgeführt werden hier zu 6. Code:
ATTFilter ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2010/10/31 11:41
Program Version: Version 1.3.5.0
Windows Version: Windows Vista SP2
==================================================
Drivers
-------------------
Name: 1394BUS.SYS
Image Path: C:\Windows\system32\DRIVERS\1394BUS.SYS
Address: 0x8F3BC000 Size: 57344 File Visible: - Signed: -
Status: -
Name: acpi.sys
Image Path: C:\Windows\system32\drivers\acpi.sys
Address: 0x807AB000 Size: 286720 File Visible: - Signed: -
Status: -
Name: ACPI_HAL
Image Path: \Driver\ACPI_HAL
Address: 0x8243D000 Size: 3903488 File Visible: - Signed: -
Status: -
Name: afd.sys
Image Path: C:\Windows\system32\drivers\afd.sys
Address: 0x904FC000 Size: 294912 File Visible: - Signed: -
Status: -
Name: apkaqhr4.SYS
Image Path: C:\Windows\System32\Drivers\apkaqhr4.SYS
Address: 0x82DB5000 Size: 233472 File Visible: - Signed: -
Status: -
Name: atapi.sys
Image Path: C:\Windows\system32\drivers\atapi.sys
Address: 0x82A84000 Size: 32768 File Visible: - Signed: -
Status: -
Name: ataport.SYS
Image Path: C:\Windows\system32\drivers\ataport.SYS
Address: 0x82A8C000 Size: 122880 File Visible: - Signed: -
Status: -
Name: ATMFD.DLL
Image Path: C:\Windows\System32\ATMFD.DLL
Address: 0x9CCE0000 Size: 311296 File Visible: - Signed: -
Status: -
Name: avgntflt.sys
Image Path: C:\Windows\system32\DRIVERS\avgntflt.sys
Address: 0x917B3000 Size: 86016 File Visible: - Signed: -
Status: -
Name: avipbb.sys
Image Path: C:\Windows\system32\DRIVERS\avipbb.sys
Address: 0x916AE000 Size: 139264 File Visible: - Signed: -
Status: -
Name: BdaSup.SYS
Image Path: C:\Windows\system32\drivers\BdaSup.SYS
Address: 0x8F37F000 Size: 12288 File Visible: - Signed: -
Status: -
Name: Beep.SYS
Image Path: C:\Windows\System32\Drivers\Beep.SYS
Address: 0x90200000 Size: 28672 File Visible: - Signed: -
Status: -
Name: BHDrvx86.sys
Image Path: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\BASHDefs\20100429.001\BHDrvx86.sys
Address: 0x9160F000 Size: 548864 File Visible: - Signed: -
Status: -
Name: BOOTVID.dll
Image Path: C:\Windows\system32\BOOTVID.dll
Address: 0x80484000 Size: 32768 File Visible: - Signed: -
Status: -
Name: bowser.sys
Image Path: C:\Windows\system32\DRIVERS\bowser.sys
Address: 0xA19A0000 Size: 102400 File Visible: - Signed: -
Status: -
Name: ccHPx86.sys
Image Path: C:\Windows\system32\drivers\NIS\1108000.005\ccHPx86.sys
Address: 0x9091C000 Size: 520192 File Visible: - Signed: -
Status: -
Name: cdd.dll
Image Path: C:\Windows\System32\cdd.dll
Address: 0x9CCD0000 Size: 57344 File Visible: - Signed: -
Status: -
Name: cdfs.sys
Image Path: C:\Windows\system32\DRIVERS\cdfs.sys
Address: 0x91749000 Size: 90112 File Visible: - Signed: -
Status: -
Name: cdrom.sys
Image Path: C:\Windows\system32\DRIVERS\cdrom.sys
Address: 0x8F3CA000 Size: 98304 File Visible: - Signed: -
Status: -
Name: CI.dll
Image Path: C:\Windows\system32\CI.dll
Address: 0x804CD000 Size: 917504 File Visible: - Signed: -
Status: -
Name: circlass.sys
Image Path: C:\Windows\system32\DRIVERS\circlass.sys
Address: 0x8FD29000 Size: 57344 File Visible: - Signed: -
Status: -
Name: CLASSPNP.SYS
Image Path: C:\Windows\system32\drivers\CLASSPNP.SYS
Address: 0x8AB9C000 Size: 135168 File Visible: - Signed: -
Status: -
Name: CLFS.SYS
Image Path: C:\Windows\system32\CLFS.SYS
Address: 0x8048C000 Size: 266240 File Visible: - Signed: -
Status: -
Name: crashdmp.sys
Image Path: C:\Windows\System32\Drivers\crashdmp.sys
Address: 0x9175F000 Size: 53248 File Visible: - Signed: -
Status: -
Name: crcdisk.sys
Image Path: C:\Windows\system32\drivers\crcdisk.sys
Address: 0x8ABBD000 Size: 36864 File Visible: - Signed: -
Status: -
Name: dfsc.sys
Image Path: C:\Windows\System32\Drivers\dfsc.sys
Address: 0x90905000 Size: 94208 File Visible: - Signed: -
Status: -
Name: disk.sys
Image Path: C:\Windows\system32\drivers\disk.sys
Address: 0x8AB8B000 Size: 69632 File Visible: - Signed: -
Status: -
Name: drmk.sys
Image Path: C:\Windows\system32\drivers\drmk.sys
Address: 0x8FD94000 Size: 151552 File Visible: - Signed: -
Status: -
Name: dump_atapi.sys
Image Path: C:\Windows\System32\Drivers\dump_atapi.sys
Address: 0x91777000 Size: 32768 File Visible: No Signed: -
Status: -
Name: dump_dumpata.sys
Image Path: C:\Windows\System32\Drivers\dump_dumpata.sys
Address: 0x9176C000 Size: 45056 File Visible: No Signed: -
Status: -
Name: Dxapi.sys
Image Path: C:\Windows\System32\drivers\Dxapi.sys
Address: 0x9177F000 Size: 40960 File Visible: - Signed: -
Status: -
Name: dxgkrnl.sys
Image Path: C:\Windows\System32\drivers\dxgkrnl.sys
Address: 0x82F16000 Size: 659456 File Visible: - Signed: -
Status: -
Name: e1e6032.sys
Image Path: C:\Windows\system32\DRIVERS\e1e6032.sys
Address: 0x82FB7000 Size: 229376 File Visible: - Signed: -
Status: -
Name: ecache.sys
Image Path: C:\Windows\System32\drivers\ecache.sys
Address: 0x8AB64000 Size: 159744 File Visible: - Signed: -
Status: -
Name: eeCtrl.sys
Image Path: C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
Address: 0x908A7000 Size: 385024 File Visible: - Signed: -
Status: -
Name: fileinfo.sys
Image Path: C:\Windows\system32\drivers\fileinfo.sys
Address: 0x82B32000 Size: 65536 File Visible: - Signed: -
Status: -
Name: fltmgr.sys
Image Path: C:\Windows\system32\drivers\fltmgr.sys
Address: 0x82AAA000 Size: 204800 File Visible: - Signed: -
Status: -
Name: Fs_Rec.SYS
Image Path: C:\Windows\System32\Drivers\Fs_Rec.SYS
Address: 0x903F0000 Size: 36864 File Visible: - Signed: -
Status: -
Name: fwpkclnt.sys
Image Path: C:\Windows\System32\drivers\fwpkclnt.sys
Address: 0x82EEC000 Size: 110592 File Visible: - Signed: -
Status: -
Name: GEARAspiWDM.sys
Image Path: C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
Address: 0x8F3E2000 Size: 21120 File Visible: - Signed: -
Status: -
Name: hal.dll
Image Path: C:\Windows\system32\hal.dll
Address: 0x8240A000 Size: 208896 File Visible: - Signed: -
Status: -
Name: HCW85BDA.sys
Image Path: C:\Windows\system32\drivers\HCW85BDA.sys
Address: 0x8F292000 Size: 968064 File Visible: - Signed: -
Status: -
Name: HDAudBus.sys
Image Path: C:\Windows\system32\DRIVERS\HDAudBus.sys
Address: 0x8F205000 Size: 577536 File Visible: - Signed: -
Status: -
Name: HIDCLASS.SYS
Image Path: C:\Windows\system32\DRIVERS\HIDCLASS.SYS
Address: 0x916D9000 Size: 65536 File Visible: - Signed: -
Status: -
Name: hidir.sys
Image Path: C:\Windows\system32\DRIVERS\hidir.sys
Address: 0x91729000 Size: 45056 File Visible: - Signed: -
Status: -
Name: HIDPARSE.SYS
Image Path: C:\Windows\system32\DRIVERS\HIDPARSE.SYS
Address: 0x90207000 Size: 28672 File Visible: - Signed: -
Status: -
Name: hidusb.sys
Image Path: C:\Windows\system32\DRIVERS\hidusb.sys
Address: 0x916D0000 Size: 36864 File Visible: - Signed: -
Status: -
Name: HTTP.sys
Image Path: C:\Windows\system32\drivers\HTTP.sys
Address: 0xA1916000 Size: 446464 File Visible: - Signed: -
Status: -
Name: IDSvix86.sys
Image Path: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\IPSDefs\20100520.001\IDSvix86.sys
Address: 0x9084F000 Size: 360448 File Visible: - Signed: -
Status: -
Name: intelide.sys
Image Path: C:\Windows\system32\DRIVERS\intelide.sys
Address: 0x82A58000 Size: 28672 File Visible: - Signed: -
Status: -
Name: intelppm.sys
Image Path: C:\Windows\system32\DRIVERS\intelppm.sys
Address: 0x82F07000 Size: 61440 File Visible: - Signed: -
Status: -
Name: ipnat.sys
Image Path: C:\Windows\system32\DRIVERS\ipnat.sys
Address: 0xA2B9F000 Size: 155648 File Visible: - Signed: -
Status: -
Name: Ironx86.SYS
Image Path: C:\Windows\system32\drivers\NIS\1108000.005\Ironx86.SYS
Address: 0x905AD000 Size: 126976 File Visible: - Signed: -
Status: -
Name: kbdclass.sys
Image Path: C:\Windows\system32\DRIVERS\kbdclass.sys
Address: 0x8FD11000 Size: 45056 File Visible: - Signed: -
Status: -
Name: kbdhid.sys
Image Path: C:\Windows\system32\DRIVERS\kbdhid.sys
Address: 0x916E9000 Size: 36864 File Visible: - Signed: -
Status: -
Name: kdcom.dll
Image Path: C:\Windows\system32\kdcom.dll
Address: 0x877EA000 Size: 12288 File Visible: - Signed: -
Status: -
Name: ks.sys
Image Path: C:\Windows\system32\drivers\ks.sys
Address: 0x8F382000 Size: 172032 File Visible: - Signed: -
Status: -
Name: ksecdd.sys
Image Path: C:\Windows\System32\Drivers\ksecdd.sys
Address: 0x82B79000 Size: 462848 File Visible: - Signed: -
Status: -
Name: LHidKE.Sys
Image Path: C:\Windows\system32\DRIVERS\LHidKE.Sys
Address: 0x91708000 Size: 27008 File Visible: - Signed: -
Status: -
Name: lltdio.sys
Image Path: C:\Windows\system32\DRIVERS\lltdio.sys
Address: 0xA18BF000 Size: 65536 File Visible: - Signed: -
Status: -
Name: LMouKE.sys
Image Path: C:\Windows\System32\Drivers\LMouKE.sys
Address: 0x91717000 Size: 69760 File Visible: - Signed: -
Status: -
Name: luafv.sys
Image Path: C:\Windows\system32\drivers\luafv.sys
Address: 0x91798000 Size: 110592 File Visible: - Signed: -
Status: -
Name: mcupdate_GenuineIntel.dll
Image Path: C:\Windows\system32\mcupdate_GenuineIntel.dll
Address: 0x80403000 Size: 458752 File Visible: - Signed: -
Status: -
Name: monitor.sys
Image Path: C:\Windows\system32\DRIVERS\monitor.sys
Address: 0x91789000 Size: 61440 File Visible: - Signed: -
Status: -
Name: mouclass.sys
Image Path: C:\Windows\system32\DRIVERS\mouclass.sys
Address: 0x8FD1C000 Size: 45056 File Visible: - Signed: -
Status: -
Name: mouhid.sys
Image Path: C:\Windows\system32\DRIVERS\mouhid.sys
Address: 0x9170F000 Size: 32768 File Visible: - Signed: -
Status: -
Name: mountmgr.sys
Image Path: C:\Windows\System32\drivers\mountmgr.sys
Address: 0x82A74000 Size: 65536 File Visible: - Signed: -
Status: -
Name: mpsdrv.sys
Image Path: C:\Windows\System32\drivers\mpsdrv.sys
Address: 0xA19B9000 Size: 86016 File Visible: - Signed: -
Status: -
Name: mrxdav.sys
Image Path: C:\Windows\system32\drivers\mrxdav.sys
Address: 0xA19CE000 Size: 135168 File Visible: - Signed: -
Status: -
Name: mrxsmb.sys
Image Path: C:\Windows\system32\DRIVERS\mrxsmb.sys
Address: 0x917D0000 Size: 126976 File Visible: - Signed: -
Status: -
Name: mrxsmb10.sys
Image Path: C:\Windows\system32\DRIVERS\mrxsmb10.sys
Address: 0x9099B000 Size: 233472 File Visible: - Signed: -
Status: -
Name: mrxsmb20.sys
Image Path: C:\Windows\system32\DRIVERS\mrxsmb20.sys
Address: 0x909D4000 Size: 98304 File Visible: - Signed: -
Status: -
Name: Msfs.SYS
Image Path: C:\Windows\System32\Drivers\Msfs.SYS
Address: 0x90432000 Size: 45056 File Visible: - Signed: -
Status: -
Name: msisadrv.sys
Image Path: C:\Windows\system32\drivers\msisadrv.sys
Address: 0x807F1000 Size: 32768 File Visible: - Signed: -
Status: -
Name: msiscsi.sys
Image Path: C:\Windows\system32\DRIVERS\msiscsi.sys
Address: 0x8FC09000 Size: 192512 File Visible: - Signed: -
Status: -
Name: msrpc.sys
Image Path: C:\Windows\system32\drivers\msrpc.sys
Address: 0x82D11000 Size: 176128 File Visible: - Signed: -
Status: -
Name: mssmbios.sys
Image Path: C:\Windows\system32\DRIVERS\mssmbios.sys
Address: 0x8FD37000 Size: 40960 File Visible: - Signed: -
Status: -
Name: mup.sys
Image Path: C:\Windows\System32\Drivers\mup.sys
Address: 0x8AB55000 Size: 61440 File Visible: - Signed: -
Status: -
Name: ndis.sys
Image Path: C:\Windows\system32\drivers\ndis.sys
Address: 0x82C06000 Size: 1093632 File Visible: - Signed: -
Status: -
Name: ndistapi.sys
Image Path: C:\Windows\system32\DRIVERS\ndistapi.sys
Address: 0x8FC9B000 Size: 45056 File Visible: - Signed: -
Status: -
Name: ndisuio.sys
Image Path: C:\Windows\system32\DRIVERS\ndisuio.sys
Address: 0xA18F9000 Size: 40960 File Visible: - Signed: -
Status: -
Name: ndiswan.sys
Image Path: C:\Windows\system32\DRIVERS\ndiswan.sys
Address: 0x8FCA6000 Size: 143360 File Visible: - Signed: -
Status: -
Name: NDProxy.SYS
Image Path: C:\Windows\System32\Drivers\NDProxy.SYS
Address: 0x8FD83000 Size: 69632 File Visible: - Signed: -
Status: -
Name: netbios.sys
Image Path: C:\Windows\system32\DRIVERS\netbios.sys
Address: 0x9058C000 Size: 57344 File Visible: - Signed: -
Status: -
Name: netbt.sys
Image Path: C:\Windows\System32\DRIVERS\netbt.sys
Address: 0x90544000 Size: 204800 File Visible: - Signed: -
Status: -
Name: NETIO.SYS
Image Path: C:\Windows\system32\drivers\NETIO.SYS
Address: 0x82D3C000 Size: 241664 File Visible: - Signed: -
Status: -
Name: Npfs.SYS
Image Path: C:\Windows\System32\Drivers\Npfs.SYS
Address: 0x9043D000 Size: 57344 File Visible: - Signed: -
Status: -
Name: nsiproxy.sys
Image Path: C:\Windows\system32\drivers\nsiproxy.sys
Address: 0x90845000 Size: 40960 File Visible: - Signed: -
Status: -
Name: Ntfs.sys
Image Path: C:\Windows\System32\Drivers\Ntfs.sys
Address: 0x8AA04000 Size: 1114112 File Visible: - Signed: -
Status: -
Name: ntkrnlpa.exe
Image Path: C:\Windows\system32\ntkrnlpa.exe
Address: 0x8243D000 Size: 3903488 File Visible: - Signed: -
Status: -
Name: Null.SYS
Image Path: C:\Windows\System32\Drivers\Null.SYS
Address: 0x903F9000 Size: 28672 File Visible: - Signed: -
Status: -
Name: nvlddmkm.sys
Image Path: C:\Windows\system32\DRIVERS\nvlddmkm.sys
Address: 0x8E80A000 Size: 8237120 File Visible: - Signed: -
Status: -
Name: nwifi.sys
Image Path: C:\Windows\system32\DRIVERS\nwifi.sys
Address: 0xA18CF000 Size: 172032 File Visible: - Signed: -
Status: -
Name: ohci1394.sys
Image Path: C:\Windows\system32\DRIVERS\ohci1394.sys
Address: 0x8F3AC000 Size: 62208 File Visible: - Signed: -
Status: -
Name: pacer.sys
Image Path: C:\Windows\system32\DRIVERS\pacer.sys
Address: 0x90576000 Size: 90112 File Visible: - Signed: -
Status: -
Name: partmgr.sys
Image Path: C:\Windows\System32\drivers\partmgr.sys
Address: 0x805D4000 Size: 61440 File Visible: - Signed: -
Status: -
Name: pci.sys
Image Path: C:\Windows\system32\drivers\pci.sys
Address: 0x805AD000 Size: 159744 File Visible: - Signed: -
Status: -
Name: pciide.sys
Image Path: C:\Windows\system32\drivers\pciide.sys
Address: 0x82A6D000 Size: 28672 File Visible: - Signed: -
Status: -
Name: PCIIDEX.SYS
Image Path: C:\Windows\system32\DRIVERS\PCIIDEX.SYS
Address: 0x82A5F000 Size: 57344 File Visible: - Signed: -
Status: -
Name: peauth.sys
Image Path: C:\Windows\system32\drivers\peauth.sys
Address: 0xA2A84000 Size: 909312 File Visible: - Signed: -
Status: -
Name: PnpManager
Image Path: \Driver\PnpManager
Address: 0x8243D000 Size: 3903488 File Visible: - Signed: -
Status: -
Name: portcls.sys
Image Path: C:\Windows\system32\drivers\portcls.sys
Address: 0x903C3000 Size: 184320 File Visible: - Signed: -
Status: -
Name: PSHED.dll
Image Path: C:\Windows\system32\PSHED.dll
Address: 0x80473000 Size: 69632 File Visible: - Signed: -
Status: -
Name: PxHelp20.sys
Image Path: C:\Windows\System32\Drivers\PxHelp20.sys
Address: 0x82B6F000 Size: 38080 File Visible: - Signed: -
Status: -
Name: pxldipoc.sys
Image Path: C:\Users\Nico\AppData\Local\Temp\pxldipoc.sys
Address: 0xA2BC9000 Size: 93824 File Visible: No Signed: -
Status: -
Name: rasacd.sys
Image Path: C:\Windows\System32\DRIVERS\rasacd.sys
Address: 0x9044B000 Size: 36864 File Visible: - Signed: -
Status: -
Name: rasl2tp.sys
Image Path: C:\Windows\system32\DRIVERS\rasl2tp.sys
Address: 0x8FC84000 Size: 94208 File Visible: - Signed: -
Status: -
Name: raspppoe.sys
Image Path: C:\Windows\system32\DRIVERS\raspppoe.sys
Address: 0x8FCC9000 Size: 61440 File Visible: - Signed: -
Status: -
Name: raspptp.sys
Image Path: C:\Windows\system32\DRIVERS\raspptp.sys
Address: 0x8FCD8000 Size: 81920 File Visible: - Signed: -
Status: -
Name: rassstp.sys
Image Path: C:\Windows\system32\DRIVERS\rassstp.sys
Address: 0x8FCEC000 Size: 86016 File Visible: - Signed: -
Status: -
Name: RAW
Image Path: \FileSystem\RAW
Address: 0x8243D000 Size: 3903488 File Visible: - Signed: -
Status: -
Name: rdbss.sys
Image Path: C:\Windows\system32\DRIVERS\rdbss.sys
Address: 0x90809000 Size: 245760 File Visible: - Signed: -
Status: -
Name: RDPCDD.sys
Image Path: C:\Windows\System32\DRIVERS\RDPCDD.sys
Address: 0x90422000 Size: 32768 File Visible: - Signed: -
Status: -
Name: rdpencdd.sys
Image Path: C:\Windows\system32\drivers\rdpencdd.sys
Address: 0x9042A000 Size: 32768 File Visible: - Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\Windows\system32\drivers\rootrepeal.sys
Address: 0xA2BE0000 Size: 49152 File Visible: No Signed: -
Status: -
Name: rspndr.sys
Image Path: C:\Windows\system32\DRIVERS\rspndr.sys
Address: 0xA1903000 Size: 77824 File Visible: - Signed: -
Status: -
Name: RTKVHDA.sys
Image Path: C:\Windows\system32\drivers\RTKVHDA.sys
Address: 0x9020E000 Size: 1788480 File Visible: - Signed: -
Status: -
Name: SCSIPORT.SYS
Image Path: C:\Windows\System32\Drivers\SCSIPORT.SYS
Address: 0x80785000 Size: 155648 File Visible: - Signed: -
Status: -
Name: secdrv.SYS
Image Path: C:\Windows\System32\Drivers\secdrv.SYS
Address: 0xA2B62000 Size: 40960 File Visible: - Signed: -
Status: -
Name: smb.sys
Image Path: C:\Windows\system32\DRIVERS\smb.sys
Address: 0x904E8000 Size: 81920 File Visible: - Signed: -
Status: -
Name: spldr.sys
Image Path: C:\Windows\System32\Drivers\spldr.sys
Address: 0x8AB4D000 Size: 32768 File Visible: - Signed: -
Status: -
Name: spsys.sys
Image Path: C:\Windows\system32\drivers\spsys.sys
Address: 0xA180F000 Size: 720896 File Visible: - Signed: -
Status: -
Name: sptd
Image Path: \Driver\sptd
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -
Name: spvl.sys
Image Path: C:\Windows\System32\Drivers\spvl.sys
Address: 0x80689000 Size: 995328 File Visible: No Signed: -
Status: -
Name: SRTSPX.SYS
Image Path: C:\Windows\system32\drivers\NIS\1108000.005\SRTSPX.SYS
Address: 0x905D2000 Size: 36992 File Visible: - Signed: -
Status: -
Name: srv.sys
Image Path: C:\Windows\System32\DRIVERS\srv.sys
Address: 0xA2A36000 Size: 319488 File Visible: - Signed: -
Status: -
Name: srv2.sys
Image Path: C:\Windows\System32\DRIVERS\srv2.sys
Address: 0xA2A0E000 Size: 163840 File Visible: - Signed: -
Status: -
Name: srvnet.sys
Image Path: C:\Windows\System32\DRIVERS\srvnet.sys
Address: 0xA1983000 Size: 118784 File Visible: - Signed: -
Status: -
Name: ssmdrv.sys
Image Path: C:\Windows\system32\DRIVERS\ssmdrv.sys
Address: 0x905CC000 Size: 23040 File Visible: - Signed: -
Status: -
Name: storport.sys
Image Path: C:\Windows\system32\DRIVERS\storport.sys
Address: 0x8FC38000 Size: 266240 File Visible: - Signed: -
Status: -
Name: swenum.sys
Image Path: C:\Windows\system32\DRIVERS\swenum.sys
Address: 0x8FD27000 Size: 4992 File Visible: - Signed: -
Status: -
Name: SYMDS.SYS
Image Path: C:\Windows\system32\drivers\NIS\1108000.005\SYMDS.SYS
Address: 0x82ADC000 Size: 352256 File Visible: - Signed: -
Status: -
Name: SYMEFA.SYS
Image Path: C:\Windows\system32\drivers\NIS\1108000.005\SYMEFA.SYS
Address: 0x82B42000 Size: 184320 File Visible: - Signed: -
Status: -
Name: SYMEVENT.SYS
Image Path: C:\Windows\system32\Drivers\SYMEVENT.SYS
Address: 0x904C3000 Size: 151552 File Visible: - Signed: -
Status: -
Name: SYMTDIV.SYS
Image Path: C:\Windows\System32\Drivers\NIS\1108000.005\SYMTDIV.SYS
Address: 0x9046A000 Size: 364544 File Visible: - Signed: -
Status: -
Name: tcpip.sys
Image Path: C:\Windows\System32\drivers\tcpip.sys
Address: 0x82E02000 Size: 958464 File Visible: - Signed: -
Status: -
Name: tcpipreg.sys
Image Path: C:\Windows\System32\drivers\tcpipreg.sys
Address: 0xA2B6C000 Size: 49152 File Visible: - Signed: -
Status: -
Name: TDI.SYS
Image Path: C:\Windows\system32\DRIVERS\TDI.SYS
Address: 0x8FC79000 Size: 45056 File Visible: - Signed: -
Status: -
Name: tdx.sys
Image Path: C:\Windows\system32\DRIVERS\tdx.sys
Address: 0x90454000 Size: 90112 File Visible: - Signed: -
Status: -
Name: termdd.sys
Image Path: C:\Windows\system32\DRIVERS\termdd.sys
Address: 0x8FD01000 Size: 65536 File Visible: - Signed: -
Status: -
Name: TSDDD.dll
Image Path: C:\Windows\System32\TSDDD.dll
Address: 0x9CCB0000 Size: 36864 File Visible: - Signed: -
Status: -
Name: tunmp.sys
Image Path: C:\Windows\system32\DRIVERS\tunmp.sys
Address: 0x8ABF1000 Size: 36864 File Visible: - Signed: -
Status: -
Name: tunnel.sys
Image Path: C:\Windows\system32\DRIVERS\tunnel.sys
Address: 0x8ABE6000 Size: 45056 File Visible: - Signed: -
Status: -
Name: umbus.sys
Image Path: C:\Windows\system32\DRIVERS\umbus.sys
Address: 0x8FD41000 Size: 53248 File Visible: - Signed: -
Status: -
Name: usbccgp.sys
Image Path: C:\Windows\system32\DRIVERS\usbccgp.sys
Address: 0x91695000 Size: 94208 File Visible: - Signed: -
Status: -
Name: usbcir.sys
Image Path: C:\Windows\system32\DRIVERS\usbcir.sys
Address: 0x916F2000 Size: 90112 File Visible: - Signed: -
Status: -
Name: USBD.SYS
Image Path: C:\Windows\system32\DRIVERS\USBD.SYS
Address: 0x916AC000 Size: 8192 File Visible: - Signed: -
Status: -
Name: usbehci.sys
Image Path: C:\Windows\system32\DRIVERS\usbehci.sys
Address: 0x82FEF000 Size: 61440 File Visible: - Signed: -
Status: -
Name: usbhub.sys
Image Path: C:\Windows\system32\DRIVERS\usbhub.sys
Address: 0x8FD4E000 Size: 217088 File Visible: - Signed: -
Status: -
Name: USBPORT.SYS
Image Path: C:\Windows\system32\DRIVERS\USBPORT.SYS
Address: 0x82D77000 Size: 253952 File Visible: - Signed: -
Status: -
Name: USBSTOR.SYS
Image Path: C:\Windows\system32\DRIVERS\USBSTOR.SYS
Address: 0x91734000 Size: 86016 File Visible: - Signed: -
Status: -
Name: usbuhci.sys
Image Path: C:\Windows\system32\DRIVERS\usbuhci.sys
Address: 0x8EFF2000 Size: 45056 File Visible: - Signed: -
Status: -
Name: vga.sys
Image Path: C:\Windows\System32\drivers\vga.sys
Address: 0x8FDD5000 Size: 49152 File Visible: - Signed: -
Status: -
Name: VIDEOPRT.SYS
Image Path: C:\Windows\System32\drivers\VIDEOPRT.SYS
Address: 0x90401000 Size: 135168 File Visible: - Signed: -
Status: -
Name: volmgr.sys
Image Path: C:\Windows\system32\drivers\volmgr.sys
Address: 0x805E3000 Size: 61440 File Visible: - Signed: -
Status: -
Name: volmgrx.sys
Image Path: C:\Windows\System32\drivers\volmgrx.sys
Address: 0x82A0E000 Size: 303104 File Visible: - Signed: -
Status: -
Name: volsnap.sys
Image Path: C:\Windows\system32\drivers\volsnap.sys
Address: 0x8AB14000 Size: 233472 File Visible: - Signed: -
Status: -
Name: wanarp.sys
Image Path: C:\Windows\system32\DRIVERS\wanarp.sys
Address: 0x9059A000 Size: 77824 File Visible: - Signed: -
Status: -
Name: watchdog.sys
Image Path: C:\Windows\System32\drivers\watchdog.sys
Address: 0x8EFE6000 Size: 49152 File Visible: - Signed: -
Status: -
Name: Wdf01000.sys
Image Path: C:\Windows\system32\drivers\Wdf01000.sys
Address: 0x80600000 Size: 507904 File Visible: - Signed: -
Status: -
Name: WDFLDR.SYS
Image Path: C:\Windows\system32\drivers\WDFLDR.SYS
Address: 0x8067C000 Size: 53248 File Visible: - Signed: -
Status: -
Name: Win32k
Image Path: \Driver\Win32k
Address: 0x9CA90000 Size: 2109440 File Visible: - Signed: -
Status: -
Name: win32k.sys
Image Path: C:\Windows\System32\win32k.sys
Address: 0x9CA90000 Size: 2109440 File Visible: - Signed: -
Status: -
Name: WMILIB.SYS
Image Path: C:\Windows\System32\Drivers\WMILIB.SYS
Address: 0x8077C000 Size: 36864 File Visible: - Signed: -
Status: -
Name: WMIxWDM
Image Path: \Driver\WMIxWDM
Address: 0x8243D000 Size: 3903488 File Visible: - Signed: -
Status: -
Name: WUDFPf.sys
Image Path: C:\Windows\system32\DRIVERS\WUDFPf.sys
Address: 0xA2B8D000 Size: 73728 File Visible: - Signed: -
Status: -
Name: WUDFRd.sys
Image Path: C:\Windows\system32\DRIVERS\WUDFRd.sys
Address: 0xA2B78000 Size: 83328 File Visible: - Signed: -
Status: -
Stealth Objects
-------------------
Object: Hidden Module [Name: msgsres.dll]
Process: msnmsgr.exe (PID: 2360) Address: 0x6cf30000 Size: 11403264
Object: Hidden Module [Name: msgslang.14.0.8089.0726.dll]
Process: msnmsgr.exe (PID: 2360) Address: 0x6e770000 Size: 372736
Object: Hidden Module [Name: msgrvsta.thm]
Process: msnmsgr.exe (PID: 2360) Address: 0x70310000 Size: 20480
Object: Hidden Code [Driver: Ntfs, IRP_MJ_CREATE]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLOSE]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_READ]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_WRITE]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_EA]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_EA]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SHUTDOWN]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLEANUP]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_SECURITY]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_QUOTA]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_PNP]
Process: System Address: 0x864101f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_CREATE]
Process: System Address: 0x8640f1f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_CLOSE]
Process: System Address: 0x8640f1f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8640f1f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8640f1f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_POWER]
Process: System Address: 0x8640f1f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8640f1f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_PNP]
Process: System Address: 0x8640f1f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_CREATE]
Process: System Address: 0x877f91f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_CLOSE]
Process: System Address: 0x877f91f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_READ]
Process: System Address: 0x877f91f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_WRITE]
Process: System Address: 0x877f91f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x877f91f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x877f91f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x877f91f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_SHUTDOWN]
Process: System Address: 0x877f91f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_POWER]
Process: System Address: 0x877f91f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x877f91f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_PNP]
Process: System Address: 0x877f91f8 Size: 121
Object: Hidden Code [Driver: USBSTOR, IRP_MJ_CREATE]
Process: System Address: 0x88eec1f8 Size: 121
Object: Hidden Code [Driver: USBSTOR, IRP_MJ_CLOSE]
Process: System Address: 0x88eec1f8 Size: 121
Object: Hidden Code [Driver: USBSTOR, IRP_MJ_READ]
Process: System Address: 0x88eec1f8 Size: 121
Object: Hidden Code [Driver: USBSTOR, IRP_MJ_WRITE]
Process: System Address: 0x88eec1f8 Size: 121
Object: Hidden Code [Driver: USBSTOR, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x88eec1f8 Size: 121
Object: Hidden Code [Driver: USBSTOR, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x88eec1f8 Size: 121
Object: Hidden Code [Driver: USBSTOR, IRP_MJ_POWER]
Process: System Address: 0x88eec1f8 Size: 121
Object: Hidden Code [Driver: USBSTOR, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x88eec1f8 Size: 121
Object: Hidden Code [Driver: USBSTOR, IRP_MJ_PNP]
Process: System Address: 0x88eec1f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_CREATE]
Process: System Address: 0x878631f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_CLOSE]
Process: System Address: 0x878631f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x878631f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x878631f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_POWER]
Process: System Address: 0x878631f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x878631f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_PNP]
Process: System Address: 0x878631f8 Size: 121
Object: Hidden Code [Driver: Smb??????, IRP_MJ_CREATE]
Process: System Address: 0x87fc51f8 Size: 121
Object: Hidden Code [Driver: Smb??????, IRP_MJ_CLOSE]
Process: System Address: 0x87fc51f8 Size: 121
Object: Hidden Code [Driver: Smb??????, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x87fc51f8 Size: 121
Object: Hidden Code [Driver: Smb??????, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x87fc51f8 Size: 121
Object: Hidden Code [Driver: Smb??????, IRP_MJ_CLEANUP]
Process: System Address: 0x87fc51f8 Size: 121
Object: Hidden Code [Driver: Smb??????, IRP_MJ_PNP]
Process: System Address: 0x87fc51f8 Size: 121
Object: Hidden Code [Driver: apkaqhr4???????, IRP_MJ_CREATE]
Process: System Address: 0x878d71f8 Size: 121
Object: Hidden Code [Driver: apkaqhr4???????, IRP_MJ_CLOSE]
Process: System Address: 0x878d71f8 Size: 121
Object: Hidden Code [Driver: apkaqhr4???????, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x878d71f8 Size: 121
Object: Hidden Code [Driver: apkaqhr4???????, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x878d71f8 Size: 121
Object: Hidden Code [Driver: apkaqhr4???????, IRP_MJ_POWER]
Process: System Address: 0x878d71f8 Size: 121
Object: Hidden Code [Driver: apkaqhr4???????, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x878d71f8 Size: 121
Object: Hidden Code [Driver: apkaqhr4???????, IRP_MJ_PNP]
Process: System Address: 0x878d71f8 Size: 121
Object: Hidden Code [Driver: netbt?, IRP_MJ_CREATE]
Process: System Address: 0x881741f8 Size: 121
Object: Hidden Code [Driver: netbt?, IRP_MJ_CLOSE]
Process: System Address: 0x881741f8 Size: 121
Object: Hidden Code [Driver: netbt?, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x881741f8 Size: 121
Object: Hidden Code [Driver: netbt?, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x881741f8 Size: 121
Object: Hidden Code [Driver: netbt?, IRP_MJ_CLEANUP]
Process: System Address: 0x881741f8 Size: 121
Object: Hidden Code [Driver: netbt?, IRP_MJ_PNP]
Process: System Address: 0x881741f8 Size: 121
Object: Hidden Code [Driver: iScsiPrt???, IRP_MJ_CREATE]
Process: System Address: 0x879ef1f8 Size: 121
Object: Hidden Code [Driver: iScsiPrt???, IRP_MJ_CLOSE]
Process: System Address: 0x879ef1f8 Size: 121
Object: Hidden Code [Driver: iScsiPrt???, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x879ef1f8 Size: 121
Object: Hidden Code [Driver: iScsiPrt???, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x879ef1f8 Size: 121
Object: Hidden Code [Driver: iScsiPrt???, IRP_MJ_POWER]
Process: System Address: 0x879ef1f8 Size: 121
Object: Hidden Code [Driver: iScsiPrt???, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x879ef1f8 Size: 121
Object: Hidden Code [Driver: iScsiPrt???, IRP_MJ_PNP]
Process: System Address: 0x879ef1f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_CREATE]
Process: System Address: 0x8640d1f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_READ]
Process: System Address: 0x8640d1f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_WRITE]
Process: System Address: 0x8640d1f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x8640d1f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8640d1f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8640d1f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_SHUTDOWN]
Process: System Address: 0x8640d1f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_CLEANUP]
Process: System Address: 0x8640d1f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_POWER]
Process: System Address: 0x8640d1f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8640d1f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_PNP]
Process: System Address: 0x8640d1f8 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_CREATE]
Process: System Address: 0x878641f8 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_CLOSE]
Process: System Address: 0x878641f8 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x878641f8 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x878641f8 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_POWER]
Process: System Address: 0x878641f8 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x878641f8 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_PNP]
Process: System Address: 0x878641f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_CREATE]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_CREATE_NAMED_PIPE]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_CLOSE]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_READ]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_WRITE]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_QUERY_EA]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_SET_EA]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_SHUTDOWN]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_CLEANUP]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_CREATE_MAILSLOT]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_SET_SECURITY]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_POWER]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_DEVICE_CHANGE]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_SET_QUOTA]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: mrxsmb, IRP_MJ_PNP]
Process: System Address: 0x878231f8 Size: 121
Object: Hidden Code [Driver: cdfs????, IRP_MJ_CREATE]
Process: System Address: 0x88f241f8 Size: 121
Object: Hidden Code [Driver: cdfs????, IRP_MJ_CLOSE]
Process: System Address: 0x88f241f8 Size: 121
Object: Hidden Code [Driver: cdfs????, IRP_MJ_READ]
Process: System Address: 0x88f241f8 Size: 121
Object: Hidden Code [Driver: cdfs????, IRP_MJ_WRITE]
Process: System Address: 0x88f241f8 Size: 121
Object: Hidden Code [Driver: cdfs????, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x88f241f8 Size: 121
Object: Hidden Code [Driver: cdfs????, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x88f241f8 Size: 121
Object: Hidden Code [Driver: cdfs????, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x88f241f8 Size: 121
Object: Hidden Code [Driver: cdfs????, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x88f241f8 Size: 121
Object: Hidden Code [Driver: cdfs????, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x88f241f8 Size: 121
Object: Hidden Code [Driver: cdfs????, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x88f241f8 Size: 121
Object: Hidden Code [Driver: cdfs????, IRP_MJ_SHUTDOWN]
Process: System Address: 0x88f241f8 Size: 121
Object: Hidden Code [Driver: cdfs????, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x88f241f8 Size: 121
Object: Hidden Code [Driver: cdfs????, IRP_MJ_CLEANUP]
Process: System Address: 0x88f241f8 Size: 121
Object: Hidden Code [Driver: cdfs????, IRP_MJ_PNP]
Process: System Address: 0x88f241f8 Size: 121
Hidden Services
-------------------
Jedes mal wenn ich versuche die HJTscanlist zu posten kommt die Nachricht der Server hat die Verbindung unterbrochen und ich kann es nicht posten. Ich hoffe das hilft auch so weiter. gruß  |
|
01.11.2010, 06:47
| #5 |
| /// Helfer-Team | Browser öffnet Seiten von alleine und Windows Hostprozess konnte nicht ausgeführt werden 1. eigentlich wird ungefragt mitinstalliert : Code:
ATTFilter Viewpoint Manager
falls nicht (mehr) vorhanden: "Start--> Ausführen" dann folgende Befehl bitte eingeben: cmd --> ok es öffnet sich ein Kommando-Fenster danach folgende Befehl eingeben und nach jedem Befehl die Eingabetaste [Enter] drücken: Code:
ATTFilter sc stop Viewpoint Corporation
sc delete Viewpoint Corporation
Falls eine Fehlermeldung erscheint, probiere mit "Viewpoint Manager Service" 2. → besuche die Seite von virustotal und die Datei/en aus Codebox bitte prüfen lassen - inklusive Dateigröße und Name, MD5 und SHA1 auch mitkopieren: → Tipps für die Suche nach Dateien Code:
ATTFilter C:\Windows\System32\Drivers\apkaqhr4.SYS
→ Suche die Datei auf deinem Rechner→ Doppelklick auf die zu prüfende Datei (oder kopiere den Inhalt ab aus der Codebox) → "Senden der Datei" und Warte, bis der Scandurchlauf aller Virenscanner beendet ist → das Ergebnis wie Du es bekommst (NICHT AUSLASSEN!) da reinkoperen (inklusive <geprüfter Dateiname> + Dateigröße und Name, MD5 und SHA1) ** Beispiel - das zu postende Logfile von Virustotal soll so wie hier aussehen Also nicht auslassen, sondern wie Du es bekommst da reinkopieren!: Code:
ATTFilter File name:
<<Dateiname>>
Submission date:
2010-10-22 03:34:01 (UTC)
Current status:
queued queued analysing finished
Result:
.....%
VT Community
goodware/badware
Safety score: 100.0%
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2010.10.22.00 2010.10.21 -
AntiVir 7.10.13.15 2010.10.21 -
Antiy-AVL 2.0.3.7 2010.10.22 -
Authentium 5.2.0.5 2010.10.22 -
Avast 4.8.1351.0 2010.10.21 -
Avast5 5.0.594.0 2010.10.21 -
usw........
Geändert von kira (01.11.2010 um 06:53 Uhr) |
|
01.11.2010, 10:18
| #6 |
| | Browser öffnet Seiten von alleine und Windows Hostprozess konnte nicht ausgeführt werden Also das mit dem Viewpoint deinstallieren geht nicht, da erscheint bei beiden Versionen immer die Meldung: Code:
ATTFilter [SC] OpenService FEHLER 1060
Code:
ATTFilter C:\Windows\System32\Drivers\apkaqhr4.SYS
gruß |
|
02.11.2010, 06:39
| #7 | |
| /// Helfer-Team | Browser öffnet Seiten von alleine und Windows Hostprozess konnte nicht ausgeführt werdenZitat:
|
|
02.11.2010, 12:36
| #8 |
| | Browser öffnet Seiten von alleine und Windows Hostprozess konnte nicht ausgeführt werden Gut dann hier in mehreren Teilen. Code:
ATTFilter
Microsoft Windows [Version 6.0.6002]
C:
31.10.2010 10:01 C:\rsit --------- 0
31.10.2010 10:01 C:\Program Files --------- 20480
31.10.2010 09:59 C:\WINDOWS --------- 28672
C:\hiberfil.sys ---------
C:\pagefile.sys ---------
30.10.2010 22:56 C:\System Volume Information --------- 16384
28.10.2010 19:01 C:\Config.Msi --------- 0
21.10.2010 15:29 C:\ProgramData --------- 8192
21.10.2010 15:27 C:\lopR.txt --------- 12058
21.10.2010 15:27 C:\Lop SD --------- 8192
18.10.2010 17:39 C:\ping.txt --------- 500
28.05.2010 10:14 C:\IO.SYS --------- 0
28.05.2010 10:14 C:\MSDOS.SYS --------- 0
14.04.2010 15:41 C:\MSOCache --------- 0
18.03.2010 17:45 C:\divx --------- 0
18.03.2010 16:17 C:\found.000 --------- 0
13.03.2010 14:16 C:\TO_InstallLog.txt --------- 161
02.03.2010 16:58 C:\$Recycle.Bin --------- 4096
02.03.2010 16:57 C:\Users --------- 4096
09.02.2010 08:00 C:\Boot --------- 4096
02.02.2010 19:36 C:\hp --------- 4096
02.02.2010 17:30 C:\Programme --------- 0
02.02.2010 17:30 C:\Dokumente und Einstellungen --------- 0
11.04.2009 07:36 C:\bootmgr --------- 333257
18.09.2006 22:43 C:\config.sys --------- 10
08.02.2002 09:51 C:\BOOTSECT.BAK --------- 8192
08.02.2002 01:40 C:\autoexec.bat --------- 74
----------------------------------------
|
|
02.11.2010, 12:38
| #9 |
| | Browser öffnet Seiten von alleine und Windows Hostprozess konnte nicht ausgeführt werdenCode:
ATTFilter C:\Windows\System
02.02.2010 17:40 C:\Windows\System\hpsysdrv.dat --------- 44
02.11.2006 13:34 C:\Windows\System\mciseq.drv --------- 25264
02.11.2006 13:34 C:\Windows\System\mciwave.drv --------- 28160
02.11.2006 13:34 C:\Windows\System\avicap.dll --------- 69584
02.11.2006 13:34 C:\Windows\System\avifile.dll --------- 109456
02.11.2006 13:34 C:\Windows\System\mciavi.drv --------- 73376
02.11.2006 13:34 C:\Windows\System\msvideo.dll --------- 126912
02.11.2006 08:10 C:\Windows\System\OLESVR.DLL --------- 24064
02.11.2006 08:10 C:\Windows\System\WFWNET.DRV --------- 12704
02.11.2006 08:10 C:\Windows\System\COMMDLG.DLL --------- 32816
02.11.2006 08:10 C:\Windows\System\TIMER.DRV --------- 4048
02.11.2006 08:10 C:\Windows\System\MMSYSTEM.DLL --------- 68992
02.11.2006 08:10 C:\Windows\System\mmtask.tsk --------- 1152
02.11.2006 08:10 C:\Windows\System\mouse.drv --------- 2032
02.11.2006 08:10 C:\Windows\System\vga.drv --------- 2176
02.11.2006 08:10 C:\Windows\System\sound.drv --------- 1744
02.11.2006 08:10 C:\Windows\System\keyboard.drv --------- 2000
02.11.2006 08:10 C:\Windows\System\SHELL.DLL --------- 5120
02.11.2006 08:10 C:\Windows\System\system.drv --------- 3360
18.09.2006 22:43 C:\Windows\System\ver.dll --------- 9008
18.09.2006 22:43 C:\Windows\System\olecli.dll --------- 82944
18.09.2006 22:43 C:\Windows\System\lzexpand.dll --------- 9936
18.09.2006 22:35 C:\Windows\System\stdole.tlb --------- 5532
----------------------------------------
C:\Windows\System32
31.10.2010 10:06 C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 --------- 3568
31.10.2010 10:06 C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 --------- 3568
31.10.2010 09:55 C:\Windows\system32\perfh009.dat --------- 586980
31.10.2010 09:55 C:\Windows\system32\perfc009.dat --------- 101052
31.10.2010 09:55 C:\Windows\system32\perfh007.dat --------- 618204
31.10.2010 09:55 C:\Windows\system32\perfc007.dat --------- 122442
31.10.2010 09:55 C:\Windows\system32\PerfStringBackup.INI --------- 1418612
26.10.2010 14:23 C:\Windows\system32\Tasks --------- 4096
25.10.2010 17:31 C:\Windows\system32\drivers --------- 61440
24.10.2010 16:30 C:\Windows\system32\%APPDATA% --------- 0
19.10.2010 20:53 C:\Windows\system32\AU8Settings.ini --------- 144
19.10.2010 13:26 C:\Windows\system32\Adobe --------- 0
19.10.2010 13:19 C:\Windows\system32\Macromed --------- 0
18.10.2010 17:14 C:\Windows\system32\javaws.exe --------- 153376
18.10.2010 17:14 C:\Windows\system32\javaw.exe --------- 145184
18.10.2010 17:14 C:\Windows\system32\java.exe --------- 145184
18.10.2010 17:14 C:\Windows\system32\deployJava1.dll --------- 472808
18.10.2010 16:06 C:\Windows\system32\catroot2 --------- 8192
18.10.2010 16:06 C:\Windows\system32\FNTCACHE.DAT --------- 1774632
16.10.2010 18:43 C:\Windows\system32\jupdate-1.6.0_22-b04.log --------- 4034
16.10.2010 11:45 C:\Windows\system32\AGEIA --------- 0
14.10.2010 14:49 C:\Windows\system32\de-DE --------- 266240
13.10.2010 20:43 C:\Windows\system32\mrt.exe --------- 35385288
13.10.2010 17:05 C:\Windows\system32\catroot --------- 4096
01.10.2010 19:51 C:\Windows\system32\TVUAx --------- 4096
16.09.2010 15:31 C:\Windows\system32\migration --------- 0
16.09.2010 15:31 C:\Windows\system32\wbem --------- 61440
16.09.2010 15:31 C:\Windows\system32\en-US --------- 8192
16.09.2010 15:25 C:\Windows\system32\icrav03.rat --------- 8798
16.09.2010 15:25 C:\Windows\system32\ticrf.rat --------- 1988
13.09.2010 16:46 C:\Windows\system32\wmp.dll --------- 10628096
13.09.2010 14:56 C:\Windows\system32\wmploc.DLL --------- 8147456
08.09.2010 10:17 C:\Windows\system32\QuickTime.qts --------- 69632
08.09.2010 10:17 C:\Windows\system32\QuickTimeVR.qtx --------- 94208
06.09.2010 17:20 C:\Windows\system32\srvsvc.dll --------- 125952
06.09.2010 17:19 C:\Windows\system32\netevent.dll --------- 17920
31.08.2010 23:55 C:\Windows\system32\iedkcs32.dll --------- 460088
31.08.2010 23:47 C:\Windows\system32\mshtml.dll --------- 10199040
31.08.2010 23:46 C:\Windows\system32\jscript9.dll --------- 1355264
31.08.2010 23:45 C:\Windows\system32\ieframe.dll --------- 12348928
31.08.2010 23:44 C:\Windows\system32\html.iec --------- 367104
31.08.2010 23:44 C:\Windows\system32\inetcpl.cpl --------- 1448448
31.08.2010 23:44 C:\Windows\system32\wininet.dll --------- 1122304
31.08.2010 23:44 C:\Windows\system32\ieapfltr.dll --------- 441856
31.08.2010 23:44 C:\Windows\system32\urlmon.dll --------- 1097728
31.08.2010 23:44 C:\Windows\system32\vbscript.dll --------- 424960
31.08.2010 23:43 C:\Windows\system32\webcheck.dll --------- 208384
31.08.2010 23:43 C:\Windows\system32\occache.dll --------- 128000
31.08.2010 23:43 C:\Windows\system32\msrating.dll --------- 166400
31.08.2010 23:43 C:\Windows\system32\url.dll --------- 109568
31.08.2010 23:43 C:\Windows\system32\licmgr10.dll --------- 23552
31.08.2010 23:43 C:\Windows\system32\jsproxy.dll --------- 65024
31.08.2010 23:43 C:\Windows\system32\ieUnatt.exe --------- 142848
31.08.2010 23:43 C:\Windows\system32\SetDepNx.exe --------- 72704
31.08.2010 23:43 C:\Windows\system32\iesysprep.dll --------- 114176
31.08.2010 23:43 C:\Windows\system32\RegisterIEPKEYs.exe --------- 74752
31.08.2010 23:43 C:\Windows\system32\SetIEInstalledDate.exe --------- 76800
31.08.2010 23:43 C:\Windows\system32\advpack.dll --------- 114176
31.08.2010 23:43 C:\Windows\system32\ieaksie.dll --------- 227840
31.08.2010 23:43 C:\Windows\system32\ieakeng.dll --------- 130560
31.08.2010 23:42 C:\Windows\system32\admparse.dll --------- 51200
31.08.2010 23:42 C:\Windows\system32\ieakui.dll --------- 163840
31.08.2010 23:42 C:\Windows\system32\ie4uinit.exe --------- 193024
31.08.2010 23:42 C:\Windows\system32\iesetup.dll --------- 75264
31.08.2010 23:42 C:\Windows\system32\inseng.dll --------- 80384
31.08.2010 23:42 C:\Windows\system32\iernonce.dll --------- 32768
31.08.2010 23:42 C:\Windows\system32\IEAdvpack.dll --------- 110592
31.08.2010 23:42 C:\Windows\system32\jscript.dll --------- 719360
31.08.2010 23:42 C:\Windows\system32\iexpress.exe --------- 150016
31.08.2010 23:42 C:\Windows\system32\iertutil.dll --------- 2056192
31.08.2010 23:42 C:\Windows\system32\wextract.exe --------- 149504
31.08.2010 23:42 C:\Windows\system32\msfeeds.dll --------- 596480
31.08.2010 23:42 C:\Windows\system32\msfeedsbs.dll --------- 44544
31.08.2010 23:42 C:\Windows\system32\dxtmsft.dll --------- 353280
31.08.2010 23:42 C:\Windows\system32\iepeers.dll --------- 111104
31.08.2010 23:42 C:\Windows\system32\icardie.dll --------- 59392
31.08.2010 23:42 C:\Windows\system32\dxtrans.dll --------- 223232
31.08.2010 23:42 C:\Windows\system32\imgutil.dll --------- 33280
31.08.2010 23:42 C:\Windows\system32\msfeedssync.exe --------- 10240
31.08.2010 23:42 C:\Windows\system32\pngfilt.dll --------- 49664
31.08.2010 23:42 C:\Windows\system32\mshtmled.dll --------- 67072
31.08.2010 23:42 C:\Windows\system32\mshtmler.dll --------- 48640
31.08.2010 23:42 C:\Windows\system32\mshta.exe --------- 11264
31.08.2010 23:42 C:\Windows\system32\mshtml.tlb --------- 2381824
31.08.2010 23:42 C:\Windows\system32\tdc.ocx --------- 63488
31.08.2010 23:41 C:\Windows\system32\msls31.dll --------- 160768
31.08.2010 23:41 C:\Windows\system32\ieui.dll --------- 176640
31.08.2010 23:36 C:\Windows\system32\ieuinit.inf --------- 72533
31.08.2010 16:46 C:\Windows\system32\mfc40u.dll --------- 954288
31.08.2010 16:46 C:\Windows\system32\mfc40.dll --------- 954752
31.08.2010 16:44 C:\Windows\system32\comctl32.dll --------- 531968
31.08.2010 14:27 C:\Windows\system32\win32k.sys --------- 2038272
26.08.2010 17:37 C:\Windows\system32\t2embed.dll --------- 157184
20.08.2010 17:05 C:\Windows\system32\wmpmde.dll --------- 867328
18.08.2010 00:54 C:\Windows\system32\XpsGdiConverter.dll --------- 280064
18.08.2010 00:54 C:\Windows\system32\XpsRasterService.dll --------- 135680
18.08.2010 00:52 C:\Windows\system32\MFH264Dec.dll --------- 979456
18.08.2010 00:51 C:\Windows\system32\MFHEAACdec.dll --------- 357376
18.08.2010 00:51 C:\Windows\system32\mfreadwrite.dll --------- 261632
18.08.2010 00:51 C:\Windows\system32\mfmp4src.dll --------- 302592
----------------------------------------
|
|
02.11.2010, 12:38
| #10 |
| | Browser öffnet Seiten von alleine und Windows Hostprozess konnte nicht ausgeführt werdenCode:
ATTFilter
C:\Windows\Prefetch
31.10.2010 10:10 C:\Windows\Prefetch\WERFAULT.EXE-B7E27BE5.pf --------- 92466
31.10.2010 10:09 C:\Windows\Prefetch\CONIME.EXE-B273009A.pf --------- 19852
31.10.2010 10:09 C:\Windows\Prefetch\CMD.EXE-89305D47.pf --------- 18778
31.10.2010 10:09 C:\Windows\Prefetch\SEARCHFILTERHOST.EXE-AA7A1FDD.pf --------- 17950
31.10.2010 10:09 C:\Windows\Prefetch\SEARCHPROTOCOLHOST.EXE-AFAD3EF9.pf --------- 27742
31.10.2010 10:09 C:\Windows\Prefetch\WINRAR.EXE-6F42D4E7.pf --------- 53306
31.10.2010 10:08 C:\Windows\Prefetch\DLLHOST.EXE-71214090.pf --------- 26036
31.10.2010 10:07 C:\Windows\Prefetch\RUNDLL32.EXE-CC74A1C3.pf --------- 22422
31.10.2010 10:06 C:\Windows\Prefetch\WMIPRVSE.EXE-43972D0F.pf --------- 35132
31.10.2010 10:06 C:\Windows\Prefetch\CONTROL.EXE-9459D5A0.pf --------- 39752
31.10.2010 10:06 C:\Windows\Prefetch\HELPPANE.EXE-D1016F9E.pf --------- 110890
31.10.2010 10:05 C:\Windows\Prefetch\TASKENG.EXE-5BAF290C.pf --------- 137784
31.10.2010 10:03 C:\Windows\Prefetch\NOTEPAD.EXE-EB1B961A.pf --------- 23350
31.10.2010 10:03 C:\Windows\Prefetch\WERMGR.EXE-2A1BCBC7.pf --------- 76264
31.10.2010 10:02 C:\Windows\Prefetch\AVWSC.EXE-877F4F63.pf --------- 32042
31.10.2010 10:02 C:\Windows\Prefetch\RUNDLL32.EXE-E447C111.pf --------- 38626
31.10.2010 10:01 C:\Windows\Prefetch\NICO.EXE-75BDB2B1.pf --------- 24214
31.10.2010 10:01 C:\Windows\Prefetch\RSIT.EXE-502122B4.pf --------- 27862
31.10.2010 10:00 C:\Windows\Prefetch\WSQMCONS.EXE-E2CE6542.pf --------- 3136
31.10.2010 09:59 C:\Windows\Prefetch\SYSTEMPROPERTIESPROTECTION.EX-47C43498.pf --------- 49974
31.10.2010 09:58 C:\Windows\Prefetch\SVCHOST.EXE-8FD92526.pf --------- 19088
31.10.2010 09:58 C:\Windows\Prefetch\VSSVC.EXE-04D079CC.pf --------- 118982
31.10.2010 09:58 C:\Windows\Prefetch\RSTRUI.EXE-4841C8C8.pf --------- 37510
31.10.2010 09:58 C:\Windows\Prefetch\VERCLSID.EXE-4D95F5A7.pf --------- 24976
31.10.2010 09:58 C:\Windows\Prefetch\RUNDLL32.EXE-0F830E3C.pf --------- 45136
31.10.2010 09:55 C:\Windows\Prefetch\CLTLMH.EXE-B0401503.pf --------- 27786
31.10.2010 09:54 C:\Windows\Prefetch\WMIADAP.EXE-369DF1CD.pf --------- 36480
31.10.2010 09:53 C:\Windows\Prefetch\HPHC_SERVICE.EXE-B8B935C8.pf --------- 42848
31.10.2010 09:52 C:\Windows\Prefetch\WSCSTUB.EXE-B9878F16.pf --------- 28132
31.10.2010 09:52 C:\Windows\Prefetch\TASKMGR.EXE-72398DC0.pf --------- 51886
31.10.2010 09:52 C:\Windows\Prefetch\LOGONUI.EXE-1BEE4A84.pf --------- 32906
31.10.2010 09:51 C:\Windows\Prefetch\ReadyBoot --------- 4096
31.10.2010 09:51 C:\Windows\Prefetch\OPERA.EXE-E1830577.pf --------- 106390
31.10.2010 09:51 C:\Windows\Prefetch\WLCOMM.EXE-648065CA.pf --------- 76520
31.10.2010 09:51 C:\Windows\Prefetch\UNSECAPP.EXE-CD982D99.pf --------- 26296
31.10.2010 09:51 C:\Windows\Prefetch\IPODSERVICE.EXE-FE1A6FF7.pf --------- 19336
31.10.2010 09:51 C:\Windows\Prefetch\WMPLAYER.EXE-9DE758AE.pf --------- 58554
31.10.2010 09:51 C:\Windows\Prefetch\NTOSBOOT-B00DFAAD.pf --------- 2916296
30.10.2010 23:15 C:\Windows\Prefetch\AgGlFgAppHistory.db --------- 2150625
30.10.2010 23:15 C:\Windows\Prefetch\AgGlFaultHistory.db --------- 930309
30.10.2010 23:15 C:\Windows\Prefetch\AgGlGlobalHistory.db --------- 3449370
30.10.2010 23:15 C:\Windows\Prefetch\PfSvPerfStats.bin --------- 508
30.10.2010 23:15 C:\Windows\Prefetch\AgRobust.db --------- 191796
30.10.2010 23:06 C:\Windows\Prefetch\RUNDLL32.EXE-D05D2FD4.pf --------- 44322
30.10.2010 23:03 C:\Windows\Prefetch\UPDATE.EXE-3FBE35E6.pf --------- 318412
30.10.2010 23:03 C:\Windows\Prefetch\AVCENTER.EXE-087DA68F.pf --------- 120608
30.10.2010 23:03 C:\Windows\Prefetch\AVCONFIG.EXE-25BB6BD8.pf --------- 80456
30.10.2010 22:52 C:\Windows\Prefetch\ALG.EXE-5BBFFD2F.pf --------- 19862
30.10.2010 22:52 C:\Windows\Prefetch\PSI.EXE-973712FB.pf --------- 4300
30.10.2010 22:51 C:\Windows\Prefetch\SVCHOST.EXE-B421B09A.pf --------- 97218
30.10.2010 22:28 C:\Windows\Prefetch\SCHTASKS.EXE-2DE769BF.pf --------- 1182
30.10.2010 22:14 C:\Windows\Prefetch\AVNOTIFY.EXE-4291C867.pf --------- 63474
30.10.2010 22:14 C:\Windows\Prefetch\AVSCAN.EXE-1FDA38F3.pf --------- 190804
30.10.2010 22:12 C:\Windows\Prefetch\SVCHOST.EXE-135A30D8.pf --------- 53588
29.10.2010 22:21 C:\Windows\Prefetch\AgGlUAD_P_S-1-5-21-1520337693-1879009250-3396951402-1001.db --------- 976780
29.10.2010 22:21 C:\Windows\Prefetch\AgGlUAD_S-1-5-21-1520337693-1879009250-3396951402-1001.db --------- 2118552
29.10.2010 22:20 C:\Windows\Prefetch\AgCx_SC1.db --------- 739965
29.10.2010 22:20 C:\Windows\Prefetch\AgCx_SC1.db.trx --------- 147970
29.10.2010 19:43 C:\Windows\Prefetch\ASOELNCH.EXE-9154F828.pf --------- 27326
29.10.2010 18:43 C:\Windows\Prefetch\ADOBEARM.EXE-ACA00A4A.pf --------- 21986
29.10.2010 17:29 C:\Windows\Prefetch\INTEGRATOR.EXE-6F86C88D.pf --------- 71018
29.10.2010 17:29 C:\Windows\Prefetch\INITIALIZE.EXE-68F10AC4.pf --------- 36328
29.10.2010 17:29 C:\Windows\Prefetch\REGSVR32.EXE-55A4EE79.pf --------- 34004
29.10.2010 17:28 C:\Windows\Prefetch\IS-4M0O6.TMP-D450AF1C.pf --------- 44314
29.10.2010 17:28 C:\Windows\Prefetch\GUSETUPNEW.EXE-16019D4D.pf --------- 27254
29.10.2010 17:28 C:\Windows\Prefetch\ASKINSTALLCHECKER.EXE-EFB499D6.pf --------- 32596
29.10.2010 17:05 C:\Windows\Prefetch\GAMEOVERLAYUI.EXE-E24BB2EF.pf --------- 70340
29.10.2010 17:05 C:\Windows\Prefetch\HL2.EXE-6869E142.pf --------- 175344
29.10.2010 16:55 C:\Windows\Prefetch\PLUGIN-CONTAINER.EXE-1D5F6C6B.pf --------- 93922
29.10.2010 16:54 C:\Windows\Prefetch\FIREFOX.EXE-E60C0AA7.pf --------- 251606
29.10.2010 16:54 C:\Windows\Prefetch\STEAM.EXE-786CC607.pf --------- 12900
29.10.2010 14:17 C:\Windows\Prefetch\HELPER.EXE-36267E56.pf --------- 28276
29.10.2010 14:17 C:\Windows\Prefetch\UPDATER.EXE-1FA191F8.pf --------- 166280
29.10.2010 14:14 C:\Windows\Prefetch\KHALMNPR.EXE-EB9C0624.pf --------- 5970
29.10.2010 14:13 C:\Windows\Prefetch\EXPLORER.EXE-7A3328DA.pf --------- 277970
29.10.2010 14:13 C:\Windows\Prefetch\CCSVCHST.EXE-589EE114.pf --------- 83512
29.10.2010 14:13 C:\Windows\Prefetch\DWM.EXE-AEABE78B.pf --------- 32134
29.10.2010 14:13 C:\Windows\Prefetch\USERINIT.EXE-F39AB672.pf --------- 16270
29.10.2010 14:13 C:\Windows\Prefetch\DLLHOST.EXE-893DDF55.pf --------- 45434
29.10.2010 14:13 C:\Windows\Prefetch\RUNDLL32.EXE-7768279B.pf --------- 952
28.10.2010 19:43 C:\Windows\Prefetch\SYMERR.EXE-181CA669.pf --------- 3128
28.10.2010 19:29 C:\Windows\Prefetch\JAVA.EXE-066C5985.pf --------- 101530
28.10.2010 19:29 C:\Windows\Prefetch\JP2LAUNCHER.EXE-42754454.pf --------- 17060
28.10.2010 19:23 C:\Windows\Prefetch\MFPMP.EXE-73140A33.pf --------- 62114
28.10.2010 19:15 C:\Windows\Prefetch\VLC.EXE-CE8E9BE1.pf --------- 279658
28.10.2010 19:14 C:\Windows\Prefetch\DIVX PLUS PLAYER.EXE-50BD3554.pf --------- 150256
28.10.2010 19:13 C:\Windows\Prefetch\RUNDLL32.EXE-C21D3DCD.pf --------- 40822
28.10.2010 19:03 C:\Windows\Prefetch\DISTNOTED.EXE-6676BA54.pf --------- 21604
28.10.2010 19:03 C:\Windows\Prefetch\APPLEMOBILEDEVICEHELPER.EXE-B651274A.pf --------- 44272
28.10.2010 19:03 C:\Windows\Prefetch\ITUNES.EXE-049DB451.pf --------- 142856
28.10.2010 19:03 C:\Windows\Prefetch\SAFARI.EXE-29E0FDAD.pf --------- 150600
28.10.2010 19:03 C:\Windows\Prefetch\SOFTWAREUPDATE.EXE-2B0C49F7.pf --------- 111502
28.10.2010 19:03 C:\Windows\Prefetch\DLLHOST.EXE-91B07125.pf --------- 27408
28.10.2010 19:01 C:\Windows\Prefetch\APPLESYNCNOTIFIER.EXE-B83D62EB.pf --------- 46872
28.10.2010 19:00 C:\Windows\Prefetch\SETUPADMIN.EXE-8CCF9633.pf --------- 13624
28.10.2010 19:00 C:\Windows\Prefetch\MSIEXEC.EXE-B5AFA339.pf --------- 45142
28.10.2010 18:52 C:\Windows\Prefetch\ITUNESHELPER.EXE-302622F9.pf --------- 28242
28.10.2010 18:51 C:\Windows\Prefetch\ITUNESPHOTOPROCESSOR.EXE-0D78BCAB.pf --------- 12410
28.10.2010 18:51 C:\Windows\Prefetch\DIFXINSTALL32.EXE-ED9609C9.pf --------- 34558
28.10.2010 18:49 C:\Windows\Prefetch\ITUNESSETUP.EXE-6DBAE2C9.pf --------- 15514
28.10.2010 18:48 C:\Windows\Prefetch\IEXPLORE.EXE-1B894AFB.pf --------- 92788
28.10.2010 18:40 C:\Windows\Prefetch\ACRORD32INFO.EXE-E3F62CBD.pf --------- 51178
28.10.2010 18:39 C:\Windows\Prefetch\QUICKTIMEPLAYER.EXE-5CACBC1C.pf --------- 26860
28.10.2010 18:37 C:\Windows\Prefetch\RUNDLL32.EXE-B04C85B7.pf --------- 44676
28.10.2010 17:51 C:\Windows\Prefetch\JAVAW.EXE-C4EA16F0.pf --------- 94394
28.10.2010 17:51 C:\Windows\Prefetch\JAUCHECK.EXE-04AFF24E.pf --------- 24366
28.10.2010 17:51 C:\Windows\Prefetch\JAVAWS.EXE-25FD1E0F.pf --------- 20218
28.10.2010 17:10 C:\Windows\Prefetch\RUNDLL32.EXE-F452D79D.pf --------- 3284
28.10.2010 17:01 C:\Windows\Prefetch\Layout.ini --------- 1543366
28.10.2010 16:55 C:\Windows\Prefetch\LOGON.SCR-7C80CA1C.pf --------- 36040
28.10.2010 16:27 C:\Windows\Prefetch\GOOGLETOOLBARNOTIFIER.EXE-9F32D4F0.pf --------- 25306
28.10.2010 16:24 C:\Windows\Prefetch\WINLOGON.EXE-8163EECC.pf --------- 17058
28.10.2010 16:24 C:\Windows\Prefetch\CSRSS.EXE-8C04D631.pf --------- 27980
28.10.2010 16:24 C:\Windows\Prefetch\SMSS.EXE-1DCD0EB1.pf --------- 2240
27.10.2010 19:33 C:\Windows\Prefetch\CCLEANER.EXE-7590636D.pf --------- 34216
23.10.2010 13:59 C:\Windows\Prefetch\AgCx_SC3_87B69224.db --------- 507423
23.10.2010 13:54 C:\Windows\Prefetch\AgCx_S1_S-1-5-21-1520337693-1879009250-3396951402-1001.snp.db --------- 3877723
05.10.2010 13:59 C:\Windows\Prefetch\AgCx_SC2.db --------- 810460
24.07.2010 20:23 C:\Windows\Prefetch\AgGlUAD_P_S-1-5-21-1520337693-1879009250-3396951402-1002.db --------- 906521
24.07.2010 20:23 C:\Windows\Prefetch\AgGlUAD_S-1-5-21-1520337693-1879009250-3396951402-1002.db --------- 419210
02.02.2010 17:30 C:\Windows\Prefetch\AgAppLaunch.db --------- 332116
----------------------------------------
C:\Windows\Tasks
31.10.2010 09:50 C:\Windows\Tasks\SA.DAT --------- 6
30.10.2010 23:15 C:\Windows\Tasks\SCHEDLGU.TXT --------- 32534
29.10.2010 17:29 C:\Windows\Tasks\GlaryInitialize.job --------- 304
28.10.2010 16:02 C:\Windows\Tasks\Norton Security Scan for Nico.job --------- 472
----------------------------------------
C:\Windows\Temp
31.10.2010 10:10 C:\Windows\Temp\WER1C68.tmp.hdmp --------- 109183602
31.10.2010 10:10 C:\Windows\Temp\WER1C57.tmp.appcompat.txt --------- 18556
31.10.2010 10:10 C:\Windows\Temp\WER1C46.tmp.version.txt --------- 476
31.10.2010 09:50 C:\Windows\Temp\nmsmc_DQLWinService.log --------- 149
29.10.2010 18:43 C:\Windows\Temp\AdobeARM.log --------- 762
27.10.2010 16:05 C:\Windows\Temp\CPSSMasterCatalog.ini --------- 417
----------------------------------------
C:\Users\Nico\AppData\Local\Temp
31.10.2010 09:55 C:\Users\Nico\AppData\Local\Temp\jusched.log --------- 2011
31.10.2010 09:50 C:\Users\Nico\AppData\Local\Temp\WPDNSE --------- 0
31.10.2010 09:50 C:\Users\Nico\AppData\Local\Temp\divDC2B.tmp --------- 0
31.10.2010 09:50 C:\Users\Nico\AppData\Local\Temp\AdobeARM.log --------- 4983
31.10.2010 09:50 C:\Users\Nico\AppData\Local\Temp\Nico.bmp --------- 31832
30.10.2010 22:12 C:\Users\Nico\AppData\Local\Temp\divDF94.tmp --------- 0
29.10.2010 17:29 C:\Users\Nico\AppData\Local\Temp\~gu-ver.dat --------- 590
29.10.2010 16:54 C:\Users\Nico\AppData\Local\Temp\scoped_dir17254 --------- 0
29.10.2010 16:54 C:\Users\Nico\AppData\Local\Temp\scoped_dir19331 --------- 0
29.10.2010 15:48 C:\Users\Nico\AppData\Local\Temp\MessengerCache --------- 8192
29.10.2010 14:14 C:\Users\Nico\AppData\Local\Temp\div46A0.tmp --------- 0
28.10.2010 19:32 C:\Users\Nico\AppData\Local\Temp\hsperfdata_Nico --------- 0
28.10.2010 19:08 C:\Users\Nico\AppData\Local\Temp\divFA64.tmp --------- 0
28.10.2010 19:00 C:\Users\Nico\AppData\Local\Temp\SetupAdmin10F0.log --------- 86
28.10.2010 18:49 C:\Users\Nico\AppData\Local\Temp\QTInstallCode.log --------- 763
28.10.2010 18:36 C:\Users\Nico\AppData\Local\Temp\divDE2D.tmp --------- 0
27.10.2010 17:07 C:\Users\Nico\AppData\Local\Temp\div8AD1.tmp --------- 0
19.10.2010 17:17 C:\Users\Nico\AppData\Local\Temp\Low --------- 0
----------------------------------------
C:\Program Files
31.10.2010 10:01 C:\Program Files\trend micro --------- 0
29.10.2010 14:17 C:\Program Files\Mozilla Firefox --------- 24576
28.10.2010 19:00 C:\Program Files\Safari --------- 4096
24.10.2010 16:30 C:\Program Files\Windows Media Player --------- 4096
19.10.2010 17:19 C:\Program Files\Adobe --------- 0
19.10.2010 13:21 C:\Program Files\NOS --------- 0
18.10.2010 18:44 C:\Program Files\Viewpoint --------- 4096
17.10.2010 19:13 C:\Program Files\Windows Sidebar --------- 4096
17.10.2010 19:13 C:\Program Files\PC-Doctor 5 for Windows --------- 839680
17.10.2010 19:13 C:\Program Files\Microsoft Visual Studio 8 --------- 0
17.10.2010 19:13 C:\Program Files\HP --------- 0
17.10.2010 19:09 C:\Program Files\DivX --------- 4096
16.10.2010 18:43 C:\Program Files\Java --------- 4096
16.10.2010 11:45 C:\Program Files\AGEIA Technologies --------- 8192
16.10.2010 08:18 C:\Program Files\Opera --------- 4096
07.10.2010 17:58 C:\Program Files\iTunes --------- 8192
07.10.2010 17:58 C:\Program Files\iPod --------- 0
01.10.2010 12:48 C:\Program Files\Microsoft Silverlight --------- 4096
29.09.2010 21:03 C:\Program Files\Common Files --------- 8192
29.09.2010 21:02 C:\Program Files\InstallShield Installation Information --------- 4096
16.09.2010 15:31 C:\Program Files\Internet Explorer --------- 4096
13.08.2010 09:18 C:\Program Files\Movie Maker --------- 4096
01.08.2010 11:23 C:\Program Files\DVDVideoSoft --------- 4096
15.07.2010 13:08 C:\Program Files\VideoLAN --------- 0
15.07.2010 12:41 C:\Program Files\PPLive --------- 0
28.06.2010 18:20 C:\Program Files\DVD Audio Extractor --------- 0
25.05.2010 12:38 C:\Program Files\Norton Security Scan --------- 0
25.05.2010 12:38 C:\Program Files\NortonInstaller --------- 0
18.05.2010 11:34 C:\Program Files\Symantec --------- 0
18.05.2010 11:33 C:\Program Files\Norton Internet Security --------- 0
13.05.2010 16:23 C:\Program Files\Windows Mail --------- 4096
18.04.2010 21:16 C:\Program Files\Microsoft Works --------- 28672
14.04.2010 15:45 C:\Program Files\MSBuild --------- 0
14.04.2010 15:45 C:\Program Files\Microsoft Office --------- 4096
14.04.2010 15:45 C:\Program Files\Microsoft Visual Studio --------- 0
14.04.2010 15:44 C:\Program Files\Microsoft.NET --------- 0
13.04.2010 15:35 C:\Program Files\GIMP-2.0 --------- 0
10.04.2010 22:13 C:\Program Files\Veetle --------- 0
03.04.2010 20:04 C:\Program Files\Avira --------- 0
13.03.2010 22:46 C:\Program Files\AVS4YOU --------- 4096
25.02.2010 19:50 C:\Program Files\Apple Software Update --------- 4096
22.02.2010 16:00 C:\Program Files\WinRAR --------- 4096
09.02.2010 07:56 C:\Program Files\Windows Calendar --------- 0
09.02.2010 07:56 C:\Program Files\Windows Collaboration --------- 4096
09.02.2010 07:56 C:\Program Files\Windows Photo Gallery --------- 4096
09.02.2010 07:56 C:\Program Files\Windows Defender --------- 4096
03.02.2010 16:33 C:\Program Files\Microsoft --------- 0
03.02.2010 16:33 C:\Program Files\Windows Live --------- 0
03.02.2010 15:18 C:\Program Files\EASEUS --------- 0
02.02.2010 21:41 C:\Program Files\desktop.ini --------- 174
02.02.2010 20:27 C:\Program Files\Logitech --------- 0
02.02.2010 17:50 C:\Program Files\T-Online --------- 0
02.02.2010 17:30 C:\Program Files\Windows NT --------- 4096
02.02.2010 17:30 C:\Program Files\Gemeinsame Dateien --------- 0
15.06.2007 12:37 C:\Program Files\EasyBits --------- 0
02.11.2006 14:01 C:\Program Files\Uninstall Information --------- 0
02.11.2006 13:37 C:\Program Files\Microsoft Games --------- 4096
02.11.2006 13:37 C:\Program Files\Reference Assemblies --------- 0
08.02.2002 01:48 C:\Program Files\Google --------- 4096
08.02.2002 01:48 C:\Program Files\Online-Dienste --------- 4096
08.02.2002 01:46 C:\Program Files\Hewlett-Packard --------- 4096
08.02.2002 01:40 C:\Program Files\muvee Technologies --------- 0
08.02.2002 01:38 C:\Program Files\Roxio --------- 4096
08.02.2002 01:30 C:\Program Files\Intel --------- 0
08.02.2002 01:29 C:\Program Files\Realtek --------- 0
08.02.2002 01:28 C:\Program Files\WinTV --------- 0
----------------------------------------
C:\ProgramData\..
IUSR_NMPR
Default
Nico
Evi
desktop.ini
All Users
Default User
Public
----------------------------------------
C:\Windows\system32\drivers\etc\hosts
127.0.0.1 localhost
----------------------------------------
Abbildname PID Sitzungsname Sitz.-Nr. Speichernutzung
========================= ======== ================ =========== ===============
System Idle Process 0 Services 0 24 K
System 4 Services 0 14.476 K
smss.exe 492 Services 0 800 K
csrss.exe 560 Services 0 6.996 K
wininit.exe 608 Services 0 4.464 K
csrss.exe 616 Console 1 9.648 K
services.exe 652 Services 0 7.504 K
lsass.exe 664 Services 0 4.060 K
lsm.exe 672 Services 0 4.800 K
svchost.exe 828 Services 0 6.072 K
winlogon.exe 860 Console 1 5.916 K
svchost.exe 960 Services 0 6.972 K
svchost.exe 1064 Services 0 14.716 K
svchost.exe 1092 Services 0 78.376 K
svchost.exe 1120 Services 0 142.712 K
audiodg.exe 1204 Services 0 16.588 K
svchost.exe 1316 Services 0 4.820 K
SLsvc.exe 1336 Services 0 11.784 K
svchost.exe 1408 Services 0 12.484 K
svchost.exe 1540 Services 0 14.428 K
spoolsv.exe 1820 Services 0 9.056 K
sched.exe 1844 Services 0 1.772 K
svchost.exe 1856 Services 0 16.236 K
dwm.exe 692 Console 1 76.016 K
taskeng.exe 836 Console 1 11.032 K
explorer.exe 1052 Console 1 71.904 K
RtHDVCpl.exe 2104 Console 1 7.264 K
rundll32.exe 2148 Console 1 7.628 K
rundll32.exe 2156 Console 1 5.704 K
avgnt.exe 2168 Console 1 4.384 K
DivXUpdate.exe 2200 Console 1 15.916 K
jusched.exe 2240 Console 1 3.636 K
iTunesHelper.exe 2320 Console 1 11.144 K
sidebar.exe 2352 Console 1 41.388 K
msnmsgr.exe 2360 Console 1 53.504 K
SetPoint.exe 2400 Console 1 13.036 K
KHALMNPR.exe 2464 Console 1 5.608 K
taskeng.exe 2568 Services 0 5.464 K
avguard.exe 2772 Services 0 7.808 K
AppleMobileDeviceService. 2804 Services 0 4.108 K
DQLWinService.exe 2824 Services 0 3.128 K
HPBtnSrv.exe 2952 Services 0 5.384 K
avshadow.exe 3020 Services 0 5.864 K
LSSrvc.exe 3076 Services 0 4.072 K
ccsvchst.exe 3104 Services 0 8.656 K
svchost.exe 3140 Services 0 5.100 K
svchost.exe 3232 Services 0 6.440 K
ViewpointService.exe 3312 Services 0 3.872 K
svchost.exe 3380 Services 0 4.264 K
SearchIndexer.exe 3492 Services 0 16.132 K
WUDFHost.exe 3828 Services 0 5.492 K
ccsvchst.exe 3872 Console 1 4.832 K
alg.exe 2052 Services 0 4.552 K
WmiPrvSE.exe 2068 Services 0 10.584 K
svchost.exe 2388 Services 0 14.820 K
mobsync.exe 356 Console 1 7.912 K
iPodService.exe 4832 Services 0 5.628 K
wlcomm.exe 5000 Console 1 24.132 K
unsecapp.exe 5048 Console 1 6.328 K
opera.exe 4544 Console 1 165.780 K
HPHC_Service.exe 5068 Services 0 9.092 K
WinRAR.exe 5556 Console 1 14.852 K
SearchProtocolHost.exe 4216 Services 0 8.812 K
SearchFilterHost.exe 4752 Services 0 5.608 K
cmd.exe 3068 Console 1 4.152 K
conime.exe 4860 Console 1 5.224 K
WerFault.exe 5552 Services 0 11.768 K
dllhost.exe 424 Console 1 6.116 K
tasklist.exe 2348 Console 1 5.176 K
WmiPrvSE.exe 5196 Services 0 6.384 K
***** Ende des Scans 31.10.2010 um 10:11:03,87 ***
|
|
02.11.2010, 12:44
| #11 |
| | Browser öffnet Seiten von alleine und Windows Hostprozess konnte nicht ausgeführt werden Also ich hab das jetzt einige male probiert und mir ist aufgefallen, dass ich alles posten kann außer den Teil Code:
ATTFilter C:\Windows
ich weiß nicht warum aber jedesmal wenn ich das reinkopiere und auf antworten drücke, kommt die Meldung "Verbindung wurde vom Server unterbrochen". |
|
02.11.2010, 12:46
| #12 |
| | Browser öffnet Seiten von alleine und Windows Hostprozess konnte nicht ausgeführt werden Also ich hab das jetzt einige male probiert und mir ist aufgefallen, dass ich alles posten kann außer den Teil Code:
ATTFilter C:\Windows
|
|
03.11.2010, 06:29
| #13 |
| /// Helfer-Team | Browser öffnet Seiten von alleine und Windows Hostprozess konnte nicht ausgeführt werden versuche mal als Textdatei oder ZIP-Dateiformat anhängen, oder bei File-Upload.net/kostenlos hochladen und den Link mir hier posten. |
|
03.11.2010, 20:34
| #14 |
| | Browser öffnet Seiten von alleine und Windows Hostprozess konnte nicht ausgeführt werden Also irgendwie wird da von meinem pc des geblockt sobald WindowsUpdat(e) zusammen geschrieben wird. Bei FileUpload hat es auch nicht funktioniert. Also hab ich jetzt in der dritten Zeile bei update einfach das e weggemacht und dann gings... Code:
ATTFilter C:\Windows
31.10.2010 09:59 C:\Windows\setupact.log --------- 0
31.10.2010 09:59 C:\Windows\setuperr.log --------- 0
31.10.2010 09:54 C:\Windows\WindowsUpdat.log --------- 200962
31.10.2010 09:50 C:\Windows\bootstat.dat --------- 67584
18.04.2010 21:14 C:\Windows\win.ini --------- 219
14.03.2010 22:33 C:\Windows\EPMBatch.ept --------- 2196
02.02.2010 21:41 C:\Windows\WindowsShell.Manifest --------- 749
02.02.2010 21:05 C:\Windows\SPInstall.etl --------- 327680
11.04.2009 07:27 C:\Windows\explorer.exe --------- 2926592
18.01.2008 23:33 C:\Windows\regedit.exe --------- 134656
18.01.2008 23:33 C:\Windows\notepad.exe --------- 151040
18.01.2008 23:33 C:\Windows\fveupdate.exe --------- 13312
18.01.2008 23:33 C:\Windows\HelpPane.exe --------- 498176
18.01.2008 23:33 C:\Windows\bfsvc.exe --------- 58880
06.07.2007 12:06 C:\Windows\RtHDVCpl.exe --------- 4669440
07.02.2007 18:57 C:\Windows\WMPrfDeu.prx --------- 33820
16.01.2007 11:39 C:\Windows\RtlUpd.exe --------- 1191936
12.01.2007 17:54 C:\Windows\RtlExUpd.dll --------- 520192
02.11.2006 13:35 C:\Windows\WMSysPr9.prx --------- 316640
02.11.2006 13:34 C:\Windows\twunk_16.exe --------- 49680
02.11.2006 13:34 C:\Windows\twunk_32.exe --------- 31232
02.11.2006 13:34 C:\Windows\twain_32.dll --------- 50688
02.11.2006 13:34 C:\Windows\twain.dll --------- 94784
02.11.2006 10:45 C:\Windows\winhlp32.exe --------- 9216
02.11.2006 10:45 C:\Windows\hh.exe --------- 14848
02.11.2006 08:46 C:\Windows\mib.bin --------- 43131
19.09.2006 12:41 C:\Windows\HomePremium.xml --------- 8328
18.09.2006 22:46 C:\Windows\system.ini --------- 219
18.09.2006 22:43 C:\Windows\_default.pif --------- 707
18.09.2006 22:43 C:\Windows\winhelp.exe --------- 256192
18.09.2006 22:30 C:\Windows\msdfmap.ini --------- 1405
28.03.2006 17:38 C:\Windows\KHALMNPR.Exe --------- 94208
08.02.2002 01:34 C:\Windows\hpqins13.dat --------- 114973
08.02.2002 01:29 C:\Windows\DIFxAPI.dll --------- 319456
08.02.2002 01:29 C:\Windows\HideWin.exe --------- 315392
08.02.2002 01:28 C:\Windows\HCWPNP.INI --------- 3758
08.02.2002 01:19 C:\Windows\csup.txt --------- 12
30.11.1998 17:04 C:\Windows\p_981116.exe --------- 497376
----------------------------------------
|
|
04.11.2010, 04:31
| #15 |
| /// Helfer-Team | Browser öffnet Seiten von alleine und Windows Hostprozess konnte nicht ausgeführt werden 1. - zwei gleichzeitig installierte und aktivierte Antivirenprogramme: AntiVir PersonalEdition Classic & Norton Internet Security - Beide Scanner haben nämlich nur ein Ziel, dein System sinnvoll gegen Schädlingen zu prüfen/schützen. Da aber laufen beide parallel, sie behindern sich gegenseitig und auch eine eine gewaltige Belastung für dein System! Die Folge kann ein Crash sein, oder im schlechtesten fall, kannst Du über eine komplette Neuinstallation freuen! Mehr AV Programme bedeutet nicht mehr Sicherheit! Deinstalliere also eines der AV-Programme und lass nur noch eins auf deinem PC laufen!! 2. ** Update Malwarebytes Anti-Malware, lass es nochmal anhand der folgenden Anleitung laufen:
3. Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen Master Boot Record überprüfen: Geändert von kira (04.11.2010 um 04:40 Uhr) |
|
| Themen zu Browser öffnet Seiten von alleine und Windows Hostprozess konnte nicht ausgeführt werden |
| 32-bit, adresse, arbeitsspeicher, benutzer, bildschirm, bildschirm schwarz, browser, gen, hostprozess, laden, malwarebytes, meldung, neu, neues, problem, prozess, prozesse, sanduhr, schwarz, seite, seiten, spybot, taskmanager, vista, windows, öffnet, öffnet seiten |
Linear-Darstellung
