| |
| |||||||
Log-Analyse und Auswertung: Java-Virus (JAVA/Lamar.RI ; JAVA/Jogek.WK usw.)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
06.06.2013, 15:55
| #1 |
| |  Java-Virus (JAVA/Lamar.RI ; JAVA/Jogek.WK usw.) Hallo geschätzte Helfer, nachdem ich heute Nacht mal einen Avira Scan durchgeführt habe und er mir etwa 50 Funde gemeldet hat, von denen gerade mal zehn in Quarantäne verschoben wurden, wende ich mich an euch (irgendwie nehme ich Oracle nicht ab, dass es einfach mit der Bereinigung des Java-Cache getan ist). Ich habe mit Defogger die entsprechenden Treiber deaktiviert. OTL hat leider nur eine Textdatei ausgespuckt, Extras war nicht dabei. Mit GMER hab ich mich etwas dämlich angestellt: Beim ersten Scan habe ich vergessen WLan zu deaktivieren, beim zweiten Scan hat sich durch den Neustart von mir unbemerkt Avira wieder aktiviert - wobei es keinen Mucks von sich gegeben hat. Ich poste entsprechend mal alle Logs, wenn sie nicht ausreichen kann ich die Scans nochmals durchführen (ich wollte jetzt nur nicht den ganzen Tag meinen Rechner blockieren ohne zu wissen ob es überhaupt nochmal nötig ist). Vielen Dank im Voraus, Ain edit: Der letzte Gmer-Post (ohne WLan, mit aktiviertem Avira) ist mittlerweile wieder verschwunden. Ich nehme mal an er wurde aus Redundanzgründen gelöscht. Avira-Log: Code:
ATTFilter
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Donnerstag, 6. Juni 2013 02:14
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 Home Premium
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : AINSOPHAUR-PC
Versionsinformationen:
BUILD.DAT : 13.0.0.3640 54852 Bytes 18.04.2013 13:29:00
AVSCAN.EXE : 13.6.0.1262 636984 Bytes 06.05.2013 08:45:54
AVSCANRC.DLL : 13.4.0.360 64800 Bytes 26.02.2013 14:56:00
LUKE.DLL : 13.6.0.1262 65080 Bytes 06.05.2013 08:46:08
AVSCPLR.DLL : 13.6.0.1262 92216 Bytes 06.05.2013 08:45:54
AVREG.DLL : 13.6.0.1262 247864 Bytes 06.05.2013 08:45:53
avlode.dll : 13.6.2.1262 432184 Bytes 06.05.2013 08:45:53
avlode.rdf : 13.0.1.12 25921 Bytes 16.05.2013 12:11:54
VBASE000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 09:33:02
VBASE001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 15:24:13
VBASE002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 10:24:36
VBASE003.VDF : 7.11.80.61 2048 Bytes 28.05.2013 10:24:36
VBASE004.VDF : 7.11.80.62 2048 Bytes 28.05.2013 10:24:36
VBASE005.VDF : 7.11.80.63 2048 Bytes 28.05.2013 10:24:37
VBASE006.VDF : 7.11.80.64 2048 Bytes 28.05.2013 10:24:37
VBASE007.VDF : 7.11.80.65 2048 Bytes 28.05.2013 10:24:37
VBASE008.VDF : 7.11.80.66 2048 Bytes 28.05.2013 10:24:37
VBASE009.VDF : 7.11.80.67 2048 Bytes 28.05.2013 10:24:37
VBASE010.VDF : 7.11.80.68 2048 Bytes 28.05.2013 10:24:37
VBASE011.VDF : 7.11.80.69 2048 Bytes 28.05.2013 10:24:37
VBASE012.VDF : 7.11.80.70 2048 Bytes 28.05.2013 10:24:37
VBASE013.VDF : 7.11.80.71 2048 Bytes 28.05.2013 10:24:37
VBASE014.VDF : 7.11.81.57 145408 Bytes 29.05.2013 02:24:39
VBASE015.VDF : 7.11.81.137 130048 Bytes 30.05.2013 15:46:21
VBASE016.VDF : 7.11.81.255 207360 Bytes 31.05.2013 17:53:19
VBASE017.VDF : 7.11.82.91 156160 Bytes 03.06.2013 10:44:23
VBASE018.VDF : 7.11.82.169 220160 Bytes 04.06.2013 10:19:00
VBASE019.VDF : 7.11.82.170 2048 Bytes 04.06.2013 10:19:00
VBASE020.VDF : 7.11.82.171 2048 Bytes 04.06.2013 10:19:01
VBASE021.VDF : 7.11.82.172 2048 Bytes 04.06.2013 10:19:01
VBASE022.VDF : 7.11.82.173 2048 Bytes 04.06.2013 10:19:01
VBASE023.VDF : 7.11.82.174 2048 Bytes 04.06.2013 10:19:01
VBASE024.VDF : 7.11.82.175 2048 Bytes 04.06.2013 10:19:01
VBASE025.VDF : 7.11.82.176 2048 Bytes 04.06.2013 10:19:01
VBASE026.VDF : 7.11.82.177 2048 Bytes 04.06.2013 10:19:01
VBASE027.VDF : 7.11.82.178 2048 Bytes 04.06.2013 10:19:01
VBASE028.VDF : 7.11.82.179 2048 Bytes 04.06.2013 10:19:01
VBASE029.VDF : 7.11.82.180 2048 Bytes 04.06.2013 10:19:01
VBASE030.VDF : 7.11.82.181 2048 Bytes 04.06.2013 10:19:01
VBASE031.VDF : 7.11.83.16 299520 Bytes 05.06.2013 23:07:02
Engineversion : 8.2.12.54
AEVDF.DLL : 8.1.3.2 102774 Bytes 04.06.2013 16:19:06
AESCRIPT.DLL : 8.1.4.118 487805 Bytes 23.05.2013 14:40:32
AESCN.DLL : 8.1.10.4 131446 Bytes 26.03.2013 17:41:17
AESBX.DLL : 8.2.5.12 606578 Bytes 28.08.2012 16:58:06
AERDL.DLL : 8.2.0.118 684408 Bytes 04.06.2013 16:19:06
AEPACK.DLL : 8.3.2.14 754041 Bytes 04.06.2013 16:19:05
AEOFFICE.DLL : 8.1.2.56 205180 Bytes 08.03.2013 17:47:38
AEHEUR.DLL : 8.1.4.396 5931386 Bytes 04.06.2013 16:19:05
AEHELP.DLL : 8.1.27.2 266617 Bytes 04.06.2013 16:19:01
AEGEN.DLL : 8.1.7.4 442741 Bytes 08.05.2013 10:41:59
AEEXP.DLL : 8.4.0.34 201079 Bytes 04.06.2013 16:19:06
AEEMU.DLL : 8.1.3.2 393587 Bytes 19.09.2012 14:42:55
AECORE.DLL : 8.1.31.2 201080 Bytes 22.02.2013 23:33:59
AEBB.DLL : 8.1.1.4 53619 Bytes 22.02.2013 23:33:59
AVWINLL.DLL : 13.6.0.480 26480 Bytes 26.02.2013 14:55:50
AVPREF.DLL : 13.6.0.480 51056 Bytes 26.02.2013 14:55:59
AVREP.DLL : 13.6.0.480 178544 Bytes 22.02.2013 23:34:04
AVARKT.DLL : 13.6.0.1262 258104 Bytes 06.05.2013 08:45:50
AVEVTLOG.DLL : 13.6.0.1262 164920 Bytes 06.05.2013 08:45:52
SQLITE3.DLL : 3.7.0.1 397088 Bytes 19.09.2012 18:17:40
AVSMTP.DLL : 13.6.0.480 62832 Bytes 26.02.2013 14:56:01
NETNT.DLL : 13.6.0.480 16240 Bytes 26.02.2013 14:56:26
RCIMAGE.DLL : 13.4.0.360 4780832 Bytes 26.02.2013 14:55:50
RCTEXT.DLL : 13.6.0.976 69344 Bytes 28.03.2013 01:42:10
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\Program Files (x86)\Avira\AntiVir Desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:, Q:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Beginn des Suchlaufs: Donnerstag, 6. Juni 2013 02:14
Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'D:\'
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf nach versteckten Objekten wird begonnen.
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\ILUsageMask
[HINWEIS] Der Registrierungseintrag ist nicht sichtbar.
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NIUsageMask
[HINWEIS] Der Registrierungseintrag ist nicht sichtbar.
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'MsMpEng.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '101' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '150' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvxdsync.exe' - '58' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLANExt.exe' - '83' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '86' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'cvpnd.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'CxAudMsg64.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'dsiwmis.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'ePowerSvc.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMutilps32.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'EvtEng.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'GREGsvc.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'HerculesDJControlMP3.EXE' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'HiPatchService.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'RIconMan.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '181' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxpers.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'iFrmewrk.exe' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxtray.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'hkcmd.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'UpdaterService.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'NIHardwareService.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'msseces.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'clear.fiAgent.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'IScheduleSvc.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'RegSrvc.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'RS_Service.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'DMREngine.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'sftvsa.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'sftlist.exe' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvtray.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'CVHSVC.EXE' - '91' Modul(e) wurden durchsucht
Durchsuche Prozess 'nusb3mon.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'LManager.exe' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'pcee4.exe' - '80' Modul(e) wurden durchsucht
Durchsuche Prozess 'razerhid.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'BackupManagerTray.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'clear.fiMovieService.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '97' Modul(e) wurden durchsucht
Durchsuche Prozess 'razertra.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'MMDx64Fx.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMworker.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'NisSrv.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'razerofa.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'PresentationFontCache.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'mscorsvw.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAStorDataMgrSvc.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMS.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '117' Modul(e) wurden durchsucht
Durchsuche Prozess 'UNS.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'PMMUpdate.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'EgisUpdate.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'Steam.exe' - '138' Modul(e) wurden durchsucht
Durchsuche Prozess 'SteamService.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '122' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '129' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'mscorsvw.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '3416' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\' <Acer>
[0] Archivtyp: CAB (Microsoft)
--> amd64\winusbcoinstaller2.dll
[1] Archivtyp: RSRC
--> amd64\WUDFUpdate_01009.dll
[2] Archivtyp: RSRC
--> i386\winusbcoinstaller2.dll
[3] Archivtyp: RSRC
--> C:\Users\AinSophAur\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MXKFRC32\ed6.0_RioGrande_Signed_All_1.00.003[1].cab
[4] Archivtyp: CAB (Microsoft)
--> amd64\winusbcoinstaller2.dll
[5] Archivtyp: RSRC
--> amd64\WUDFUpdate_01009.dll
[6] Archivtyp: RSRC
--> i386\winusbcoinstaller2.dll
[7] Archivtyp: RSRC
--> C:\Users\AinSophAur\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QEJU3TXI\Lagan_Signed_All_1.00.001[1].cab
[8] Archivtyp: CAB (Microsoft)
--> amd64\winusbcoinstaller2.dll
[9] Archivtyp: RSRC
--> amd64\WUDFUpdate_01009.dll
[10] Archivtyp: RSRC
--> i386\winusbcoinstaller2.dll
[11] Archivtyp: RSRC
--> C:\Users\AinSophAur\AppData\Local\Temp\jar_cache1435266555697695784.tmp
[12] Archivtyp: ZIP
--> refillLa/antae.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/Java.Agent.BS
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> refillLa/defogWych.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/Java.A.7
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> refillLa/muLeg.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/Java.A.8
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> refillLa/swearGyrenesHuge.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/Java.HLP.I
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> refillLa/ulstersBoonsDaze.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/Java.A.9
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\AinSophAur\AppData\Local\Temp\jar_cache1435266555697695784.tmp
[FUND] Enthält Erkennungsmuster des Exploits EXP/Java.A.9
--> C:\Users\AinSophAur\AppData\Local\Temp\jar_cache2239318221365110019.tmp
[12] Archivtyp: ZIP
--> HclVzzWDdz.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.RI
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> MBun.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.RJ
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> QFibx.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.RK
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> aJDXsQ.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.RM
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> EJFd.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.QV
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\AinSophAur\AppData\Local\Temp\jar_cache2239318221365110019.tmp
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.QV
--> C:\Users\AinSophAur\AppData\Local\Temp\jar_cache3045799240615115189.tmp
[12] Archivtyp: ZIP
--> CIRXuDM.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Jogek.WK
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> Fxi.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Jogek.WL
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\AinSophAur\AppData\Local\Temp\jar_cache3045799240615115189.tmp
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Jogek.WL
--> C:\Users\AinSophAur\AppData\Local\Temp\jar_cache4028565684910736547.tmp
[12] Archivtyp: ZIP
--> CIRXuDM.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Jogek.WK
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> Fxi.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Jogek.WL
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\AinSophAur\AppData\Local\Temp\jar_cache4028565684910736547.tmp
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Jogek.WL
--> C:\Users\AinSophAur\AppData\Local\Temp\jar_cache5548005440347655258.tmp
[12] Archivtyp: ZIP
--> CIRXuDM.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Jogek.WK
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> Fxi.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Jogek.WL
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\AinSophAur\AppData\Local\Temp\jar_cache5548005440347655258.tmp
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Jogek.WL
--> C:\Users\AinSophAur\AppData\Local\Temp\jar_cache6386500639367725703.tmp
[12] Archivtyp: ZIP
--> HclVzzWDdz.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.RI
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> MBun.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.RJ
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> QFibx.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.RK
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> aJDXsQ.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.RM
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> EJFd.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.QV
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\AinSophAur\AppData\Local\Temp\jar_cache6386500639367725703.tmp
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.QV
--> C:\Users\AinSophAur\AppData\Local\Temp\jar_cache666010072619152936.tmp
[12] Archivtyp: ZIP
--> HclVzzWDdz.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.RI
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> MBun.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.RJ
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> QFibx.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.RK
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> aJDXsQ.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.RM
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> EJFd.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.QV
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\AinSophAur\AppData\Local\Temp\jar_cache666010072619152936.tmp
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.QV
--> C:\Users\AinSophAur\AppData\Local\Temp\jar_cache6817727847601395182.tmp
[12] Archivtyp: ZIP
--> HclVzzWDdz.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.RI
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> MBun.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.RJ
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> QFibx.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.RK
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> aJDXsQ.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.RM
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> EJFd.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.QV
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\AinSophAur\AppData\Local\Temp\jar_cache6817727847601395182.tmp
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.QV
--> C:\Users\AinSophAur\AppData\Local\Temp\jar_cache8500513396643307379.tmp
[12] Archivtyp: ZIP
--> CIRXuDM.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Jogek.WK
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> Fxi.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Jogek.WL
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\AinSophAur\AppData\Local\Temp\jar_cache8500513396643307379.tmp
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Jogek.WL
--> C:\Users\AinSophAur\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
[12] Archivtyp: Runtime Packed
--> C:\Users\AinSophAur\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
[13] Archivtyp: Runtime Packed
--> C:\Users\AinSophAur\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
[14] Archivtyp: Runtime Packed
--> C:\Users\AinSophAur\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe
[15] Archivtyp: Runtime Packed
--> C:\Users\AinSophAur\AppData\Local\Temp\jre-6u39-windows-i586-iftw.exe
[16] Archivtyp: Runtime Packed
--> C:\Users\AinSophAur\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
[17] Archivtyp: Runtime Packed
--> C:\Users\AinSophAur\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
[18] Archivtyp: Runtime Packed
--> C:\Users\AinSophAur\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
[19] Archivtyp: Runtime Packed
--> C:\Users\AinSophAur\AppData\Local\Temp\Sony Ericsson\Sony Ericsson PC Companion\AutoUpdate\Sony Ericsson PC Companion_2.02.015_NetStorage.exe
[20] Archivtyp: CAB SFX (self extracting)
--> \Drivers\CurrentSigned.cab
[21] Archivtyp: CAB (Microsoft)
--> C:\Users\AinSophAur\AppData\Local\Temp\Sony Ericsson\Sony Ericsson PC Companion\AutoUpdate\Sony PC Companion_2.10.027_NetStorage.exe
[22] Archivtyp: CAB SFX (self extracting)
--> \Drivers\CurrentSigned.cab
[23] Archivtyp: CAB (Microsoft)
--> C:\Users\AinSophAur\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\7e13a779-395909a2
[24] Archivtyp: ZIP
--> xwtpXrDwc.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Neurl.I
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> Wve.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Treams.JF
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> vpINnypK.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/Java.HLP.FO
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> upRyfwbb.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/Java.HLP.FH
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> KqtW.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Treams.MO
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> kACkgQgwa.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.ltg.22
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> gFGOSJGwGs.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Themod.FP
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> FWJKHCzaIV.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Themod.HT
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> ezwPAc.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.ltg.23
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> DyJTr.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.ltg.24
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> Dcg.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Dermit.GP
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\AinSophAur\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\7e13a779-395909a2
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Dermit.GP
Beginne mit der Suche in 'D:\' <AinSophAur>
Beginne mit der Suche in 'Q:\'
Der zu durchsuchende Pfad Q:\ konnte nicht geöffnet werden!
Systemfehler [5]: Zugriff verweigert
Beginne mit der Desinfektion:
C:\Users\AinSophAur\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\7e13a779-395909a2
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Dldr.Dermit.GP
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '568efceb.qua' verschoben!
C:\Users\AinSophAur\AppData\Local\Temp\jar_cache8500513396643307379.tmp
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Jogek.WL
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4ddad348.qua' verschoben!
C:\Users\AinSophAur\AppData\Local\Temp\jar_cache6817727847601395182.tmp
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.QV
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1f8589a0.qua' verschoben!
C:\Users\AinSophAur\AppData\Local\Temp\jar_cache666010072619152936.tmp
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.QV
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '79b2c662.qua' verschoben!
C:\Users\AinSophAur\AppData\Local\Temp\jar_cache6386500639367725703.tmp
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.QV
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '3c36eb5c.qua' verschoben!
C:\Users\AinSophAur\AppData\Local\Temp\jar_cache5548005440347655258.tmp
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Jogek.WL
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '432dd93d.qua' verschoben!
C:\Users\AinSophAur\AppData\Local\Temp\jar_cache4028565684910736547.tmp
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Jogek.WL
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0f95f577.qua' verschoben!
C:\Users\AinSophAur\AppData\Local\Temp\jar_cache3045799240615115189.tmp
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Jogek.WL
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '738db527.qua' verschoben!
C:\Users\AinSophAur\AppData\Local\Temp\jar_cache2239318221365110019.tmp
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.QV
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5ed79a6a.qua' verschoben!
C:\Users\AinSophAur\AppData\Local\Temp\jar_cache1435266555697695784.tmp
[FUND] Enthält Erkennungsmuster des Exploits EXP/Java.A.9
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '47bfa1f0.qua' verschoben!
Ende des Suchlaufs: Donnerstag, 6. Juni 2013 12:03
Benötigte Zeit: 3:13:38 Stunde(n)
Der Suchlauf wurde vollständig durchgeführt.
55864 Verzeichnisse wurden überprüft
1682236 Dateien wurden geprüft
54 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
10 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
1682182 Dateien ohne Befall
20644 Archive wurden durchsucht
44 Warnungen
12 Hinweise
830225 Objekte wurden beim Rootkitscan durchsucht
2 Versteckte Objekte wurden gefunden
OTL OTL Logfile: Code:
ATTFilter OTL logfile created on: 06.06.2013 16:21:46 - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\AinSophAur\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16576) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,86 Gb Total Physical Memory | 2,35 Gb Available Physical Memory | 60,89% Memory free 7,71 Gb Paging File | 5,85 Gb Available in Paging File | 75,91% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 101,79 Gb Total Space | 21,41 Gb Free Space | 21,03% Space Free | Partition Type: NTFS Drive D: | 348,87 Gb Total Space | 32,14 Gb Free Space | 9,21% Space Free | Partition Type: NTFS Computer Name: AINSOPHAUR-PC | User Name: AinSophAur | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.06.06 13:06:03 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\AinSophAur\Desktop\OTL.exe PRC - [2013.06.05 21:29:08 | 001,641,896 | ---- | M] (Valve Corporation) -- D:\Program Files (x86)\Steam\Steam.exe PRC - [2013.06.05 21:29:08 | 000,543,656 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe PRC - [2013.05.10 00:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2013.05.06 10:45:53 | 000,345,312 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2013.03.28 03:42:27 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2013.03.28 03:42:13 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2013.03.20 12:55:48 | 000,162,856 | ---- | M] (Geek Software GmbH) -- C:\Program Files (x86)\PDF24\pdf24.exe PRC - [2012.12.14 02:42:10 | 000,277,616 | ---- | M] (Intel Corporation) -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe PRC - [2012.01.05 15:22:10 | 000,256,536 | ---- | M] (NTI Corporation) -- C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe PRC - [2012.01.05 15:21:44 | 000,296,984 | ---- | M] (NTI Corporation) -- C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe PRC - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe PRC - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe PRC - [2011.07.01 04:51:13 | 000,418,896 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMutilps32.exe PRC - [2011.07.01 04:51:12 | 000,343,632 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe PRC - [2011.07.01 04:51:11 | 000,353,360 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe PRC - [2011.07.01 04:51:10 | 001,103,440 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe PRC - [2011.05.30 04:54:14 | 000,036,456 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe PRC - [2011.05.20 11:13:06 | 000,120,104 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe PRC - [2011.05.20 11:13:04 | 000,169,352 | ---- | M] () -- C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe PRC - [2011.05.20 10:10:26 | 000,013,592 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe PRC - [2011.05.12 07:04:12 | 000,723,560 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe PRC - [2011.05.09 18:41:56 | 000,177,448 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe PRC - [2011.04.22 18:44:14 | 000,244,624 | ---- | M] (Acer Incorporated) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe PRC - [2011.02.01 23:41:24 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe PRC - [2011.02.01 23:41:20 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe PRC - [2010.12.27 10:30:22 | 001,817,088 | ---- | M] (Realsil Microelectronics Inc.) -- C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe PRC - [2010.11.17 03:53:16 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe PRC - [2010.05.05 17:56:06 | 000,251,392 | ---- | M] () -- C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe PRC - [2010.04.27 15:41:26 | 000,218,112 | ---- | M] () -- C:\Program Files (x86)\Razer\DeathAdder\razertra.exe PRC - [2010.03.23 14:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe PRC - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe PRC - [2010.01.30 01:52:58 | 000,260,640 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe PRC - [2007.12.19 12:58:24 | 000,163,840 | ---- | M] (Razer Inc.) -- C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe ========== Modules (No Company Name) ========== MOD - [2013.06.05 21:29:08 | 001,114,536 | ---- | M] () -- D:\Program Files (x86)\Steam\bin\chromehtml.dll MOD - [2013.05.12 23:42:27 | 000,004,096 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll MOD - [2013.05.07 03:05:20 | 000,654,848 | ---- | M] () -- D:\Program Files (x86)\Steam\SDL2.dll MOD - [2013.03.27 02:16:40 | 020,341,672 | ---- | M] () -- D:\Program Files (x86)\Steam\bin\libcef.dll MOD - [2012.12.11 19:51:10 | 001,100,800 | ---- | M] () -- D:\Program Files (x86)\Steam\bin\avcodec-53.dll MOD - [2012.12.11 19:51:10 | 000,192,000 | ---- | M] () -- D:\Program Files (x86)\Steam\bin\avformat-53.dll MOD - [2012.12.11 19:51:10 | 000,124,416 | ---- | M] () -- D:\Program Files (x86)\Steam\bin\avutil-51.dll MOD - [2012.01.05 15:22:36 | 000,465,344 | ---- | M] () -- C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll MOD - [2011.05.20 11:13:04 | 000,206,216 | ---- | M] () -- C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\CLNetMediaDMA.dll MOD - [2011.05.20 11:13:04 | 000,169,352 | ---- | M] () -- C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe MOD - [2010.05.05 17:56:06 | 000,251,392 | ---- | M] () -- C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe MOD - [2010.04.27 15:41:26 | 000,218,112 | ---- | M] () -- C:\Program Files (x86)\Razer\DeathAdder\razertra.exe ========== Services (SafeList) ========== SRV:64bit: - [2010.12.17 01:18:08 | 000,198,784 | ---- | M] (Conexant Systems Inc.) [Auto | Running] -- C:\Windows\SysNative\CxAudMsg64.exe -- (CxAudMsg) SRV - [2013.06.05 21:29:08 | 000,543,656 | ---- | M] (Valve Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2013.05.25 15:36:45 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.05.10 00:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2013.03.28 03:42:27 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2013.03.28 03:42:13 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2013.01.27 12:34:32 | 000,379,360 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv) SRV - [2013.01.27 12:34:32 | 000,022,056 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc) SRV - [2013.01.17 18:36:16 | 006,383,920 | ---- | M] (Native Instruments GmbH) [Auto | Running] -- C:\Programme\Common Files\Native Instruments\Hardware\NIHardwareService.exe -- (NIHardwareService) SRV - [2012.12.14 02:42:10 | 000,277,616 | ---- | M] (Intel Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs) SRV - [2012.12.05 16:39:26 | 000,384,888 | ---- | M] (BlueStack Systems, Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe -- (BstHdLogRotatorSvc) SRV - [2012.12.05 16:39:08 | 000,393,080 | ---- | M] (BlueStack Systems, Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\BlueStacks\HD-Service.exe -- (BstHdAndroidSvc) SRV - [2012.10.08 12:42:54 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2012.08.15 12:44:44 | 000,008,704 | ---- | M] (Hi-Rez Studios) [Auto | Running] -- D:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe -- (HiPatchService) SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.01.05 15:22:10 | 000,256,536 | ---- | M] (NTI Corporation) [Auto | Running] -- C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc) SRV - [2011.12.01 11:48:54 | 000,018,944 | ---- | M] (Hercules®) [Auto | Running] -- C:\Programme\Hercules\Audio\DJ Console Series\drivers\amd64\HerculesDJControlMP3.EXE -- (HerculesDJControlMP3) SRV - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa) SRV - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist) SRV - [2011.09.25 03:40:50 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2011.07.01 04:51:11 | 000,353,360 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService) SRV - [2011.06.21 21:55:04 | 000,173,424 | ---- | M] (Egis Technology Inc. ) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe -- (EgisTec Ticket Service) SRV - [2011.05.30 04:54:14 | 000,036,456 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService) SRV - [2011.05.20 10:10:26 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) SRV - [2011.05.02 14:27:50 | 001,517,328 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) SRV - [2011.05.02 14:13:54 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS) SRV - [2011.05.02 14:10:26 | 000,844,560 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) SRV - [2011.04.22 18:44:14 | 000,244,624 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Live Updater Service) SRV - [2011.03.29 06:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2011.03.28 09:41:00 | 000,799,848 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer PowerSmart Manager\ePowerSvc.exe -- (ePowerSvc) SRV - [2011.02.01 23:41:24 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) SRV - [2011.02.01 23:41:20 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) SRV - [2010.12.27 10:30:22 | 001,817,088 | ---- | M] (Realsil Microelectronics Inc.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe -- (IconMan_R) SRV - [2010.11.29 15:00:56 | 000,149,504 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Programme\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost) SRV - [2010.10.12 19:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService) SRV - [2010.09.23 03:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV - [2010.03.23 14:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.01.30 01:52:58 | 000,260,640 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe -- (RS_Service) SRV - [2010.01.09 22:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2013.05.12 23:42:27 | 000,030,496 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\nvpciflt.sys -- (nvpciflt) DRV:64bit: - [2013.03.28 03:42:31 | 000,130,016 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2013.03.28 03:42:31 | 000,100,712 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2013.03.28 03:42:31 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2013.01.20 16:59:04 | 000,130,008 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv) DRV:64bit: - [2012.12.14 02:42:22 | 005,353,888 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2012.12.09 19:55:18 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV:64bit: - [2012.08.23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:64bit: - [2012.08.23 16:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:64bit: - [2012.08.23 16:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2012.07.22 20:41:38 | 000,024,672 | ---- | M] (Resplendence Software Projects Sp.) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rspLLL64.sys -- (rspLLL) DRV:64bit: - [2012.07.03 12:58:00 | 000,031,744 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgandnetadb.sys -- (andnetadb) DRV:64bit: - [2012.07.03 12:50:00 | 000,036,352 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgandnetmodem64.sys -- (ANDNetModem) DRV:64bit: - [2012.07.03 12:50:00 | 000,029,184 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgandnetdiag64.sys -- (AndNetDiag) DRV:64bit: - [2012.03.02 17:34:35 | 000,027,176 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggsemc.sys -- (ggsemc) DRV:64bit: - [2012.03.02 17:34:35 | 000,013,352 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggflt.sys -- (ggflt) DRV:64bit: - [2012.03.02 17:03:00 | 000,034,816 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64modem.sys -- (USBModem) DRV:64bit: - [2012.03.02 17:03:00 | 000,028,160 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64diag.sys -- (UsbDiag) DRV:64bit: - [2012.03.02 17:03:00 | 000,017,920 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64bus.sys -- (usbbus) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2012.02.22 12:23:14 | 000,358,480 | ---- | M] (Native Instruments GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ks2avs.sys -- (ks2avs) DRV:64bit: - [2012.02.22 12:23:14 | 000,080,464 | ---- | M] (Native Instruments GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ks2usb.sys -- (ks2usb_svc) DRV:64bit: - [2011.12.27 16:43:48 | 000,297,808 | ---- | M] (© Guillemot R&D, 2010. All rights reserved.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HDJAsioK.sys -- (HDJAsioK) DRV:64bit: - [2011.12.27 16:43:48 | 000,229,200 | ---- | M] (© Guillemot R&D, 2010. All rights reserved.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HDJBulk.sys -- (Bulk) DRV:64bit: - [2011.12.27 16:43:46 | 000,251,728 | ---- | M] (© Guillemot R&D, 2011. All rights reserved.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HDJMidi.sys -- (HDJMidi) DRV:64bit: - [2011.10.01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol) DRV:64bit: - [2011.10.01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay) DRV:64bit: - [2011.10.01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir) DRV:64bit: - [2011.10.01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs) DRV:64bit: - [2011.08.03 18:09:01 | 000,062,776 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk) DRV:64bit: - [2011.08.03 18:09:01 | 000,022,648 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter) DRV:64bit: - [2011.08.03 18:09:01 | 000,020,520 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ) DRV:64bit: - [2011.07.14 07:35:47 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.07.14 07:35:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.06.21 15:19:14 | 000,025,496 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iwdbus.sys -- (iwdbus) DRV:64bit: - [2011.06.21 15:19:12 | 000,034,200 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\intelaud.sys -- (intaud_WaveExtensible) DRV:64bit: - [2011.05.20 09:53:44 | 000,557,848 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2011.05.01 08:33:06 | 008,593,920 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) DRV:64bit: - [2011.04.05 13:26:26 | 000,142,632 | ---- | M] (ELAN Microelectronics Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD) DRV:64bit: - [2011.03.25 04:49:24 | 001,583,744 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService) DRV:64bit: - [2011.03.10 06:01:45 | 000,018,432 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr) DRV:64bit: - [2011.03.10 06:01:45 | 000,017,408 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper) DRV:64bit: - [2011.02.10 08:52:34 | 000,181,760 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc) DRV:64bit: - [2011.02.10 08:52:34 | 000,082,432 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub) DRV:64bit: - [2011.01.12 10:10:44 | 000,333,928 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsPStor.sys -- (RSPCIESTOR) DRV:64bit: - [2010.11.29 15:00:04 | 000,016,120 | ---- | M] (Intel(R) Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB) DRV:64bit: - [2010.11.21 05:23:47 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus) DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.08 06:44:40 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C) DRV:64bit: - [2010.10.20 02:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) DRV:64bit: - [2010.10.15 10:28:18 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) DRV:64bit: - [2010.10.01 01:16:34 | 000,013,312 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VKbms.sys -- (VKbms) DRV:64bit: - [2010.05.11 12:11:38 | 002,229,608 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr) DRV:64bit: - [2010.03.23 17:37:34 | 000,012,032 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\danew.sys -- (danewFltr) DRV:64bit: - [2010.03.23 14:29:46 | 000,304,784 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CVPNDRVA.sys -- (CVPNDRVA) DRV:64bit: - [2010.02.08 09:32:00 | 000,014,992 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CVirtA64.sys -- (CVirtA) DRV:64bit: - [2009.08.10 16:25:32 | 000,047,104 | ---- | M] (Cypress Semiconductor) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CYUSB.sys -- (CYUSB) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 03:18:06 | 000,281,088 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BrSerIb.sys -- (BrSerIb) DRV:64bit: - [2009.06.10 22:41:10 | 000,015,360 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BrUsbSIb.sys -- (BrUsbSIb) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2008.11.16 19:39:44 | 000,157,968 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dne64x.sys -- (DNE) DRV - [2012.12.05 16:39:18 | 000,071,032 | ---- | M] (BlueStack Systems) [Kernel | Auto | Running] -- C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys -- (BstHdDrv) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: mdsata.sys -- (amdsata) DRV:64bit: - [2011.07.14 07:35:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.06.21 15:19:14 | 000,025,496 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iwdbus.sys -- (iwdbus) DRV:64bit: - [2011.06.21 15:19:12 | 000,034,200 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\intelaud.sys -- (intaud_WaveExtensible) DRV:64bit: - [2011.05.20 09:53:44 | 000,557,848 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2011.05.01 08:33:06 | 008,593,920 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) DRV:64bit: - [2011.04.05 13:26:26 | 000,142,632 | ---- | M] (ELAN Microelectronics Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD) DRV:64bit: - [2011.03.25 04:49:24 | 001,583,744 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService) DRV:64bit: - [2011.03.10 06:01:45 | 000,018,432 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr) DRV:64bit: - [2011.03.10 06:01:45 | 000,017,408 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper) DRV:64bit: - [2011.02.10 08:52:34 | 000,181,760 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc) DRV:64bit: - [2011.02.10 08:52:34 | 000,082,432 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub) DRV:64bit: - [2011.01.12 10:10:44 | 000,333,928 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsPStor.sys -- (RSPCIESTOR) DRV:64bit: - [2010.11.29 15:00:04 | 000,016,120 | ---- | M] (Intel(R) Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB) DRV:64bit: - [2010.11.21 05:23:47 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus) DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.08 06:44:40 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C) DRV:64bit: - [2010.10.20 02:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) DRV:64bit: - [2010.10.15 10:28:18 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) DRV:64bit: - [2010.10.01 01:16:34 | 000,013,312 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VKbms.sys -- (VKbms) DRV:64bit: - [2010.05.11 12:11:38 | 002,229,608 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr) DRV:64bit: - [2010.03.23 17:37:34 | 000,012,032 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\danew.sys -- (danewFltr) DRV:64bit: - [2010.03.23 14:29:46 | 000,304,784 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CVPNDRVA.sys -- (CVPNDRVA) DRV:64bit: - [2010.02.08 09:32:00 | 000,014,992 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CVirtA64.sys -- (CVirtA) DRV:64bit: - [2009.08.10 16:25:32 | 000,047,104 | ---- | M] (Cypress Semiconductor) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CYUSB.sys -- (CYUSB) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 03:18:06 | 000,281,088 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BrSerIb.sys -- (BrSerIb) DRV:64bit: - [2009.06.10 22:41:10 | 000,015,360 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BrUsbSIb.sys -- (BrUsbSIb) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2008.11.16 19:39:44 | 000,157,968 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dne64x.sys -- (DNE) DRV - [2012.12.05 16:39:18 | 000,071,032 | ---- | M] (BlueStack Systems) [Kernel | Auto | Running] -- C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys -- (BstHdDrv) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "hxxp://www.spiegel.de/" FF - prefs.js..extensions.enabledAddons: %7Bc50ca3c4-5656-43c2-a061-13e717f73fc8%7D:4.2.5 FF - prefs.js..extensions.enabledAddons: ich%40maltegoetz.de:1.4.8 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0 FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.11.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.11.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: D:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll () FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}: C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2013.01.27 21:49:17 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.02.25 22:51:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\AinSophAur\AppData\Roaming\mozilla\Extensions [2013.04.11 14:17:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\AinSophAur\AppData\Roaming\mozilla\Firefox\Profiles\1kt90l9d.default\extensions [2012.04.01 15:42:26 | 000,000,000 | ---D | M] (Разпознаване на устройство Logitech) -- C:\Users\AinSophAur\AppData\Roaming\mozilla\Firefox\Profiles\1kt90l9d.default\extensions\DeviceDetection@logitech.com [2013.04.11 14:17:21 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\AinSophAur\AppData\Roaming\mozilla\Firefox\Profiles\1kt90l9d.default\extensions\ich@maltegoetz.de [2013.01.15 00:48:15 | 000,316,778 | ---- | M] () (No name found) -- C:\Users\AinSophAur\AppData\Roaming\mozilla\firefox\profiles\1kt90l9d.default\extensions\{c50ca3c4-5656-43c2-a061-13e717f73fc8}.xpi [2013.05.25 15:36:46 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2013.05.25 15:36:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2013.05.25 15:36:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2013.05.25 15:36:23 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2013.05.25 15:36:46 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions [2013.05.25 15:36:46 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.) O4:64bit: - HKLM..\Run: [ETDCtrl] C:\Programme\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.) O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IntelPAN] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation) O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [Power Management] C:\Programme\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe (Acer Incorporated) O4 - HKLM..\Run: [ArcadeMovieService] C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe (CyberLink Corp.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (NTI Corporation) O4 - HKLM..\Run: [DeathAdder] C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe () O4 - HKLM..\Run: [Dolby Home Theater v4] C:\Dolby PCEE4\pcee4.exe (Dolby Laboratories Inc.) O4 - HKLM..\Run: [Hercules DJ Series] C:\Program Files\Hercules\Audio\DJ Console Series\HDJSeriesCPL.exe (Hercules®) O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.) O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation) O4 - HKLM..\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH) O4 - HKLM..\Run: [SuiteTray] C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.) O4 - HKCU..\Run: [Steam] D:\Program Files (x86)\Steam\Steam.exe (Valve Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2847673A-D657-4D11-8659-652AEF65B405}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation) O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{a1c0d320-4513-11e2-bb45-b870f4f322fc}\Shell - "" = AutoRun O33 - MountPoints2\{a1c0d320-4513-11e2-bb45-b870f4f322fc}\Shell\AutoRun\command - "" = G:\LGAutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.06.06 13:06:02 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\AinSophAur\Desktop\OTL.exe [2013.06.06 00:19:56 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\NV [2013.06.06 00:19:56 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\NV [2013.06.06 00:17:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AGEIA Technologies [2013.06.06 00:11:53 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation [2013.06.05 23:53:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Rockstar Games [2013.06.05 23:53:36 | 000,000,000 | ---D | C] -- C:\Users\AinSophAur\Documents\Rockstar Games [2013.05.29 03:00:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0 [2013.05.27 17:59:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LGMobile Support Tool [2013.05.27 17:59:48 | 000,000,000 | ---D | C] -- C:\ProgramData\LGMOBILEAX [2013.05.25 15:36:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2013.05.11 18:19:31 | 000,000,000 | ---D | C] -- C:\Users\AinSophAur\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MAXQDA 11 [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.06.06 16:19:48 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.06.06 16:19:48 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.06.06 16:16:12 | 001,614,924 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.06.06 16:16:12 | 000,697,542 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.06.06 16:16:12 | 000,652,820 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.06.06 16:16:12 | 000,148,548 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.06.06 16:16:12 | 000,121,494 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.06.06 16:11:35 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.06.06 16:11:04 | 3104,722,944 | -HS- | M] () -- C:\hiberfil.sys [2013.06.06 16:09:47 | 001,592,818 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2013.06.06 13:11:57 | 000,000,168 | ---- | M] () -- C:\Users\AinSophAur\defogger_reenable [2013.06.06 13:07:06 | 000,377,856 | ---- | M] () -- C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe [2013.06.06 13:06:03 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\AinSophAur\Desktop\OTL.exe [2013.06.06 13:04:36 | 000,050,477 | ---- | M] () -- C:\Users\AinSophAur\Desktop\Defogger.exe [2013.05.27 18:08:53 | 000,002,413 | ---- | M] () -- C:\Windows\SysWow64\lgAxconfig.ini [2013.05.27 18:07:56 | 000,000,835 | ---- | M] () -- C:\Users\AinSophAur\Desktop\LGMobile Support Tool.lnk [2013.05.17 11:11:28 | 000,314,968 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2013.05.12 23:42:27 | 000,061,216 | ---- | M] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll [2013.05.12 23:42:27 | 000,053,024 | ---- | M] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll [2013.05.12 23:42:27 | 000,020,536 | ---- | M] () -- C:\Windows\SysNative\nvinfo.pb [2013.05.08 16:13:10 | 003,165,737 | ---- | M] () -- C:\Windows\SysNative\nvcoproc.bin [1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.06.06 13:11:57 | 000,000,168 | ---- | C] () -- C:\Users\AinSophAur\defogger_reenable [2013.06.06 13:07:05 | 000,377,856 | ---- | C] () -- C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe [2013.06.06 13:04:36 | 000,050,477 | ---- | C] () -- C:\Users\AinSophAur\Desktop\Defogger.exe [2013.06.06 00:12:35 | 003,165,737 | ---- | C] () -- C:\Windows\SysNative\nvcoproc.bin [2013.06.06 00:06:47 | 000,020,536 | ---- | C] () -- C:\Windows\SysNative\nvinfo.pb [2013.05.27 18:00:01 | 000,000,835 | ---- | C] () -- C:\Users\AinSophAur\Desktop\LGMobile Support Tool.lnk [2013.05.27 17:59:56 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\CommonDL.dll [2013.05.27 17:59:56 | 000,002,413 | ---- | C] () -- C:\Windows\SysWow64\lgAxconfig.ini [2012.12.14 02:42:30 | 000,064,512 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll [2012.10.10 03:22:28 | 000,272,928 | ---- | C] () -- C:\Windows\SysWow64\igvpkrng600.bin [2012.10.10 03:22:20 | 000,963,452 | ---- | C] () -- C:\Windows\SysWow64\igcodeckrng600.bin [2012.02.27 18:36:29 | 001,592,818 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.02.14 19:47:06 | 000,963,912 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin [2012.02.14 19:47:06 | 000,261,208 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin [2011.08.03 18:16:12 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2013.05.07 11:12:54 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\Audacity [2013.02.15 21:52:57 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\cef-cache [2012.12.09 19:57:56 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\DAEMON Tools Lite [2012.02.22 23:00:27 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\GHISLER [2012.08.15 15:46:30 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\ImgBurn [2012.02.29 20:16:43 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\IrfanView [2012.12.10 23:59:28 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\Kalypso Media [2012.12.13 14:43:36 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\LG Electronics [2013.05.11 18:18:01 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\MAXQDA11 [2013.01.24 21:35:31 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\mp3DirectCut [2012.12.25 22:36:42 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\Nettalk [2012.02.27 19:38:18 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\OpenOffice.org [2012.02.22 19:17:06 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\Opera [2012.08.20 12:17:11 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\Party [2012.03.10 02:06:19 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\pdfforge [2012.12.09 20:03:24 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\Propellerhead Software [2012.03.23 12:30:30 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\Razer [2013.03.02 04:59:16 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\SoftGrid Client [2012.03.26 02:21:10 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\Swiss Academic Software [2012.02.27 18:37:17 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\TP [2012.12.23 00:22:21 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\Tropico 4 ========== Purity Check ========== < End of report > [/CODE] Geändert von Ain (06.06.2013 um 16:39 Uhr) |
|
06.06.2013, 15:57
| #2 |
| | Java-Virus (JAVA/Lamar.RI ; JAVA/Jogek.WK usw.)Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-06-06 14:56:53
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\AINSOP~1\AppData\Local\Temp\awtyauod.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 560 fffff800031fa000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 607 fffff800031fa02f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1576] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007762af40 7 bytes JMP 000000016fff0260
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1576] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077634a60 5 bytes JMP 000000016fff01b8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1576] C:\Windows\system32\kernel32.dll!RegDeleteValueW 0000000077652990 5 bytes JMP 000000016fff01f0
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1576] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007765efe0 5 bytes JMP 000000016fff0148
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1576] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 00000000776899b0 7 bytes JMP 000000016fff00d8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1576] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000776994d0 5 bytes JMP 000000016fff0180
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1576] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077699640 5 bytes JMP 000000016fff0110
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1576] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000776ba500 7 bytes JMP 000000016fff0228
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1576] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd6d3460 7 bytes JMP 000007fffd6c00d8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1576] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd6d9940 6 bytes JMP 000007fffd6c0148
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1576] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd6d9fb0 5 bytes JMP 000007fffd6c0180
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1576] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd6da150 5 bytes JMP 000007fffd6c0110
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1576] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefda689e0 8 bytes JMP 000007fffd6c01f0
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1576] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefda6be40 8 bytes JMP 000007fffd6c01b8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1576] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff967490 11 bytes JMP 000007fffd6c0228
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1576] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feff97bf00 7 bytes JMP 000007fffd6c0260
.text C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2004] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000779f1465 2 bytes [9F, 77]
.text C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2004] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000779f14bb 2 bytes [9F, 77]
.text ... * 2
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1276] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000076151f2e 7 bytes JMP 00000001719c16b3
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1276] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000076155bcd 7 bytes JMP 00000001719c11cc
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1276] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076161429 7 bytes JMP 00000001719c12a8
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1276] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007616ea5d 7 bytes JMP 00000001719c1262
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1276] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007617b223 5 bytes JMP 00000001719c15c8
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1276] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000761f88f4 7 bytes JMP 00000001719c1357
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1276] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000761f8979 5 bytes JMP 00000001719c16f4
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1276] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000761f8ccf 5 bytes JMP 00000001719c101e
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1276] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000077081d1b 5 bytes JMP 00000001719c11e5
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1276] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000077081dc9 5 bytes JMP 00000001719c1019
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1276] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000077082aa4 5 bytes JMP 00000001719c1573
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1276] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000077082d0a 5 bytes JMP 00000001719c128f
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1276] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076858a29 5 bytes JMP 00000001719c1046
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1276] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076864572 5 bytes JMP 00000001719c10c8
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1276] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 000000007687e567 5 bytes JMP 00000001719c1433
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1276] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000768b7a5c 5 bytes JMP 00000001719c15f0
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1276] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 0000000076f7e9a2 5 bytes JMP 00000001719c15e1
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1276] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 0000000076f7ebdc 5 bytes JMP 00000001719c11a9
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1276] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a45ea5 5 bytes JMP 00000001719c1618
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1276] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a79d0b 5 bytes JMP 00000001719c123f
.text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[2592] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000779f1465 2 bytes [9F, 77]
.text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[2592] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000779f14bb 2 bytes [9F, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3480] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000779f1465 2 bytes [9F, 77]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3480] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000779f14bb 2 bytes [9F, 77]
.text ... * 2
.text C:\Windows\system32\Dwm.exe[3336] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd6d3460 7 bytes JMP 000007fffd6c00d8
.text C:\Windows\system32\Dwm.exe[3336] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd6d9940 6 bytes JMP 000007fffd6c0148
.text C:\Windows\system32\Dwm.exe[3336] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd6d9fb0 5 bytes JMP 000007fffd6c0180
.text C:\Windows\system32\Dwm.exe[3336] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd6da150 5 bytes JMP 000007fffd6c0110
.text C:\Windows\system32\Dwm.exe[3336] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefda689e0 8 bytes JMP 000007fffd6c01f0
.text C:\Windows\system32\Dwm.exe[3336] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefda6be40 8 bytes JMP 000007fffd6c01b8
.text C:\Windows\system32\Dwm.exe[3336] C:\Windows\system32\dxgi.dll!CreateDXGIFactory 000007fef296dc88 5 bytes JMP 000007fff27600d8
.text C:\Windows\system32\Dwm.exe[3336] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1 000007fef296de10 5 bytes JMP 000007fff2760110
.text C:\Windows\System32\igfxpers.exe[3992] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007762af40 7 bytes JMP 000000016fff0260
.text C:\Windows\System32\igfxpers.exe[3992] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077634a60 5 bytes JMP 000000016fff01b8
.text C:\Windows\System32\igfxpers.exe[3992] C:\Windows\system32\kernel32.dll!RegDeleteValueW 0000000077652990 5 bytes JMP 000000016fff01f0
.text C:\Windows\System32\igfxpers.exe[3992] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007765efe0 5 bytes JMP 000000016fff0148
.text C:\Windows\System32\igfxpers.exe[3992] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 00000000776899b0 7 bytes JMP 000000016fff00d8
.text C:\Windows\System32\igfxpers.exe[3992] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000776994d0 5 bytes JMP 000000016fff0180
.text C:\Windows\System32\igfxpers.exe[3992] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077699640 5 bytes JMP 000000016fff0110
.text C:\Windows\System32\igfxpers.exe[3992] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000776ba500 7 bytes JMP 000000016fff0228
.text C:\Windows\System32\igfxpers.exe[3992] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd6d3460 7 bytes JMP 000007fffd6c00d8
.text C:\Windows\System32\igfxpers.exe[3992] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd6d9940 6 bytes JMP 000007fffd6c0148
.text C:\Windows\System32\igfxpers.exe[3992] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd6d9fb0 5 bytes JMP 000007fffd6c0180
.text C:\Windows\System32\igfxpers.exe[3992] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd6da150 5 bytes JMP 000007fffd6c0110
.text C:\Windows\System32\igfxpers.exe[3992] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefda689e0 8 bytes JMP 000007fffd6c01f0
.text C:\Windows\System32\igfxpers.exe[3992] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefda6be40 8 bytes JMP 000007fffd6c01b8
.text C:\Windows\System32\igfxpers.exe[3992] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff967490 11 bytes JMP 000007fffd6c0228
.text C:\Windows\System32\igfxpers.exe[3992] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feff97bf00 7 bytes JMP 000007fffd6c0260
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[3964] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007762af40 7 bytes JMP 000000016fff0260
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[3964] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077634a60 5 bytes JMP 000000016fff01b8
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[3964] C:\Windows\system32\kernel32.dll!RegDeleteValueW 0000000077652990 5 bytes JMP 000000016fff01f0
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[3964] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007765efe0 5 bytes JMP 000000016fff0148
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[3964] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 00000000776899b0 7 bytes JMP 000000016fff00d8
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[3964] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000776994d0 5 bytes JMP 000000016fff0180
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[3964] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077699640 5 bytes JMP 000000016fff0110
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[3964] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000776ba500 7 bytes JMP 000000016fff0228
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[3964] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd6d3460 7 bytes JMP 000007fffd6c00d8
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[3964] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd6d9940 6 bytes JMP 000007fffd6c0148
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[3964] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd6d9fb0 5 bytes JMP 000007fffd6c0180
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[3964] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd6da150 5 bytes JMP 000007fffd6c0110
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[3964] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefda689e0 8 bytes JMP 000007fffd6c01f0
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[3964] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefda6be40 8 bytes JMP 000007fffd6c01b8
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[3964] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff967490 11 bytes JMP 000007fffd6c0228
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[3964] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feff97bf00 7 bytes JMP 000007fffd6c0260
.text C:\Program Files\Microsoft Security Client\msseces.exe[4128] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd6d3460 7 bytes JMP 000007fffd6b00d8
.text C:\Program Files\Microsoft Security Client\msseces.exe[4128] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd6d9940 6 bytes JMP 000007fffd6b0148
.text C:\Program Files\Microsoft Security Client\msseces.exe[4128] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd6d9fb0 5 bytes JMP 000007fffd6b0180
.text C:\Program Files\Microsoft Security Client\msseces.exe[4128] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd6da150 5 bytes JMP 000007fffd6b0110
.text C:\Program Files\Microsoft Security Client\msseces.exe[4128] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff967490 11 bytes JMP 000007fffd6b0228
.text C:\Program Files\Microsoft Security Client\msseces.exe[4128] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feff97bf00 7 bytes JMP 000007fffd6b0260
.text C:\Program Files\Microsoft Security Client\msseces.exe[4128] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefda689e0 8 bytes JMP 000007fffd6b01f0
.text C:\Program Files\Microsoft Security Client\msseces.exe[4128] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefda6be40 8 bytes JMP 000007fffd6b01b8
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\kernel32.dll!RegSetValueExW 000000007762af40 7 bytes JMP 000000016fff0260
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077634a60 5 bytes JMP 000000016fff01b8
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\kernel32.dll!RegDeleteValueW 0000000077652990 5 bytes JMP 000000016fff01f0
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007765efe0 5 bytes JMP 000000016fff0148
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 00000000776899b0 7 bytes JMP 000000016fff00d8
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000776994d0 5 bytes JMP 000000016fff0180
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077699640 5 bytes JMP 000000016fff0110
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000776ba500 7 bytes JMP 000000016fff0228
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd6d3460 7 bytes JMP 000007fffd6c00d8
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd6d9940 6 bytes JMP 000007fffd6c0148
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd6d9fb0 5 bytes JMP 000007fffd6c0180
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd6da150 5 bytes JMP 000007fffd6c0110
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefda689e0 8 bytes JMP 000007fffd6c01f0
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefda6be40 8 bytes JMP 000007fffd6c01b8
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4592] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000076151f2e 7 bytes JMP 00000001719c16b3
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4592] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000076155bcd 7 bytes JMP 00000001719c11cc
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4592] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076161429 7 bytes JMP 00000001719c12a8
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4592] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007616ea5d 7 bytes JMP 00000001719c1262
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4592] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007617b223 5 bytes JMP 00000001719c15c8
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4592] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000761f88f4 7 bytes JMP 00000001719c1357
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4592] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000761f8979 5 bytes JMP 00000001719c16f4
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4592] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000761f8ccf 5 bytes JMP 00000001719c101e
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4592] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000077081d1b 5 bytes JMP 00000001719c11e5
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4592] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000077081dc9 5 bytes JMP 00000001719c1019
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4592] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000077082aa4 5 bytes JMP 00000001719c1573
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4592] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000077082d0a 5 bytes JMP 00000001719c128f
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4592] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 0000000076f7e9a2 5 bytes JMP 00000001719c15e1
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4592] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 0000000076f7ebdc 5 bytes JMP 00000001719c11a9
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4592] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076858a29 5 bytes JMP 00000001719c1046
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4592] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076864572 5 bytes JMP 00000001719c10c8
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4592] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 000000007687e567 5 bytes JMP 00000001719c1433
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4592] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000768b7a5c 5 bytes JMP 00000001719c15f0
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4592] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a45ea5 5 bytes JMP 00000001719c1618
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[4592] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a79d0b 5 bytes JMP 00000001719c123f
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000076151f2e 7 bytes JMP 00000001719c16b3
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000076155bcd 7 bytes JMP 00000001719c11cc
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076161429 7 bytes JMP 00000001719c12a8
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007616ea5d 7 bytes JMP 00000001719c1262
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007617b223 5 bytes JMP 00000001719c15c8
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000761f88f4 7 bytes JMP 00000001719c1357
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000761f8979 5 bytes JMP 00000001719c16f4
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000761f8ccf 5 bytes JMP 00000001719c101e
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000077081d1b 5 bytes JMP 00000001719c11e5
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000077081dc9 5 bytes JMP 00000001719c1019
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000077082aa4 5 bytes JMP 00000001719c1573
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000077082d0a 5 bytes JMP 00000001719c128f
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 0000000076f7e9a2 5 bytes JMP 00000001719c15e1
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 0000000076f7ebdc 5 bytes JMP 00000001719c11a9
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076858a29 5 bytes JMP 00000001719c1046
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076864572 5 bytes JMP 00000001719c10c8
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 000000007687e567 5 bytes JMP 00000001719c1433
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000768b7a5c 5 bytes JMP 00000001719c15f0
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a45ea5 5 bytes JMP 00000001719c1618
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a79d0b 5 bytes JMP 00000001719c123f
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000779f1465 2 bytes [9F, 77]
.text C:\Program Files (x86)\Launch Manager\LManager.exe[4620] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000779f14bb 2 bytes [9F, 77]
.text ... * 2
.text C:\DOLBY PCEE4\pcee4.exe[4636] C:\Windows\system32\KERNEL32.dll!RegSetValueExW 000000007762af40 7 bytes JMP 000000016fff0260
.text C:\DOLBY PCEE4\pcee4.exe[4636] C:\Windows\system32\KERNEL32.dll!RegQueryValueExW 0000000077634a60 5 bytes JMP 000000016fff01b8
.text C:\DOLBY PCEE4\pcee4.exe[4636] C:\Windows\system32\KERNEL32.dll!RegDeleteValueW 0000000077652990 5 bytes JMP 000000016fff01f0
.text C:\DOLBY PCEE4\pcee4.exe[4636] C:\Windows\system32\KERNEL32.dll!K32GetMappedFileNameW 000000007765efe0 5 bytes JMP 000000016fff0148
.text C:\DOLBY PCEE4\pcee4.exe[4636] C:\Windows\system32\KERNEL32.dll!K32EnumProcessModulesEx 00000000776899b0 7 bytes JMP 000000016fff00d8
.text C:\DOLBY PCEE4\pcee4.exe[4636] C:\Windows\system32\KERNEL32.dll!K32GetModuleInformation 00000000776994d0 5 bytes JMP 000000016fff0180
.text C:\DOLBY PCEE4\pcee4.exe[4636] C:\Windows\system32\KERNEL32.dll!K32GetModuleFileNameExW 0000000077699640 5 bytes JMP 000000016fff0110
.text C:\DOLBY PCEE4\pcee4.exe[4636] C:\Windows\system32\KERNEL32.dll!RegSetValueExA 00000000776ba500 7 bytes JMP 000000016fff0228
.text C:\DOLBY PCEE4\pcee4.exe[4636] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd6d3460 7 bytes JMP 000007fffd6c00d8
.text C:\DOLBY PCEE4\pcee4.exe[4636] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd6d9940 6 bytes JMP 000007fffd6c0148
.text C:\DOLBY PCEE4\pcee4.exe[4636] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd6d9fb0 5 bytes JMP 000007fffd6c0180
.text C:\DOLBY PCEE4\pcee4.exe[4636] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd6da150 5 bytes JMP 000007fffd6c0110
.text C:\DOLBY PCEE4\pcee4.exe[4636] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefda689e0 8 bytes JMP 000007fffd6c01f0
.text C:\DOLBY PCEE4\pcee4.exe[4636] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefda6be40 8 bytes JMP 000007fffd6c01b8
.text C:\DOLBY PCEE4\pcee4.exe[4636] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff967490 11 bytes JMP 000007fffd6c0228
.text C:\DOLBY PCEE4\pcee4.exe[4636] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feff97bf00 7 bytes JMP 000007fffd6c0260
.text C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe[4664] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000076151f2e 7 bytes JMP 00000001719c16b3
.text C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe[4664] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000076155bcd 7 bytes JMP 00000001719c11cc
.text C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe[4664] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076161429 7 bytes JMP 00000001719c12a8
.text C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe[4664] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007616ea5d 7 bytes JMP 00000001719c1262
.text C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe[4664] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007617b223 5 bytes JMP 00000001719c15c8
.text C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe[4664] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000761f88f4 7 bytes JMP 00000001719c1357
.text C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe[4664] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000761f8979 5 bytes JMP 00000001719c16f4
.text C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe[4664] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000761f8ccf 5 bytes JMP 00000001719c101e
.text C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe[4664] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000077081d1b 5 bytes JMP 00000001719c11e5
.text C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe[4664] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000077081dc9 5 bytes JMP 00000001719c1019
.text C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe[4664] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000077082aa4 5 bytes JMP 00000001719c1573
.text C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe[4664] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000077082d0a 5 bytes JMP 00000001719c128f
.text C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe[4664] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 0000000076f7e9a2 5 bytes JMP 00000001719c15e1
.text C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe[4664] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 0000000076f7ebdc 5 bytes JMP 00000001719c11a9
.text C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe[4664] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076858a29 5 bytes JMP 00000001719c1046
.text C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe[4664] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076864572 5 bytes JMP 00000001719c10c8
.text C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe[4664] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 000000007687e567 5 bytes JMP 00000001719c1433
.text C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe[4664] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000768b7a5c 5 bytes JMP 00000001719c15f0
.text C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe[4664] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a45ea5 5 bytes JMP 00000001719c1618
.text C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe[4664] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a79d0b 5 bytes JMP 00000001719c123f
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000076151f2e 7 bytes JMP 00000001719c16b3
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000076155bcd 7 bytes JMP 00000001719c11cc
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076161429 7 bytes JMP 00000001719c12a8
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007616ea5d 7 bytes JMP 00000001719c1262
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007617b223 5 bytes JMP 00000001719c15c8
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000761f88f4 7 bytes JMP 00000001719c1357
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000761f8979 5 bytes JMP 00000001719c16f4
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000761f8ccf 5 bytes JMP 00000001719c101e
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000077081d1b 5 bytes JMP 00000001719c11e5
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000077081dc9 5 bytes JMP 00000001719c1019
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000077082aa4 5 bytes JMP 00000001719c1573
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000077082d0a 5 bytes JMP 00000001719c128f
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076858a29 5 bytes JMP 00000001719c1046
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076864572 5 bytes JMP 00000001719c10c8
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 000000007687e567 5 bytes JMP 00000001719c1433
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000768b7a5c 5 bytes JMP 00000001719c15f0
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 0000000076f7e9a2 5 bytes JMP 00000001719c15e1
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 0000000076f7ebdc 5 bytes JMP 00000001719c11a9
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a45ea5 5 bytes JMP 00000001719c1618
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a79d0b 5 bytes JMP 00000001719c123f
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000779f1465 2 bytes [9F, 77]
.text C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4684] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000779f14bb 2 bytes [9F, 77]
.text ... * 2
.text C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe[4704] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000076151f2e 7 bytes JMP 00000001719c16b3
.text C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe[4704] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000076155bcd 7 bytes JMP 00000001719c11cc
.text C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe[4704] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076161429 7 bytes JMP 00000001719c12a8
.text C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe[4704] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007616ea5d 7 bytes JMP 00000001719c1262
.text C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe[4704] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007617b223 5 bytes JMP 00000001719c15c8
.text C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe[4704] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000761f88f4 7 bytes JMP 00000001719c1357
.text C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe[4704] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000761f8979 5 bytes JMP 00000001719c16f4
.text C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe[4704] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000761f8ccf 5 bytes JMP 00000001719c101e
.text C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe[4704] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000077081d1b 5 bytes JMP 00000001719c11e5
.text C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe[4704] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000077081dc9 5 bytes JMP 00000001719c1019
.text C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe[4704] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000077082aa4 5 bytes JMP 00000001719c1573
.text C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe[4704] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000077082d0a 5 bytes JMP 00000001719c128f
.text C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe[4704] C:\Windows\syswow64\user32.DLL!CreateWindowExW 0000000076858a29 5 bytes JMP 00000001719c1046
.text C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe[4704] C:\Windows\syswow64\user32.DLL!EnumDisplayDevicesA 0000000076864572 5 bytes JMP 00000001719c10c8
.text C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe[4704] C:\Windows\syswow64\user32.DLL!EnumDisplayDevicesW 000000007687e567 5 bytes JMP 00000001719c1433
.text C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe[4704] C:\Windows\syswow64\user32.DLL!DisplayConfigGetDeviceInfo 00000000768b7a5c 5 bytes JMP 00000001719c15f0
.text C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe[4704] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 0000000076f7e9a2 5 bytes JMP 00000001719c15e1
.text C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe[4704] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 0000000076f7ebdc 5 bytes JMP 00000001719c11a9
.text C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe[4704] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a45ea5 5 bytes JMP 00000001719c1618
.text C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe[4704] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a79d0b 5 bytes JMP 00000001719c123f
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4744] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000076151f2e 7 bytes JMP 00000001719c16b3
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4744] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000076155bcd 7 bytes JMP 00000001719c11cc
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4744] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076161429 7 bytes JMP 00000001719c12a8
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4744] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007616ea5d 7 bytes JMP 00000001719c1262
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4744] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007617b223 5 bytes JMP 00000001719c15c8
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4744] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000761f88f4 7 bytes JMP 00000001719c1357
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4744] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000761f8979 5 bytes JMP 00000001719c16f4
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4744] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000761f8ccf 5 bytes JMP 00000001719c101e
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4744] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000077081d1b 5 bytes JMP 00000001719c11e5
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4744] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000077081dc9 5 bytes JMP 00000001719c1019
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4744] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000077082aa4 5 bytes JMP 00000001719c1573
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4744] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000077082d0a 5 bytes JMP 00000001719c128f
.text C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[4768] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd6d3460 7 bytes JMP 000007fffd6c00d8
.text C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[4768] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd6d9940 6 bytes JMP 000007fffd6c0148
.text C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[4768] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd6d9fb0 5 bytes JMP 000007fffd6c0180
.text C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[4768] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd6da150 5 bytes JMP 000007fffd6c0110
.text C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[4768] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefda689e0 8 bytes JMP 000007fffd6c01f0
.text C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[4768] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefda6be40 8 bytes JMP 000007fffd6c01b8
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[4876] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000076151f2e 7 bytes JMP 00000001719c16b3
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[4876] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000076155bcd 7 bytes JMP 00000001719c11cc
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[4876] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076161429 7 bytes JMP 00000001719c12a8
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[4876] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007616ea5d 7 bytes JMP 00000001719c1262
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[4876] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007617b223 5 bytes JMP 00000001719c15c8
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[4876] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000761f88f4 7 bytes JMP 00000001719c1357
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[4876] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000761f8979 5 bytes JMP 00000001719c16f4
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[4876] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000761f8ccf 5 bytes JMP 00000001719c101e
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[4876] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000077081d1b 5 bytes JMP 00000001719c11e5
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[4876] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000077081dc9 5 bytes JMP 00000001719c1019
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[4876] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000077082aa4 5 bytes JMP 00000001719c1573
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[4876] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000077082d0a 5 bytes JMP 00000001719c128f
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[4876] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076858a29 5 bytes JMP 00000001719c1046
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[4876] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076864572 5 bytes JMP 00000001719c10c8
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[4876] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 000000007687e567 5 bytes JMP 00000001719c1433
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[4876] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000768b7a5c 5 bytes JMP 00000001719c15f0
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[4876] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 0000000076f7e9a2 5 bytes JMP 00000001719c15e1
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[4876] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 0000000076f7ebdc 5 bytes JMP 00000001719c11a9
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[4876] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a45ea5 5 bytes JMP 00000001719c1618
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[4876] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a79d0b 5 bytes JMP 00000001719c123f
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4916] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000076151f2e 7 bytes JMP 00000001719c16b3
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4916] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000076155bcd 7 bytes JMP 00000001719c11cc
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4916] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076161429 7 bytes JMP 00000001719c12a8
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4916] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007616ea5d 7 bytes JMP 00000001719c1262
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4916] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007617b223 5 bytes JMP 00000001719c15c8
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4916] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000761f88f4 7 bytes JMP 00000001719c1357
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4916] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000761f8979 5 bytes JMP 00000001719c16f4
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4916] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000761f8ccf 5 bytes JMP 00000001719c101e
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4916] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000077081d1b 5 bytes JMP 00000001719c11e5
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4916] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000077081dc9 5 bytes JMP 00000001719c1019
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4916] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000077082aa4 5 bytes JMP 00000001719c1573
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4916] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000077082d0a 5 bytes JMP 00000001719c128f
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4916] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 0000000076f7e9a2 5 bytes JMP 00000001719c15e1
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4916] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 0000000076f7ebdc 5 bytes JMP 00000001719c11a9
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4916] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076858a29 5 bytes JMP 00000001719c1046
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4916] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076864572 5 bytes JMP 00000001719c10c8
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4916] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 000000007687e567 5 bytes JMP 00000001719c1433
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4916] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000768b7a5c 5 bytes JMP 00000001719c15f0
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4916] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a45ea5 5 bytes JMP 00000001719c1618
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4916] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a79d0b 5 bytes JMP 00000001719c123f
.text C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[5008] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000076151f2e 7 bytes JMP 00000001719c16b3
.text C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[5008] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000076155bcd 7 bytes JMP 00000001719c11cc
.text C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[5008] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076161429 7 bytes JMP 00000001719c12a8
.text C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[5008] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007616ea5d 7 bytes JMP 00000001719c1262
.text C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[5008] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007617b223 5 bytes JMP 00000001719c15c8
.text C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[5008] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000761f88f4 7 bytes JMP 00000001719c1357
.text C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[5008] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000761f8979 5 bytes JMP 00000001719c16f4
.text C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[5008] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000761f8ccf 5 bytes JMP 00000001719c101e
.text C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[5008] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000077081d1b 5 bytes JMP 00000001719c11e5
.text C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[5008] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000077081dc9 5 bytes JMP 00000001719c1019
.text C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[5008] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000077082aa4 5 bytes JMP 00000001719c1573
.text C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[5008] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000077082d0a 5 bytes JMP 00000001719c128f
.text C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[5008] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076858a29 5 bytes JMP 00000001719c1046
.text C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[5008] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076864572 5 bytes JMP 00000001719c10c8
.text C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[5008] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 000000007687e567 5 bytes JMP 00000001719c1433
.text C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[5008] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000768b7a5c 5 bytes JMP 00000001719c15f0
.text C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[5008] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 0000000076f7e9a2 5 bytes JMP 00000001719c15e1
.text C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[5008] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 0000000076f7ebdc 5 bytes JMP 00000001719c11a9
.text C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[5008] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a45ea5 5 bytes JMP 00000001719c1618
.text C:\Program Files (x86)\Razer\DeathAdder\razertra.exe[5008] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a79d0b 5 bytes JMP 00000001719c123f
.text C:\Windows\system32\wbem\unsecapp.exe[5092] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd6d3460 7 bytes JMP 000007fffd6c00d8
.text C:\Windows\system32\wbem\unsecapp.exe[5092] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd6d9940 6 bytes JMP 000007fffd6c0148
.text C:\Windows\system32\wbem\unsecapp.exe[5092] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd6d9fb0 5 bytes JMP 000007fffd6c0180
.text C:\Windows\system32\wbem\unsecapp.exe[5092] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd6da150 5 bytes JMP 000007fffd6c0110
.text C:\Windows\system32\wbem\unsecapp.exe[5092] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff967490 11 bytes JMP 000007fffd6c0228
.text C:\Windows\system32\wbem\unsecapp.exe[5092] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feff97bf00 7 bytes JMP 000007fffd6c0260
.text C:\Windows\system32\wbem\unsecapp.exe[5092] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefda689e0 8 bytes JMP 000007fffd6c01f0
.text C:\Windows\system32\wbem\unsecapp.exe[5092] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefda6be40 8 bytes JMP 000007fffd6c01b8
.text C:\Windows\system32\taskeng.exe[4764] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd6d3460 7 bytes JMP 000007fffd6c00d8
.text C:\Windows\system32\taskeng.exe[4764] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd6d9940 6 bytes JMP 000007fffd6c0148
.text C:\Windows\system32\taskeng.exe[4764] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd6d9fb0 5 bytes JMP 000007fffd6c0180
.text C:\Windows\system32\taskeng.exe[4764] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd6da150 5 bytes JMP 000007fffd6c0110
.text C:\Windows\system32\taskeng.exe[4764] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefda689e0 8 bytes JMP 000007fffd6c01f0
.text C:\Windows\system32\taskeng.exe[4764] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefda6be40 8 bytes JMP 000007fffd6c01b8
.text C:\Windows\system32\taskeng.exe[4764] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff967490 11 bytes JMP 000007fffd6c0228
.text C:\Windows\system32\taskeng.exe[4764] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feff97bf00 7 bytes JMP 000007fffd6c0260
.text C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe[964] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000076151f2e 7 bytes JMP 00000001719c16b3
.text C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe[964] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000076155bcd 7 bytes JMP 00000001719c11cc
.text C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe[964] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076161429 7 bytes JMP 00000001719c12a8
.text C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe[964] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007616ea5d 7 bytes JMP 00000001719c1262
.text C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe[964] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007617b223 5 bytes JMP 00000001719c15c8
.text C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe[964] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000761f88f4 7 bytes JMP 00000001719c1357
.text C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe[964] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000761f8979 5 bytes JMP 00000001719c16f4
.text C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe[964] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000761f8ccf 5 bytes JMP 00000001719c101e
.text C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe[964] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000077081d1b 5 bytes JMP 00000001719c11e5
.text C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe[964] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000077081dc9 5 bytes JMP 00000001719c1019
.text C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe[964] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000077082aa4 5 bytes JMP 00000001719c1573
.text C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe[964] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000077082d0a 5 bytes JMP 00000001719c128f
.text C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe[964] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076858a29 5 bytes JMP 00000001719c1046
.text C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe[964] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076864572 5 bytes JMP 00000001719c10c8
.text C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe[964] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 000000007687e567 5 bytes JMP 00000001719c1433
.text C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe[964] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000768b7a5c 5 bytes JMP 00000001719c15f0
.text C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe[964] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 0000000076f7e9a2 5 bytes JMP 00000001719c15e1
.text C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe[964] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 0000000076f7ebdc 5 bytes JMP 00000001719c11a9
.text C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe[964] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a45ea5 5 bytes JMP 00000001719c1618
.text C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe[964] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a79d0b 5 bytes JMP 00000001719c123f
.text C:\Windows\system32\wuauclt.exe[4896] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd6d3460 7 bytes JMP 000007fffd6c00d8
.text C:\Windows\system32\wuauclt.exe[4896] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd6d9940 6 bytes JMP 000007fffd6c0148
.text C:\Windows\system32\wuauclt.exe[4896] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd6d9fb0 5 bytes JMP 000007fffd6c0180
.text C:\Windows\system32\wuauclt.exe[4896] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd6da150 5 bytes JMP 000007fffd6c0110
.text C:\Windows\system32\wuauclt.exe[4896] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff967490 11 bytes JMP 000007fffd6c0228
.text C:\Windows\system32\wuauclt.exe[4896] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feff97bf00 7 bytes JMP 000007fffd6c0260
.text C:\Windows\system32\wuauclt.exe[4896] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefda689e0 8 bytes JMP 000007fffd6c01f0
.text C:\Windows\system32\wuauclt.exe[4896] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefda6be40 8 bytes JMP 000007fffd6c01b8
.text C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe[2876] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000076151f2e 7 bytes JMP 00000001719c16b3
.text C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe[2876] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000076155bcd 7 bytes JMP 00000001719c11cc
.text C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe[2876] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 0000000076161429 7 bytes JMP 00000001719c12a8
.text C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe[2876] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007616ea5d 7 bytes JMP 00000001719c1262
.text C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe[2876] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007617b223 5 bytes JMP 00000001719c15c8
.text C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe[2876] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000761f88f4 7 bytes JMP 00000001719c1357
.text C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe[2876] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 00000000761f8979 5 bytes JMP 00000001719c16f4
.text C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe[2876] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000761f8ccf 5 bytes JMP 00000001719c101e
.text C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe[2876] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000077081d1b 5 bytes JMP 00000001719c11e5
.text C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe[2876] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000077081dc9 5 bytes JMP 00000001719c1019
.text C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe[2876] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000077082aa4 5 bytes JMP 00000001719c1573
.text C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe[2876] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000077082d0a 5 bytes JMP 00000001719c128f
.text C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe[2876] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 0000000076f7e9a2 5 bytes JMP 00000001719c15e1
.text C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe[2876] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 0000000076f7ebdc 5 bytes JMP 00000001719c11a9
.text C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe[2876] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076858a29 5 bytes JMP 00000001719c1046
.text C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe[2876] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076864572 5 bytes JMP 00000001719c10c8
.text C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe[2876] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 000000007687e567 5 bytes JMP 00000001719c1433
.text C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe[2876] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 00000000768b7a5c 5 bytes JMP 00000001719c15f0
.text C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe[2876] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a45ea5 5 bytes JMP 00000001719c1618
.text C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe[2876] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a79d0b 5 bytes JMP 00000001719c123f
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{34C6D16D-FB24-4573-9010-162D8CEFAEC3}\Connection@Name isatap.{E7150C7A-AA64-4C7F-8F0C-49BBB84D633F}
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{FF456D48-F30B-4FB9-86AE-C1BC5424D468}\Connection@Name isatap.{FADFA358-5A0E-474C-88AC-B0F2044A7E9D}
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind \Device\{34C6D16D-FB24-4573-9010-162D8CEFAEC3}?\Device\{FF456D48-F30B-4FB9-86AE-C1BC5424D468}?\Device\{8939FB0F-4C4F-4326-9804-1400CEB2C7CD}?\Device\{907212CB-DA92-4B80-B7AC-512BFDB80567}?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route "{34C6D16D-FB24-4573-9010-162D8CEFAEC3}"?"{FF456D48-F30B-4FB9-86AE-C1BC5424D468}"?"{8939FB0F-4C4F-4326-9804-1400CEB2C7CD}"?"{907212CB-DA92-4B80-B7AC-512BFDB80567}"?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export \Device\TCPIP6TUNNEL_{34C6D16D-FB24-4573-9010-162D8CEFAEC3}?\Device\TCPIP6TUNNEL_{FF456D48-F30B-4FB9-86AE-C1BC5424D468}?\Device\TCPIP6TUNNEL_{8939FB0F-4C4F-4326-9804-1400CEB2C7CD}?\Device\TCPIP6TUNNEL_{907212CB-DA92-4B80-B7AC-512BFDB80567}?
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{34C6D16D-FB24-4573-9010-162D8CEFAEC3}@InterfaceName isatap.{E7150C7A-AA64-4C7F-8F0C-49BBB84D633F}
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{34C6D16D-FB24-4573-9010-162D8CEFAEC3}@ReusableType 0
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{FF456D48-F30B-4FB9-86AE-C1BC5424D468}@InterfaceName isatap.{FADFA358-5A0E-474C-88AC-B0F2044A7E9D}
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{FF456D48-F30B-4FB9-86AE-C1BC5424D468}@ReusableType 0
Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch2@Epoch 11828
---- EOF - GMER 2.1 ----
|
|
10.06.2013, 18:15
| #3 | |
| /// the machine /// TB-Ausbilder    | Java-Virus (JAVA/Lamar.RI ; JAVA/Jogek.WK usw.) Hi,
__________________Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
10.06.2013, 23:10
| #4 |
| | Java-Virus (JAVA/Lamar.RI ; JAVA/Jogek.WK usw.) Moin, anbei der Combofix-Log, der direkt von Combofix geöffnet wurde. Nochmals vielen Dank, Ain Combofix Logfile: Code:
ATTFilter ComboFix 13-06-08.02 - AinSophAur 10.06.2013 23:47:00.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3948.2370 [GMT 2:00]
ausgeführt von:: c:\users\AinSophAur\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk
c:\programdata\Roaming
c:\windows\Installer\{467D5E81-8349-4892-9E81-C3674ED8E451}\Icon09DB8A851.exe
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-05-10 bis 2013-06-10 ))))))))))))))))))))))))))))))
.
.
2013-06-10 21:55 . 2013-06-10 21:55 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-06-10 21:55 . 2013-06-10 21:55 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-06-10 17:23 . 2013-05-13 06:37 9460464 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{FEB38EA9-A185-4FD6-8F75-BBB1940CC597}\mpengine.dll
2013-06-09 11:32 . 2013-05-13 06:37 9460464 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-06-05 22:19 . 2013-06-06 14:11 -------- d-----w- c:\windows\SysWow64\NV
2013-06-05 22:19 . 2013-06-06 14:11 -------- d-----w- c:\windows\system32\NV
2013-06-05 22:17 . 2013-06-05 22:17 -------- d-----w- c:\program files (x86)\AGEIA Technologies
2013-06-05 22:12 . 2013-05-12 20:34 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-06-05 22:12 . 2013-05-12 20:34 67072 ----a-w- c:\windows\system32\nv3dappshextr.dll
2013-06-05 22:12 . 2013-05-12 20:34 1025312 ----a-w- c:\windows\system32\nv3dappshext.dll
2013-06-05 22:12 . 2013-05-12 20:34 6491936 ----a-w- c:\windows\system32\nvcpl.dll
2013-06-05 22:12 . 2013-05-12 20:34 3514656 ----a-w- c:\windows\system32\nvsvc64.dll
2013-06-05 22:12 . 2013-05-12 20:34 884512 ----a-w- c:\windows\system32\nvvsvc.exe
2013-06-05 22:12 . 2013-05-12 20:34 2555680 ----a-w- c:\windows\system32\nvsvcr.dll
2013-06-05 22:12 . 2013-05-12 20:34 237856 ----a-w- c:\windows\system32\nvmctray.dll
2013-06-05 22:12 . 2013-05-08 14:13 3165737 ----a-w- c:\windows\system32\nvcoproc.bin
2013-06-05 22:11 . 2013-06-05 22:11 -------- d-----w- c:\programdata\NVIDIA Corporation
2013-06-05 21:55 . 2008-10-15 04:22 519000 ----a-w- c:\windows\system32\d3dx10_40.dll
2013-06-05 21:53 . 2013-06-05 21:53 -------- d-----w- c:\program files (x86)\Rockstar Games
2013-05-29 01:00 . 2013-05-29 01:00 -------- d-----w- c:\program files (x86)\MSXML 4.0
2013-05-27 16:00 . 2011-05-10 02:37 655872 ----a-w- c:\windows\SysWow64\msvcr90.dll
2013-05-27 16:00 . 2011-05-10 02:37 568832 ----a-w- c:\windows\SysWow64\msvcp90.dll
2013-05-27 16:00 . 2011-05-10 02:37 224768 ----a-w- c:\windows\SysWow64\msvcm90.dll
2013-05-27 15:59 . 2006-05-03 21:33 53248 ----a-w- c:\windows\SysWow64\CommonDL.dll
2013-05-27 15:59 . 2005-11-23 15:34 82432 ----a-w- c:\windows\SysWow64\msxml4r.dll
2013-05-27 15:59 . 2005-10-03 14:39 44544 ----a-w- c:\windows\SysWow64\msxml4a.dll
2013-05-27 15:59 . 2013-05-27 16:09 -------- d-----w- c:\programdata\LGMOBILEAX
2013-05-21 19:28 . 2013-05-21 19:27 964552 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{EE0532CE-1627-4C93-96F6-D8345D7E8BFB}\gapaengine.dll
2013-05-16 12:16 . 2013-04-10 06:01 265064 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-16 23:21 . 2012-02-22 19:49 75016696 ----a-w- c:\windows\system32\MRT.exe
2013-05-16 12:11 . 2012-04-05 10:48 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-05-16 12:11 . 2011-08-03 16:12 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-05-12 21:42 . 2012-07-12 22:31 61216 ----a-w- c:\windows\system32\OpenCL.dll
2013-05-12 21:42 . 2012-07-12 22:31 53024 ----a-w- c:\windows\SysWow64\OpenCL.dll
2013-05-06 08:46 . 2013-05-06 08:46 83160 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-05-02 15:29 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-04-30 00:46 . 2013-04-30 00:46 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-04-30 00:46 . 2013-04-30 00:46 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-04-30 00:46 . 2013-04-30 00:46 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-04-30 00:46 . 2013-04-30 00:46 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-04-30 00:46 . 2013-04-30 00:46 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-04-30 00:46 . 2013-04-30 00:46 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-04-30 00:46 . 2013-04-30 00:46 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-04-30 00:46 . 2013-04-30 00:46 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-04-30 00:46 . 2013-04-30 00:46 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-04-30 00:46 . 2013-04-30 00:46 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-04-30 00:46 . 2013-04-30 00:46 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-04-30 00:46 . 2013-04-30 00:46 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-04-30 00:46 . 2013-04-30 00:46 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-04-30 00:46 . 2013-04-30 00:46 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-04-30 00:46 . 2013-04-30 00:46 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-04-30 00:46 . 2013-04-30 00:46 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-04-30 00:46 . 2013-04-30 00:46 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-04-30 00:46 . 2013-04-30 00:46 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-04-30 00:46 . 2013-04-30 00:46 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-04-30 00:46 . 2013-04-30 00:46 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-04-30 00:46 . 2013-04-30 00:46 81408 ----a-w- c:\windows\system32\icardie.dll
2013-04-30 00:46 . 2013-04-30 00:46 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-04-30 00:46 . 2013-04-30 00:46 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-04-30 00:46 . 2013-04-30 00:46 441856 ----a-w- c:\windows\system32\html.iec
2013-04-30 00:46 . 2013-04-30 00:46 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-04-30 00:46 . 2013-04-30 00:46 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-04-30 00:46 . 2013-04-30 00:46 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-04-30 00:46 . 2013-04-30 00:46 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-04-30 00:46 . 2013-04-30 00:46 235008 ----a-w- c:\windows\system32\url.dll
2013-04-30 00:46 . 2013-04-30 00:46 216064 ----a-w- c:\windows\system32\msls31.dll
2013-04-30 00:46 . 2013-04-30 00:46 197120 ----a-w- c:\windows\system32\msrating.dll
2013-04-30 00:46 . 2013-04-30 00:46 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-04-30 00:46 . 2013-04-30 00:46 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-04-30 00:46 . 2013-04-30 00:46 144896 ----a-w- c:\windows\system32\wextract.exe
2013-04-30 00:46 . 2013-04-30 00:46 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-04-30 00:46 . 2013-04-30 00:46 102912 ----a-w- c:\windows\system32\inseng.dll
2013-04-30 00:46 . 2013-04-30 00:46 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-04-30 00:46 . 2013-04-30 00:46 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-04-30 00:46 . 2013-04-30 00:46 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-04-30 00:46 . 2013-04-30 00:46 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-04-30 00:46 . 2013-04-30 00:46 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-04-30 00:46 . 2013-04-30 00:46 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-04-30 00:46 . 2013-04-30 00:46 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-04-30 00:46 . 2013-04-30 00:46 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-04-30 00:46 . 2013-04-30 00:46 149504 ----a-w- c:\windows\system32\occache.dll
2013-04-30 00:46 . 2013-04-30 00:46 13824 ----a-w- c:\windows\system32\mshta.exe
2013-04-30 00:46 . 2013-04-30 00:46 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-04-30 00:46 . 2013-04-30 00:46 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-04-30 00:46 . 2013-04-30 00:46 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-04-23 17:10 . 2012-06-13 12:18 905296 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-04-13 05:49 . 2013-05-16 12:16 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-16 12:16 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-16 12:16 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-16 12:16 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-16 12:16 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-16 12:16 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 11:41 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-04 03:35 . 2013-04-25 10:22 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-03-28 01:42 . 2013-03-28 01:42 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-03-28 01:42 . 2013-03-28 01:42 130016 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-03-28 01:42 . 2013-03-28 01:42 100712 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-03-19 06:04 . 2013-04-10 10:40 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-19 05:46 . 2013-04-10 10:39 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-10 10:39 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-10 10:40 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-10 10:39 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-10 10:39 112640 ----a-w- c:\windows\system32\smss.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="d:\program files (x86)\Steam\Steam.exe" [2013-06-06 1641896]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Hercules DJ Series"="c:\program files\Hercules\Audio\DJ Console Series\HDJSeriesCPL.exe" [2011-12-29 3399240]
"SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2011-06-21 341360]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2011-07-01 1103440]
"Dolby Home Theater v4"="c:\dolby pcee4\pcee4.exe" [2011-02-03 506712]
"DeathAdder"="c:\program files (x86)\Razer\DeathAdder\razerhid.exe" [2010-05-05 251392]
"BackupManagerTray"="c:\program files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" [2012-01-05 296984]
"ArcadeMovieService"="c:\program files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe" [2011-05-09 177448]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-05-06 345312]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2013-03-20 162856]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"IsMyWinLockerReboot"="msiexec.exe" [2010-11-21 73216]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files (x86)\Acer\Acer VCM\AcerVCM.exe [2011-8-3 723560]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R1 bhihsseg;bhihsseg;c:\windows\system32\drivers\bhihsseg.sys;c:\windows\SYSNATIVE\drivers\bhihsseg.sys [x]
R1 pqjctddh;pqjctddh;c:\windows\system32\drivers\pqjctddh.sys;c:\windows\SYSNATIVE\drivers\pqjctddh.sys [x]
R1 qbmokdxb;qbmokdxb;c:\windows\system32\drivers\qbmokdxb.sys;c:\windows\SYSNATIVE\drivers\qbmokdxb.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 andnetadb;ADB Interface DriverNet;c:\windows\system32\Drivers\lgandnetadb.sys;c:\windows\SYSNATIVE\Drivers\lgandnetadb.sys [x]
R3 AndNetDiag;LGE AndroidNet USB Serial Port;c:\windows\system32\DRIVERS\lgandnetdiag64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetdiag64.sys [x]
R3 ANDNetModem;LGE AndroidNet USB Modem;c:\windows\system32\DRIVERS\lgandnetmodem64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetmodem64.sys [x]
R3 BrSerIb;Brother MFC Serial Interface Driver(WDM);c:\windows\system32\DRIVERS\BrSerIb.sys;c:\windows\SYSNATIVE\DRIVERS\BrSerIb.sys [x]
R3 BrUsbSIb;Brother MFC Serial USB Driver(WDM);c:\windows\system32\DRIVERS\BrUsbSIb.sys;c:\windows\SYSNATIVE\DRIVERS\BrUsbSIb.sys [x]
R3 Bulk;HDJBulk;c:\windows\system32\Drivers\HDJBulk.sys;c:\windows\SYSNATIVE\Drivers\HDJBulk.sys [x]
R3 CYUSB;Cypress Generic USB Driver;c:\windows\system32\Drivers\CYUSB.sys;c:\windows\SYSNATIVE\Drivers\CYUSB.sys [x]
R3 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]
R3 HDJAsioK;HDJAsioK;c:\windows\system32\Drivers\HDJAsioK.sys;c:\windows\SYSNATIVE\Drivers\HDJAsioK.sys [x]
R3 HDJMidi;Hercules DJ Console Rmx MIDI;c:\windows\system32\DRIVERS\HDJMidi.sys;c:\windows\SYSNATIVE\DRIVERS\HDJMidi.sys [x]
R3 intaud_WaveExtensible;Intel WiDi Audio Device;c:\windows\system32\drivers\intelaud.sys;c:\windows\SYSNATIVE\drivers\intelaud.sys [x]
R3 ks2avs;Kontrol S2 WDM Audio;c:\windows\system32\Drivers\ks2avs.sys;c:\windows\SYSNATIVE\Drivers\ks2avs.sys [x]
R3 ks2usb_svc;Traktor Kontrol S2;c:\windows\system32\Drivers\ks2usb.sys;c:\windows\SYSNATIVE\Drivers\ks2usb.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 rspLLL;rspLLL;c:\windows\system32\DRIVERS\rspLLL64.sys;c:\windows\SYSNATIVE\DRIVERS\rspLLL64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R4 BstHdAndroidSvc;BlueStacks Android Service;c:\program files (x86)\BlueStacks\HD-Service.exe BstHdAndroidSvc Android;c:\program files (x86)\BlueStacks\HD-Service.exe BstHdAndroidSvc Android [x]
R4 BstHdLogRotatorSvc;BlueStacks Log Rotator Service;c:\program files (x86)\BlueStacks\HD-LogRotatorService.exe;c:\program files (x86)\BlueStacks\HD-LogRotatorService.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDVDisk.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 BstHdDrv;BlueStacks Hypervisor;c:\program files (x86)\BlueStacks\HD-Hypervisor-amd64.sys;c:\program files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 CxAudMsg;Conexant Audio Message Service;c:\windows\system32\CxAudMsg64.exe;c:\windows\SYSNATIVE\CxAudMsg64.exe [x]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe;c:\program files (x86)\Launch Manager\dsiwmis.exe [x]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [x]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe;c:\program files (x86)\Acer\Registration\GREGsvc.exe [x]
S2 HerculesDJControlMP3;Hercules DJ Control MP3;c:\program files\Hercules\Audio\DJ Console Series\drivers\amd64\HerculesDJControlMP3.EXE;c:\program files\Hercules\Audio\DJ Console Series\drivers\amd64\HerculesDJControlMP3.EXE [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 Live Updater Service;Live Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]
S2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [x]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [x]
S2 RS_Service;Raw Socket Service;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 danewFltr;NewDeathAdder Mouse;c:\windows\system32\drivers\danew.sys;c:\windows\SYSNATIVE\drivers\danew.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 iwdbus;IWD Bus Enumerator;c:\windows\system32\DRIVERS\iwdbus.sys;c:\windows\SYSNATIVE\DRIVERS\iwdbus.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
S3 VKbms;Razer Gaming Device;c:\windows\system32\DRIVERS\VKbms.sys;c:\windows\SYSNATIVE\DRIVERS\VKbms.sys [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelPAN"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-05-02 1935120]
"Power Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2011-03-28 499304]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]
"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2011-07-19 2780776]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-12-14 172144]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-12-14 399984]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-12-14 441968]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://acer.msn.com
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\AinSophAur\AppData\Roaming\Mozilla\Firefox\Profiles\1kt90l9d.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.spiegel.de/
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\BlueStacks]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-06-10 23:58:05
ComboFix-quarantined-files.txt 2013-06-10 21:58
.
Vor Suchlauf: 13 Verzeichnis(se), 22.814.994.432 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 24.792.924.160 Bytes frei
.
- - End Of File - - FE58B372E22DF7504DABB94A061E8B10
D41D8CD98F00B204E9800998ECF8427E |
|
11.06.2013, 06:33
| #5 |
| /// the machine /// TB-Ausbilder | Java-Virus (JAVA/Lamar.RI ; JAVA/Jogek.WK usw.) Hi, Combofix-Skript
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.06.2013, 20:58
| #6 |
| | Java-Virus (JAVA/Lamar.RI ; JAVA/Jogek.WK usw.) Hi, anbei schonmal der Combofix-Log. Der Rest folgt (würde wahrscheinlich eh nicht in eine Antwort passen oder?) Combofix Logfile: Code:
ATTFilter ComboFix 13-06-08.02 - AinSophAur 11.06.2013 21:36:51.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3948.2253 [GMT 2:00]
ausgeführt von:: c:\users\AinSophAur\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\AinSophAur\Desktop\CFScript.txt
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\system32\drivers\bhihsseg.sys"
"c:\windows\system32\drivers\pqjctddh.sys"
"c:\windows\system32\drivers\qbmokdxb.sys"
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_bhihsseg
-------\Service_pqjctddh
-------\Service_qbmokdxb
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-05-11 bis 2013-06-11 ))))))))))))))))))))))))))))))
.
.
2013-06-11 19:43 . 2013-06-11 19:43 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-06-11 19:43 . 2013-06-11 19:43 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-06-10 22:05 . 2013-05-13 06:37 9460464 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BDD32406-F009-4771-A5C5-F8FBE6F4137D}\mpengine.dll
2013-06-09 11:32 . 2013-05-13 06:37 9460464 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-06-05 22:19 . 2013-06-06 14:11 -------- d-----w- c:\windows\SysWow64\NV
2013-06-05 22:19 . 2013-06-06 14:11 -------- d-----w- c:\windows\system32\NV
2013-06-05 22:17 . 2013-06-05 22:17 -------- d-----w- c:\program files (x86)\AGEIA Technologies
2013-06-05 22:12 . 2013-05-12 20:34 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-06-05 22:12 . 2013-05-12 20:34 67072 ----a-w- c:\windows\system32\nv3dappshextr.dll
2013-06-05 22:12 . 2013-05-12 20:34 1025312 ----a-w- c:\windows\system32\nv3dappshext.dll
2013-06-05 22:12 . 2013-05-12 20:34 6491936 ----a-w- c:\windows\system32\nvcpl.dll
2013-06-05 22:12 . 2013-05-12 20:34 3514656 ----a-w- c:\windows\system32\nvsvc64.dll
2013-06-05 22:12 . 2013-05-12 20:34 884512 ----a-w- c:\windows\system32\nvvsvc.exe
2013-06-05 22:12 . 2013-05-12 20:34 2555680 ----a-w- c:\windows\system32\nvsvcr.dll
2013-06-05 22:12 . 2013-05-12 20:34 237856 ----a-w- c:\windows\system32\nvmctray.dll
2013-06-05 22:12 . 2013-05-08 14:13 3165737 ----a-w- c:\windows\system32\nvcoproc.bin
2013-06-05 22:11 . 2013-06-05 22:11 -------- d-----w- c:\programdata\NVIDIA Corporation
2013-06-05 21:55 . 2008-10-15 04:22 519000 ----a-w- c:\windows\system32\d3dx10_40.dll
2013-06-05 21:53 . 2013-06-05 21:53 -------- d-----w- c:\program files (x86)\Rockstar Games
2013-05-29 01:00 . 2013-05-29 01:00 -------- d-----w- c:\program files (x86)\MSXML 4.0
2013-05-27 16:00 . 2011-05-10 02:37 655872 ----a-w- c:\windows\SysWow64\msvcr90.dll
2013-05-27 16:00 . 2011-05-10 02:37 568832 ----a-w- c:\windows\SysWow64\msvcp90.dll
2013-05-27 16:00 . 2011-05-10 02:37 224768 ----a-w- c:\windows\SysWow64\msvcm90.dll
2013-05-27 15:59 . 2006-05-03 21:33 53248 ----a-w- c:\windows\SysWow64\CommonDL.dll
2013-05-27 15:59 . 2005-11-23 15:34 82432 ----a-w- c:\windows\SysWow64\msxml4r.dll
2013-05-27 15:59 . 2005-10-03 14:39 44544 ----a-w- c:\windows\SysWow64\msxml4a.dll
2013-05-27 15:59 . 2013-05-27 16:09 -------- d-----w- c:\programdata\LGMOBILEAX
2013-05-21 19:28 . 2013-05-21 19:27 964552 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{EE0532CE-1627-4C93-96F6-D8345D7E8BFB}\gapaengine.dll
2013-05-16 12:16 . 2013-04-10 06:01 265064 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-16 23:21 . 2012-02-22 19:49 75016696 ----a-w- c:\windows\system32\MRT.exe
2013-05-16 12:11 . 2012-04-05 10:48 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-05-16 12:11 . 2011-08-03 16:12 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-05-12 21:42 . 2012-07-12 22:31 61216 ----a-w- c:\windows\system32\OpenCL.dll
2013-05-12 21:42 . 2012-07-12 22:31 53024 ----a-w- c:\windows\SysWow64\OpenCL.dll
2013-05-06 08:46 . 2013-05-06 08:46 83160 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-05-02 15:29 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-04-30 00:46 . 2013-04-30 00:46 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-04-30 00:46 . 2013-04-30 00:46 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-04-30 00:46 . 2013-04-30 00:46 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-04-30 00:46 . 2013-04-30 00:46 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-04-30 00:46 . 2013-04-30 00:46 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-04-30 00:46 . 2013-04-30 00:46 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-04-30 00:46 . 2013-04-30 00:46 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-04-30 00:46 . 2013-04-30 00:46 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-04-30 00:46 . 2013-04-30 00:46 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-04-30 00:46 . 2013-04-30 00:46 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-04-30 00:46 . 2013-04-30 00:46 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-04-30 00:46 . 2013-04-30 00:46 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-04-30 00:46 . 2013-04-30 00:46 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-04-30 00:46 . 2013-04-30 00:46 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-04-30 00:46 . 2013-04-30 00:46 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-04-30 00:46 . 2013-04-30 00:46 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-04-30 00:46 . 2013-04-30 00:46 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-04-30 00:46 . 2013-04-30 00:46 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-04-30 00:46 . 2013-04-30 00:46 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-04-30 00:46 . 2013-04-30 00:46 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-04-30 00:46 . 2013-04-30 00:46 81408 ----a-w- c:\windows\system32\icardie.dll
2013-04-30 00:46 . 2013-04-30 00:46 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-04-30 00:46 . 2013-04-30 00:46 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-04-30 00:46 . 2013-04-30 00:46 441856 ----a-w- c:\windows\system32\html.iec
2013-04-30 00:46 . 2013-04-30 00:46 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-04-30 00:46 . 2013-04-30 00:46 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-04-30 00:46 . 2013-04-30 00:46 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-04-30 00:46 . 2013-04-30 00:46 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-04-30 00:46 . 2013-04-30 00:46 235008 ----a-w- c:\windows\system32\url.dll
2013-04-30 00:46 . 2013-04-30 00:46 216064 ----a-w- c:\windows\system32\msls31.dll
2013-04-30 00:46 . 2013-04-30 00:46 197120 ----a-w- c:\windows\system32\msrating.dll
2013-04-30 00:46 . 2013-04-30 00:46 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-04-30 00:46 . 2013-04-30 00:46 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-04-30 00:46 . 2013-04-30 00:46 144896 ----a-w- c:\windows\system32\wextract.exe
2013-04-30 00:46 . 2013-04-30 00:46 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-04-30 00:46 . 2013-04-30 00:46 102912 ----a-w- c:\windows\system32\inseng.dll
2013-04-30 00:46 . 2013-04-30 00:46 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-04-30 00:46 . 2013-04-30 00:46 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-04-30 00:46 . 2013-04-30 00:46 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-04-30 00:46 . 2013-04-30 00:46 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-04-30 00:46 . 2013-04-30 00:46 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-04-30 00:46 . 2013-04-30 00:46 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-04-30 00:46 . 2013-04-30 00:46 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-04-30 00:46 . 2013-04-30 00:46 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-04-30 00:46 . 2013-04-30 00:46 149504 ----a-w- c:\windows\system32\occache.dll
2013-04-30 00:46 . 2013-04-30 00:46 13824 ----a-w- c:\windows\system32\mshta.exe
2013-04-30 00:46 . 2013-04-30 00:46 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-04-30 00:46 . 2013-04-30 00:46 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-04-30 00:46 . 2013-04-30 00:46 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-04-23 17:10 . 2012-06-13 12:18 905296 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-04-13 05:49 . 2013-05-16 12:16 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-16 12:16 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-16 12:16 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-16 12:16 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-16 12:16 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-16 12:16 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 11:41 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-04 03:35 . 2013-04-25 10:22 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-03-28 01:42 . 2013-03-28 01:42 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-03-28 01:42 . 2013-03-28 01:42 130016 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-03-28 01:42 . 2013-03-28 01:42 100712 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-03-19 06:04 . 2013-04-10 10:40 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-19 05:46 . 2013-04-10 10:39 43520 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-10 10:39 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-10 10:40 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-10 10:39 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-10 10:39 112640 ----a-w- c:\windows\system32\smss.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="d:\program files (x86)\Steam\Steam.exe" [2013-06-06 1641896]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Hercules DJ Series"="c:\program files\Hercules\Audio\DJ Console Series\HDJSeriesCPL.exe" [2011-12-29 3399240]
"SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2011-06-21 341360]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2011-07-01 1103440]
"Dolby Home Theater v4"="c:\dolby pcee4\pcee4.exe" [2011-02-03 506712]
"DeathAdder"="c:\program files (x86)\Razer\DeathAdder\razerhid.exe" [2010-05-05 251392]
"BackupManagerTray"="c:\program files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" [2012-01-05 296984]
"ArcadeMovieService"="c:\program files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe" [2011-05-09 177448]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-05-06 345312]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2013-03-20 162856]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"IsMyWinLockerReboot"="msiexec.exe" [2010-11-21 73216]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files (x86)\Acer\Acer VCM\AcerVCM.exe [2011-8-3 723560]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 andnetadb;ADB Interface DriverNet;c:\windows\system32\Drivers\lgandnetadb.sys;c:\windows\SYSNATIVE\Drivers\lgandnetadb.sys [x]
R3 AndNetDiag;LGE AndroidNet USB Serial Port;c:\windows\system32\DRIVERS\lgandnetdiag64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetdiag64.sys [x]
R3 ANDNetModem;LGE AndroidNet USB Modem;c:\windows\system32\DRIVERS\lgandnetmodem64.sys;c:\windows\SYSNATIVE\DRIVERS\lgandnetmodem64.sys [x]
R3 BrSerIb;Brother MFC Serial Interface Driver(WDM);c:\windows\system32\DRIVERS\BrSerIb.sys;c:\windows\SYSNATIVE\DRIVERS\BrSerIb.sys [x]
R3 BrUsbSIb;Brother MFC Serial USB Driver(WDM);c:\windows\system32\DRIVERS\BrUsbSIb.sys;c:\windows\SYSNATIVE\DRIVERS\BrUsbSIb.sys [x]
R3 Bulk;HDJBulk;c:\windows\system32\Drivers\HDJBulk.sys;c:\windows\SYSNATIVE\Drivers\HDJBulk.sys [x]
R3 CYUSB;Cypress Generic USB Driver;c:\windows\system32\Drivers\CYUSB.sys;c:\windows\SYSNATIVE\Drivers\CYUSB.sys [x]
R3 danewFltr;NewDeathAdder Mouse;c:\windows\system32\drivers\danew.sys;c:\windows\SYSNATIVE\drivers\danew.sys [x]
R3 EgisTec Ticket Service;EgisTec Ticket Service;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe;c:\program files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]
R3 HDJAsioK;HDJAsioK;c:\windows\system32\Drivers\HDJAsioK.sys;c:\windows\SYSNATIVE\Drivers\HDJAsioK.sys [x]
R3 HDJMidi;Hercules DJ Console Rmx MIDI;c:\windows\system32\DRIVERS\HDJMidi.sys;c:\windows\SYSNATIVE\DRIVERS\HDJMidi.sys [x]
R3 intaud_WaveExtensible;Intel WiDi Audio Device;c:\windows\system32\drivers\intelaud.sys;c:\windows\SYSNATIVE\drivers\intelaud.sys [x]
R3 ks2avs;Kontrol S2 WDM Audio;c:\windows\system32\Drivers\ks2avs.sys;c:\windows\SYSNATIVE\Drivers\ks2avs.sys [x]
R3 ks2usb_svc;Traktor Kontrol S2;c:\windows\system32\Drivers\ks2usb.sys;c:\windows\SYSNATIVE\Drivers\ks2usb.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 rspLLL;rspLLL;c:\windows\system32\DRIVERS\rspLLL64.sys;c:\windows\SYSNATIVE\DRIVERS\rspLLL64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R4 BstHdAndroidSvc;BlueStacks Android Service;c:\program files (x86)\BlueStacks\HD-Service.exe BstHdAndroidSvc Android;c:\program files (x86)\BlueStacks\HD-Service.exe BstHdAndroidSvc Android [x]
R4 BstHdLogRotatorSvc;BlueStacks Log Rotator Service;c:\program files (x86)\BlueStacks\HD-LogRotatorService.exe;c:\program files (x86)\BlueStacks\HD-LogRotatorService.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDVDisk.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 BstHdDrv;BlueStacks Hypervisor;c:\program files (x86)\BlueStacks\HD-Hypervisor-amd64.sys;c:\program files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 CxAudMsg;Conexant Audio Message Service;c:\windows\system32\CxAudMsg64.exe;c:\windows\SYSNATIVE\CxAudMsg64.exe [x]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe;c:\program files (x86)\Launch Manager\dsiwmis.exe [x]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [x]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe;c:\program files (x86)\Acer\Registration\GREGsvc.exe [x]
S2 HerculesDJControlMP3;Hercules DJ Control MP3;c:\program files\Hercules\Audio\DJ Console Series\drivers\amd64\HerculesDJControlMP3.EXE;c:\program files\Hercules\Audio\DJ Console Series\drivers\amd64\HerculesDJControlMP3.EXE [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 Live Updater Service;Live Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]
S2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [x]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [x]
S2 RS_Service;Raw Socket Service;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 iwdbus;IWD Bus Enumerator;c:\windows\system32\DRIVERS\iwdbus.sys;c:\windows\SYSNATIVE\DRIVERS\iwdbus.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
S3 VKbms;Razer Gaming Device;c:\windows\system32\DRIVERS\VKbms.sys;c:\windows\SYSNATIVE\DRIVERS\VKbms.sys [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelPAN"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-05-02 1935120]
"Power Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2011-03-28 499304]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]
"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]
"ETDCtrl"="c:\program files (x86)\Elantech\ETDCtrl.exe" [BU]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2011-07-19 2780776]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-12-14 172144]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-12-14 399984]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-12-14 441968]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://acer.msn.com
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\AinSophAur\AppData\Roaming\Mozilla\Firefox\Profiles\1kt90l9d.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.spiegel.de/
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\BlueStacks]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Cisco Systems\VPN Client\cvpnd.exe
c:\program files (x86)\Launch Manager\LMutilps32.exe
c:\program files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe
c:\program files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-06-11 21:49:53 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2013-06-11 19:49
ComboFix2.txt 2013-06-10 21:58
.
Vor Suchlauf: 17 Verzeichnis(se), 24.402.522.112 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 23.920.705.536 Bytes frei
.
- - End Of File - - F11D39ABFF1E763DAE6F36F7E5807AFF
D41D8CD98F00B204E9800998ECF8427E AdwCleaner: AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v2.303 - Datei am 11/06/2013 um 22:01:48 erstellt
# Aktualisiert am 08/06/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : AinSophAur - AINSOPHAUR-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\AinSophAur\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gelöscht : C:\Users\AinSophAur\AppData\Roaming\Mozilla\Firefox\Profiles\1kt90l9d.default\extensions\{c50ca3c4-5656-43c2-a061-13e717f73fc8}.xpi
Datei Gelöscht : C:\Users\AinSophAur\AppData\Roaming\Mozilla\Firefox\Profiles\1kt90l9d.default\foxydeal.sqlite
Ordner Gelöscht : C:\Users\AinSophAur\AppData\Roaming\pdfforge
***** [Registrierungsdatenbank] *****
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16576
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v21.0 (de)
Datei : C:\Users\AinSophAur\AppData\Roaming\Mozilla\Firefox\Profiles\1kt90l9d.default\prefs.js
[OK] Die Datei ist sauber.
-\\ Opera v12.15.1748.0
Datei : C:\Users\AinSophAur\AppData\Roaming\Opera\Opera\operaprefs.ini
[OK] Die Datei ist sauber.
*************************
AdwCleaner[S1].txt - [1201 octets] - [11/06/2013 22:01:48]
########## EOF - C:\AdwCleaner[S1].txt - [1261 octets] ##########
und JRT JRT Logfile: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Home Premium x64
Ran by AinSophAur on 11.06.2013 at 22:12:47,79
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
Successfully deleted: [File] C:\Windows\syswow64\shoE7BC.tmp
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\AinSophAur\AppData\Roaming\mozilla\firefox\profiles\1kt90l9d.default\minidumps [97 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 11.06.2013 at 22:16:22,24
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Geändert von Ain (11.06.2013 um 21:18 Uhr) |
|
12.06.2013, 06:42
| #7 |
| /// the machine /// TB-Ausbilder | Java-Virus (JAVA/Lamar.RI ; JAVA/Jogek.WK usw.)ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches OTL log. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
15.06.2013, 16:36
| #8 |
| | Java-Virus (JAVA/Lamar.RI ; JAVA/Jogek.WK usw.) Hi, anbei schonmal der ESET-Log. Den Rest editier ich später rein. So wirklich Probleme hatte ich ja nie, aber Avira hat halt beim Scan das Java-Zeug gefunden. Und ESET hat auch immernoch zwei Funde bzgl. Java ausgespuckt. Abermals danke für die Hilfe. Viele Grüße ESET-Log: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=da5e1972f33abd4c9cee6c5e2a507ab6
# engine=14075
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-06-14 11:33:30
# local_time=2013-06-15 01:33:30 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 96 119361 236672500 112140 0
# compatibility_mode=5893 16776574 100 94 39565050 122882660 0 0
# scanned=357339
# found=2
# cleaned=0
# scan_time=12572
sh=F9E670EB5A1FA9F00AB7A3BE838680A77260FE0B ft=0 fh=0000000000000000 vn="probably a variant of Java/Exploit.Agent.NMS trojan" ac=I fn="C:\Users\AinSophAur\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\2a3cd391-7d66b2d5"
sh=554FE8D9AC1CAC337F25953354BA6E7F4512EF35 ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.OLE trojan" ac=I fn="C:\Users\AinSophAur\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\4b8c5f9e-68d79d07"
Code:
ATTFilter Results of screen317's Security Check version 0.99.64
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Microsoft Security Essentials
Avira Desktop
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 21
Adobe Flash Player 11.7.700.202
Adobe Reader 10.1.7 Adobe Reader out of Date!
Mozilla Firefox (21.0)
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
Code:
ATTFilter OTL logfile created on: 15.06.2013 17:50:34 - Run 3 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\AinSophAur\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16614) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,86 Gb Total Physical Memory | 2,43 Gb Available Physical Memory | 62,93% Memory free 7,71 Gb Paging File | 6,08 Gb Available in Paging File | 78,91% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 101,79 Gb Total Space | 19,47 Gb Free Space | 19,13% Space Free | Partition Type: NTFS Drive D: | 348,87 Gb Total Space | 31,51 Gb Free Space | 9,03% Space Free | Partition Type: NTFS Drive E: | 2,54 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: AINSOPHAUR-PC | User Name: AinSophAur | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.06.06 13:06:03 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\AinSophAur\Desktop\OTL.exe PRC - [2013.05.10 00:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2013.03.28 03:42:27 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2013.03.28 03:42:13 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2012.01.05 15:22:10 | 000,256,536 | ---- | M] (NTI Corporation) -- C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe PRC - [2012.01.05 15:21:44 | 000,296,984 | ---- | M] (NTI Corporation) -- C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe PRC - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe PRC - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe PRC - [2011.07.01 04:51:13 | 000,418,896 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMutilps32.exe PRC - [2011.07.01 04:51:12 | 000,343,632 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LMworker.exe PRC - [2011.07.01 04:51:11 | 000,353,360 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe PRC - [2011.07.01 04:51:10 | 001,103,440 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\LManager.exe PRC - [2011.05.30 04:54:14 | 000,036,456 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe PRC - [2011.05.20 11:13:06 | 000,120,104 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Acer\clear.fi\MVP\clear.fiAgent.exe PRC - [2011.05.20 11:13:04 | 000,169,352 | ---- | M] () -- C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe PRC - [2011.05.20 10:10:26 | 000,013,592 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe PRC - [2011.05.12 07:04:12 | 000,723,560 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe PRC - [2011.05.09 18:41:56 | 000,177,448 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe PRC - [2011.04.22 18:44:14 | 000,244,624 | ---- | M] (Acer Incorporated) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe PRC - [2011.02.01 23:41:24 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe PRC - [2011.02.01 23:41:20 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe PRC - [2010.12.27 10:30:22 | 001,817,088 | ---- | M] (Realsil Microelectronics Inc.) -- C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe PRC - [2010.11.17 03:53:16 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe PRC - [2010.05.05 17:56:06 | 000,251,392 | ---- | M] () -- C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe PRC - [2010.04.27 15:41:26 | 000,218,112 | ---- | M] () -- C:\Program Files (x86)\Razer\DeathAdder\razertra.exe PRC - [2010.03.23 14:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe PRC - [2010.01.30 01:52:58 | 000,260,640 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe PRC - [2007.12.19 12:58:24 | 000,163,840 | ---- | M] (Razer Inc.) -- C:\Program Files (x86)\Razer\DeathAdder\razerofa.exe ========== Modules (No Company Name) ========== MOD - [2013.05.12 23:42:27 | 000,004,096 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll MOD - [2012.01.05 15:22:36 | 000,465,344 | ---- | M] () -- C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll MOD - [2011.05.20 11:13:04 | 000,206,216 | ---- | M] () -- C:\Program Files (x86)\Acer\clear.fi\MVP\Kernel\DMR\CLNetMediaDMA.dll MOD - [2011.05.20 11:13:04 | 000,169,352 | ---- | M] () -- C:\Program Files (x86)\Acer\clear.fi\MVP\.\Kernel\DMR\DMREngine.exe MOD - [2010.05.05 17:56:06 | 000,251,392 | ---- | M] () -- C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe MOD - [2010.04.27 15:41:26 | 000,218,112 | ---- | M] () -- C:\Program Files (x86)\Razer\DeathAdder\razertra.exe ========== Services (SafeList) ========== SRV:64bit: - [2010.12.17 01:18:08 | 000,198,784 | ---- | M] (Conexant Systems Inc.) [Auto | Running] -- C:\Windows\SysNative\CxAudMsg64.exe -- (CxAudMsg) SRV - [2013.06.07 00:06:24 | 000,543,656 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2013.05.25 15:36:45 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.05.10 00:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2013.03.28 03:42:27 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2013.03.28 03:42:13 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2013.01.27 12:34:32 | 000,379,360 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv) SRV - [2013.01.27 12:34:32 | 000,022,056 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc) SRV - [2013.01.17 18:36:16 | 006,383,920 | ---- | M] (Native Instruments GmbH) [Auto | Running] -- C:\Programme\Common Files\Native Instruments\Hardware\NIHardwareService.exe -- (NIHardwareService) SRV - [2012.12.14 02:42:10 | 000,277,616 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs) SRV - [2012.12.05 16:39:26 | 000,384,888 | ---- | M] (BlueStack Systems, Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe -- (BstHdLogRotatorSvc) SRV - [2012.12.05 16:39:08 | 000,393,080 | ---- | M] (BlueStack Systems, Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\BlueStacks\HD-Service.exe -- (BstHdAndroidSvc) SRV - [2012.10.08 12:42:54 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2012.08.15 12:44:44 | 000,008,704 | ---- | M] (Hi-Rez Studios) [Auto | Paused] -- D:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe -- (HiPatchService) SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.01.05 15:22:10 | 000,256,536 | ---- | M] (NTI Corporation) [Auto | Running] -- C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc) SRV - [2011.12.01 11:48:54 | 000,018,944 | ---- | M] (Hercules®) [Auto | Running] -- C:\Programme\Hercules\Audio\DJ Console Series\drivers\amd64\HerculesDJControlMP3.EXE -- (HerculesDJControlMP3) SRV - [2011.10.01 09:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa) SRV - [2011.10.01 09:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist) SRV - [2011.09.25 03:40:50 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2011.07.01 04:51:11 | 000,353,360 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService) SRV - [2011.06.21 21:55:04 | 000,173,424 | ---- | M] (Egis Technology Inc. ) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe -- (EgisTec Ticket Service) SRV - [2011.05.30 04:54:14 | 000,036,456 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService) SRV - [2011.05.20 10:10:26 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) SRV - [2011.05.02 14:27:50 | 001,517,328 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) SRV - [2011.05.02 14:13:54 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS) SRV - [2011.05.02 14:10:26 | 000,844,560 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) SRV - [2011.04.22 18:44:14 | 000,244,624 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Live Updater Service) SRV - [2011.03.29 06:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2011.03.28 09:41:00 | 000,799,848 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer PowerSmart Manager\ePowerSvc.exe -- (ePowerSvc) SRV - [2011.02.01 23:41:24 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) SRV - [2011.02.01 23:41:20 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) SRV - [2010.12.27 10:30:22 | 001,817,088 | ---- | M] (Realsil Microelectronics Inc.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe -- (IconMan_R) SRV - [2010.11.29 15:00:56 | 000,149,504 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Programme\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost) SRV - [2010.10.12 19:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService) SRV - [2010.09.23 03:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV - [2010.03.23 14:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.01.30 01:52:58 | 000,260,640 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe -- (RS_Service) SRV - [2010.01.09 22:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2013.05.12 23:42:27 | 000,030,496 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\nvpciflt.sys -- (nvpciflt) DRV:64bit: - [2013.03.28 03:42:31 | 000,130,016 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2013.03.28 03:42:31 | 000,100,712 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2013.03.28 03:42:31 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2013.01.20 16:59:04 | 000,130,008 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv) DRV:64bit: - [2012.12.14 02:42:22 | 005,353,888 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2012.12.09 19:55:18 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV:64bit: - [2012.08.23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:64bit: - [2012.08.23 16:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:64bit: - [2012.08.23 16:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2012.07.22 20:41:38 | 000,024,672 | ---- | M] (Resplendence Software Projects Sp.) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rspLLL64.sys -- (rspLLL) DRV:64bit: - [2012.07.03 12:58:00 | 000,031,744 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgandnetadb.sys -- (andnetadb) DRV:64bit: - [2012.07.03 12:50:00 | 000,036,352 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgandnetmodem64.sys -- (ANDNetModem) DRV:64bit: - [2012.07.03 12:50:00 | 000,029,184 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgandnetdiag64.sys -- (AndNetDiag) DRV:64bit: - [2012.03.02 17:34:35 | 000,027,176 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggsemc.sys -- (ggsemc) DRV:64bit: - [2012.03.02 17:34:35 | 000,013,352 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggflt.sys -- (ggflt) DRV:64bit: - [2012.03.02 17:03:00 | 000,034,816 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64modem.sys -- (USBModem) DRV:64bit: - [2012.03.02 17:03:00 | 000,028,160 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64diag.sys -- (UsbDiag) DRV:64bit: - [2012.03.02 17:03:00 | 000,017,920 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lgx64bus.sys -- (usbbus) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2012.02.22 12:23:14 | 000,358,480 | ---- | M] (Native Instruments GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ks2avs.sys -- (ks2avs) DRV:64bit: - [2012.02.22 12:23:14 | 000,080,464 | ---- | M] (Native Instruments GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ks2usb.sys -- (ks2usb_svc) DRV:64bit: - [2011.12.27 16:43:48 | 000,297,808 | ---- | M] (© Guillemot R&D, 2010. All rights reserved.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HDJAsioK.sys -- (HDJAsioK) DRV:64bit: - [2011.12.27 16:43:48 | 000,229,200 | ---- | M] (© Guillemot R&D, 2010. All rights reserved.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HDJBulk.sys -- (Bulk) DRV:64bit: - [2011.12.27 16:43:46 | 000,251,728 | ---- | M] (© Guillemot R&D, 2011. All rights reserved.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HDJMidi.sys -- (HDJMidi) DRV:64bit: - [2011.10.01 09:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol) DRV:64bit: - [2011.10.01 09:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay) DRV:64bit: - [2011.10.01 09:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir) DRV:64bit: - [2011.10.01 09:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs) DRV:64bit: - [2011.08.03 18:09:01 | 000,062,776 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk) DRV:64bit: - [2011.08.03 18:09:01 | 000,022,648 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter) DRV:64bit: - [2011.08.03 18:09:01 | 000,020,520 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ) DRV:64bit: - [2011.07.14 07:35:47 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.07.14 07:35:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.06.21 15:19:14 | 000,025,496 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iwdbus.sys -- (iwdbus) DRV:64bit: - [2011.06.21 15:19:12 | 000,034,200 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\intelaud.sys -- (intaud_WaveExtensible) DRV:64bit: - [2011.05.20 09:53:44 | 000,557,848 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2011.05.01 08:33:06 | 008,593,920 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) DRV:64bit: - [2011.04.05 13:26:26 | 000,142,632 | ---- | M] (ELAN Microelectronics Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD) DRV:64bit: - [2011.03.25 04:49:24 | 001,583,744 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService) DRV:64bit: - [2011.03.10 06:01:45 | 000,018,432 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr) DRV:64bit: - [2011.03.10 06:01:45 | 000,017,408 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper) DRV:64bit: - [2011.02.10 08:52:34 | 000,181,760 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc) DRV:64bit: - [2011.02.10 08:52:34 | 000,082,432 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub) DRV:64bit: - [2011.01.12 10:10:44 | 000,333,928 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsPStor.sys -- (RSPCIESTOR) DRV:64bit: - [2010.11.29 15:00:04 | 000,016,120 | ---- | M] (Intel(R) Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB) DRV:64bit: - [2010.11.21 05:23:47 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus) DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.08 06:44:40 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C) DRV:64bit: - [2010.10.20 02:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) DRV:64bit: - [2010.10.15 10:28:18 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) DRV:64bit: - [2010.10.01 01:16:34 | 000,013,312 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VKbms.sys -- (VKbms) DRV:64bit: - [2010.05.11 12:11:38 | 002,229,608 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr) DRV:64bit: - [2010.03.23 17:37:34 | 000,012,032 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\danew.sys -- (danewFltr) DRV:64bit: - [2010.03.23 14:29:46 | 000,304,784 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CVPNDRVA.sys -- (CVPNDRVA) DRV:64bit: - [2010.02.08 09:32:00 | 000,014,992 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CVirtA64.sys -- (CVirtA) DRV:64bit: - [2009.08.10 16:25:32 | 000,047,104 | ---- | M] (Cypress Semiconductor) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CYUSB.sys -- (CYUSB) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 03:18:06 | 000,281,088 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BrSerIb.sys -- (BrSerIb) DRV:64bit: - [2009.06.10 22:41:10 | 000,015,360 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BrUsbSIb.sys -- (BrUsbSIb) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2008.11.16 19:39:44 | 000,157,968 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dne64x.sys -- (DNE) DRV - [2012.12.05 16:39:18 | 000,071,032 | ---- | M] (BlueStack Systems) [Kernel | Auto | Running] -- C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys -- (BstHdDrv) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com IE - HKCU\..\SearchScopes,DefaultScope = IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "hxxp://www.spiegel.de/" FF - prefs.js..extensions.enabledAddons: %7Bc50ca3c4-5656-43c2-a061-13e717f73fc8%7D:4.2.5 FF - prefs.js..extensions.enabledAddons: ich%40maltegoetz.de:1.4.8 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0 FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.11.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.11.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: D:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll () FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}: C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2013.01.27 21:49:17 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.02.25 22:51:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\AinSophAur\AppData\Roaming\mozilla\Extensions [2013.06.11 22:01:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\AinSophAur\AppData\Roaming\mozilla\Firefox\Profiles\1kt90l9d.default\extensions [2012.04.01 15:42:26 | 000,000,000 | ---D | M] (Разпознаване на устройство Logitech) -- C:\Users\AinSophAur\AppData\Roaming\mozilla\Firefox\Profiles\1kt90l9d.default\extensions\DeviceDetection@logitech.com [2013.04.11 14:17:21 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\AinSophAur\AppData\Roaming\mozilla\Firefox\Profiles\1kt90l9d.default\extensions\ich@maltegoetz.de [2013.05.25 15:36:46 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2013.05.25 15:36:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2013.05.25 15:36:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2013.05.25 15:36:23 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2013.05.25 15:36:46 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions [2013.05.25 15:36:46 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} File not found (No name found) -- C:\USERS\AINSOPHAUR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\1KT90L9D.DEFAULT\EXTENSIONS\{C50CA3C4-5656-43C2-A061-13E717F73FC8}.XPI O1 HOSTS File: ([2013.06.10 23:55:33 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.) O4:64bit: - HKLM..\Run: [ETDCtrl] C:\Programme\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.) O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IntelPAN] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation) O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [Power Management] C:\Programme\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe (Acer Incorporated) O4 - HKLM..\Run: [ArcadeMovieService] C:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe (CyberLink Corp.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (NTI Corporation) O4 - HKLM..\Run: [DeathAdder] C:\Program Files (x86)\Razer\DeathAdder\razerhid.exe () O4 - HKLM..\Run: [Dolby Home Theater v4] C:\Dolby PCEE4\pcee4.exe (Dolby Laboratories Inc.) O4 - HKLM..\Run: [Hercules DJ Series] C:\Program Files\Hercules\Audio\DJ Console Series\HDJSeriesCPL.exe (Hercules®) O4 - HKLM..\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.) O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation) O4 - HKLM..\Run: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH) O4 - HKLM..\Run: [SuiteTray] C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.) O4 - HKCU..\Run: [Steam] D:\Program Files (x86)\Steam\Steam.exe (Valve Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2847673A-D657-4D11-8659-652AEF65B405}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O20:64bit: - AppInit_DLLs: (C:\Windows\System32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation) O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation) O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008.01.08 09:08:11 | 000,000,000 | R--D | M] - E:\Autorun -- [ UDF ] O32 - AutoRun File - [2007.09.17 20:48:04 | 000,263,744 | R--- | M] (Firaxis Games) - E:\autorun.exe -- [ UDF ] O32 - AutoRun File - [2007.09.20 04:18:35 | 000,006,276 | R--- | M] () - E:\autorun.inf -- [ UDF ] O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.06.14 21:59:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET [2013.06.14 21:56:52 | 002,347,384 | ---- | C] (ESET) -- C:\Users\AinSophAur\Desktop\esetsmartinstaller_enu.exe [2013.06.11 22:12:45 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT [2013.06.11 22:12:18 | 000,000,000 | ---D | C] -- C:\JRT [2013.06.11 22:11:34 | 000,545,954 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\AinSophAur\Desktop\JRT.exe [2013.06.11 21:45:15 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN [2013.06.11 21:30:26 | 005,078,680 | R--- | C] (Swearware) -- C:\Users\AinSophAur\Desktop\ComboFix.exe [2013.06.10 23:45:22 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2013.06.10 23:45:22 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2013.06.10 23:45:22 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2013.06.10 23:42:07 | 000,000,000 | ---D | C] -- C:\Qoobox [2013.06.10 23:41:39 | 000,000,000 | ---D | C] -- C:\Windows\erdnt [2013.06.06 13:06:02 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\AinSophAur\Desktop\OTL.exe [2013.06.06 00:19:56 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\NV [2013.06.06 00:19:56 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\NV [2013.06.06 00:17:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AGEIA Technologies [2013.06.06 00:11:53 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation [2013.06.05 23:53:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Rockstar Games [2013.06.05 23:53:36 | 000,000,000 | ---D | C] -- C:\Users\AinSophAur\Documents\Rockstar Games [2013.05.29 03:00:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0 [2013.05.27 17:59:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LGMobile Support Tool [2013.05.27 17:59:48 | 000,000,000 | ---D | C] -- C:\ProgramData\LGMOBILEAX [2013.05.25 15:36:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox ========== Files - Modified Within 30 Days ========== [2013.06.15 17:37:42 | 000,890,839 | ---- | M] () -- C:\Users\AinSophAur\Desktop\SecurityCheck.exe [2013.06.15 13:21:22 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.06.15 13:21:22 | 000,016,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.06.15 13:18:03 | 001,614,924 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.06.15 13:18:03 | 000,697,542 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.06.15 13:18:03 | 000,652,820 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.06.15 13:18:03 | 000,148,548 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.06.15 13:18:03 | 000,121,494 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.06.15 13:13:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.06.15 13:13:02 | 3104,722,944 | -HS- | M] () -- C:\hiberfil.sys [2013.06.14 21:56:52 | 002,347,384 | ---- | M] (ESET) -- C:\Users\AinSophAur\Desktop\esetsmartinstaller_enu.exe [2013.06.11 22:11:34 | 000,545,954 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\AinSophAur\Desktop\JRT.exe [2013.06.11 22:00:40 | 000,648,201 | ---- | M] () -- C:\Users\AinSophAur\Desktop\adwcleaner.exe [2013.06.11 21:30:47 | 005,078,680 | R--- | M] (Swearware) -- C:\Users\AinSophAur\Desktop\ComboFix.exe [2013.06.10 23:55:33 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts [2013.06.06 16:09:47 | 001,592,818 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2013.06.06 13:11:57 | 000,000,168 | ---- | M] () -- C:\Users\AinSophAur\defogger_reenable [2013.06.06 13:07:06 | 000,377,856 | ---- | M] () -- C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe [2013.06.06 13:06:03 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\AinSophAur\Desktop\OTL.exe [2013.06.06 13:04:36 | 000,050,477 | ---- | M] () -- C:\Users\AinSophAur\Desktop\Defogger.exe [2013.05.27 18:08:53 | 000,002,413 | ---- | M] () -- C:\Windows\SysWow64\lgAxconfig.ini [2013.05.27 18:07:56 | 000,000,835 | ---- | M] () -- C:\Users\AinSophAur\Desktop\LGMobile Support Tool.lnk [2013.05.17 11:11:28 | 000,314,968 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT ========== Files Created - No Company Name ========== [2013.06.15 17:37:40 | 000,890,839 | ---- | C] () -- C:\Users\AinSophAur\Desktop\SecurityCheck.exe [2013.06.11 22:00:40 | 000,648,201 | ---- | C] () -- C:\Users\AinSophAur\Desktop\adwcleaner.exe [2013.06.10 23:45:22 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe [2013.06.10 23:45:22 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe [2013.06.10 23:45:22 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2013.06.10 23:45:22 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2013.06.10 23:45:22 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2013.06.06 13:11:57 | 000,000,168 | ---- | C] () -- C:\Users\AinSophAur\defogger_reenable [2013.06.06 13:07:05 | 000,377,856 | ---- | C] () -- C:\Users\AinSophAur\Desktop\gmer_2.1.19163.exe [2013.06.06 13:04:36 | 000,050,477 | ---- | C] () -- C:\Users\AinSophAur\Desktop\Defogger.exe [2013.06.06 00:12:35 | 003,165,737 | ---- | C] () -- C:\Windows\SysNative\nvcoproc.bin [2013.06.06 00:06:47 | 000,020,536 | ---- | C] () -- C:\Windows\SysNative\nvinfo.pb [2013.05.27 18:00:01 | 000,000,835 | ---- | C] () -- C:\Users\AinSophAur\Desktop\LGMobile Support Tool.lnk [2013.05.27 17:59:56 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\CommonDL.dll [2013.05.27 17:59:56 | 000,002,413 | ---- | C] () -- C:\Windows\SysWow64\lgAxconfig.ini [2012.12.14 02:42:30 | 000,064,512 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll [2012.10.10 03:22:28 | 000,272,928 | ---- | C] () -- C:\Windows\SysWow64\igvpkrng600.bin [2012.10.10 03:22:20 | 000,963,452 | ---- | C] () -- C:\Windows\SysWow64\igcodeckrng600.bin [2012.02.27 18:36:29 | 001,592,818 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.02.14 19:47:06 | 000,963,912 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin [2012.02.14 19:47:06 | 000,261,208 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin [2011.08.03 18:16:12 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2013.05.07 11:12:54 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\Audacity [2013.02.15 21:52:57 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\cef-cache [2012.12.09 19:57:56 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\DAEMON Tools Lite [2012.02.22 23:00:27 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\GHISLER [2012.08.15 15:46:30 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\ImgBurn [2012.02.29 20:16:43 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\IrfanView [2012.12.10 23:59:28 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\Kalypso Media [2012.12.13 14:43:36 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\LG Electronics [2013.05.11 18:18:01 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\MAXQDA11 [2013.01.24 21:35:31 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\mp3DirectCut [2012.12.25 22:36:42 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\Nettalk [2012.02.27 19:38:18 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\OpenOffice.org [2012.02.22 19:17:06 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\Opera [2012.08.20 12:17:11 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\Party [2012.12.09 20:03:24 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\Propellerhead Software [2012.03.23 12:30:30 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\Razer [2013.03.02 04:59:16 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\SoftGrid Client [2012.03.26 02:21:10 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\Swiss Academic Software [2012.02.27 18:37:17 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\TP [2012.12.23 00:22:21 | 000,000,000 | ---D | M] -- C:\Users\AinSophAur\AppData\Roaming\Tropico 4 ========== Purity Check ========== < End of report > Geändert von Ain (15.06.2013 um 17:29 Uhr) |
|
15.06.2013, 17:52
| #9 |
| /// the machine /// TB-Ausbilder | Java-Virus (JAVA/Lamar.RI ; JAVA/Jogek.WK usw.) Adobe Reader updaten. Die ESET Funde sind im Cache, den löschen wir jetzt  Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
17.06.2013, 19:04
| #10 |
| | Java-Virus (JAVA/Lamar.RI ; JAVA/Jogek.WK usw.) Sooo, TFC ist durchgelaufen, brauchte auch keinen Reboot. Vielen Dank schonmal. Combofix ist deinstalliert, die anderen von DelFix auch - bis auf Gmer, das lösche ich dann manuell. Adobe Reader X sagt, es gäbe aktuell keine Updates. Das werde ich nochmal überprüfen. Was Browser betrifft... ich verwende Opera. Ich schaue mir die empfohlenen Programme mal an, vielen Dank auch dafür. Zu dem Punkt Anti-Viren-Software bzw. zur Betonung von "eine" hätte ich allerdings noch Fragen: - Ich habe Avira und Microsoft Security Essentials gleichzeitig aktiviert. Sollte ich eines deaktivieren? - Ist eventuell eine andere Software mehr zu empfehlen? - Bei Avira gibt es in den Optionen die Funktion "Prozesse vor unerwünschtem Beenden schützen" mit einem Unterpunkt "erweiterter Prozessschutz" unter Sicherheit, dazu noch eine Frage: Bei der Beschreibung zum erweiterten Prozessschutz steht, dass dieser erheblich mehr Ressourcen benötige. Da mein Rechner nicht gerade das Performance-Monster ist, stellt sich die Frage, ob die Funktion eingespart werden kann oder besser nicht. Vielen Dank und viele Grüße Ain (edit: +kleine Spende für die Mühen. Toll wenn Leute sowas ehrenamtlich machen!) Geändert von Ain (17.06.2013 um 19:11 Uhr) |
|
17.06.2013, 19:12
| #11 | ||
| /// the machine /// TB-Ausbilder | Java-Virus (JAVA/Lamar.RI ; JAVA/Jogek.WK usw.)Zitat:
Zitat:
Zum rest: Weg mit Avira
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
18.06.2013, 12:21
| #12 |
| | Java-Virus (JAVA/Lamar.RI ; JAVA/Jogek.WK usw.) Gut habe Avira deinstalliert (auch wenn ich nicht weiß woher ich MSE überhaubt habe, muss wohl vorinstalliert gewesen sein. Habe ich erst im Zuge dieses Threads entdeckt). Dann nochmal ein abschließendes danke und noch viel Erfolg bei der weiteren Arbeit. Viele Grüße Ain |
|
18.06.2013, 12:34
| #13 |
| /// the machine /// TB-Ausbilder | Java-Virus (JAVA/Lamar.RI ; JAVA/Jogek.WK usw.) Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
WARNUNG für die MITLESER: 
Linear-Darstellung
