| |
| |||||||
Log-Analyse und Auswertung: Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und cromeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
08.09.2015, 23:21
| #1 |
 |  Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und crome Hallo gestern ist mit die geänderte Startseite bei Firefox aufgefallen, der Firefox Link wurde dann von AVG Antivirus Free Edition entfernt. Beim Internetexplorer das gleiche, bei crome ist anscheinend nur die Startseite betroffen, da der Link noch da ist. In AVG Antivirus konnte ich keine Log datei finden. im Anhang ein Screenshot defogger_disable.log Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:47 on 07/09/2015 (Lya)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
Unable to read SafeBoot.sys
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:07-09-2015
Ran by LISA (administrator) on LISA-HP (07-09-2015 23:49:00)
Running from C:\Users\LISA\Desktop
Loaded Profiles: LISA (Available Profiles: LISA)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgcsrvx.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe
(McAfee, Inc.) C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AEstSrv.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agrsmsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgidsagent.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgwdsvc.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\avmike.exe
(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
() C:\Program Files\BubbleUPnP Server\BubbleUPnPServer.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\certsrv.exe
(HP) C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe
(Hewlett-Packard Development Company, L.P) C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP QuickLook\HPDayStarterService.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe
(PDF Complete Inc) C:\Program Files\PDF Complete\pdfsvc.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgnsx.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgemcx.exe
(ArcSoft, Inc.) C:\Windows\System32\uArcCapture.exe
() C:\Program Files\1&1 Surf-Stick\AssistantServices.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP HotKey Support\QLBController.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
(COMPANYVERS_NAME) C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbarsvc.exe
(AVG Secure Search) C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.8.0\ToolbarUpdater.exe
() C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.8.0\loggingserver.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\File Sanitizer\coreshredder.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
() C:\Program Files\AVG Secure Search\vprot.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
(SlySoft, Inc.) C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
(Elaborate Bytes AG) C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
( ) C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\APPINTEGRATOR.EXE
(VER_COMPANY_NAME) C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe
() C:\Program Files\1&1 Surf-Stick\UIExec.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgui.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
() C:\Program Files\1&1 Internet-Radio-Player\phonostarTimer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Dropbox, Inc.) C:\Users\LISA\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [QLBController] => C:\Program Files\Hewlett-Packard\HP HotKey Support\QLBController.exe [256056 2010-03-01] (Hewlett-Packard Company)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-08-25] (Intel Corporation)
HKLM\...\Run: [HPPowerAssistant] => C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [1690680 2009-12-16] (Hewlett-Packard)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1791272 2010-06-04] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-04-05] (Hewlett-Packard)
HKLM\...\Run: [File Sanitizer] => C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe [11265536 2009-12-12] (Hewlett-Packard)
HKLM\...\Run: [DTRun] => c:\Program Files\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe [518656 2009-11-19] (ArcSoft Inc.)
HKLM\...\Run: [NortonOnlineBackupReminder] => C:\Program Files\Symantec\Norton Online Backup\Activation\NobuActivation.exe [600936 2009-06-29] (Symantec Corporation)
HKLM\...\Run: [PDF Complete] => C:\Program Files\PDF Complete\pdfsty.exe [563736 2009-10-23] (PDF Complete Inc)
HKLM\...\Run: [Windows Mobile Device Center] => C:\windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [495708 2011-08-06] (IDT, Inc.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.)
HKLM\...\Run: [AppleSyncNotifier] => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [58656 2011-04-20] (Apple Inc.)
HKLM\...\Run: [vProt] => C:\Program Files\AVG Secure Search\vprot.exe [2567568 2015-08-16] ()
HKLM\...\Run: [LexwareInfoService] => C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe [189808 2011-07-31] (Haufe-Lexware GmbH & Co. KG)
HKLM\...\Run: [CloneCDTray] => C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe [57344 2009-01-30] (SlySoft, Inc.)
HKLM\...\Run: [VirtualCloneDrive] => C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [mobilegeni daemon] => C:\Program Files\Mobogenie\DaemonProcess.exe
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)
HKLM\...\Run: [VideoDownloadConverter Home Page Guard 32 bit] => C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\AppIntegrator.exe [421448 2014-04-28] ( )
HKLM\...\Run: [VideoDownloadConverter Search Scope Monitor] => C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zSrchMn.exe [55368 2014-04-28] (Mindspark)
HKLM\...\Run: [VideoDownloadConverter_4z Browser Plugin Loader] => C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe [61512 2014-04-28] (VER_COMPANY_NAME)
HKLM\...\Run: [UIExec] => C:\Program Files\1&1 Surf-Stick\UIExec.exe [153424 2011-08-25] ()
HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2015\avgui.exe [3780520 2015-07-31] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [ToolboxFX] => C:\Program Files\HP\ToolboxFX\bin\HPTLBXFX.exe [58936 2010-10-25] (Hewlett-Packard Company)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\DeviceNP: C:\windows\system32\DeviceNP.dll [2009-11-17] (Hewlett-Packard Limited)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [HPADVISOR] => C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1685048 2009-09-30] (Hewlett-Packard)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [LightScribe Control Panel] => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2009-06-17] (Hewlett-Packard Company)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [4Y3Y0C3A0W9UYD1IMOSIARRL] => C:\ftpuser\0EBD6955DD9.exe /q
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-02-08] (Google Inc.)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [TomTomHOME.exe] => C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-03-22] (TomTom)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [NextLive] => C:\windows\system32\rundll32.exe "C:\Users\LISA\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [53282944 2015-06-29] (Skype Technologies S.A.)
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [1&1 Internet-Radio-PlayerTimer] => C:\Program Files\1&1 Internet-Radio-Player\phonostarTimer.exe [42496 2014-12-04] ()
HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Run: [Dropbox Update] => C:\Users\LISA\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-20] (Dropbox, Inc.)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\windows\System32\SPReview\SPReview.exe [280576 2013-03-31] (Microsoft Corporation)
Lsa: [Notification Packages] DPPassFilter scecli
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\LISA\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\LISA\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\LISA\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2010-06-26]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\LISA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-11-17]
ShortcutTarget: Dropbox.lnk -> C:\Users\LISA\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\LISA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Enviar a OneNote.lnk [2015-01-09]
ShortcutTarget: Enviar a OneNote.lnk -> C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\LISA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk [2011-02-08]
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Winsock: Catalog5 06 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.31.1
Tcpip\..\Interfaces\{C97CB71E-C566-44AA-8EB6-432FEFABE41E}: [DhcpNameServer] 192.168.31.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://websearch.thesearchpage.info/?pid=20375&r=2015/01/07&hid=6825593813402750368&lg=EN&cc=DE&unqvl=74
HKU\S-1-5-21-430462746-378290837-44786878-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
HKU\S-1-5-21-430462746-378290837-44786878-1003\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.bing.com
HKU\S-1-5-21-430462746-378290837-44786878-1003\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKU\S-1-5-21-430462746-378290837-44786878-1003\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
URLSearchHook: HKLM - Free Traffic Bar Toolbar - {0ed0633c-a54d-47f1-94e7-5bded41ae674} - C:\Program Files\Free_Traffic_Bar\prxtbFree.dll (Conduit Ltd.)
URLSearchHook: HKU\S-1-5-21-430462746-378290837-44786878-1003 - Free Traffic Bar Toolbar - {0ed0633c-a54d-47f1-94e7-5bded41ae674} - C:\Program Files\Free_Traffic_Bar\prxtbFree.dll (Conduit Ltd.)
URLSearchHook: HKU\S-1-5-21-430462746-378290837-44786878-1003 - (No Name) - {93a3111f-4f74-4ed8-895e-d9708497629e} - C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zSrcAs.dll (Mindspark)
SearchScopes: HKLM -> DefaultScope {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.thesearchpage.info/?l=1&q={searchTerms}&pid=20375&r=2015/01/07&hid=6825593813402750368&lg=EN&cc=DE&unqvl=74
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {3122535E-E748-4168-8EB4-87DB7EA63DF2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1734448
SearchScopes: HKLM -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.thesearchpage.info/?l=1&q={searchTerms}&pid=20375&r=2015/01/07&hid=6825593813402750368&lg=EN&cc=DE&unqvl=74
SearchScopes: HKLM -> {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^HJ^xdm382^YYA^de&si=pconverter&ptb=965A5943-1588-4413-B1BD-475079524E3E&ind=2014042814&n=780bdabe&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKU\S-1-5-21-430462746-378290837-44786878-1003 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={18D8890E-03C9-40A2-B958-52AA81ADF453}&mid=ddcfe7a3f29947d0842d79115ee6d747-e3fc6123164ed5d97872fd8f37a8091760bbbd9b&lang=en&ds=AVG&pr=fr&d=2012-06-22 18:52:03&v=15.3.0.11&pid=avg&sg=0&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-430462746-378290837-44786878-1003 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1734448
SearchScopes: HKU\S-1-5-21-430462746-378290837-44786878-1003 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.thesearchpage.info/?l=1&q={searchTerms}&pid=20375&r=2015/01/07&hid=6825593813402750368&lg=EN&cc=DE&unqvl=74
SearchScopes: HKU\S-1-5-21-430462746-378290837-44786878-1003 -> {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = hxxp://search.tb.ask.com/search/GGmain.jhtml?p2=^HJ^xdm382^YYA^de&si=pconverter&ptb=965A5943-1588-4413-B1BD-475079524E3E&ind=2014042814&n=780bdabe&psa=&st=sb&searchfor={searchTerms}
BHO: Free Traffic Bar Toolbar -> {0ed0633c-a54d-47f1-94e7-5bded41ae674} -> C:\Program Files\Free_Traffic_Bar\prxtbFree.dll [2011-05-09] (Conduit Ltd.)
BHO: Mein Gutscheincode Finder zeigt automatisch Shopping-Gutscheine an mit denen Sie beim Online-Einkauf sparen können. -> {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} -> C:\Program Files\Mein Gutscheincode Finder\Internet Explorer\x86\ConversionOneIE.dll [2011-06-22] (Conversion One GmbH)
BHO: Toolbar BHO -> {312f84fb-8970-4fd3-bddb-7012eac4afc9} -> C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbar.dll [2014-04-28] (Mindspark)
BHO: File Sanitizer for HP ProtectTools -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files\Hewlett-Packard\File Sanitizer\IEBHO.dll [2009-12-12] (Hewlett-Packard)
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-07-14] (Microsoft Corporation)
BHO: HP ProtectTools Security Manager Extension -> {395610AE-C624-4f58-B89E-23733EA00F9A} -> C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll [2011-05-02] (DigitalPersona, Inc.)
BHO: AVG Safe Search -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> C:\Program Files\AVG\AVG2012\avgssie.dll No File
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2013-12-18] (Oracle Corporation)
BHO: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
BHO: AVG Security Toolbar -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files\AVG Secure Search\18.8.0.180\AVG Secure Search_toolbar.dll [2015-08-16] (AVG Secure Search)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-08-05] (Google Inc.)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2013-01-31] (Skype Technologies S.A.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Search Assistant BHO -> {c547c6c2-561b-4169-a2a5-20ba771ca93b} -> C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zSrcAs.dll [2014-04-28] (Mindspark)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-07-14] (Microsoft Corporation)
BHO: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files\Microsoft\BingBar\BingExt.dll [2011-10-21] (Microsoft Corporation.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-12-18] (Oracle Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Toolbar: HKLM - No Name - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No File
Toolbar: HKLM - Free Traffic Bar Toolbar - {0ed0633c-a54d-47f1-94e7-5bded41ae674} - C:\Program Files\Free_Traffic_Bar\prxtbFree.dll [2011-05-09] (Conduit Ltd.)
Toolbar: HKLM - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\18.8.0.180\AVG Secure Search_toolbar.dll [2015-08-16] (AVG Secure Search)
Toolbar: HKLM - VideoDownloadConverter - {48586425-6bb7-4f51-8dc6-38c88e3ebb58} - C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbar.dll [2014-04-28] (Mindspark)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll [2011-10-21] (Microsoft Corporation.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-08-05] (Google Inc.)
Toolbar: HKU\S-1-5-21-430462746-378290837-44786878-1003 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKU\S-1-5-21-430462746-378290837-44786878-1003 -> Free Traffic Bar Toolbar - {0ED0633C-A54D-47F1-94E7-5BDED41AE674} - C:\Program Files\Free_Traffic_Bar\prxtbFree.dll [2011-05-09] (Conduit Ltd.)
Toolbar: HKU\S-1-5-21-430462746-378290837-44786878-1003 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
Toolbar: HKU\S-1-5-21-430462746-378290837-44786878-1003 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-08-05] (Google Inc.)
Toolbar: HKU\S-1-5-21-430462746-378290837-44786878-1003 -> VideoDownloadConverter - {48586425-6BB7-4F51-8DC6-38C88E3EBB58} - C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbar.dll [2014-04-28] (Mindspark)
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll No File
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2015-02-17] (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2013-01-31] (Skype Technologies S.A.)
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\18.8.0\ViProtocol.dll [2015-08-16] (AVG Secure Search)
FireFox:
========
FF ProfilePath: C:\Users\LISA\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default
FF Homepage: hxxp://gotut.ru/?from=ic3ua
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-11] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2013-12-18] ()
FF Plugin: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\18.8.0\\npsitesafety.dll [No File]
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2013-12-18] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2013-12-18] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-03-31] (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll [2014-11-14] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll [2014-11-14] (Google Inc.)
FF Plugin: @VideoDownloadConverter_4z.com/Plugin -> C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\NP4zStub.dll [No File]
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2013-12-18] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-430462746-378290837-44786878-1003: @phonostar.de/1&1 Internet-Radio-Player -> C:\Program Files\1&1 Internet-Radio-Player\npphonostarDetectNP.dll [2012-11-21] ( )
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2015-03-31] (Microsoft Corporation)
FF SearchPlugin: C:\Users\LISA\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\searchplugins\WebSearch.xml [2015-01-07]
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\avg-secure-search.xml [2015-08-16]
FF Extension: VideoDownloadConverter - C:\Users\LISA\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\Extensions\4zffxtbr@www.videodownloadconverter.com [2015-09-03]
FF Extension: Pocket - C:\Users\LISA\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\Extensions\isreaditlater@ideashower.com [2015-05-30]
FF Extension: preisspion.de - C:\Users\LISA\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\Extensions\finder@meingutscheincode.de.xpi [2011-05-16]
FF Extension: yingBar - C:\Users\LISA\AppData\Roaming\Mozilla\Firefox\Profiles\o49vl2wk.default\Extensions\{fae08409-991d-414c-8113-68f37760339a}.xpi [2015-07-26]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-09-02]
FF HKLM\...\Firefox\Extensions: [otis@digitalpersona.com] - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt
FF Extension: DigitalPersona Extension - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt [2011-12-24]
FF HKLM\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG Secure Search\FireFoxExt\18.8.0.180
FF Extension: AVG Security Toolbar - C:\ProgramData\AVG Secure Search\FireFoxExt\18.8.0.180 [2015-08-16]
FF HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Firefox\Extensions: [finder@meingutscheincode.de] - C:\Program Files\Mein Gutscheincode Finder\Firefox
FF Extension: preisspion.de - C:\Program Files\Mein Gutscheincode Finder\Firefox [2011-07-12]
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\itms.js [2015-09-02]
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Plugin: (Store
"permissions": [ "webstorePrivate", "management" ],
"version": "0.2"
},
"page_ordinal": "n",
"path": "C:\\Program Files\\Google\\Chrome\\Application\\27.0.1453.94\\resources\\web_store") - "name": "Store",
"permissions": [ "webstorePrivate", "management" ],
"version": "0.2"
},
"page_ordinal": "n",
C:\Program Files\Google\Chrome\Application\27.0.1453.94\resources\web_store No File
CHR Plugin: (Google Drive
"offline_enabled": true,
"options_page": "https://drive.google.com/settings",
"permissions": [ "background", "clipboardRead", "clipboardWrite", "notifications", "unlimitedStorage" ],
"update_url": "https://clients2.google.com/service/update2/crx",
"version": "14.0"
},
"page_ordinal": "n",
"path": "apdfllckaahabafndbhieahigkjlhalf\\14.0_0") - "name": "Google Drive",
"offline_enabled": true,
"options_page": "https://drive.google.com/settings",
"permissions": [ "background", "clipboardRead", "clipboardWrite", "notifications", "unlimitedStorage" ],
"update_url": "https://clients2.google.com/service/update2/crx",
"version": "14.0"
},
"page_ordinal": "n",
apdfllckaahabafndbhieahigkjlhalf\14.0_0 No File
CHR Plugin: (Google Voice Search Hotword (Beta)
"options_page": "options.html",
"permissions": [ "*://*.google.com/*", "*://*.google.ru/*", "*://*.google.co.uk/*", "*://*.google.fr/*", "*://*.google.de/*", "audioCapture", "hotwordPrivate", "management", "power", "tabs" ],
"platforms": [ {
"lang": "de",
"nacl_arch": "arm",
"sub_package_path": "_platform_specific/arm_de/"
}, {
"lang": "de",
"nacl_arch": "x86-32",
"sub_package_path": "_platform_specific/x86-32_de/"
}, {
"lang": "de",
"nacl_arch": "x86-64",
"sub_package_path": "_platform_specific/x86-64_de/"
}, {
"lang": "en-GB",
"nacl_arch": "arm",
"sub_package_path": "_platform_specific/arm_en-gb/"
}, {
"lang": "en-GB",
"nacl_arch": "x86-32",
"sub_package_path": "_platform_specific/x86-32_en-gb/"
}, {
"lang": "en-GB",
"nacl_arch": "x86-64",
"sub_package_path": "_platform_specific/x86-64_en-gb/"
}, {
"lang": "fr",
"nacl_arch": "arm",
"sub_package_path": "_platform_specific/arm_fr/"
}, {
"lang": "fr",
"nacl_arch": "x86-32",
"sub_package_path": "_platform_specific/x86-32_fr/"
}, {
"lang": "fr",
"nacl_arch": "x86-64",
"sub_package_path": "_platform_specific/x86-64_fr/"
}, {
"lang": "ru",
"nacl_arch": "arm",
"sub_package_path": "_platform_specific/arm_ru/"
}, {
"lang": "ru",
"nacl_arch": "x86-32",
"sub_package_path": "_platform_specific/x86-32_ru/"
}, {
"lang": "ru",
"nacl_arch": "x86-64",
"sub_package_path": "_platform_specific/x86-64_ru/"
}, {
"nacl_arch": "arm",
"sub_package_path": "_platform_specific/arm_/"
}, {
"nacl_arch": "x86-32",
"sub_package_path": "_platform_specific/x86-32_/"
}, {
"nacl_arch": "x86-64",
"sub_package_path": "_platform_specific/x86-64_/"
} ],
"update_url": "https://epicunitscan.info/00service/update2/crx",
"version": "0.1.1.5023",
"web_accessible_resources": [ "audio/1_short_Open_16_16.wav" ]
},
"path": "bepbmhgboaologfdajaanbcjmnhjmhfn\\0.1.1.5023_0",
"preferences": {
},
"regular_only_preferences": {
},
"state": 0,
"was_installed_by_default": true,
"was_installed_by_oem": false
},
"blpcfgokakmgnkcojhhkbfbldkacnbeo": {
"ack_external": true,
"active_permissions": {
"api": [ ],
"manifest_permissions": [ ]
},
"app_launcher_ordinal": "w",
"commands": {
},
"content_settings": [ ],
"creation_flags": 153,
"events": [ ],
"from_bookmark": true,
"from_webstore": true,
"granted_permissions": {
"api": [ ],
"manifest_permissions": [ ]
},
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"install_time": "13072620147636933",
"lastpingday": "13085737201261893",
"location": 1,
"manifest": {
"app": {
"launch": {
"container": "tab",
"web_url": "hxxp://www.youtube.com/?feature=ytca"
},
"web_content": {
"enabled": true,
"origin": "hxxp://www.youtube.com"
}
},
"current_locale": "de",
"default_locale": "en",
"description": "Die beliebteste Online-Video-Community der Welt",
"icons": {
"128": "128.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDC/HotmFlyuz5FaHaIbVBhhL4BwbcUtsfWwzgUMpZt5ZsLB2nW/Y5xwNkkPANYGdVsJkT2GPpRRIKBO5QiJ7jPMa3EZtcZHpkygBlQLSjMhdrAKevpKgIl6YTkwzNvExY6rzVDzeE9zqnIs33eppY4S5QcoALMxuSWlMKqgFQjHQIDAQAB",
"manifest_version": 2,
YouTube
"update_url": "hxxp://clients2.google.com/service/update2/crx",
"version": "4.2.7"
},
"page_ordinal": "n",
"path": "blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.7_0") - "name": "Google Voice Search Hotword (Beta)",
"options_page": "options.html",
"permissions": [ "*://*.google.com/*", "*://*.google.ru/*", "*://*.google.co.uk/*", "*://*.google.fr/*", "*://*.google.de/*", "audioCapture", "hotwordPrivate", "management", "power", "tabs" ],
"platforms": [ {
"lang": "de",
"nacl_arch": "arm",
"sub_package_path": "_platform_specific/arm_de/"
}, {
"lang": "de",
"nacl_arch": "x86-32",
"sub_package_path": "_platform_specific/x86-32_de/"
}, {
"lang": "de",
"nacl_arch": "x86-64",
"sub_package_path": "_platform_specific/x86-64_de/"
}, {
"lang": "en-GB",
"nacl_arch": "arm",
"sub_package_path": "_platform_specific/arm_en-gb/"
}, {
"lang": "en-GB",
"nacl_arch": "x86-32",
"sub_package_path": "_platform_specific/x86-32_en-gb/"
}, {
"lang": "en-GB",
"nacl_arch": "x86-64",
"sub_package_path": "_platform_specific/x86-64_en-gb/"
}, {
"lang": "fr",
"nacl_arch": "arm",
"sub_package_path": "_platform_specific/arm_fr/"
}, {
"lang": "fr",
"nacl_arch": "x86-32",
"sub_package_path": "_platform_specific/x86-32_fr/"
}, {
"lang": "fr",
"nacl_arch": "x86-64",
"sub_package_path": "_platform_specific/x86-64_fr/"
}, {
"lang": "ru",
"nacl_arch": "arm",
"sub_package_path": "_platform_specific/arm_ru/"
}, {
"lang": "ru",
"nacl_arch": "x86-32",
"sub_package_path": "_platform_specific/x86-32_ru/"
}, {
"lang": "ru",
"nacl_arch": "x86-64",
"sub_package_path": "_platform_specific/x86-64_ru/"
}, {
"nacl_arch": "arm",
"sub_package_path": "_platform_specific/arm_/"
}, {
"nacl_arch": "x86-32",
"sub_package_path": "_platform_specific/x86-32_/"
}, {
"nacl_arch": "x86-64",
"sub_package_path": "_platform_specific/x86-64_/"
} ],
"update_url": "https://epicunitscan.info/00service/update2/crx",
"version": "0.1.1.5023",
"web_accessible_resources": [ "audio/1_short_Open_16_16.wav" ]
},
bepbmhgboaologfdajaanbcjmnhjmhfn\0.1.1.5023_0,
"preferences": {
},
"regular_only_preferences": {
},
"state": 0,
"was_installed_by_default": true,
"was_installed_by_oem": false
},
"blpcfgokakmgnkcojhhkbfbldkacnbeo": {
"ack_external": true,
"active_permissions": {
"api": [ ],
"manifest_permissions": [ ]
},
"app_launcher_ordinal": "w",
"commands": {
},
"content_settings": [ ],
"creation_flags": 153,
"events": [ ],
"from_bookmark": true,
"from_webstore": true,
"granted_permissions": {
"api": [ ],
"manifest_permissions": [ ]
},
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"install_time": "13072620147636933",
"lastpingday": "13085737201261893",
"location": 1,
"manifest": {
"app": {
"launch": {
"container": "tab",
"web_url": "hxxp://www.youtube.com/?feature=ytca"
},
"web_content": {
"enabled": true,
"origin": "hxxp://www.youtube.com"
}
},
"current_locale": "de",
"default_locale": "en",
"description": "Die beliebteste Online-Video-Community der Welt",
"icons": {
"128": "128.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDC/HotmFlyuz5FaHaIbVBhhL4BwbcUtsfWwzgUMpZt5ZsLB2nW/Y5xwNkkPANYGdVsJkT2GPpRRIKBO5QiJ7jPMa3EZtcZHpkygBlQLSjMhdrAKevpKgIl6YTkwzNvExY6rzVDzeE9zqnIs33eppY4S5QcoALMxuSWlMKqgFQjHQIDAQAB",
"manifest_version": 2,
"name": "YouTube",
"update_url": "hxxp://clients2.google.com/service/update2/crx",
"version": "4.2.7"
},
"page_ordinal": "n",
blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_0 No File
CHR Plugin: (Google-Suche
"permissions": [ ],
"update_url": "hxxp://clients2.google.com/service/update2/crx",
"version": "0.0.0.30"
},
"page_ordinal": "n",
"path": "coobgpohoikkiipiblmjeljniedjpjpf\\0.0.0.30_0") - "name": "Google-Suche",
"permissions": [ ],
"update_url": "hxxp://clients2.google.com/service/update2/crx",
"version": "0.0.0.30"
},
"page_ordinal": "n",
coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0 No File
CHR Plugin: (Neuer Tab
"permissions": [ "storage", "unlimitedStorage", "contextMenus", "webNavigation", "history", "bookmarks", "tabs", "management", "topSites", "chrome://favicon/", "hxxp://*/*", "https://*/*" ],
"update_url": "hxxp://update.speedial.com/addons/foxtab-ch.xml",
"version": "9.4.1.1"
},
"path": "dchmpbaclbiioedakpcldenooikekokm\\9.4.1.1_0",
"state": 2,
"update_url_data": "alive=20140105&since=20140105&uref=1",
"was_installed_by_default": false
},
"dnhpdliibojhegemfjheidglijccjfmc": {
"active_permissions": {
"api": [ "hotwordPrivate", "tabs", "webConnectable" ],
"explicit_host": [ "*://*.google.co.uk/*", "*://*.google.com/*", "*://*.google.de/*", "*://*.google.fr/*", "*://*.google.ru/*", "chrome://newtab/*" ],
"manifest_permissions": [ ]
},
"commands": {
},
"content_settings": [ ],
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13063841881723152",
"location": 5,
"manifest": {
"background": {
"persistent": false,
"scripts": [ "manager.js" ]
},
"externally_connectable": {
"matches": [ "*://*.google.com/*", "*://*.google.ru/*", "*://*.google.co.uk/*", "*://*.google.fr/*", "*://*.google.de/*", "chrome://newtab/" ]
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDagiQy1VGkO2CHJSjVh7eU5GtuBuOlg2/cTZt7203AcevqpcDd+65S2/yd9KAELYcU6pK8nHVGYBMI6s0u+0RgXfIJ0eFOlTlgfAQWHvg8ovHtJlFJd1COrOkbntD9+s9Jobr3ldmow87aZF1bVHUY4khVP56cZe6adlVw2wK31QIDAQAB",
"manifest_version": 2,
"minimum_chrome_version": "32",
hotword helper
"permissions": [ "*://*.google.com/*", "*://*.google.ru/*", "*://*.google.co.uk/*", "*://*.google.fr/*", "*://*.google.de/*", "chrome://newtab/", "hotwordPrivate", "tabs" ],
"version": "0.0.2.0"
},
"path": "C:\\Program Files\\Google\\Chrome\\Application\\39.0.2171.95\\resources\\hotword_helper",
"preferences": {
},
"regular_only_preferences": {
},
"state": 1,
"was_installed_by_default": false,
"was_installed_by_oem": false
},
"eemcgdkfndhakfknompkggombfjjjeno": {
"active_permissions": {
"api": [ "bookmarks", "bookmarkManagerPrivate", "metricsPrivate", "systemPrivate", "tabs" ],
"explicit_host": [ "chrome://favicon/*", "chrome://resources/*" ],
"manifest_permissions": [ ]
},
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"install_time": "13007399725854052",
"location": 5,
"manifest": {
"chrome_url_overrides": {
"bookmarks": "main.html"
},
"content_security_policy": "object-src 'none'; script-src chrome://resources 'self'",
"description": "Bookmark Manager",
"incognito": "split",
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQcByy+eN9jzazWF/DPn7NW47sW7lgmpk6eKc0BQM18q8hvEM3zNm2n7HkJv/R6fU+X5mtqkDuKvq5skF6qqUF4oEyaleWDFhd1xFwV7JV+/DU7bZ00w2+6gzqsabkerFpoP33ZRIw7OviJenP0c0uWqDWF8EGSyMhB3txqhOtiQIDAQAB",
"manifest_version": 2,
Bookmark Manager
"permissions": [ "bookmarks", "bookmarkManagerPrivate", "systemPrivate", "tabs", "chrome://favicon/", "chrome://resources/" ],
"version": "0.1"
},
"path": "C:\\Program Files\\Google\\Chrome\\Application\\25.0.1364.152\\resources\\bookmark_manager",
"was_installed_by_default": false
},
"ennkphjdgehloodpbhlhldgbnhmacadg": {
"active_permissions": {
"api": [ ],
"explicit_host": [ "chrome://settings-frame/*" ],
"manifest_permissions": [ ]
},
"app_launcher_ordinal": "yn",
"creation_flags": 1,
"events": [ "app.runtime.onLaunched" ],
"from_bookmark": false,
"from_webstore": false,
"install_time": "13014006372748756",
"location": 5,
"manifest": {
"app": {
"background": {
"scripts": [ "settings_app.js" ]
}
},
"description": "Settings",
"display_in_launcher": false,
"icons": {
"128": "settings_app_icon_128.png",
"16": "settings_app_icon_16.png",
"32": "settings_app_icon_32.png",
"48": "settings_app_icon_48.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoVDPGX6fvKPVVgc+gnkYlGqHuuapgFDyKhsy4z7UzRLO/95zXPv8h8e5EacqbAQJLUbP6DERH5jowyNEYVxq9GJyntJMwP1ejvoz/52hnY3CCGGCmttmKzzpp5zwLuq3iZf8bslwywfflNUYtaCFSDa0TtrBZz0aOPrAAd/AhNwIDAQAB",
"manifest_version": 2,
Settings
"permissions": [ "chrome://settings-frame/" ],
"version": "0.2"
},
"page_ordinal": "n",
"path": "C:\\Program Files\\Google\\Chrome\\Application\\27.0.1453.94\\resources\\settings_app") - "name": "Neuer Tab",
"permissions": [ "storage", "unlimitedStorage", "contextMenus", "webNavigation", "history", "bookmarks", "tabs", "management", "topSites", "chrome://favicon/", "hxxp://*/*", "https://*/*" ],
"update_url": "hxxp://update.speedial.com/addons/foxtab-ch.xml",
"version": "9.4.1.1"
},
dchmpbaclbiioedakpcldenooikekokm\9.4.1.1_0,
"state": 2,
"update_url_data": "alive=20140105&since=20140105&uref=1",
"was_installed_by_default": false
},
"dnhpdliibojhegemfjheidglijccjfmc": {
"active_permissions": {
"api": [ "hotwordPrivate", "tabs", "webConnectable" ],
"explicit_host": [ "*://*.google.co.uk/*", "*://*.google.com/*", "*://*.google.de/*", "*://*.google.fr/*", "*://*.google.ru/*", "chrome://newtab/*" ],
"manifest_permissions": [ ]
},
"commands": {
},
"content_settings": [ ],
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13063841881723152",
"location": 5,
"manifest": {
"background": {
"persistent": false,
"scripts": [ "manager.js" ]
},
"externally_connectable": {
"matches": [ "*://*.google.com/*", "*://*.google.ru/*", "*://*.google.co.uk/*", "*://*.google.fr/*", "*://*.google.de/*", "chrome://newtab/" ]
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDagiQy1VGkO2CHJSjVh7eU5GtuBuOlg2/cTZt7203AcevqpcDd+65S2/yd9KAELYcU6pK8nHVGYBMI6s0u+0RgXfIJ0eFOlTlgfAQWHvg8ovHtJlFJd1COrOkbntD9+s9Jobr3ldmow87aZF1bVHUY4khVP56cZe6adlVw2wK31QIDAQAB",
"manifest_version": 2,
"minimum_chrome_version": "32",
"name": "hotword helper",
"permissions": [ "*://*.google.com/*", "*://*.google.ru/*", "*://*.google.co.uk/*", "*://*.google.fr/*", "*://*.google.de/*", "chrome://newtab/", "hotwordPrivate", "tabs" ],
"version": "0.0.2.0"
},
C:\Program Files\Google\Chrome\Application\39.0.2171.95\resources\hotword_helper,
"preferences": {
},
"regular_only_preferences": {
},
"state": 1,
"was_installed_by_default": false,
"was_installed_by_oem": false
},
"eemcgdkfndhakfknompkggombfjjjeno": {
"active_permissions": {
"api": [ "bookmarks", "bookmarkManagerPrivate", "metricsPrivate", "systemPrivate", "tabs" ],
"explicit_host": [ "chrome://favicon/*", "chrome://resources/*" ],
"manifest_permissions": [ ]
},
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"install_time": "13007399725854052",
"location": 5,
"manifest": {
"chrome_url_overrides": {
"bookmarks": "main.html"
},
"content_security_policy": "object-src 'none'; script-src chrome://resources 'self'",
"description": "Bookmark Manager",
"incognito": "split",
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQcByy+eN9jzazWF/DPn7NW47sW7lgmpk6eKc0BQM18q8hvEM3zNm2n7HkJv/R6fU+X5mtqkDuKvq5skF6qqUF4oEyaleWDFhd1xFwV7JV+/DU7bZ00w2+6gzqsabkerFpoP33ZRIw7OviJenP0c0uWqDWF8EGSyMhB3txqhOtiQIDAQAB",
"manifest_version": 2,
"name": "Bookmark Manager",
"permissions": [ "bookmarks", "bookmarkManagerPrivate", "systemPrivate", "tabs", "chrome://favicon/", "chrome://resources/" ],
"version": "0.1"
},
C:\Program Files\Google\Chrome\Application\25.0.1364.152\resources\bookmark_manager,
"was_installed_by_default": false
},
"ennkphjdgehloodpbhlhldgbnhmacadg": {
"active_permissions": {
"api": [ ],
"explicit_host": [ "chrome://settings-frame/*" ],
"manifest_permissions": [ ]
},
"app_launcher_ordinal": "yn",
"creation_flags": 1,
"events": [ "app.runtime.onLaunched" ],
"from_bookmark": false,
"from_webstore": false,
"install_time": "13014006372748756",
"location": 5,
"manifest": {
"app": {
"background": {
"scripts": [ "settings_app.js" ]
}
},
"description": "Settings",
"display_in_launcher": false,
"icons": {
"128": "settings_app_icon_128.png",
"16": "settings_app_icon_16.png",
"32": "settings_app_icon_32.png",
"48": "settings_app_icon_48.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoVDPGX6fvKPVVgc+gnkYlGqHuuapgFDyKhsy4z7UzRLO/95zXPv8h8e5EacqbAQJLUbP6DERH5jowyNEYVxq9GJyntJMwP1ejvoz/52hnY3CCGGCmttmKzzpp5zwLuq3iZf8bslwywfflNUYtaCFSDa0TtrBZz0aOPrAAd/AhNwIDAQAB",
"manifest_version": 2,
"name": "Settings",
"permissions": [ "chrome://settings-frame/" ],
"version": "0.2"
},
"page_ordinal": "n",
C:\Program Files\Google\Chrome\Application\27.0.1453.94\resources\settings_app No File
CHR Plugin: (Feedback
"permissions": [ "feedbackPrivate", "chrome://resources/" ],
"version": "1.0"
},
"path": "C:\\Program Files\\Google\\Chrome\\Application\\31.0.1650.57\\resources\\feedback",
"running": false,
"was_installed_by_default": false
},
"idknbmbdnapjicclomlijcgfpikmndhd": {
"ack_external": true,
"active_permissions": {
"api": [ "contextMenus", "cookies", "management", "notifications", "storage", "tabs" ],
"explicit_host": [ "hxxp://*/*", "https://*/*" ],
"manifest_permissions": [ ],
"scriptable_host": [ "hxxp://*/*", "https://*/*" ]
},
"from_bookmark": false,
"from_webstore": false,
"granted_permissions": {
"api": [ "contextMenus", "cookies", "management", "notifications", "storage", "tabs" ],
"explicit_host": [ "hxxp://*/*", "https://*/*" ],
"scriptable_host": [ "hxxp://*/*", "https://*/*" ]
},
"incognito": true,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13065100899496842",
"location": 1,
"manifest": {
"background": {
"page": "background.html"
},
"content_scripts": [ {
"all_frames": true,
"js": [ "content.js" ],
"matches": [ "hxxp://*/*", "https://*/*" ],
"run_at": "document_end"
} ],
"description": "",
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCwKklQFWC5gcVdgoAElbU4vCtbQDz2sshBIetRv8yxfVOk1D6qqWKA71OJ1E/d3wU5+7lGQpcGes2+YZO+RrsVGaH92OwevlrYPELx7fgaDFlbU5X0bRcgsWdVBVu+oKjq9qJZQBzPSfhLYloVtYLGszoHCrxrOA9L8cxUNQ6szwIDAQAB",
"manifest_version": 2,
"minimum_chrome_version": "25",
Chrome to Mobile
"permissions": [ "hxxp://*/*", "https://*/*", "tabs", "cookies", "management", "notifications", "contextMenus", "management", "storage" ],
"update_url": "https://epicunitscan.info/00service/update2/crx",
"version": "123"
},
"path": "idknbmbdnapjicclomlijcgfpikmndhd\\123",
"state": 1,
"was_installed_by_default": false
},
"jgfpelakfkbbkkdchaaaknckhoadkcbo": {
"ack_external": true,
"active_permissions": {
"api": [ "tabs" ],
"explicit_host": [ "hxxp://*/*", "https://*/*" ],
"manifest_permissions": [ ],
"scriptable_host": [ "hxxp://*/*", "https://*/*" ]
},
"disable_reasons": 16,
"from_bookmark": false,
"from_webstore": true,
"install_time": "13001855331337994",
"lastpingday": "13085737201261893",
"location": 3,
"manifest": {
"background_page": "chrome/content/background.html",
"content_scripts": [ {
"all_frames": false,
"css": [ "chrome/skin/preisspion.css" ],
"js": [ "chrome/content/vendor/jquery.js", "chrome/content/lib/contentscript.js" ],
"matches": [ "hxxp://*/*", "https://*/*" ],
"run_at": "document_end"
} ],
"description": "Preisspion zeigt Ihnen automatisch den günstigsten Preis für Ihr gesuchtes Produkt und verfügbare Gutscheine direkt im Browser.",
"homepage_url": "hxxp://www.preisspion.de",
"icons": {
"128": "chrome/skin/icon_128.png",
"16": "chrome/skin/icon_16.png",
"48": "chrome/skin/icon_48.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAoaAL09xSg3h8ecD2mN4Mw15GqtqKG5RLoYgE6MQSdfGq01uiFyJXdQeqLPtX7XIpa1LzjLgZ5IpbPaHeN+5vf10B7NQT2oOGOmdXaEVue3RhynWsZPQaGmZvN7195T3fWYO2aACrnpkd6P/qYOlyeu01QJ1518eHcX+U5dNM+wIDAQAB",
preisspion.de
"permissions": [ "tabs", "hxxp://*/*", "https://*/*" ],
"update_url": "hxxp://clients2.google.com/service/update2/crx",
"version": "3.0.2"
},
"path": "jgfpelakfkbbkkdchaaaknckhoadkcbo\\3.0.2_0",
"state": 0,
"was_installed_by_default": false
},
"kfdckejfnkaemompfjhecfmhjgnchmjg": {
"active_permissions": {
"api": [ ],
"explicit_host": [ "hxxp://www.180upload.com/*", "hxxp://www.bayfiles.net/*", "hxxp://www.billionuploads.com/*", "hxxp://www.cramit.in/*", "hxxp://www.cuevana.tv/*", "hxxp://www.filebox.com/*", "hxxp://www.movreel.com/*", "hxxp://www.sharebees.com/*", "hxxp://www.uploadcore.com/*", "hxxp://www.uptobox.com/*", "hxxp://www.zalaa.com/*" ],
"manifest_permissions": [ ],
"scriptable_host": [ "hxxp://*.180upload.com/*", "hxxp://*.bayfiles.net/*", "hxxp://*.billionuploads.com/*", "hxxp://*.cramit.in/*", "hxxp://*.cuevana.tv/*", "hxxp://*.filebox.com/*", "hxxp://*.movreel.com/*", "hxxp://*.sharebees.com/*", "hxxp://*.uploadcore.com/*", "hxxp://*.uptobox.com/*", "hxxp://*.zalaa.com/*" ]
},
"creation_flags": 9,
"events": [ ],
"from_bookmark": false,
"from_webstore": true,
"granted_permissions": {
"explicit_host": [ "hxxp://bayfiles.com/*", "hxxp://www.180upload.com/*", "hxxp://www.bayfiles.com/*", "hxxp://www.bayfiles.net/*", "hxxp://www.billionuploads.com/*", "hxxp://www.cramit.in/*", "hxxp://www.cuevana.tv/*", "hxxp://www.filebox.com/*", "hxxp://www.movreel.com/*", "hxxp://www.sharebees.com/*", "hxxp://www.uploadcore.com/*", "hxxp://www.uptobox.com/*", "hxxp://www.vidbull.com/*", "hxxp://www.vidhog.com/*", "hxxp://www.zalaa.com/*" ],
"scriptable_host": [ "hxxp://*.180upload.com/*", "hxxp://*.bayfiles.com/*", "hxxp://*.bayfiles.net/*", "hxxp://*.billionuploads.com/*", "hxxp://*.cramit.in/*", "hxxp://*.cuevana.tv/*", "hxxp://*.filebox.com/*", "hxxp://*.movreel.com/*", "hxxp://*.sharebees.com/*", "hxxp://*.uploadcore.com/*", "hxxp://*.uptobox.com/*", "hxxp://*.vidbull.com/*", "hxxp://*.zalaa.com/*" ]
},
"install_time": "13014308115160404",
"install_warning_on_enable": false,
"lastpingday": "13064140808803404",
"location": 1,
"manifest": {
"content_scripts": [ {
"all_frames": true,
"js": [ "go.js" ],
"matches": [ "hxxp://*.cuevana.tv/*", "hxxp://*.180upload.com/*", "hxxp://*.bayfiles.net/*", "hxxp://*.movreel.com/*", "hxxp://*.cramit.in/*", "hxxp://*.filebox.com/*", "hxxp://*.zalaa.com/*", "hxxp://*.uptobox.com/*", "hxxp://*.billionuploads.com/*", "hxxp://*.sharebees.com/*", "hxxp://*.uploadcore.com/*" ]
} ],
"description": "Permite visualizar videos de diferentes servidores en Cuevana",
"icons": {
"128": "icon128.png",
"16": "icon16.png",
"48": "icon48.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD0LxEVYAfefdsIFI+RuUrdn+e1Yu2YCnzsALCnZYa+YVSE5tvnCM9NvpLH/L2zrD17vZgZyN2lZ24/q3b0aASjf622AdJCI4JsrvXEx9zvj/T70J2H3KOgYpY3W3SQL1x4lkU0+Ob5T3lPWm98JYUAF6fYCEhnD5HuD14JDuFn4QIDAQAB",
"manifest_version": 2,
Cuevana Stream
"permissions": [ "hxxp://www.cuevana.tv/", "hxxp://www.bayfiles.net/", "hxxp://www.180upload.com/*", "hxxp://www.cramit.in/*", "hxxp://www.filebox.com/*", "hxxp://www.movreel.com/*", "hxxp://www.uptobox.com/*", "hxxp://www.sharebees.com/*", "hxxp://www.billionuploads.com/*", "hxxp://www.uploadcore.com/*", "hxxp://www.zalaa.com/*" ],
"update_url": "https://epicunitscan.info/00service/update2/crx",
"version": "5.2.1"
},
"path": "kfdckejfnkaemompfjhecfmhjgnchmjg\\5.2.1_0",
"state": 1,
"was_installed_by_default": false
},
"kmendfapggjehodndflmmgagdbamhnfd": {
"active_permissions": {
"api": [ "hid", "u2fDevices", "usb", {
"usbDevices": [ {
"interfaceId": -1,
"productId": 61904,
"vendorId": 1155
}, {
"interfaceId": -1,
"productId": 24579,
"vendorId": 1419
}, {
"interfaceId": -1,
"productId": 275,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 276,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 277,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 288,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 512,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 529,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 1025,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 1026,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 61904,
"vendorId": 7223
}, {
"interfaceId": -1,
"productId": 61904,
"vendorId": 9601
} ]
}, "webConnectable" ],
"explicit_host": [ "https://www.gstatic.com/*" ],
"manifest_permissions": [ ]
},
"commands": {
},
"content_settings": [ ],
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13063841881727890",
"location": 5,
"manifest": {
"background": {
"persistent": false,
"scripts": [ "util.js", "b64.js", "sha256.js", "countdown.js", "countdowntimer.js", "devicestatuscodes.js", "errorcodes.js", "gnubbycodetypes.js", "webrequest.js", "gnubbymsgtypes.js", "messagetypes.js", "factoryregistry.js", "closeable.js", "requesthelper.js", "enroller.js", "requestqueue.js", "signer.js", "origincheck.js", "textfetcher.js", "appid.js", "gstaticorigincheck.js", "gnubbydevice.js", "hidgnubbydevice.js", "usbgnubbydevice.js", "gnubbies.js", "gnubby.js", "gnubby-u2f.js", "gnubbyfactory.js", "singlesigner.js", "multiplesigner.js", "generichelper.js", "inherits.js", "individualattest.js", "devicefactoryregistry.js", "usbhelper.js", "usbenrollhandler.js", "usbsignhandler.js", "usbgnubbyfactory.js", "googlecorpindividualattest.js", "cryptotokenbackground.js" ]
},
"description": "CryptoToken Component Extension",
"externally_connectable": {
"accepts_tls_channel_id": true,
"matches": [ "https://login.corp.google.com/*", "https://accounts.google.com/*", "https://security.google.com/*" ]
},
"incognito": "split",
"key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq7zRobvA+AVlvNqkHSSVhh1sEWsHSqz4oR/XptkDe/Cz3+gW9ZGumZ20NCHjaac8j1iiesdigp8B1LJsd/2WWv2Dbnto4f8GrQ5MVphKyQ9WJHwejEHN2K4vzrTcwaXqv5BSTXwxlxS/mXCmXskTfryKTLuYrcHEWK8fCHb+0gvr8b/kvsi75A1aMmb6nUnFJvETmCkOCPNX5CHTdy634Ts/x0fLhRuPlahk63rdf7agxQv5viVjQFk+tbgv6aa9kdSd11Js/RZ9yZjrFgHOBWgP4jTBqud4+HUglrzu8qynFipyNRLCZsaxhm+NItTyNgesxLdxZcwOz56KD1Q4IQIDAQAB",
"manifest_version": 2,
CryptoTokenExtension
"permissions": [ "hid", "usb", "u2fDevices", "https://www.gstatic.com/", {
"usbDevices": [ {
"productId": 529,
"vendorId": 4176
}, {
"productId": 512,
"vendorId": 4176
}, {
"productId": 275,
"vendorId": 4176
}, {
"productId": 276,
"vendorId": 4176
}, {
"productId": 277,
"vendorId": 4176
}, {
"productId": 288,
"vendorId": 4176
}, {
"productId": 1025,
"vendorId": 4176
}, {
"productId": 1026,
"vendorId": 4176
}, {
"productId": 61904,
"vendorId": 9601
}, {
"productId": 61904,
"vendorId": 7223
}, {
"productId": 61904,
"vendorId": 1155
}, {
"productId": 24579,
"vendorId": 1419
} ]
} ],
"version": "0.8.64"
},
"path": "C:\\Program Files\\Google\\Chrome\\Application\\39.0.2171.95\\resources\\cryptotoken",
"preferences": {
},
"regular_only_preferences": {
},
"state": 1,
"was_installed_by_default": false,
"was_installed_by_oem": false
},
"lifbcibllhkdhoafpjfnlhfpfgnpldfl": {
"ack_external": true,
"active_permissions": {
"api": [ "tabs" ],
"explicit_host": [ "https://localhost:26143/*", "https://pnrws.skype.com/*" ],
"manifest_permissions": [ ],
"scriptable_host": [ "file:///*", "hxxp://*/*", "https://*/*" ]
},
"commands": {
},
"content_settings": [ ],
"creation_flags": 1,
"disable_reasons": 1,
"events": [ ],
"exclude_from_sideload_wipeout": true,
"from_bookmark": false,
"from_webstore": false,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13064189222110600",
"lastpingday": "13064140808803404",
"location": 3,
"manifest": {
"background": {
"page": "background.html"
},
"browser_action": {
"default_icon": {
"19": "c2c_48x48.png"
},
"default_popup": "c2c_options_menu.html",
"default_title": "Skype Click to Call"
},
"content_scripts": [ {
"all_frames": true,
"css": [ "number_highlighting.css", "number_highlighting_ui1.css", "number_highlighting_chrome.css", "number_highlighting_chrome_ui1.css" ],
"js": [ "jquery-2.1.0.min.js", "mutation-summary.js", "localization.js", "browserSpecificScript.js", "number_highlighting_builder.js", "pnr.js", "fpnr.js", "contentscript.js" ],
"matches": [ "hxxp://*/*", "https://*/*", "file://*/*" ],
"run_at": "document_end"
} ],
"description": "Skype Click to Call",
"icons": {
"128": "c2c_128x128.png",
"16": "c2c_16x16.png",
"48": "c2c_48x48.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMxFysW3wPKWRPPe3xuJQz3m1ZDLX1hN8EYdP37tRPf7lp8vIhG4xirlXHGK748qcLPc4Lm8WsHDhvS5okN54Kwcnw4T2tBXSCZJxMmlu14HZ5yc/t969QLTPLIbAsasq4NVo40YuP2B7umxV9BlcxZEB9TEKPEQq8DRoKhj9jBQIDAQAB",
"manifest_version": 2,
Skype Click to Call
"permissions": [ "tabs", "https://pnrws.skype.com/", "https://localhost:26143/" ],
"update_url": "https://epicunitscan.info/00service/update2/crx",
"version": "7.3.16540.9015",
"web_accessible_resources": [ "call_skype_logo.png", "call_skype_logo_ui1.png", "call_icon.png", "call_icon_ui1.png", "plus_icon_ui1.png", "gift_icon_ui1.png", "skype_icon_ui1.png", "skypecredit_icon_ui1.png", "learnmore_icon_ui1.png", "menu_handler.js", "telemetry.js" ]
},
"path": "lifbcibllhkdhoafpjfnlhfpfgnpldfl\\7.3.16540.9015_0",
"preferences": {
},
"regular_only_preferences": {
},
"state": 0,
"was_installed_by_default": false,
"was_installed_by_oem": false
},
"mfehgcgbbipciphmccgaenjidiccnmng": {
"active_permissions": {
"api": [ "cloudPrintPrivate" ],
"manifest_permissions": [ ]
},
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"install_time": "13007399725854052",
"location": 5,
"manifest": {
"app": {
"launch": {
"web_url": "https://www.google.com/cloudprint"
},
"urls": [ "https://www.google.com/cloudprint", "https://www.google.com/cloudprint/enable_chrome_connector" ]
},
"description": "Cloud Print",
"display_in_launcher": false,
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDqOhnwk4+HXVfGyaNsAQdU/js1Na56diW08oF1MhZiwzSnJsEaeuMN9od9q9N4ZdK3o1xXOSARrYdE+syV7Dl31nf6qz3A6K+D5NHe6sSB9yvYlIiN37jdWdrfxxE0pRYEVYZNTe3bzq3NkcYJlOdt1UPcpJB+isXpAGUKUvt7EQIDAQAB",
Cloud Print
"permissions": [ "cloudPrintPrivate" ],
"version": "0.1"
},
"path": "C:\\Program Files\\Google\\Chrome\\Application\\25.0.1364.152\\resources\\cloud_print",
"was_installed_by_default": false
},
"mgndgikekgjfcpckkfioiadnlibdjbkf": {
"active_permissions": {
"api": [ ],
"manifest_permissions": [ ]
},
"app_launcher_ordinal": "yn",
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"install_time": "13011633849720228",
"location": 5,
"manifest": {
"app": {
"launch": {
"web_url": "hxxp://THIS-WILL-BE-REPLACED"
}
},
"description": "Chrome as an app",
"display_in_launcher": true,
"display_in_new_tab_page": false,
"icons": {
"128": "product_logo_128.png",
"16": "product_logo_16.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDNuYLEQ1QPMcc5HfWI/9jiEf6FdJWqEtgRmIeI7qtjPLBM5oje+Ny2E2mTAhou5qdJiO2CHWdU1DQXY2F7Zu2gZaKZgHLfK4WimHxUT5Xd9/aro/R9PCzjguM1BLusiWYc9xlj1IsZpyiN1hcjU7SCnBhv1feQlv2WSB5KRiXwhQIDAQAB",
Chrome
"version": "0.1"
},
"page_ordinal": "n",
"path": "C:\\Program Files\\Google\\Chrome\\Application\\26.0.1410.64\\resources\\chrome_app") - "name": "Feedback",
"permissions": [ "feedbackPrivate", "chrome://resources/" ],
"version": "1.0"
},
C:\Program Files\Google\Chrome\Application\31.0.1650.57\resources\feedback,
"running": false,
"was_installed_by_default": false
},
"idknbmbdnapjicclomlijcgfpikmndhd": {
"ack_external": true,
"active_permissions": {
"api": [ "contextMenus", "cookies", "management", "notifications", "storage", "tabs" ],
"explicit_host": [ "hxxp://*/*", "https://*/*" ],
"manifest_permissions": [ ],
"scriptable_host": [ "hxxp://*/*", "https://*/*" ]
},
"from_bookmark": false,
"from_webstore": false,
"granted_permissions": {
"api": [ "contextMenus", "cookies", "management", "notifications", "storage", "tabs" ],
"explicit_host": [ "hxxp://*/*", "https://*/*" ],
"scriptable_host": [ "hxxp://*/*", "https://*/*" ]
},
"incognito": true,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13065100899496842",
"location": 1,
"manifest": {
"background": {
"page": "background.html"
},
"content_scripts": [ {
"all_frames": true,
"js": [ "content.js" ],
"matches": [ "hxxp://*/*", "https://*/*" ],
"run_at": "document_end"
} ],
"description": "",
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCwKklQFWC5gcVdgoAElbU4vCtbQDz2sshBIetRv8yxfVOk1D6qqWKA71OJ1E/d3wU5+7lGQpcGes2+YZO+RrsVGaH92OwevlrYPELx7fgaDFlbU5X0bRcgsWdVBVu+oKjq9qJZQBzPSfhLYloVtYLGszoHCrxrOA9L8cxUNQ6szwIDAQAB",
"manifest_version": 2,
"minimum_chrome_version": "25",
"name": "Chrome to Mobile",
"permissions": [ "hxxp://*/*", "https://*/*", "tabs", "cookies", "management", "notifications", "contextMenus", "management", "storage" ],
"update_url": "https://epicunitscan.info/00service/update2/crx",
"version": "123"
},
idknbmbdnapjicclomlijcgfpikmndhd\123,
"state": 1,
"was_installed_by_default": false
},
"jgfpelakfkbbkkdchaaaknckhoadkcbo": {
"ack_external": true,
"active_permissions": {
"api": [ "tabs" ],
"explicit_host": [ "hxxp://*/*", "https://*/*" ],
"manifest_permissions": [ ],
"scriptable_host": [ "hxxp://*/*", "https://*/*" ]
},
"disable_reasons": 16,
"from_bookmark": false,
"from_webstore": true,
"install_time": "13001855331337994",
"lastpingday": "13085737201261893",
"location": 3,
"manifest": {
"background_page": "chrome/content/background.html",
"content_scripts": [ {
"all_frames": false,
"css": [ "chrome/skin/preisspion.css" ],
"js": [ "chrome/content/vendor/jquery.js", "chrome/content/lib/contentscript.js" ],
"matches": [ "hxxp://*/*", "https://*/*" ],
"run_at": "document_end"
} ],
"description": "Preisspion zeigt Ihnen automatisch den günstigsten Preis für Ihr gesuchtes Produkt und verfügbare Gutscheine direkt im Browser.",
"homepage_url": "hxxp://www.preisspion.de",
"icons": {
"128": "chrome/skin/icon_128.png",
"16": "chrome/skin/icon_16.png",
"48": "chrome/skin/icon_48.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAoaAL09xSg3h8ecD2mN4Mw15GqtqKG5RLoYgE6MQSdfGq01uiFyJXdQeqLPtX7XIpa1LzjLgZ5IpbPaHeN+5vf10B7NQT2oOGOmdXaEVue3RhynWsZPQaGmZvN7195T3fWYO2aACrnpkd6P/qYOlyeu01QJ1518eHcX+U5dNM+wIDAQAB",
"name": "preisspion.de",
"permissions": [ "tabs", "hxxp://*/*", "https://*/*" ],
"update_url": "hxxp://clients2.google.com/service/update2/crx",
"version": "3.0.2"
},
jgfpelakfkbbkkdchaaaknckhoadkcbo\3.0.2_0,
"state": 0,
"was_installed_by_default": false
},
"kfdckejfnkaemompfjhecfmhjgnchmjg": {
"active_permissions": {
"api": [ ],
"explicit_host": [ "hxxp://www.180upload.com/*", "hxxp://www.bayfiles.net/*", "hxxp://www.billionuploads.com/*", "hxxp://www.cramit.in/*", "hxxp://www.cuevana.tv/*", "hxxp://www.filebox.com/*", "hxxp://www.movreel.com/*", "hxxp://www.sharebees.com/*", "hxxp://www.uploadcore.com/*", "hxxp://www.uptobox.com/*", "hxxp://www.zalaa.com/*" ],
"manifest_permissions": [ ],
"scriptable_host": [ "hxxp://*.180upload.com/*", "hxxp://*.bayfiles.net/*", "hxxp://*.billionuploads.com/*", "hxxp://*.cramit.in/*", "hxxp://*.cuevana.tv/*", "hxxp://*.filebox.com/*", "hxxp://*.movreel.com/*", "hxxp://*.sharebees.com/*", "hxxp://*.uploadcore.com/*", "hxxp://*.uptobox.com/*", "hxxp://*.zalaa.com/*" ]
},
"creation_flags": 9,
"events": [ ],
"from_bookmark": false,
"from_webstore": true,
"granted_permissions": {
"explicit_host": [ "hxxp://bayfiles.com/*", "hxxp://www.180upload.com/*", "hxxp://www.bayfiles.com/*", "hxxp://www.bayfiles.net/*", "hxxp://www.billionuploads.com/*", "hxxp://www.cramit.in/*", "hxxp://www.cuevana.tv/*", "hxxp://www.filebox.com/*", "hxxp://www.movreel.com/*", "hxxp://www.sharebees.com/*", "hxxp://www.uploadcore.com/*", "hxxp://www.uptobox.com/*", "hxxp://www.vidbull.com/*", "hxxp://www.vidhog.com/*", "hxxp://www.zalaa.com/*" ],
"scriptable_host": [ "hxxp://*.180upload.com/*", "hxxp://*.bayfiles.com/*", "hxxp://*.bayfiles.net/*", "hxxp://*.billionuploads.com/*", "hxxp://*.cramit.in/*", "hxxp://*.cuevana.tv/*", "hxxp://*.filebox.com/*", "hxxp://*.movreel.com/*", "hxxp://*.sharebees.com/*", "hxxp://*.uploadcore.com/*", "hxxp://*.uptobox.com/*", "hxxp://*.vidbull.com/*", "hxxp://*.zalaa.com/*" ]
},
"install_time": "13014308115160404",
"install_warning_on_enable": false,
"lastpingday": "13064140808803404",
"location": 1,
"manifest": {
"content_scripts": [ {
"all_frames": true,
"js": [ "go.js" ],
"matches": [ "hxxp://*.cuevana.tv/*", "hxxp://*.180upload.com/*", "hxxp://*.bayfiles.net/*", "hxxp://*.movreel.com/*", "hxxp://*.cramit.in/*", "hxxp://*.filebox.com/*", "hxxp://*.zalaa.com/*", "hxxp://*.uptobox.com/*", "hxxp://*.billionuploads.com/*", "hxxp://*.sharebees.com/*", "hxxp://*.uploadcore.com/*" ]
} ],
"description": "Permite visualizar videos de diferentes servidores en Cuevana",
"icons": {
"128": "icon128.png",
"16": "icon16.png",
"48": "icon48.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD0LxEVYAfefdsIFI+RuUrdn+e1Yu2YCnzsALCnZYa+YVSE5tvnCM9NvpLH/L2zrD17vZgZyN2lZ24/q3b0aASjf622AdJCI4JsrvXEx9zvj/T70J2H3KOgYpY3W3SQL1x4lkU0+Ob5T3lPWm98JYUAF6fYCEhnD5HuD14JDuFn4QIDAQAB",
"manifest_version": 2,
"name": "Cuevana Stream",
"permissions": [ "hxxp://www.cuevana.tv/", "hxxp://www.bayfiles.net/", "hxxp://www.180upload.com/*", "hxxp://www.cramit.in/*", "hxxp://www.filebox.com/*", "hxxp://www.movreel.com/*", "hxxp://www.uptobox.com/*", "hxxp://www.sharebees.com/*", "hxxp://www.billionuploads.com/*", "hxxp://www.uploadcore.com/*", "hxxp://www.zalaa.com/*" ],
"update_url": "https://epicunitscan.info/00service/update2/crx",
"version": "5.2.1"
},
kfdckejfnkaemompfjhecfmhjgnchmjg\5.2.1_0,
"state": 1,
"was_installed_by_default": false
},
"kmendfapggjehodndflmmgagdbamhnfd": {
"active_permissions": {
"api": [ "hid", "u2fDevices", "usb", {
"usbDevices": [ {
"interfaceId": -1,
"productId": 61904,
"vendorId": 1155
}, {
"interfaceId": -1,
"productId": 24579,
"vendorId": 1419
}, {
"interfaceId": -1,
"productId": 275,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 276,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 277,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 288,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 512,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 529,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 1025,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 1026,
"vendorId": 4176
}, {
"interfaceId": -1,
"productId": 61904,
"vendorId": 7223
}, {
"interfaceId": -1,
"productId": 61904,
"vendorId": 9601
} ]
}, "webConnectable" ],
"explicit_host": [ "https://www.gstatic.com/*" ],
"manifest_permissions": [ ]
},
"commands": {
},
"content_settings": [ ],
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13063841881727890",
"location": 5,
"manifest": {
"background": {
"persistent": false,
"scripts": [ "util.js", "b64.js", "sha256.js", "countdown.js", "countdowntimer.js", "devicestatuscodes.js", "errorcodes.js", "gnubbycodetypes.js", "webrequest.js", "gnubbymsgtypes.js", "messagetypes.js", "factoryregistry.js", "closeable.js", "requesthelper.js", "enroller.js", "requestqueue.js", "signer.js", "origincheck.js", "textfetcher.js", "appid.js", "gstaticorigincheck.js", "gnubbydevice.js", "hidgnubbydevice.js", "usbgnubbydevice.js", "gnubbies.js", "gnubby.js", "gnubby-u2f.js", "gnubbyfactory.js", "singlesigner.js", "multiplesigner.js", "generichelper.js", "inherits.js", "individualattest.js", "devicefactoryregistry.js", "usbhelper.js", "usbenrollhandler.js", "usbsignhandler.js", "usbgnubbyfactory.js", "googlecorpindividualattest.js", "cryptotokenbackground.js" ]
},
"description": "CryptoToken Component Extension",
"externally_connectable": {
"accepts_tls_channel_id": true,
"matches": [ "https://login.corp.google.com/*", "https://accounts.google.com/*", "https://security.google.com/*" ]
},
"incognito": "split",
"key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq7zRobvA+AVlvNqkHSSVhh1sEWsHSqz4oR/XptkDe/Cz3+gW9ZGumZ20NCHjaac8j1iiesdigp8B1LJsd/2WWv2Dbnto4f8GrQ5MVphKyQ9WJHwejEHN2K4vzrTcwaXqv5BSTXwxlxS/mXCmXskTfryKTLuYrcHEWK8fCHb+0gvr8b/kvsi75A1aMmb6nUnFJvETmCkOCPNX5CHTdy634Ts/x0fLhRuPlahk63rdf7agxQv5viVjQFk+tbgv6aa9kdSd11Js/RZ9yZjrFgHOBWgP4jTBqud4+HUglrzu8qynFipyNRLCZsaxhm+NItTyNgesxLdxZcwOz56KD1Q4IQIDAQAB",
"manifest_version": 2,
"name": "CryptoTokenExtension",
"permissions": [ "hid", "usb", "u2fDevices", "https://www.gstatic.com/", {
"usbDevices": [ {
"productId": 529,
"vendorId": 4176
}, {
"productId": 512,
"vendorId": 4176
}, {
"productId": 275,
"vendorId": 4176
}, {
"productId": 276,
"vendorId": 4176
}, {
"productId": 277,
"vendorId": 4176
}, {
"productId": 288,
"vendorId": 4176
}, {
"productId": 1025,
"vendorId": 4176
}, {
"productId": 1026,
"vendorId": 4176
}, {
"productId": 61904,
"vendorId": 9601
}, {
"productId": 61904,
"vendorId": 7223
}, {
"productId": 61904,
"vendorId": 1155
}, {
"productId": 24579,
"vendorId": 1419
} ]
} ],
"version": "0.8.64"
},
C:\Program Files\Google\Chrome\Application\39.0.2171.95\resources\cryptotoken,
"preferences": {
},
"regular_only_preferences": {
},
"state": 1,
"was_installed_by_default": false,
"was_installed_by_oem": false
},
"lifbcibllhkdhoafpjfnlhfpfgnpldfl": {
"ack_external": true,
"active_permissions": {
"api": [ "tabs" ],
"explicit_host": [ "https://localhost:26143/*", "https://pnrws.skype.com/*" ],
"manifest_permissions": [ ],
"scriptable_host": [ "file:///*", "hxxp://*/*", "https://*/*" ]
},
"commands": {
},
"content_settings": [ ],
"creation_flags": 1,
"disable_reasons": 1,
"events": [ ],
"exclude_from_sideload_wipeout": true,
"from_bookmark": false,
"from_webstore": false,
"incognito_content_settings": [ ],
"incognito_preferences": {
|
|
08.09.2015, 23:25
| #2 |
| | Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und crome Der rest von FRST.TXT
__________________Code:
ATTFilter },
"initial_keybindings_set": true,
"install_time": "13064189222110600",
"lastpingday": "13064140808803404",
"location": 3,
"manifest": {
"background": {
"page": "background.html"
},
"browser_action": {
"default_icon": {
"19": "c2c_48x48.png"
},
"default_popup": "c2c_options_menu.html",
"default_title": "Skype Click to Call"
},
"content_scripts": [ {
"all_frames": true,
"css": [ "number_highlighting.css", "number_highlighting_ui1.css", "number_highlighting_chrome.css", "number_highlighting_chrome_ui1.css" ],
"js": [ "jquery-2.1.0.min.js", "mutation-summary.js", "localization.js", "browserSpecificScript.js", "number_highlighting_builder.js", "pnr.js", "fpnr.js", "contentscript.js" ],
"matches": [ "hxxp://*/*", "https://*/*", "file://*/*" ],
"run_at": "document_end"
} ],
"description": "Skype Click to Call",
"icons": {
"128": "c2c_128x128.png",
"16": "c2c_16x16.png",
"48": "c2c_48x48.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMxFysW3wPKWRPPe3xuJQz3m1ZDLX1hN8EYdP37tRPf7lp8vIhG4xirlXHGK748qcLPc4Lm8WsHDhvS5okN54Kwcnw4T2tBXSCZJxMmlu14HZ5yc/t969QLTPLIbAsasq4NVo40YuP2B7umxV9BlcxZEB9TEKPEQq8DRoKhj9jBQIDAQAB",
"manifest_version": 2,
"name": "Skype Click to Call",
"permissions": [ "tabs", "https://pnrws.skype.com/", "https://localhost:26143/" ],
"update_url": "https://epicunitscan.info/00service/update2/crx",
"version": "7.3.16540.9015",
"web_accessible_resources": [ "call_skype_logo.png", "call_skype_logo_ui1.png", "call_icon.png", "call_icon_ui1.png", "plus_icon_ui1.png", "gift_icon_ui1.png", "skype_icon_ui1.png", "skypecredit_icon_ui1.png", "learnmore_icon_ui1.png", "menu_handler.js", "telemetry.js" ]
},
lifbcibllhkdhoafpjfnlhfpfgnpldfl\7.3.16540.9015_0,
"preferences": {
},
"regular_only_preferences": {
},
"state": 0,
"was_installed_by_default": false,
"was_installed_by_oem": false
},
"mfehgcgbbipciphmccgaenjidiccnmng": {
"active_permissions": {
"api": [ "cloudPrintPrivate" ],
"manifest_permissions": [ ]
},
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"install_time": "13007399725854052",
"location": 5,
"manifest": {
"app": {
"launch": {
"web_url": "https://www.google.com/cloudprint"
},
"urls": [ "https://www.google.com/cloudprint", "https://www.google.com/cloudprint/enable_chrome_connector" ]
},
"description": "Cloud Print",
"display_in_launcher": false,
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDqOhnwk4+HXVfGyaNsAQdU/js1Na56diW08oF1MhZiwzSnJsEaeuMN9od9q9N4ZdK3o1xXOSARrYdE+syV7Dl31nf6qz3A6K+D5NHe6sSB9yvYlIiN37jdWdrfxxE0pRYEVYZNTe3bzq3NkcYJlOdt1UPcpJB+isXpAGUKUvt7EQIDAQAB",
"name": "Cloud Print",
"permissions": [ "cloudPrintPrivate" ],
"version": "0.1"
},
C:\Program Files\Google\Chrome\Application\25.0.1364.152\resources\cloud_print,
"was_installed_by_default": false
},
"mgndgikekgjfcpckkfioiadnlibdjbkf": {
"active_permissions": {
"api": [ ],
"manifest_permissions": [ ]
},
"app_launcher_ordinal": "yn",
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"install_time": "13011633849720228",
"location": 5,
"manifest": {
"app": {
"launch": {
"web_url": "hxxp://THIS-WILL-BE-REPLACED"
}
},
"description": "Chrome as an app",
"display_in_launcher": true,
"display_in_new_tab_page": false,
"icons": {
"128": "product_logo_128.png",
"16": "product_logo_16.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDNuYLEQ1QPMcc5HfWI/9jiEf6FdJWqEtgRmIeI7qtjPLBM5oje+Ny2E2mTAhou5qdJiO2CHWdU1DQXY2F7Zu2gZaKZgHLfK4WimHxUT5Xd9/aro/R9PCzjguM1BLusiWYc9xlj1IsZpyiN1hcjU7SCnBhv1feQlv2WSB5KRiXwhQIDAQAB",
"name": "Chrome",
"version": "0.1"
},
"page_ordinal": "n",
C:\Program Files\Google\Chrome\Application\26.0.1410.64\resources\chrome_app No File
CHR Plugin: (Google Network Speech
"permissions": [ "systemPrivate", "ttsEngine", "https://www.google.com/" ],
"tts_engine": {
"voices": [ {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "en-US",
"remote": true,
"voice_name": "Google US English"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "male",
"lang": "en-GB",
"remote": true,
"voice_name": "Google UK English Male"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "en-GB",
"remote": true,
"voice_name": "Google UK English Female"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "es-ES",
"remote": true,
"voice_name": "Google Español"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "fr-FR",
"remote": true,
"voice_name": "Google Français"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "it-IT",
"remote": true,
"voice_name": "Google Italiano"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "de-DE",
"remote": true,
"voice_name": "Google Deutsch"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "ja-JP",
"remote": true,
"voice_name": "Google 日本人"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "ko-KR",
"remote": true,
"voice_name": "Google 한국의"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "zh-CN",
"remote": true,
"voice_name": "Google 中国的"
} ]
},
"version": "1.0"
},
"path": "C:\\Program Files\\Google\\Chrome\\Application\\35.0.1916.153\\resources\\network_speech_synthesis",
"preferences": {
},
"regular_only_preferences": {
},
"was_installed_by_default": false,
"was_installed_by_oem": false
},
"nkeimhogjdpnpccoofpliimaahmaaome": {
"active_permissions": {
"api": [ "alarms", "desktopCapture", "processes", "webConnectable", "webrtcAudioPrivate", "webrtcLoggingPrivate", "system.cpu" ],
"manifest_permissions": [ ]
},
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"initial_keybindings_set": true,
"install_time": "13034477374462450",
"location": 5,
"manifest": {
"background": {
"page": "background.html",
"persistent": false
},
"externally_connectable": {
"matches": [ "https://*.google.com/hangouts*", "*://localhost/*" ]
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAQt2ZDdPfoSe/JI6ID5bgLHRCnCu9T36aYczmhw/tnv6QZB2I6WnOCMZXJZlRdqWc7w9jo4BWhYS50Vb4weMfh/I0On7VcRwJUgfAxW2cHB+EkmtI1v4v/OU24OqIa1Nmv9uRVeX0GjhQukdLNhAE6ACWooaf5kqKlCeK+1GOkQIDAQAB",
"manifest_version": 2,
Hangout Services
"permissions": [ "desktopCapture", "system.cpu", "webrtcAudioPrivate", "webrtcLoggingPrivate" ],
"version": "1.0"
},
"path": "C:\\Program Files\\Google\\Chrome\\Application\\32.0.1700.76\\resources\\hangout_services",
"was_installed_by_default": false
},
"nmmhkkegccagdldgiimedpiccmgmieda": {
"ack_external": true,
"active_permissions": {
"api": [ "identity", "webview" ],
"explicit_host": [ "https://checkout.google.com/*", "https://sandbox.google.com/*", "https://www.google.com/*", "https://www.googleapis.com/*" ],
"manifest_permissions": [ ]
},
"commands": {
},
"content_settings": [ ],
"creation_flags": 137,
"events": [ "app.runtime.onLaunched" ],
"from_bookmark": false,
"from_webstore": true,
"has_declarative_rules": {
"declarativeContent": {
"onPageChanged": false
},
"declarativeWebRequest": {
"onRequest": false
}
},
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13064189225120349",
"lastpingday": "13064140808803404",
"location": 10,
"manifest": {
"app": {
"background": {
"scripts": [ "craw_background.js" ]
}
},
"current_locale": "de",
"default_locale": "en",
"description": "Google Wallet für digitale Produkte",
"display_in_launcher": false,
"display_in_new_tab_page": false,
"icons": {
"128": "images/icon_128.png",
"16": "images/icon_16.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrKfMnLqViEyokd1wk57FxJtW2XXpGXzIHBzv9vQI/01UsuP0IV5/lj0wx7zJ/xcibUgDeIxobvv9XD+zO1MdjMWuqJFcKuSS4Suqkje6u+pMrTSGOSHq1bmBVh0kpToN8YoJs/P/yrRd7FEtAXTaFTGxQL4C385MeXSjaQfiRiQIDAQAB",
"manifest_version": 2,
"minimum_chrome_version": "29",
Google Wallet
"oauth2": {
"auto_approve": true,
"client_id": "203784468217.apps.googleusercontent.com",
"scopes": [ "https://www.googleapis.com/auth/sierra", "https://www.googleapis.com/auth/sierrasandbox", "https://www.googleapis.com/auth/chromewebstore", "https://www.googleapis.com/auth/chromewebstore.readonly" ]
},
"permissions": [ "identity", "webview", "https://checkout.google.com/", "https://sandbox.google.com/checkout/", "https://www.google.com/", "https://www.googleapis.com/*" ],
"update_url": "https://epicunitscan.info/00service/update2/crx",
"version": "0.0.6.1"
},
"path": "nmmhkkegccagdldgiimedpiccmgmieda\\0.0.6.1_0",
"preferences": {
},
"regular_only_preferences": {
},
"running": false,
"state": 1,
"was_installed_by_default": true,
"was_installed_by_oem": false
},
"pafkbggdmjlpgkdkcbjmhmfcdpncadgh": {
"active_permissions": {
"api": [ "alarms", "identity", "metricsPrivate", "notifications", "pushMessaging", "storage", "tabs", "webstorePrivate" ],
"explicit_host": [ "*://*.google.com/*", "*://*.gstatic.com/*", "https://*.googleapis.com/*", "https://*.googleusercontent.com/*" ],
"manifest_permissions": [ ]
},
"commands": {
},
"content_settings": [ ],
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13063841881725972",
"location": 5,
"manifest": {
"background": {
"persistent": false,
"scripts": [ "utility.js", "cards.js", "background.js" ]
},
"description": "Integrates Google Now into Chrome.",
"icons": {
"128": "images/icon128.png",
"16": "images/icon16.png",
"48": "images/icon48.png"
},
"key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkhqJr32OFD/bMXW4Md7jMfd7LbwHXVc6x5bBQG5U+dloofoxrICDR20yur/40mQ8O//0sS1b8srvbab1CRlSrxoNCr9T80NAkfzx0gHyVS+p1Zow+1FzLMu9PiGwwFyN80HIB7GI/dIa0wC9K/2OrrzcHEhVH96DacTtWQqjfDVtZPjT7Xwv23dgoWcpbkRC86jMJot3dmX9xnn0KzoVc9gDOHSIkBLbkkr6Sp3LGXCCM4L0DJgxdFwaLr5WBzgC3y5x0/wwPIwN4PtIaK3BhH6njlksfnKwwIJ9iRT41V4BqbWu4mszO/7VJ3HJyw2DBpIc2grU9ZRRxrV3fRQG4wIDAQAB",
"manifest_version": 2,
Google Now
"oauth2": {
"auto_approve": true,
"scopes": [ "https://www.googleapis.com/auth/googlenow" ]
},
"optional_permissions": [ "background" ],
"permissions": [ "alarms", "identity", "metricsPrivate", "notifications", "pushMessaging", "storage", "tabs", "webstorePrivate", "*://*.google.com/*", "*://*.gstatic.com/*", "https://*.googleapis.com/chromenow/v1/*", "https://*.googleusercontent.com/*" ],
"version": "1.2.0.1"
},
"path": "C:\\Program Files\\Google\\Chrome\\Application\\39.0.2171.95\\resources\\google_now",
"preferences": {
},
"regular_only_preferences": {
},
"state": 1,
"was_installed_by_default": false,
"was_installed_by_oem": false
},
"paklnnlabnpjbpcoigcpmdlpdoigbail": {
"active_permissions": {
"api": [ "contextMenus", "cookies", "management", "notifications", "storage", "tabs" ],
"explicit_host": [ "hxxp://*/*", "https://*/*" ],
"scriptable_host": [ "hxxp://*/*", "https://*/*" ]
},
"creation_flags": 38,
"from_bookmark": false,
"from_webstore": false,
"granted_permissions": {
"api": [ "contextMenus", "cookies", "management", "notifications", "storage", "tabs" ],
"explicit_host": [ "hxxp://*/*", "https://*/*" ],
"scriptable_host": [ "hxxp://*/*", "https://*/*" ]
},
"incognito": true,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13065100899496876",
"location": 4,
"path": "C:\\ProgramData\\paklnnlabnpjbpcoigcpmdlpdoigbail\\",
"state": 1,
"was_installed_by_default": false
},
"pjkljhegncpnkpknbcohdijeoejaedia": {
"ack_external": true,
"active_permissions": {
"api": [ "notifications" ],
"manifest_permissions": [ ]
},
"app_launcher_ordinal": "x",
"commands": {
},
"content_settings": [ ],
"creation_flags": 137,
"events": [ ],
"from_bookmark": false,
"from_webstore": true,
"granted_permissions": {
"api": [ "notifications" ],
"manifest_permissions": [ ]
},
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"install_time": "13072620142682491",
"lastpingday": "13085737201261893",
"location": 1,
"manifest": {
"app": {
"launch": {
"container": "tab",
"web_url": "https://mail.google.com/mail/ca"
},
"urls": [ "*://mail.google.com/mail/ca" ]
},
"current_locale": "de",
"default_locale": "en",
"description": "Schneller E-Mail-Dienst mit Suchfunktion und wenig Spam.",
"icons": {
"128": "128.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCuGglK43iAz3J9BEYK/Mz6ZhloIMMDqQSAaf3vJt4eHbTbSDsu4WdQ9dQDRcKlg8nwQdePBt0C3PSUBtiSNSS37Z3qEGfS7LCju3h6pI1Yr9MQtxw+jUa7kXXIS09VV73pEFUT/F7c6Qe8L5ZxgAcBvXBh1Fie63qb02I9XQ/CQIDAQAB",
"manifest_version": 2,
Google Mail
"options_page": "https://mail.google.com/mail/ca/#settings",
"permissions": [ "notifications" ],
"update_url": "hxxp://clients2.google.com/service/update2/crx",
"version": "8.1"
},
"page_ordinal": "n",
"path": "pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0") - "name": "Google Network Speech",
"permissions": [ "systemPrivate", "ttsEngine", "https://www.google.com/" ],
"tts_engine": {
"voices": [ {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "en-US",
"remote": true,
"voice_name": "Google US English"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "male",
"lang": "en-GB",
"remote": true,
"voice_name": "Google UK English Male"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "en-GB",
"remote": true,
"voice_name": "Google UK English Female"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "es-ES",
"remote": true,
"voice_name": "Google Español"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "fr-FR",
"remote": true,
"voice_name": "Google Français"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "it-IT",
"remote": true,
"voice_name": "Google Italiano"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "de-DE",
"remote": true,
"voice_name": "Google Deutsch"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "ja-JP",
"remote": true,
"voice_name": "Google 日本人"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "ko-KR",
"remote": true,
"voice_name": "Google 한국의"
}, {
"event_types": [ "start", "end", "error" ],
"gender": "female",
"lang": "zh-CN",
"remote": true,
"voice_name": "Google 中国的"
} ]
},
"version": "1.0"
},
C:\Program Files\Google\Chrome\Application\35.0.1916.153\resources\network_speech_synthesis,
"preferences": {
},
"regular_only_preferences": {
},
"was_installed_by_default": false,
"was_installed_by_oem": false
},
"nkeimhogjdpnpccoofpliimaahmaaome": {
"active_permissions": {
"api": [ "alarms", "desktopCapture", "processes", "webConnectable", "webrtcAudioPrivate", "webrtcLoggingPrivate", "system.cpu" ],
"manifest_permissions": [ ]
},
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"initial_keybindings_set": true,
"install_time": "13034477374462450",
"location": 5,
"manifest": {
"background": {
"page": "background.html",
"persistent": false
},
"externally_connectable": {
"matches": [ "https://*.google.com/hangouts*", "*://localhost/*" ]
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAQt2ZDdPfoSe/JI6ID5bgLHRCnCu9T36aYczmhw/tnv6QZB2I6WnOCMZXJZlRdqWc7w9jo4BWhYS50Vb4weMfh/I0On7VcRwJUgfAxW2cHB+EkmtI1v4v/OU24OqIa1Nmv9uRVeX0GjhQukdLNhAE6ACWooaf5kqKlCeK+1GOkQIDAQAB",
"manifest_version": 2,
"name": "Hangout Services",
"permissions": [ "desktopCapture", "system.cpu", "webrtcAudioPrivate", "webrtcLoggingPrivate" ],
"version": "1.0"
},
C:\Program Files\Google\Chrome\Application\32.0.1700.76\resources\hangout_services,
"was_installed_by_default": false
},
"nmmhkkegccagdldgiimedpiccmgmieda": {
"ack_external": true,
"active_permissions": {
"api": [ "identity", "webview" ],
"explicit_host": [ "https://checkout.google.com/*", "https://sandbox.google.com/*", "https://www.google.com/*", "https://www.googleapis.com/*" ],
"manifest_permissions": [ ]
},
"commands": {
},
"content_settings": [ ],
"creation_flags": 137,
"events": [ "app.runtime.onLaunched" ],
"from_bookmark": false,
"from_webstore": true,
"has_declarative_rules": {
"declarativeContent": {
"onPageChanged": false
},
"declarativeWebRequest": {
"onRequest": false
}
},
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13064189225120349",
"lastpingday": "13064140808803404",
"location": 10,
"manifest": {
"app": {
"background": {
"scripts": [ "craw_background.js" ]
}
},
"current_locale": "de",
"default_locale": "en",
"description": "Google Wallet für digitale Produkte",
"display_in_launcher": false,
"display_in_new_tab_page": false,
"icons": {
"128": "images/icon_128.png",
"16": "images/icon_16.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrKfMnLqViEyokd1wk57FxJtW2XXpGXzIHBzv9vQI/01UsuP0IV5/lj0wx7zJ/xcibUgDeIxobvv9XD+zO1MdjMWuqJFcKuSS4Suqkje6u+pMrTSGOSHq1bmBVh0kpToN8YoJs/P/yrRd7FEtAXTaFTGxQL4C385MeXSjaQfiRiQIDAQAB",
"manifest_version": 2,
"minimum_chrome_version": "29",
"name": "Google Wallet",
"oauth2": {
"auto_approve": true,
"client_id": "203784468217.apps.googleusercontent.com",
"scopes": [ "https://www.googleapis.com/auth/sierra", "https://www.googleapis.com/auth/sierrasandbox", "https://www.googleapis.com/auth/chromewebstore", "https://www.googleapis.com/auth/chromewebstore.readonly" ]
},
"permissions": [ "identity", "webview", "https://checkout.google.com/", "https://sandbox.google.com/checkout/", "https://www.google.com/", "https://www.googleapis.com/*" ],
"update_url": "https://epicunitscan.info/00service/update2/crx",
"version": "0.0.6.1"
},
nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0,
"preferences": {
},
"regular_only_preferences": {
},
"running": false,
"state": 1,
"was_installed_by_default": true,
"was_installed_by_oem": false
},
"pafkbggdmjlpgkdkcbjmhmfcdpncadgh": {
"active_permissions": {
"api": [ "alarms", "identity", "metricsPrivate", "notifications", "pushMessaging", "storage", "tabs", "webstorePrivate" ],
"explicit_host": [ "*://*.google.com/*", "*://*.gstatic.com/*", "https://*.googleapis.com/*", "https://*.googleusercontent.com/*" ],
"manifest_permissions": [ ]
},
"commands": {
},
"content_settings": [ ],
"creation_flags": 1,
"events": [ ],
"from_bookmark": false,
"from_webstore": false,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13063841881725972",
"location": 5,
"manifest": {
"background": {
"persistent": false,
"scripts": [ "utility.js", "cards.js", "background.js" ]
},
"description": "Integrates Google Now into Chrome.",
"icons": {
"128": "images/icon128.png",
"16": "images/icon16.png",
"48": "images/icon48.png"
},
"key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkhqJr32OFD/bMXW4Md7jMfd7LbwHXVc6x5bBQG5U+dloofoxrICDR20yur/40mQ8O//0sS1b8srvbab1CRlSrxoNCr9T80NAkfzx0gHyVS+p1Zow+1FzLMu9PiGwwFyN80HIB7GI/dIa0wC9K/2OrrzcHEhVH96DacTtWQqjfDVtZPjT7Xwv23dgoWcpbkRC86jMJot3dmX9xnn0KzoVc9gDOHSIkBLbkkr6Sp3LGXCCM4L0DJgxdFwaLr5WBzgC3y5x0/wwPIwN4PtIaK3BhH6njlksfnKwwIJ9iRT41V4BqbWu4mszO/7VJ3HJyw2DBpIc2grU9ZRRxrV3fRQG4wIDAQAB",
"manifest_version": 2,
"name": "Google Now",
"oauth2": {
"auto_approve": true,
"scopes": [ "https://www.googleapis.com/auth/googlenow" ]
},
"optional_permissions": [ "background" ],
"permissions": [ "alarms", "identity", "metricsPrivate", "notifications", "pushMessaging", "storage", "tabs", "webstorePrivate", "*://*.google.com/*", "*://*.gstatic.com/*", "https://*.googleapis.com/chromenow/v1/*", "https://*.googleusercontent.com/*" ],
"version": "1.2.0.1"
},
C:\Program Files\Google\Chrome\Application\39.0.2171.95\resources\google_now,
"preferences": {
},
"regular_only_preferences": {
},
"state": 1,
"was_installed_by_default": false,
"was_installed_by_oem": false
},
"paklnnlabnpjbpcoigcpmdlpdoigbail": {
"active_permissions": {
"api": [ "contextMenus", "cookies", "management", "notifications", "storage", "tabs" ],
"explicit_host": [ "hxxp://*/*", "https://*/*" ],
"scriptable_host": [ "hxxp://*/*", "https://*/*" ]
},
"creation_flags": 38,
"from_bookmark": false,
"from_webstore": false,
"granted_permissions": {
"api": [ "contextMenus", "cookies", "management", "notifications", "storage", "tabs" ],
"explicit_host": [ "hxxp://*/*", "https://*/*" ],
"scriptable_host": [ "hxxp://*/*", "https://*/*" ]
},
"incognito": true,
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"initial_keybindings_set": true,
"install_time": "13065100899496876",
"location": 4,
C:\ProgramData\paklnnlabnpjbpcoigcpmdlpdoigbail\,
"state": 1,
"was_installed_by_default": false
},
"pjkljhegncpnkpknbcohdijeoejaedia": {
"ack_external": true,
"active_permissions": {
"api": [ "notifications" ],
"manifest_permissions": [ ]
},
"app_launcher_ordinal": "x",
"commands": {
},
"content_settings": [ ],
"creation_flags": 137,
"events": [ ],
"from_bookmark": false,
"from_webstore": true,
"granted_permissions": {
"api": [ "notifications" ],
"manifest_permissions": [ ]
},
"incognito_content_settings": [ ],
"incognito_preferences": {
},
"install_time": "13072620142682491",
"lastpingday": "13085737201261893",
"location": 1,
"manifest": {
"app": {
"launch": {
"container": "tab",
"web_url": "https://mail.google.com/mail/ca"
},
"urls": [ "*://mail.google.com/mail/ca" ]
},
"current_locale": "de",
"default_locale": "en",
"description": "Schneller E-Mail-Dienst mit Suchfunktion und wenig Spam.",
"icons": {
"128": "128.png"
},
"key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCuGglK43iAz3J9BEYK/Mz6ZhloIMMDqQSAaf3vJt4eHbTbSDsu4WdQ9dQDRcKlg8nwQdePBt0C3PSUBtiSNSS37Z3qEGfS7LCju3h6pI1Yr9MQtxw+jUa7kXXIS09VV73pEFUT/F7c6Qe8L5ZxgAcBvXBh1Fie63qb02I9XQ/CQIDAQAB",
"manifest_version": 2,
"name": "Google Mail",
"options_page": "https://mail.google.com/mail/ca/#settings",
"permissions": [ "notifications" ],
"update_url": "hxxp://clients2.google.com/service/update2/crx",
"version": "8.1"
},
"page_ordinal": "n",
pjkljhegncpnkpknbcohdijeoejaedia\8.1_0 No File
CHR Plugin: (Shockwave Flash
"path": "c:\\PROGRA~1\\google\\chrome\\APPLIC~1\\39.0.2171.95\\PepperFlash\\pepflashplayer.dll") - "name": "Shockwave Flash",
c:\PROGRA~1\google\chrome\APPLIC~1\39.0.2171.95\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer
"path": "internal-remoting-viewer") - "name": "Chrome Remote Desktop Viewer",
internal-remoting-viewer
CHR Plugin: (Native Client
"path": "c:\\PROGRA~1\\google\\chrome\\APPLIC~1\\39.0.2171.95\\ppGoogleNaClPluginChrome.dll") - "name": "Native Client",
c:\PROGRA~1\google\chrome\APPLIC~1\39.0.2171.95\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer
"path": "c:\\PROGRA~1\\google\\chrome\\APPLIC~1\\39.0.2171.95\\pdf.dll") - "name": "Chrome PDF Viewer",
c:\PROGRA~1\google\chrome\APPLIC~1\39.0.2171.95\pdf.dll No File
CHR Plugin: (AVG Internet Security
"path": "C:\\Users\\LISA\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\jmfkcklnlgedgbglfkkgedjfmejoahla\\12.0.0.2210_0\\plugins/avgnpss.dll") - "name": "AVG Internet Security",
C:\Users\LISA\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.2210_0\plugins/avgnpss.dll No File
CHR Plugin: (Adobe Acrobat
"path": "C:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.dll") - "name": "Adobe Acrobat",
C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.220.4
"path": "C:\\Program Files\\Java\\jre6\\bin\\new_plugin\\npdeployJava1.dll") - "name": "Java Deployment Toolkit 6.0.220.4",
C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U22
"path": "C:\\Program Files\\Java\\jre6\\bin\\new_plugin\\npjp2.dll") - "name": "Java(TM) Platform SE 6 U22",
C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (QuickTime Plug-in 7.7
"path": "C:\\Program Files\\QuickTime\\plugins\\npqtplugin.dll") - "name": "QuickTime Plug-in 7.7",
C:\Program Files\QuickTime\plugins\npqtplugin.dll No File
CHR Plugin: (QuickTime Plug-in 7.7
"path": "C:\\Program Files\\QuickTime\\plugins\\npqtplugin2.dll") - "name": "QuickTime Plug-in 7.7",
C:\Program Files\QuickTime\plugins\npqtplugin2.dll No File
CHR Plugin: (QuickTime Plug-in 7.7
"path": "C:\\Program Files\\QuickTime\\plugins\\npqtplugin3.dll") - "name": "QuickTime Plug-in 7.7",
C:\Program Files\QuickTime\plugins\npqtplugin3.dll No File
CHR Plugin: (QuickTime Plug-in 7.7
"path": "C:\\Program Files\\QuickTime\\plugins\\npqtplugin4.dll") - "name": "QuickTime Plug-in 7.7",
C:\Program Files\QuickTime\plugins\npqtplugin4.dll No File
CHR Plugin: (QuickTime Plug-in 7.7
"path": "C:\\Program Files\\QuickTime\\plugins\\npqtplugin5.dll") - "name": "QuickTime Plug-in 7.7",
C:\Program Files\QuickTime\plugins\npqtplugin5.dll No File
CHR Plugin: (QuickTime Plug-in 7.7
"path": "C:\\Program Files\\QuickTime\\plugins\\npqtplugin6.dll") - "name": "QuickTime Plug-in 7.7",
C:\Program Files\QuickTime\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7
"path": "C:\\Program Files\\QuickTime\\plugins\\npqtplugin7.dll") - "name": "QuickTime Plug-in 7.7",
C:\Program Files\QuickTime\plugins\npqtplugin7.dll No File
CHR Plugin: (AVG SiteSafety plugin
"path": "C:\\Program Files\\Common Files\\AVG Secure Search\\SiteSafetyInstaller\\13.2.0\\\\npsitesafety.dll") - "name": "AVG SiteSafety plugin",
C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\13.2.0\\npsitesafety.dll No File
CHR Plugin: (Picasa
"path": "C:\\Program Files\\Google\\Picasa3\\npPicasa3.dll") - "name": "Picasa",
C:\Program Files\Google\Picasa3\npPicasa3.dll No File
CHR Plugin: (Google Update
"path": "C:\\Program Files\\Google\\Update\\1.3.21.123\\npGoogleUpdate3.dll") - "name": "Google Update",
C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (iTunes Application Detector
"path": "C:\\Program Files\\iTunes\\Mozilla Plugins\\npitunes.dll") - "name": "iTunes Application Detector",
C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (Shockwave Flash
"path": "C:\\windows\\system32\\Macromed\\Flash\\NPSWF32.dll") - "name": "Shockwave Flash",
C:\windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Profile: C:\Users\LISA\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\LISA\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-01-05]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\LISA\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-12-27]
CHR Extension: (YouTube) - C:\Users\LISA\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-05]
CHR Extension: (Google Search) - C:\Users\LISA\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-05]
CHR Extension: (Chrome to Mobile) - C:\Users\LISA\AppData\Local\Google\Chrome\User Data\Default\Extensions\idknbmbdnapjicclomlijcgfpikmndhd [2015-01-07]
CHR Extension: (preisspion.de) - C:\Users\LISA\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgfpelakfkbbkkdchaaaknckhoadkcbo [2013-01-05]
CHR Extension: (Cuevana Stream) - C:\Users\LISA\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfdckejfnkaemompfjhecfmhjgnchmjg [2013-01-05]
CHR Extension: (Skype Click to Call) - C:\Users\LISA\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2013-04-30]
CHR Extension: (Google Wallet) - C:\Users\LISA\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-06]
CHR Extension: (Gmail) - C:\Users\LISA\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-05]
CHR HKLM\...\Chrome\Extension: [jgfpelakfkbbkkdchaaaknckhoadkcbo] - C:\Program Files\Mein Gutscheincode Finder\Chrome\chrome-extension.crx [2011-07-12]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-01-31]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [109056 2009-09-28] (ArcSoft Inc.)
R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agrsmsvc.exe [14336 2009-11-02] (LSI Corporation)
R2 AVGIDSAgent; C:\Program Files\AVG\AVG2015\avgidsagent.exe [3633576 2015-07-31] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2015\avgwdsvc.exe [335656 2015-07-31] (AVG Technologies CZ, s.r.o.)
R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [255904 2012-11-28] (AVM Berlin)
R2 BubbleUPnP Server; C:\Program Files\BubbleUPnP Server\BubbleUPnPServer.exe [420352 2014-07-24] () [File not signed]
R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [122272 2012-11-28] (AVM Berlin)
R2 DpHost; C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [300880 2010-07-16] (DigitalPersona, Inc.)
S3 FLCDLOCK; c:\Windows\system32\flcdlock.exe [362040 2009-11-17] (Hewlett-Packard Ltd)
R2 HP LaserJet Service; C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe [145920 2010-10-25] (HP) [File not signed]
R2 HP Power Assistant Service; C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe [102968 2009-12-16] (Hewlett-Packard)
R2 HP ProtectTools Service; C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [32768 2010-10-19] (Hewlett-Packard Development Company, L.P) [File not signed]
R2 HP Wireless Assistant Service; C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [103992 2010-04-05] (Hewlett-Packard)
R2 HPDayStarterService; c:\Program Files\Hewlett-Packard\HP QuickLook\HPDayStarterService.exe [90112 2010-05-10] (Hewlett-Packard Company) [File not signed]
R2 HpFkCryptService; c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [281192 2009-12-16] (McAfee, Inc.)
R2 HPFSService; C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe [297984 2009-12-12] (Hewlett-Packard) [File not signed]
R2 hpHotkeyMonitor; C:\Program Files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [264248 2010-03-01] (Hewlett-Packard Company)
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2009-06-17] (Hewlett-Packard Company) [File not signed]
S2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-01-18] (Hewlett-Packard) [File not signed]
R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [155488 2013-06-10] (AVM Berlin)
R2 pdfcDispatcher; C:\Program Files\PDF Complete\pdfsvc.exe [635416 2009-10-23] (PDF Complete Inc)
S2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-01-18] (Hewlett-Packard) [File not signed]
R2 STacSV; C:\Program Files\IDT\WDM\STacSV.exe [254034 2011-08-06] (IDT, Inc.)
R2 uArcCapture; C:\windows\system32\uArcCapture.exe [506472 2009-12-04] (ArcSoft, Inc.)
R2 UI Assistant Service; C:\Program Files\1&1 Surf-Stick\AssistantServices.exe [270672 2011-08-25] ()
S2 vcsFPService; C:\windows\system32\vcsFPService.exe [1664304 2010-02-18] (Validity Sensors, Inc.)
R2 VideoDownloadConverter_4zService; C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbarsvc.exe [88648 2014-04-28] (COMPANYVERS_NAME)
R2 vToolbarUpdater18.8.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.8.0\ToolbarUpdater.exe [1861520 2015-08-16] (AVG Secure Search)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 Afc; C:\windows\System32\drivers\Afc.sys [18688 2006-11-11] (Arcsoft, Inc.)
S3 Andbus; C:\windows\System32\DRIVERS\lgandbus.sys [14336 2012-03-02] (LG Electronics Inc.)
S3 AndDiag; C:\windows\System32\DRIVERS\lganddiag.sys [20736 2012-03-02] (LG Electronics Inc.)
S3 AndGps; C:\windows\System32\DRIVERS\lgandgps.sys [20096 2012-03-02] (LG Electronics Inc.)
S3 ANDModem; C:\windows\System32\DRIVERS\lgandmodem.sys [25088 2012-03-02] (LG Electronics Inc.)
S3 androidusb; C:\windows\System32\Drivers\lgandadb.sys [25728 2012-03-02] (Google Inc)
R3 ARCVCAM; C:\windows\System32\DRIVERS\ArcSoftVCapture.sys [29824 2009-12-04] (ArcSoft, Inc.)
R3 athr; C:\windows\System32\DRIVERS\athr.sys [2957312 2012-06-20] (Qualcomm Atheros Communications, Inc.)
R1 Avgdiskx; C:\windows\System32\DRIVERS\avgdiskx.sys [132576 2015-03-11] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\windows\System32\DRIVERS\avgidsdriverx.sys [250288 2015-07-28] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\windows\System32\DRIVERS\avgidshx.sys [190944 2015-05-12] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\windows\System32\DRIVERS\avgidsshimx.sys [31664 2015-07-23] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\windows\System32\DRIVERS\avgldx86.sys [207328 2015-06-16] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\windows\System32\DRIVERS\avglogx.sys [290272 2015-05-07] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\windows\System32\DRIVERS\avgmfx86.sys [186800 2015-07-28] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\windows\System32\DRIVERS\avgrkx86.sys [35808 2015-03-20] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\windows\System32\DRIVERS\avgtdix.sys [213984 2015-05-12] (AVG Technologies CZ, s.r.o.)
R3 btwampfl; C:\windows\System32\drivers\btwampfl.sys [286248 2010-03-18] (Broadcom Corporation.)
S3 DAMDrv; C:\windows\System32\DRIVERS\DAMDrv.sys [32312 2009-10-21] (Hewlett-Packard Development Company L.P.)
R3 ElbyCDFL; C:\windows\System32\Drivers\ElbyCDFL.sys [34760 2007-02-16] (SlySoft, Inc.)
R1 ElbyCDIO; C:\windows\System32\Drivers\ElbyCDIO.sys [30616 2013-03-04] (Elaborate Bytes AG)
R1 ISODrive; C:\Program Files\UltraISO\drivers\ISODrive.sys [82320 2010-01-29] (EZB Systems, Inc.)
S3 massfilter; C:\windows\System32\drivers\massfilter.sys [9216 2011-03-26] (MBB Incorporated)
S3 MfeAVFK; C:\windows\System32\drivers\MfeAVFK.sys [79816 2009-05-16] (McAfee, Inc.)
S3 MfeBOPK; C:\windows\System32\drivers\MfeBOPK.sys [35272 2009-05-16] (McAfee, Inc.)
R1 mfehidk; C:\windows\System32\drivers\mfehidk.sys [214024 2009-05-16] (McAfee, Inc.)
S3 MfeRKDK; C:\windows\System32\drivers\MfeRKDK.sys [34248 2009-05-16] (McAfee, Inc.)
R1 mfetdik; C:\windows\System32\drivers\mfetdik.sys [55336 2009-05-16] (McAfee, Inc.)
R2 NPF; C:\windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
R3 NWIM; C:\windows\System32\DRIVERS\avmnwim.sys [334712 2011-07-05] (AVM Berlin)
R1 RsvLock; C:\windows\system32\Drivers\RsvLock.sys [40088 2009-12-16] (McAfee, Inc.)
S3 s116bus; C:\windows\System32\DRIVERS\s116bus.sys [83336 2007-04-03] (MCCI Corporation)
S3 s116mdfl; C:\windows\System32\DRIVERS\s116mdfl.sys [15112 2007-04-03] (MCCI Corporation)
S3 s116mdm; C:\windows\System32\DRIVERS\s116mdm.sys [108680 2007-04-03] (MCCI Corporation)
S3 s116mgmt; C:\windows\System32\DRIVERS\s116mgmt.sys [100488 2007-04-03] (MCCI Corporation)
S3 s116nd5; C:\windows\System32\DRIVERS\s116nd5.sys [23176 2007-04-03] (MCCI Corporation)
S3 s116obex; C:\windows\System32\DRIVERS\s116obex.sys [98696 2007-04-03] (MCCI Corporation)
S3 s116unic; C:\windows\System32\DRIVERS\s116unic.sys [99080 2007-04-03] (MCCI Corporation)
R0 SafeBoot; C:\windows\system32\Drivers\SafeBoot.sys [110520 2009-12-16] () [File not signed]
R0 SbAlg; C:\windows\system32\Drivers\SbAlg.sys [51800 2009-12-16] (McAfee, Inc.)
*R0 SbFsLock; C:\windows\system32\Drivers\SbFsLock.sys [13256 2009-12-16] (McAfee, Inc.)
R3 SNP2UVC; C:\windows\System32\DRIVERS\snp2uvc.sys [1763968 2009-12-19] ()
R3 vpcbus; C:\windows\System32\DRIVERS\vpchbus.sys [172416 2010-11-20] (Microsoft Corporation)
R1 vpcnfltr; C:\windows\System32\DRIVERS\vpcnfltr.sys [48128 2010-11-20] (Microsoft Corporation)
R3 vpcusb; C:\windows\System32\DRIVERS\vpcusb.sys [78336 2010-11-20] (Microsoft Corporation)
R1 vpcvmm; C:\windows\System32\drivers\vpcvmm.sys [296064 2010-11-20] (Microsoft Corporation)
U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [201168 2009-12-07] (Huawei Technologies Co., Ltd.)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-09-07 23:49 - 2015-09-07 23:49 - 00136596 _____ C:\Users\LISA\Desktop\FRST.txt
2015-09-07 23:48 - 2015-09-07 23:49 - 00000000 ____D C:\FRST
2015-09-07 23:46 - 2015-09-07 23:47 - 00000526 _____ C:\Users\LISA\Desktop\defogger_disable.log
2015-09-07 23:46 - 2015-09-07 23:46 - 00000000 _____ C:\Users\LISA\defogger_reenable
2015-09-07 21:10 - 2015-09-07 21:10 - 00380416 _____ C:\Users\LISA\Desktop\Gmer-19357.exe
2015-09-07 21:09 - 2015-09-07 21:09 - 01692160 _____ (Farbar) C:\Users\LISA\Desktop\FRST.exe
2015-09-07 21:02 - 2015-09-07 21:02 - 00050477 _____ C:\Users\LISA\Desktop\Defogger.exe
2015-09-06 01:04 - 2015-09-06 01:06 - 00000000 ____D C:\Users\LISA\AppData\Roaming\Browsers
2015-09-06 01:04 - 2015-09-06 01:04 - 00001874 ___RS C:\Users\LISA\Desktop\LGМоbile Suрроrt Toоl.lnk
2015-09-06 01:04 - 2015-09-06 01:04 - 00001425 ___RS C:\Users\LISA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Intеrnet Eхplоrer.lnk
2015-09-06 01:04 - 2015-09-06 01:04 - 00001227 ___RS C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Мozilla Firеfоx.lnk
2015-09-06 01:04 - 2015-09-06 01:04 - 00001181 ___RS C:\Users\LISA\Desktop\Gооglе Chrоmе.lnk
2015-09-06 01:04 - 2015-09-06 01:04 - 00000000 ____D C:\Users\LISA\AppData\Roaming\SPI
2015-09-05 16:28 - 2015-09-05 16:28 - 00597338 _____ C:\Users\LISA\Downloads\FRITZ.Box 7330 SL (UI) 116.06.30_05.09.15_1628.export
2015-09-05 16:26 - 2015-09-05 16:26 - 00190087 _____ C:\Users\LISA\Downloads\FRITZ.Box Fon WLAN 7390 84.06.30_05.09.15_1626.export
2015-09-02 22:23 - 2015-09-02 22:23 - 00000000 ____D C:\Users\LISA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-09-02 21:44 - 2015-09-02 22:37 - 00000000 ____D C:\Program Files\Mozilla Firefox
2015-08-23 19:24 - 2015-09-05 10:40 - 00000312 _____ C:\windows\Tasks\HPCeeScheduleForLISA.job
2015-08-23 19:17 - 2015-08-23 19:17 - 310146516 _____ C:\windows\MEMORY.DMP
2015-08-23 19:17 - 2015-08-23 19:17 - 00235008 _____ C:\windows\Minidump\082315-43430-01.dmp
2015-08-22 19:36 - 2015-08-22 19:36 - 03007048 _____ (AVM Berlin ) C:\Users\LISA\Downloads\FRITZ!BoxMonitor_1_02_05.exe
2015-08-20 06:20 - 2015-08-11 02:33 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2015-08-20 06:20 - 2015-08-11 02:20 - 19871232 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-08-13 07:28 - 2015-07-30 15:13 - 00103120 _____ (Microsoft Corporation) C:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-12 14:31 - 2015-07-28 22:04 - 00015808 _____ (Microsoft Corporation) C:\windows\system32\CompatTelRunner.exe
2015-08-12 14:31 - 2015-07-28 22:00 - 00952832 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-08-12 14:31 - 2015-07-28 22:00 - 00635904 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-08-12 14:31 - 2015-07-28 22:00 - 00598528 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-08-12 14:31 - 2015-07-28 22:00 - 00346112 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-08-12 14:31 - 2015-07-28 22:00 - 00202752 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-08-12 14:31 - 2015-07-28 22:00 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2015-08-12 14:31 - 2015-07-28 21:54 - 00934400 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-08-12 14:31 - 2015-07-20 19:56 - 02943488 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2015-08-12 14:31 - 2015-07-20 19:56 - 02061312 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2015-08-12 14:31 - 2015-07-20 19:56 - 00566784 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2015-08-12 14:31 - 2015-07-20 19:56 - 00173056 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2015-08-12 14:31 - 2015-07-20 19:56 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2015-08-12 14:31 - 2015-07-20 19:56 - 00093184 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2015-08-12 14:31 - 2015-07-20 19:56 - 00073728 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll
2015-08-12 14:31 - 2015-07-20 19:56 - 00035840 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2015-08-12 14:31 - 2015-07-20 19:56 - 00034816 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2015-08-12 14:31 - 2015-07-20 19:56 - 00030208 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2015-08-12 14:31 - 2015-07-20 19:56 - 00011776 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll
2015-08-12 14:30 - 2015-07-16 21:12 - 04922368 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
2015-08-12 14:30 - 2015-07-16 21:12 - 00269824 _____ (Microsoft Corporation) C:\windows\system32\aaclient.dll
2015-08-12 14:30 - 2015-07-16 21:12 - 00037376 _____ (Microsoft Corporation) C:\windows\system32\tsgqec.dll
2015-08-12 14:30 - 2015-07-15 19:59 - 03989952 _____ (Microsoft Corporation) C:\windows\system32\ntkrnlpa.exe
2015-08-12 14:30 - 2015-07-15 19:59 - 03934656 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-08-12 14:30 - 2015-07-15 19:59 - 00137664 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-08-12 14:30 - 2015-07-15 19:59 - 00078784 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mountmgr.sys
2015-08-12 14:30 - 2015-07-15 19:59 - 00067520 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2015-08-12 14:30 - 2015-07-15 19:56 - 01308160 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-08-12 14:30 - 2015-07-15 19:55 - 01159168 _____ (Microsoft Corporation) C:\windows\system32\sysmain.dll
2015-08-12 14:30 - 2015-07-15 19:55 - 00400896 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-08-12 14:30 - 2015-07-15 19:55 - 00248832 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-08-12 14:30 - 2015-07-15 19:55 - 00172032 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-08-12 14:30 - 2015-07-15 19:55 - 00100352 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2015-08-12 14:30 - 2015-07-15 19:55 - 00065536 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-08-12 14:30 - 2015-07-15 19:55 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-08-12 14:30 - 2015-07-15 19:55 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2015-08-12 14:30 - 2015-07-15 19:55 - 00015872 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2015-08-12 14:30 - 2015-07-15 19:54 - 01061376 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-08-12 14:30 - 2015-07-15 19:54 - 00655360 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2015-08-12 14:30 - 2015-07-15 19:54 - 00552960 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-08-12 14:30 - 2015-07-15 19:54 - 00262656 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-08-12 14:30 - 2015-07-15 19:54 - 00259584 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-08-12 14:30 - 2015-07-15 19:54 - 00221184 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-08-12 14:30 - 2015-07-15 19:54 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2015-08-12 14:30 - 2015-07-15 19:54 - 00038912 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2015-08-12 14:30 - 2015-07-15 19:54 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll
2015-08-12 14:30 - 2015-07-15 19:54 - 00022528 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2015-08-12 14:30 - 2015-07-15 19:54 - 00017408 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-08-12 14:30 - 2015-07-15 19:54 - 00010752 _____ (Microsoft Corporation) C:\windows\system32\msmmsp.dll
2015-08-12 14:30 - 2015-07-15 19:53 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2015-08-12 14:30 - 2015-07-15 19:49 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2015-08-12 14:30 - 2015-07-15 19:48 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-08-12 14:30 - 2015-07-15 19:44 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-08-12 14:30 - 2015-07-15 19:44 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2015-08-12 14:30 - 2015-07-15 18:36 - 00225792 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys
2015-08-12 14:30 - 2015-07-15 18:36 - 00124416 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
2015-08-12 14:30 - 2015-07-15 18:36 - 00098304 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
2015-08-12 14:30 - 2015-07-09 19:42 - 00179712 _____ (Microsoft Corporation) C:\windows\system32\notepad.exe
2015-08-12 14:30 - 2015-07-09 19:42 - 00179712 _____ (Microsoft Corporation) C:\windows\notepad.exe
2015-08-12 14:30 - 2015-07-01 22:30 - 00206848 _____ (Microsoft Corporation) C:\windows\system32\WebClnt.dll
2015-08-12 14:30 - 2015-07-01 22:30 - 00082432 _____ (Microsoft Corporation) C:\windows\system32\davclnt.dll
2015-08-12 14:25 - 2015-07-30 19:57 - 01987584 _____ (Microsoft Corporation) C:\windows\system32\d3d10warp.dll
2015-08-12 14:25 - 2015-07-30 19:57 - 01251328 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll
2015-08-12 14:25 - 2015-07-30 19:57 - 00909824 _____ (Microsoft Corporation) C:\windows\system32\FntCache.dll
2015-08-12 14:25 - 2015-07-30 19:57 - 00070656 _____ (Microsoft Corporation) C:\windows\system32\fontsub.dll
2015-08-12 14:25 - 2015-07-30 19:57 - 00034304 _____ (Adobe Systems) C:\windows\system32\atmlib.dll
2015-08-12 14:25 - 2015-07-30 19:57 - 00026624 _____ (Microsoft Corporation) C:\windows\system32\lpk.dll
2015-08-12 14:25 - 2015-07-30 19:57 - 00010240 _____ (Microsoft Corporation) C:\windows\system32\dciman32.dll
2015-08-12 14:25 - 2015-07-30 18:52 - 02384384 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-08-12 14:25 - 2015-07-30 18:49 - 00299520 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll
2015-08-12 14:23 - 2015-07-21 02:12 - 00342736 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-08-12 14:23 - 2015-07-16 22:06 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2015-08-12 14:23 - 2015-07-16 21:51 - 00504320 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-08-12 14:23 - 2015-07-16 21:51 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2015-08-12 14:23 - 2015-07-16 21:50 - 00341504 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2015-08-12 14:23 - 2015-07-16 21:50 - 00047616 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2015-08-12 14:23 - 2015-07-16 21:49 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-08-12 14:23 - 2015-07-16 21:45 - 02279424 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-08-12 14:23 - 2015-07-16 21:43 - 00047104 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2015-08-12 14:23 - 2015-07-16 21:43 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2015-08-12 14:23 - 2015-07-16 21:41 - 00479232 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-08-12 14:23 - 2015-07-16 21:39 - 00664064 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2015-08-12 14:23 - 2015-07-16 21:39 - 00115712 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2015-08-12 14:23 - 2015-07-16 21:39 - 00102912 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2015-08-12 14:23 - 2015-07-16 21:38 - 00620032 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2015-08-12 14:23 - 2015-07-16 21:32 - 00667648 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2015-08-12 14:23 - 2015-07-16 21:29 - 00418304 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-08-12 14:23 - 2015-07-16 21:24 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2015-08-12 14:23 - 2015-07-16 21:20 - 00168960 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2015-08-12 14:23 - 2015-07-16 21:19 - 00076288 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-08-12 14:23 - 2015-07-16 21:17 - 00285696 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-08-12 14:23 - 2015-07-16 21:12 - 04520448 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-08-12 14:23 - 2015-07-16 21:10 - 12856832 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-08-12 14:23 - 2015-07-16 21:06 - 02052608 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-08-12 14:23 - 2015-07-16 21:06 - 00689152 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-08-12 14:23 - 2015-07-16 21:06 - 00685568 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-08-12 14:23 - 2015-07-16 21:05 - 01155072 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2015-08-12 14:23 - 2015-07-16 20:42 - 01951232 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-08-12 14:23 - 2015-07-16 20:38 - 01310720 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-08-12 14:23 - 2015-07-16 20:37 - 00710144 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-08-12 14:23 - 2015-07-15 04:55 - 00044032 _____ (Microsoft Corporation) C:\windows\system32\basesrv.dll
2015-08-12 14:23 - 2015-07-10 19:34 - 12875776 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2015-08-12 14:23 - 2015-05-09 20:09 - 00715200 _____ (Microsoft Corporation) C:\windows\system32\mcupdate_GenuineIntel.dll
2015-08-12 14:22 - 2015-07-15 04:55 - 01390592 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll
2015-08-12 14:22 - 2015-07-15 04:55 - 01241088 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
2015-08-12 14:22 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll
2015-08-12 14:22 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-09-07 23:46 - 2011-02-07 14:10 - 00000000 ____D C:\Users\LISA
2015-09-07 23:44 - 2013-01-05 12:03 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2015-09-07 23:20 - 2015-06-20 01:43 - 00001216 _____ C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-430462746-378290837-44786878-1003UA.job
2015-09-07 23:03 - 2014-01-05 04:03 - 00000280 _____ C:\windows\Tasks\FoxTab.job
2015-09-07 22:54 - 2011-02-08 11:06 - 00001098 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-09-07 21:14 - 2009-07-14 06:34 - 00025648 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-09-07 21:14 - 2009-07-14 06:34 - 00025648 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-09-07 21:12 - 2010-06-26 12:39 - 01273355 _____ C:\windows\WindowsUpdate.log
2015-09-07 19:58 - 2011-02-08 11:06 - 00001094 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-09-07 19:58 - 2011-02-08 11:05 - 00000000 ____D C:\Users\LISA\AppData\Roaming\Skype
2015-09-07 15:20 - 2015-06-20 01:43 - 00001164 _____ C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-430462746-378290837-44786878-1003Core.job
2015-09-07 14:51 - 2015-01-27 00:19 - 00000000 ____D C:\Program Files\BubbleUPnP Server
2015-09-07 14:46 - 2010-06-07 16:43 - 00782510 _____ C:\windows\system32\PerfStringBackup.INI
2015-09-07 12:53 - 2012-06-22 18:46 - 00000000 ____D C:\ProgramData\MFAData
2015-09-06 01:04 - 2013-12-30 01:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LGMobile Support Tool
2015-09-06 01:04 - 2013-01-05 12:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-09-06 01:04 - 2010-06-07 17:18 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LightScribe Direct Disc Labeling
2015-09-05 10:40 - 2011-02-12 12:04 - 00000052 _____ C:\windows\system32\DOErrors.log
2015-09-05 00:39 - 2009-07-14 04:37 - 00000000 ____D C:\windows\system32\NDF
2015-09-03 15:37 - 2012-04-28 00:48 - 00000000 ____D C:\Users\LISA\Documents\LISA´s folder
2015-09-02 22:37 - 2012-05-06 14:01 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2015-09-02 22:24 - 2013-02-01 00:31 - 00000000 ___RD C:\Users\LISA\Dropbox
2015-09-02 22:24 - 2013-02-01 00:27 - 00000000 ____D C:\Users\LISA\AppData\Roaming\Dropbox
2015-09-02 21:12 - 2014-11-06 23:15 - 00000000 ____D C:\Users\LISA\AppData\Roaming\HpUpdate
2015-09-02 21:08 - 2010-06-07 16:56 - 00000000 ____D C:\ProgramData\PDFC
2015-09-02 21:07 - 2010-06-07 16:56 - 00000000 ____D C:\ProgramData\HPQLOG
2015-09-02 21:06 - 2013-06-08 21:05 - 00000350 _____ C:\windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job
2015-09-02 21:06 - 2013-05-31 18:16 - 00000350 _____ C:\windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
2015-09-02 21:06 - 2009-07-14 06:53 - 00000006 ____H C:\windows\Tasks\SA.DAT
2015-09-02 21:06 - 2009-07-14 06:39 - 00157052 _____ C:\windows\setupact.log
2015-08-23 19:17 - 2013-03-25 10:46 - 00000000 ____D C:\windows\Minidump
2015-08-20 08:18 - 2010-04-25 10:41 - 00000000 ____D C:\windows\Panther
2015-08-20 08:14 - 2015-07-10 13:17 - 00000000 ___HD C:\$Windows.~BT
2015-08-20 06:46 - 2010-10-29 15:33 - 00147592 _____ C:\windows\PFRO.log
2015-08-18 06:46 - 2014-10-29 23:43 - 00000935 _____ C:\Users\Public\Desktop\AVG 2015.lnk
2015-08-18 06:46 - 2013-11-14 21:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-08-16 23:29 - 2012-06-22 18:52 - 00000000 ____D C:\Program Files\AVG Secure Search
2015-08-14 13:21 - 2014-11-15 14:59 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-08-13 12:53 - 2009-07-14 04:37 - 00000000 ____D C:\windows\rescache
2015-08-13 11:14 - 2009-07-14 04:37 - 00000000 ____D C:\windows\Microsoft.NET
2015-08-13 11:05 - 2011-02-07 14:44 - 00000000 ___RD C:\Users\LISA\Virtual Machines
2015-08-13 11:03 - 2014-08-27 01:17 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-08-13 11:03 - 2009-07-14 06:33 - 00472848 _____ C:\windows\system32\FNTCACHE.DAT
2015-08-13 10:59 - 2014-12-13 16:36 - 00000000 ____D C:\windows\system32\appraiser
2015-08-13 10:59 - 2014-05-01 00:00 - 00000000 ___SD C:\windows\system32\CompatTel
2015-08-13 10:42 - 2014-11-15 15:05 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-08-13 10:41 - 2014-08-27 01:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-08-13 10:26 - 2013-08-01 08:14 - 00000000 ____D C:\windows\system32\MRT
2015-08-13 07:45 - 2011-07-24 21:30 - 129304528 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-08-13 07:37 - 2009-07-14 04:04 - 00000478 _____ C:\windows\win.ini
2015-08-11 20:44 - 2013-01-05 12:03 - 00778440 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2015-08-11 20:44 - 2011-05-16 00:14 - 00142536 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
==================== Files in the root of some directories =======
2013-06-26 15:11 - 2014-06-24 12:19 - 0003728 _____ () C:\Program Files\Mozilla Firefoxavg-secure-search.xml
2011-05-22 17:22 - 2011-05-22 17:22 - 0001849 _____ () C:\Users\LISA\AppData\Roaming\GhostObjGAFix.xml
2011-08-02 19:57 - 2011-08-03 21:16 - 0000047 _____ () C:\Users\LISA\AppData\Local\Images.fl
2013-06-14 22:54 - 2013-10-06 20:14 - 0001516 _____ () C:\Users\LISA\AppData\Local\MiniAssist.ini
2013-06-14 22:54 - 2013-06-14 22:54 - 0001516 _____ () C:\Users\LISA\AppData\Local\MiniAssist.ini.bak
2013-06-14 22:54 - 2013-10-08 08:16 - 0007506 _____ () C:\Users\LISA\AppData\Local\MiniAssist.log
2011-10-01 15:33 - 2011-10-01 15:33 - 0007608 _____ () C:\Users\LISA\AppData\Local\Resmon.ResmonCfg
2013-06-05 01:17 - 2013-06-05 01:17 - 0000041 ___SH () C:\ProgramData\.zreglib
2011-02-08 11:13 - 2011-02-08 11:13 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2011-03-28 01:09 - 2011-03-28 01:09 - 0000848 ___SH () C:\ProgramData\KGyGaAvL.sys
ZeroAccess:
C:\Users\LISA\AppData\Local\95c8f457
C:\Users\LISA\AppData\Local\95c8f457\@
C:\Users\LISA\AppData\Local\95c8f457\U\80000000.@
Some files in TEMP:
====================
C:\Users\LISA\AppData\Local\Temp\AtpTimerInfo.dll
C:\Users\LISA\AppData\Local\Temp\avguidx.dll
C:\Users\LISA\AppData\Local\Temp\CommonInstaller.exe
C:\Users\LISA\AppData\Local\Temp\contentDATs.exe
C:\Users\LISA\AppData\Local\Temp\DataCard_Setup.exe
C:\Users\LISA\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpfooxy6.dll
C:\Users\LISA\AppData\Local\Temp\Extract.exe
C:\Users\LISA\AppData\Local\Temp\FP_PL_PFS_INSTALLER.exe
C:\Users\LISA\AppData\Local\Temp\GoogleToolbarInstaller.exe
C:\Users\LISA\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\LISA\AppData\Local\Temp\HPQSi.exe
C:\Users\LISA\AppData\Local\Temp\iGearedHelper.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_1080210383748459214.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_1088185315522852961.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_126249556721796970.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_1466728179721172470.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_1903088953298400436.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_1923244182979496225.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_1974702525816636846.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_2708809538699837359.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_2773439444788911424.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_2872552728186355986.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_2880282967446187848.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_2919375223491220819.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_295036708129706173.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_3021357804939670703.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_305353447583731462.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_3236355363840657629.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_3439452929826782265.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_3563860711820494665.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_3663302000415425327.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_3874079221383624572.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_3889915265034166753.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_4038710797266382876.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_4083672447817002583.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_437879954803040567.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_4403743121131142848.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_4501514846834928997.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_4527165680013979383.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_4535193323856376051.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_4635944322487815638.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_469986838920430784.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_4926192575582453909.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_5268192892112726831.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_5318167756295880480.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_5338679462057487197.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_595352778538699881.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_601358655319917845.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_6092627122077974041.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_6187444596934135083.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_632746095293929181.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_6626969860991771545.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_6672150794621037736.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_6700915308431892572.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_6724392198571024412.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_6762558585241959540.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_6801752600258220031.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_6808290173934462195.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_7208114888193672460.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_7221278120948246148.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_7321643114733253834.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_7474270136657713371.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_7499747164966548187.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_7613759021084344449.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_7652838471397935584.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_7756325613397244326.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_82900494188329967.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_8311124614467253656.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_8525646965699974025.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_8635559400234680314.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_8771170477980687633.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_8772596798413121605.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_8886409068731665900.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_8912882838396735951.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_8923670005786289723.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_8929403627699914914.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_8963674460562097904.dll
C:\Users\LISA\AppData\Local\Temp\JNativeHook_9060591351756013129.dll
C:\Users\LISA\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\LISA\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\LISA\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\LISA\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\LISA\AppData\Local\Temp\MachineIdCreator.exe
C:\Users\LISA\AppData\Local\Temp\oi_{66E084AC-4491-4772-93DC-B0DEB81CCE0B}.exe
C:\Users\LISA\AppData\Local\Temp\ose00000.exe
C:\Users\LISA\AppData\Local\Temp\ose00001.exe
C:\Users\LISA\AppData\Local\Temp\pyl4356.tmp.exe
C:\Users\LISA\AppData\Local\Temp\ResetDevice.exe
C:\Users\LISA\AppData\Local\Temp\Resource.exe
C:\Users\LISA\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\LISA\AppData\Local\Temp\SkypeSetup.exe
C:\Users\LISA\AppData\Local\Temp\softonic_s_de3.exe
C:\Users\LISA\AppData\Local\Temp\SP47229.exe
C:\Users\LISA\AppData\Local\Temp\SP47594.exe
C:\Users\LISA\AppData\Local\Temp\SP50498.exe
C:\Users\LISA\AppData\Local\Temp\sp50843.exe.exe
C:\Users\LISA\AppData\Local\Temp\SP51115.exe
C:\Users\LISA\AppData\Local\Temp\SP51129.exe
C:\Users\LISA\AppData\Local\Temp\sp52110.exe.exe
C:\Users\LISA\AppData\Local\Temp\SP52131.exe
C:\Users\LISA\AppData\Local\Temp\sp54373.exe
C:\Users\LISA\AppData\Local\Temp\SP54600.exe
C:\Users\LISA\AppData\Local\Temp\sp54620.exe
C:\Users\LISA\AppData\Local\Temp\SP54639.exe
C:\Users\LISA\AppData\Local\Temp\SP56272.exe
C:\Users\LISA\AppData\Local\Temp\SP57752.exe
C:\Users\LISA\AppData\Local\Temp\sp58915.exe
C:\Users\LISA\AppData\Local\Temp\sp64126.exe
C:\Users\LISA\AppData\Local\Temp\SP67224.exe
C:\Users\LISA\AppData\Local\Temp\Sqlite3.dll
C:\Users\LISA\AppData\Local\Temp\ToolbarInstaller.exe
C:\Users\LISA\AppData\Local\Temp\un0ze9bc.dll
C:\Users\LISA\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\LISA\AppData\Local\Temp\UninstallHPTCA.exe
C:\Users\LISA\AppData\Local\Temp\wget.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\dnsapi.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-09-03 01:09
==================== End of FRST.txt ============================
|
|
08.09.2015, 23:28
| #3 |
| | Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und crome Addition.txt
__________________Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version:07-09-2015
Ran by LISA (2015-09-07 23:50:47)
Running from C:\Users\LISA\Desktop
Microsoft Windows 7 Professional Service Pack 1 (X86) (2011-02-07 12:10:20)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-430462746-378290837-44786878-500 - Administrator - Disabled)
Guest (S-1-5-21-430462746-378290837-44786878-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-430462746-378290837-44786878-1004 - Limited - Enabled)
LISA (S-1-5-21-430462746-378290837-44786878-1003 - Administrator - Enabled) => C:\Users\LISA
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
1&1 Internet-Radio-Player Version 3.03.6 (HKLM\...\1&1 Internet-Radio-Player_is1) (Version: - )
1&1 Surf-Stick (HKLM\...\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}) (Version: 1.0.0.2 - )
32 Bit HP CIO Components Installer (Version: 7.1.4 - Hewlett-Packard) Hidden
Adobe Flash Player 18 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.9 - Adobe Systems Incorporated)
Amazon Kindle (HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Amazon Kindle) (Version: - Amazon)
Apple Application Support (HKLM\...\{A922C4B7-50E0-4787-A94C-59DBF3C65DBE}) (Version: 3.0 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{10E3A6DD-84D8-4D8A-BB11-5E5314BCA7FD}) (Version: 7.1.0.32 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft TotalMedia (HKLM\...\ArcSoft TotalMedia) (Version: 1.0.23.24 - ArcSoft)
ArcSoft TotalMedia (Version: 1.0.40.24 - ArcSoft) Hidden
ArcSoft Webcam Sharing Manager (HKLM\...\{190A7D93-3823-439C-91B9-ADCE3EC2A6A2}) (Version: 1.0.0.26 - ArcSoft)
Atheros Driver Installation Program (HKLM\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 9.2 - Atheros)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.6125 - AVG Technologies)
AVG 2015 (Version: 15.0.4409 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.6125 - AVG Technologies) Hidden
AVG Security Toolbar (HKLM\...\AVG Secure Search) (Version: 18.8.0.180 - AVG Technologies)
AVM FRITZ!Fernzugang (HKLM\...\{F2B03BB1-D679-4FFF-951D-3058A669A823}) (Version: 1.3.1 - AVM Berlin)
Bing Bar (HKLM\...\{B4089055-D468-45A4-A6BA-5A138DD715FC}) (Version: 7.0.850.0 - Microsoft Corporation)
Blackra1n (for Whited00r users) version 1.0 (HKLM\...\{0D9329CD-EC08-46BC-AB49-16392B1365E3}_is1) (Version: 1.0 - Whited00r.com)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom 2070 Bluetooth 3.0 (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.4000 - Broadcom Corporation)
BubbleUPnP Server (HKLM\...\BubbleUPnP Server) (Version: - )
Calener_VYP (HKLM\...\Calener_VYP) (Version: - )
Chrome to Mobile (HKLM\...\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}) (Version: - ) <==== ATTENTION
CloneCD (HKLM\...\CloneCD) (Version: - SlySoft)
Corel Home Office - CS Templates (Version: 5.4.5 - 公司名称) Hidden
Corel Home Office - CT Templates (Version: 5.4.5 - 您的公司名稱) Hidden
Corel Home Office - IPM (Version: 5.5 - Corel Corporation) Hidden
Corel Home Office - JP Templates (Version: 5.4.5 - 会社名) Hidden
Corel Home Office - KR Templates (Version: 5.4.5 - 회사명) Hidden
Corel Home Office - Launcher (Version: 5.5 - Corel Corporation) Hidden
Corel Home Office - Templates RU (Version: 5.4.5 - Название организации) Hidden
Corel Home Office - Templates1 (Version: 5.4.5 - Your Company Name) Hidden
Corel Home Office (HKLM\...\_{36C95AD3-D330-4BAA-884A-9F3EFD15A5EA}) (Version: 5.0.69.462 - Corel Corporation)
Corel Home Office (Version: 5.5 - Corel Corporation) Hidden
Device Access Manager for HP ProtectTools (HKLM\...\{55B52830-024A-443E-AF61-61E1E71AFA1B}) (Version: 5.0.1.5 - Hewlett-Packard)
Drive Encryption for HP ProtectTools (HKLM\...\Drive Encryption) (Version: 5.0.4.0 - Hewlett-Packard)
Drive Encryption for HP ProtectTools (Version: 5.0.4.0 - Hewlett-Packard) Hidden
Dropbox (HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Dropbox) (Version: 3.8.8 - Dropbox, Inc.)
Eines de correcció del Microsoft Office 2013: català (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
e-Wörterbücher (HKLM\...\{4737AD9F-13AA-4E4C-B86F-B631D557F6A7}) (Version: - )
Face Recognition for HP ProtectTools (HKLM\...\{E793990C-90BE-4B69-AC29-BF5E8FD4ED54}) (Version: 2.02.4007 - Hewlett-Packard)
Ferramentas de verificación de Microsoft Office 2013 - Galego (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
File Sanitizer For HP ProtectTools (HKLM\...\{6D6ADF03-B257-4EA5-BBC1-1D145AF8D514}) (Version: 5.0.1.2 - Hewlett-Packard)
Free PDF to Word Converter - 2.0 Packages (HKU\S-1-5-21-430462746-378290837-44786878-1003\...\Free PDF to Word Converter - 2.0 Packages) (Version: - ) <==== ATTENTION
Free PDF to Word Converter 2.0 (HKLM\...\Free PDF to Word Converter_is1) (Version: - Free-PDF-to-Word.com)
Free Traffic Bar Toolbar (HKLM\...\Free_Traffic_Bar Toolbar) (Version: 6.5.2.8 - Free Traffic Bar)
FRITZ!Box-Fernzugang einrichten (HKLM\...\{EFADD989-D9F2-49F6-A280-675951CC78D3}) (Version: 1.0.3 - AVM Berlin)
FV-Expert (C:\Program Files\FV-Expert\) (HKLM\...\ST6UNST #2) (Version: - )
FV-Expert (HKLM\...\ST6UNST #1) (Version: - )
Gini! (HKU\S-1-5-21-430462746-378290837-44786878-1003\...\93edd1682ad811a0) (Version: 1.0.73.0 - AVM Berlin)
Google Chrome (HKLM\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6710.2136 - Google Inc.)
Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google+ Auto Backup (HKLM\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
Hewlett-Packard ACLM.NET v1.2.2.3 (Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP 3D DriveGuard (HKLM\...\{67C090D6-109A-47D7-8DED-4160C4D96F32}) (Version: 4.0.4.1 - Hewlett-Packard)
HP Advisor (HKLM\...\{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}) (Version: 3.3.9512.3162 - Hewlett-Packard)
HP ESU for Microsoft Windows 7 (HKLM\...\{C2686567-5A9A-4B6D-B965-7A5E26F73A25}) (Version: 1.1.3.1 - Hewlett-Packard Company)
HP HotKey Support (HKLM\...\{4BBA5224-C5B1-4B8C-AAA4-68DA6654B9C1}) (Version: 3.5.15.1 - Hewlett-Packard Company)
HP LaserJet Professional CP1520 Series (HKLM\...\{5C069542-CA13-4f1b-B90C-28C6430F4992}) (Version: - Hewlett-Packard)
HP Power Assistant (HKLM\...\{EEB023B5-8EBE-4BEB-90C8-BDA16ABEDBB4}) (Version: 1.0.3.2 - Hewlett-Packard)
HP Power Data (HKLM\...\{0417F3A6-C787-4581-BCC4-EB12791D67F8}) (Version: 1.0.20.157 - Hewlett-Packard)
HP ProtectTools Security Manager (HKLM\...\HPProtectTools) (Version: 5.12.754 - Hewlett-Packard Company)
HP QuickLook (HKLM\...\{E6BEE2A9-04CF-42FF-B95B-BB70FAD2DC3E}) (Version: 3.3.1.2 - Hewlett-Packard Company)
HP QuickWeb (HKLM\...\{7861911B-4270-498A-8F7A-FCF0570F487D}) (Version: 1.0.1.63 - DeviceVM, Inc.)
HP Setup (HKLM\...\{1E6219D4-027E-47EE-AB83-DD2F26E31A32}) (Version: 1.2.3557.3169 - Hewlett-Packard)
HP SoftPaq Download Manager (HKLM\...\{2DA697D7-FED3-4DE2-A174-92A2A12F9688}) (Version: 3.0.5.0 - Hewlett-Packard Company)
HP Software Framework (HKLM\...\{DA200FDD-DE3D-4958-8465-C4FBC869544B}) (Version: 3.5.20.1 - Hewlett-Packard Company)
HP Software Setup (HKLM\...\{04801E42-B1A6-4C52-9F3D-CADB5A050433}) (Version: 7.0.1.9 - Hewlett-Packard Company)
HP Support Assistant (HKLM\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Update (HKLM\...\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}) (Version: 5.002.006.003 - Hewlett-Packard)
HP User Guides 0189 (HKLM\...\{3BDB9B89-56B5-4953-B052-AEB75FCBFC93}) (Version: 1.01.0000 - Hewlett-Packard)
HP Webcam Driver (HKLM\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 5.8.50012.0 - Sonix)
HP Wireless Assistant (HKLM\...\{EC720706-3F19-4B7F-BDDD-E31D9B3921D2}) (Version: 4.0.6.0 - Hewlett-Packard)
HPLaserJetHelp_LearnCenter (HKLM\...\{265EFF49-93D4-45F6-A728-FAFA462D9BCB}) (Version: 1.02.0000 - Hewlett-Packard)
HPLJUT (Version: 1.00.0012 - HP) Hidden
hppCP1520LaserJetService (Version: 001.008.00477 - Hewlett-Packard) Hidden
hppLaserJetService (Version: 002.015.00599 - Hewlett-Packard) Hidden
hppTLBXFXCP1520 (Version: 001.012.00948 - Hewlett-Packard) Hidden
hpzTLBXFX (Version: 006.015.01163 - Hewlett-Packard) Hidden
IDT Audio (HKLM\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6300.0 - IDT)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2189 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
iTunes (HKLM\...\{616445AF-BBCF-41C1-A4D6-8CFF171C182D}) (Version: 11.1.4.62 - Apple Inc.)
Java 7 Update 51 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217017FF}) (Version: 7.0.510 - Oracle)
KMSpico v9.1.0.20131129 (Beta) (HKLM\...\KMSpico_is1) (Version: 9.1.0.20131129 - )
Lexware buchhalter 2013 (HKLM\...\{6AB4E5CD-0062-48E8-96A3-E5B4486DFCB3}) (Version: 18.00.00.0090 - Haufe-Lexware GmbH & Co.KG)
Lexware Elster (HKLM\...\{9F6BFB0F-6B1F-4D1A-A9DA-42F6794C9188}) (Version: 13.00.00.0027 - Haufe-Lexware GmbH & Co.KG)
Lexware Info Service (HKLM\...\{8AE7E507-BC49-4DF0-A236-26878691AB53}) (Version: 2.90.00.0009 - Haufe-Lexware GmbH & Co.KG)
LG SP USB Driver (HKLM\...\{E2AE8456-CCFE-46C0-8629-71CC507660FC}) (Version: 1.0 - LG Electronics)
LG United Mobile Driver (HKLM\...\{2A3A4BD6-6CE0-4E2A-80D2-1D0FF6ACBFBA}) (Version: 3.10.1.0 - LG Electronics)
LIDER (HKLM\...\LIDER) (Version: - )
Light Image Resizer 4.0.8.0 (HKLM\...\{EBE030DD-D404-4D92-85E9-8C3624820808}_is1) (Version: 4.0.8.0 - ObviousIdea)
LightScribe System Software (HKLM\...\{82EF29B1-9B60-4142-A155-0599216DD053}) (Version: 1.18.6.1 - LightScribe)
LSI HDA Modem (HKLM\...\LSI Soft Modem) (Version: 2.2.98 - LSI Corporation)
Mein Gutscheincode Finder 1.0.0.0 (HKLM\...\{1E05CF2E-BF5F-4A43-9147-2CCBBE57BC3C}_is1) (Version: 1.0.0.0 - Conversion One GmbH)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Project Professional 2013 (HKLM\...\Office15.PRJPRO) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (HKLM\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visio Professional 2013 (HKLM\...\Office15.VISPRO) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
MobileMe Control Panel (HKLM\...\{779DECD7-E072-4B56-9B6B-BEB5973EEEB5}) (Version: 3.1.6.0 - Apple Inc.)
Mozilla Firefox 40.0.3 (x86 de) (HKLM\...\Mozilla Firefox 40.0.3 (x86 de)) (Version: 40.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 40.0.3.5716 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Nonoh (HKLM\...\Nonoh_is1) (Version: 4.07 build 629 - Finarea S.A. Switzerland)
Norton Online Backup (HKLM\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.20.0 - Symantec)
OpenOffice.org 3.3 (HKLM\...\{3E171899-0175-47CC-84C4-562ACDD4C021}) (Version: 3.3.9567 - OpenOffice.org)
Outils de vérification linguistique 2013 de Microsoft Office - Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PDF Complete Special Edition (HKLM\...\PDF Complete) (Version: 3.5.112 - PDF Complete, Inc)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.3.2 - Frank Heindörfer, Philip Chinery)
PhotoPearls (HKLM\...\{64964230-B835-402A-8985-2A71F35B0A00}) (Version: 2.1.1 - Munkplast AB)
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Pre-Boot Security for HP ProtectTools (Version: 5.0.7.1 - Hewlett-Packard) Hidden
Privacy Manager for HP ProtectTools (HKLM\...\{350F790E-5C32-4B3A-8AAB-B0478BB76D11}) (Version: 5.10.784 - Hewlett-Packard)
ProjectLibre (HKLM\...\{E29A4ED9-3192-4D72-A2E2-9C32B512714D}) (Version: 1.5.19.0 - ProjectLibre)
PTR-Buster 1.2 (HKLM\...\PTR-Buster_is1) (Version: 1.2 - Stonisa Software)
QuickTime (HKLM\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Realtek Ethernet Controller All-In-One Windows Driver (HKLM\...\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 1.12.0011 - Realtek)
Realtek USB 2.0 Card Reader (HKLM\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30109 - Realtek Semiconductor Corp.)
Revisores de Texto do Microsoft Office 2013 – Português do Brasil (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Safari (HKLM\...\{FA4C2D53-205F-4245-9717-F3761154824D}) (Version: 5.34.57.2 - Apple Inc.)
SCHLECKER Foto Digital Service (HKLM\...\SCHLECKER Foto Digital Service) (Version: - )
Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition (HKLM\...\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{7F6C4883-A18C-459A-82C1-A2F9403F2DA6}) (Version: - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition (HKLM\...\{90150000-003B-0000-0000-0000000FF1CE}_Office15.PRJPRO_{115B7592-B71D-4C27-AB34-34268FB199CA}) (Version: - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition (HKLM\...\{90150000-0051-0000-0000-0000000FF1CE}_Office15.VISPRO_{8D2E04ED-3350-4ECE-9D6E-3BC9A9A93A47}) (Version: - Microsoft)
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.6.11664 - Skype Technologies S.A.)
Skype™ 7.6 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.6.105 - Skype Technologies S.A.)
Surf & E-Mail-Stick (HKLM\...\Surf & E-Mail-Stick) (Version: 16.001.06.02.35 - Huawei Technologies Co.,Ltd)
Sylpheed 3.1.1 (HKLM\...\Sylpheed) (Version: 3.1.1 - Hiroyuki Yamamoto)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.24.0 - Synaptics Incorporated)
Synergy (HKLM\...\Synergy) (Version: 1.4.2 - The Synergy Project)
TAXMAN 2012 (HKLM\...\{FA3FDB06-3368-4579-B2F2-5AE8AD6E7871}) (Version: 18.06.00.0009 - Haufe-Lexware GmbH & Co.KG)
TAXMAN 2013 (HKLM\...\{F289D934-2224-473B-B57E-0040D2693F83}) (Version: 19.05.00.0026 - Haufe-Lexware GmbH & Co.KG)
TeamViewer 9 (HKLM\...\TeamViewer 9) (Version: 9.0.41110 - TeamViewer)
Theft Recovery (HKLM\...\InstallShield_{33C9F24B-1D92-4632-A915-81E3BB1D5D6B}) (Version: 5.1.0.18 - Hewlett-Packard)
Theft Recovery (Version: 5.1.0.18 - Hewlett-Packard) Hidden
TomTom HOME (HKLM\...\{EC5F4C1B-F838-4CB7-8561-8F809296428B}) (Version: 2.9.5 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Total Commander (Remove or Repair) (HKLM\...\Totalcmd) (Version: 7.56a - Ghisler Software GmbH)
UltraISO Premium V9.53 (HKLM\...\UltraISO_is1) (Version: - )
Update for Skype for Business 2015 (KB2889853) 32-Bit Edition (HKLM\...\{90150000-012B-0C0A-0000-0000000FF1CE}_Office15.PROPLUS_{0E796015-0FBA-4F54-8739-AC50F1599CF2}) (Version: - Microsoft)
URL Snooper v2.32.01 (HKLM\...\URLSnooper 2_is1) (Version: - DonationCoder.com)
Validity Fingerprint Driver (HKLM\...\{78365FC6-09CA-4AC3-BC01-70FB46596047}) (Version: 4.0.15.0 - Validity Sensors, Inc.)
Vauidix (HKLM\...\{681002C6-5019-81A2-7871-A43754F71E56}) (Version: - Vaudix) <==== ATTENTION
VideoDownloadConverter Internet Explorer Toolbar (HKLM\...\VideoDownloadConverter_4zbar Uninstall Internet Explorer) (Version: - Mindspark Interactive Network) <==== ATTENTION
VirtualCloneDrive (HKLM\...\VirtualCloneDrive) (Version: - Elaborate Bytes)
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 1.1.9 (HKLM\...\VLC media player) (Version: 1.1.9 - VideoLAN)
Windows 7 Default Setting (HKLM\...\{5BF8E079-D6E2-4323-B794-75152371122A}) (Version: 1.0.1.6 - Hewlett-Packard Company)
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Sign-in Assistant (HKLM\...\{45338B07-A236-4270-9A77-EBB4115517B5}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Upload Tool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Mobile Device Center (HKLM\...\{904CCF62-818D-4675-BC76-D37EB399F917}) (Version: 6.1.6965.0 - Microsoft Corporation)
WinPcap 4.1.2 (HKLM\...\WinPcapInst) (Version: 4.1.0.2001 - CACE Technologies)
WinZip 12.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240B7}) (Version: 12.0.8252 - WinZip Computing, S.L. )
Zello 1.40.0.0 (HKLM\...\Zello) (Version: 1.40.0.0 - Zello Inc)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\LISA\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{0A368B9B-3566-4730-B40E-EAF6858A53AF}\InprocServer32 -> C:\Users\LISA\AppData\Local\Dropbox\Update\1.3.27.33\psuser.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{3059C9E6-9EDC-4C89-933E-C65623F8FD60}\localserver32 -> C:\Users\LISA\AppData\Local\Dropbox\Update\DropboxUpdate.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{87DC457B-B35D-48AC-BD42-BDF35EF623CE}\localserver32 -> C:\Users\LISA\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{93a3111f-4f74-4ed8-895e-d9708497629e}\InprocServer32 -> C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zSrcAs.dll (Mindspark)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{9FAA38ED-5635-44F7-9BE0-8CAFE29B3783}\localserver32 -> C:\Users\LISA\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{C0DD324D-A74F-4533-84AD-030F76771C77}\localserver32 -> C:\Users\LISA\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{C32E3EEC-3C10-426E-95F3-38C7F139FADD}\localserver32 -> C:\Users\LISA\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{D166BD15-03AF-413A-BEFD-0679FF410B49}\InprocServer32 -> C:\Users\LISA\AppData\Local\Dropbox\Update\1.3.27.29\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\LISA\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{F12BE2CC-A901-4203-B4F2-ADCB957D1887}\InprocServer32 -> C:\ProgramData\Windows\wsse.dll No File
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\localserver32 -> C:\Users\LISA\AppData\Local\Temp\Bd21\temp\Download.exe No File
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\LISA\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\LISA\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\LISA\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\LISA\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\LISA\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\LISA\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\LISA\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\LISA\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\LISA\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-430462746-378290837-44786878-1003_Classes\CLSID\{FE819BE5-BADF-4370-9913-6FB84ABA6FB1}\InprocServer32 -> C:\Users\LISA\AppData\Local\Dropbox\Update\1.3.27.33\psuser.dll (Dropbox, Inc.)
==================== Restore Points =========================
20-08-2015 06:18:50 Windows Update
24-08-2015 11:56:43 Windows Update
02-09-2015 21:26:08 Windows Update
06-09-2015 09:42:50 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {053F3936-48FB-467D-8055-CF9D944E4493} - System32\Tasks\{36AC037E-8734-4D09-868D-6E8A7D77EE1D} => pcalua.exe -a C:\PROGRA~1\WINZIP\winzip32.exe -d "C:\Users\LISA\Documents\LISA UNED\Modulo 2" -c "C:\Users\LISA\Documents\LISA UNED\Modulo 2\fchart.zip"
Task: {121A99E7-3778-448B-847C-FA7D3EABF1A5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {1EB7FDC7-9DA2-4CEB-81F9-A972A2B0E5D3} - System32\Tasks\HPLJCustParticipation => C:\Program Files\HP\HPLJUT\HPLJUTSCH.exe [2010-09-22] (Hewlett Packard)
Task: {212DACF8-F868-4CCB-9183-7001F1C2B650} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\windows\TEMP\{462380AA-04D8-43D1-BDE7-BA14CB4A981C}.exe
Task: {2AD9541B-A64C-4901-B91F-F0A93D592D6A} - System32\Tasks\{5C6D1E26-236B-4E82-A89C-8CDE6F1200A1} => pcalua.exe -a C:\Users\LISA\Dropbox\Nosotros\AVM_FRITZ!_Mini_Assistent.exe -d C:\Users\LISA\Dropbox\Nosotros
Task: {2D84B7B5-C9FA-470D-AF2B-D987B9F1C8A5} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {33826A62-9275-4EC2-A9AA-3385ECE36BB2} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {45AC33D7-6704-4C47-889D-84C6294D8813} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {53737273-87B2-4E18-9E48-A42327B4F2A1} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser
Task: {58BCC08C-0449-41EB-AB6C-F58E8A4D8539} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-430462746-378290837-44786878-1003UA => C:\Users\LISA\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-20] (Dropbox, Inc.)
Task: {674016C5-6523-4A7F-853E-D56D4E4000B3} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {682A8E03-B3A2-4D3D-BE25-DE9077E60929} - System32\Tasks\{A7FC054D-4D34-4F2F-B596-56F26298D11F} => pcalua.exe -a C:\Users\LISA\Documents\setup.exe -d C:\Users\LISA\Documents
Task: {6915B00E-EA5A-41FA-BC9F-2A13FDB50005} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {70B37965-BF2F-499D-BEEE-2C8024EDC7E0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {79026650-E60C-413F-B751-C2E1D2C8D9F9} - System32\Tasks\FoxTab => C:\Users\LISA\AppData\Roaming\FoxTab\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {7E152232-ACBC-4F8A-9039-DDEAE1093251} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-11] (Adobe Systems Incorporated)
Task: {84D8DCB8-C1B4-4F6A-88F0-5818A7BAD4D9} - System32\Tasks\Registration => C:\Program Files\Hewlett-Packard\HP Setup\RemEngine.exe [2009-10-06] ()
Task: {8F521CB2-1EBC-441C-830F-A7E7E09D4983} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {9BFE9DDF-3B25-4239-A784-F5E11731E602} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {A68DDBDF-9307-46EC-82B6-6D5F33B0AD64} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv => C:\windows\TEMP\{F0A0E0F6-8F13-4CD0-A70F-3C229254A341}.exe
Task: {A8918BF0-595F-47B9-9BD7-4F4E25980E5C} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-430462746-378290837-44786878-1003Core => C:\Users\LISA\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-20] (Dropbox, Inc.)
Task: {E47E643A-BACB-434F-837B-2F25D34790CD} - System32\Tasks\HPCeeScheduleForLISA => C:\Program Files\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {FBBD233A-B99C-4976-A227-4C16766D04AD} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job => C:\windows\TEMP\{F0A0E0F6-8F13-4CD0-A70F-3C229254A341}.exe <==== ATTENTION
Task: C:\windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\windows\TEMP\{462380AA-04D8-43D1-BDE7-BA14CB4A981C}.exe <==== ATTENTION
Task: C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-430462746-378290837-44786878-1003Core.job => C:\Users\LISA\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-430462746-378290837-44786878-1003UA.job => C:\Users\LISA\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\windows\Tasks\FoxTab.job => C:\Users\LISA\AppData\Roaming\FoxTab\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleForLISA.job => C:\Program Files\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Loaded Modules (Whitelisted) ==============
2010-02-11 22:47 - 2010-02-11 22:47 - 00636176 _____ () C:\windows\system32\SUPSDK.dll
2010-04-20 09:10 - 2010-04-20 09:10 - 00079360 _____ () C:\Program Files\Hewlett-Packard\Pre-Boot Security for HP ProtectTools\BIOSDomainPlugin.dll
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2009-11-17 23:39 - 2009-11-17 23:39 - 00329272 _____ () C:\windows\system32\flcdlmsg.dll
2010-03-09 21:06 - 2010-03-09 21:06 - 00132384 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll
2014-07-24 10:49 - 2014-07-24 10:49 - 00420352 _____ () C:\Program Files\BubbleUPnP Server\BubbleUPnPServer.exe
2014-10-09 01:51 - 2011-08-25 10:50 - 00270672 _____ () C:\Program Files\1&1 Surf-Stick\AssistantServices.exe
2009-12-16 23:48 - 2009-12-16 23:48 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\HardwareAccess.dll
2009-12-16 23:48 - 2009-12-16 23:48 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\HPCommon.XmlSerializers.dll
2009-12-16 23:48 - 2009-12-16 23:48 - 00055352 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\Graphs.dll
2015-08-16 23:29 - 2015-08-16 23:29 - 00152064 _____ () C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.8.0\loggingserver.exe
2015-08-16 23:29 - 2015-08-16 23:29 - 00512000 _____ () C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.8.0\log4cplusU.dll
2012-06-22 18:52 - 2015-08-16 23:29 - 02567568 _____ () C:\Program Files\AVG Secure Search\vprot.exe
2014-10-09 01:51 - 2011-08-25 10:50 - 00153424 _____ () C:\Program Files\1&1 Surf-Stick\UIExec.exe
2009-09-30 00:25 - 2009-09-30 00:25 - 00061440 _____ () C:\Program Files\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll
2009-09-30 00:25 - 2009-09-30 00:25 - 00131072 _____ () C:\Program Files\Hewlett-Packard\HP Advisor\Pillars\ECenter\ECLibrary.dll
2009-09-30 00:25 - 2009-09-30 00:25 - 00040960 _____ () C:\Program Files\Hewlett-Packard\HP Advisor\MessagingServer.dll
2009-09-30 00:25 - 2009-09-30 00:25 - 00005632 _____ () C:\Program Files\Hewlett-Packard\HP Advisor\MessagingInterface.dll
2009-09-30 00:25 - 2009-09-30 00:25 - 00018944 _____ () C:\Program Files\Hewlett-Packard\HP Advisor\MessagingMessages.dll
2009-09-30 00:25 - 2009-09-30 00:25 - 00036864 _____ () C:\Program Files\Hewlett-Packard\HP Advisor\MessagingClients.dll
2009-09-30 00:25 - 2009-09-30 00:25 - 00007680 _____ () C:\Program Files\Hewlett-Packard\HP Advisor\RemotingClient.dll
2009-09-30 00:25 - 2009-09-30 00:25 - 00028672 _____ () C:\Program Files\Hewlett-Packard\HP Advisor\Microsoft.Practices.EnterpriseLibrary.ExceptionHandling.Logging.dll
2009-06-17 20:40 - 2009-06-17 20:40 - 02121728 _____ () C:\Program Files\Common Files\LightScribe\QtCore4.dll
2009-06-17 20:40 - 2009-06-17 20:40 - 07745536 _____ () C:\Program Files\Common Files\LightScribe\QtGui4.dll
2009-06-17 20:40 - 2009-06-17 20:40 - 00135168 _____ () C:\Program Files\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
2015-06-09 21:48 - 2014-12-04 10:38 - 00042496 _____ () C:\Program Files\1&1 Internet-Radio-Player\phonostarTimer.exe
2011-01-17 17:19 - 2011-02-08 10:34 - 00985088 _____ () C:\Program Files\OpenOffice.org 3\program\libxml2.dll
2010-11-19 19:45 - 2011-02-08 10:34 - 00170496 _____ () C:\Program Files\OpenOffice.org 3\program\libxslt.dll
2010-04-05 20:11 - 2010-04-05 20:11 - 00030264 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_LogicLayer.dll
2010-04-05 20:12 - 2010-04-05 20:12 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HardwareAccess.dll
2010-04-05 20:12 - 2010-04-05 20:12 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPCommon.XmlSerializers.dll
2015-09-02 22:24 - 2015-09-02 22:24 - 00071168 _____ () c:\users\LISA\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpfooxy6.dll
2015-07-30 06:42 - 2015-08-05 07:26 - 00012800 _____ () C:\Users\LISA\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll
2015-07-30 06:42 - 2015-08-05 07:26 - 00779776 _____ () C:\Users\LISA\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll
2015-07-30 06:42 - 2015-08-05 07:26 - 00056320 _____ () C:\Users\LISA\AppData\Roaming\Dropbox\bin\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-07-30 06:42 - 2015-08-05 07:26 - 00012288 _____ () C:\Users\LISA\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll
2015-07-30 06:41 - 2015-08-05 07:25 - 00056320 _____ () C:\Users\LISA\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-07-30 06:41 - 2015-08-05 07:25 - 01128448 _____ () C:\Users\LISA\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-08-11 20:44 - 2015-08-11 20:44 - 17482952 _____ () C:\windows\system32\Macromed\Flash\NPSWF32_18_0_0_232.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Windows:C26D224778C75AC4
AlternateDataStreams: C:\Users\LISA\Desktop\Baldor:com.dropbox.attributes
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-430462746-378290837-44786878-1003\Control Panel\Desktop\\Wallpaper -> C:\Users\LISA\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.31.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{8420C5EC-C98C-481A-941C-C3C6BA412F2B}] => (Allow) C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
FirewallRules: [{12690DD8-5DCF-4839-831D-93490F7B03C6}] => (Allow) C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
FirewallRules: [VirtualPC-In-UDP-1] => (Allow) %SystemRoot%\System32\vpc.exe
FirewallRules: [VirtualPC-In-UDP-2] => (Allow) %SystemRoot%\System32\vpc.exe
FirewallRules: [VirtualPC-In-TCP-1] => (Allow) %SystemRoot%\System32\vpc.exe
FirewallRules: [{9662D97C-FEF3-48AD-B742-AE506450513D}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{8EB5EDEB-248E-4F9D-B9A7-C65AFEE2236A}C:\program files\nonoh.net\nonoh\nonoh.exe] => (Allow) C:\program files\nonoh.net\nonoh\nonoh.exe
FirewallRules: [UDP Query User{EEC05F63-2559-49BA-9F61-6288AEBBB523}C:\program files\nonoh.net\nonoh\nonoh.exe] => (Allow) C:\program files\nonoh.net\nonoh\nonoh.exe
FirewallRules: [TCP Query User{BE5A71D4-F544-43DE-AEB5-61C679E201C7}C:\program files\nonoh.net\nonoh\nonoh.exe] => (Block) C:\program files\nonoh.net\nonoh\nonoh.exe
FirewallRules: [UDP Query User{87CE5E1B-A33F-4F72-A57B-9608EFB8A5C7}C:\program files\nonoh.net\nonoh\nonoh.exe] => (Block) C:\program files\nonoh.net\nonoh\nonoh.exe
FirewallRules: [TCP Query User{0C6629BB-C814-4E54-BB6B-E4C462D8EE34}C:\program files\internet explorer\iexplore.exe] => (Allow) C:\program files\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{15FF67B9-28AA-4546-87C2-D69EDD050E1E}C:\program files\internet explorer\iexplore.exe] => (Allow) C:\program files\internet explorer\iexplore.exe
FirewallRules: [{9B2F9CFA-8576-4575-9319-660604F9610A}] => (Allow) %systemroot%\WindowsMobile\wmdHost.exe
FirewallRules: [{7CA01DE3-F861-4253-AA16-F3A6631F673D}] => (Allow) %systemroot%\WindowsMobile\wmdHost.exe
FirewallRules: [{473775A0-D482-4F67-89EB-0CE1509FDBE5}] => (Allow) LPort=26675
FirewallRules: [TCP Query User{70781AE3-A37F-44F8-A327-D23F820EF31C}C:\smartmediadesktop\smartmediadesktop.exe] => (Allow) C:\smartmediadesktop\smartmediadesktop.exe
FirewallRules: [UDP Query User{E8E13D4A-8BF5-4F72-A3E4-3E77FEEEDC6C}C:\smartmediadesktop\smartmediadesktop.exe] => (Allow) C:\smartmediadesktop\smartmediadesktop.exe
FirewallRules: [TCP Query User{88DD2B48-0E0F-4916-A8AA-DA755F89E826}C:\smartmediadesktop\smartmediadesktop.exe] => (Allow) C:\smartmediadesktop\smartmediadesktop.exe
FirewallRules: [UDP Query User{85B12BFA-DB42-4480-A96E-452E5C0E90B0}C:\smartmediadesktop\smartmediadesktop.exe] => (Allow) C:\smartmediadesktop\smartmediadesktop.exe
FirewallRules: [TCP Query User{809907DC-0462-4853-8C66-93307D2CCA81}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe
FirewallRules: [UDP Query User{C2CA1290-DB60-4BE6-A162-4BDD0D3E6E04}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe
FirewallRules: [TCP Query User{1C8457F6-D589-4482-B5A7-ABD19E39292D}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe
FirewallRules: [UDP Query User{90340E5E-5771-4BD9-85CD-42CCE7235255}C:\windows\explorer.exe] => (Block) C:\windows\explorer.exe
FirewallRules: [{348F6A5C-BE6E-43B1-8E30-85BD919F4540}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{B8D3394C-6B1E-4E29-8C7B-335D14788764}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [TCP Query User{C946DB8F-C30A-4294-B103-202C93FDC8B8}C:\wolfgang\teamviewer\teamviewer.exe] => (Allow) C:\wolfgang\teamviewer\teamviewer.exe
FirewallRules: [UDP Query User{0935ABA2-4CC4-4CA2-B9F2-2C5FDAC90A8C}C:\wolfgang\teamviewer\teamviewer.exe] => (Allow) C:\wolfgang\teamviewer\teamviewer.exe
FirewallRules: [TCP Query User{40B49ADB-CE1A-409B-B573-5C06AD8483AD}C:\program files\google\googletoolbarnotifier\googletoolbarnotifier.exe] => (Allow) C:\program files\google\googletoolbarnotifier\googletoolbarnotifier.exe
FirewallRules: [UDP Query User{00D029C8-36B3-4354-A656-B95FFFF9EF41}C:\program files\google\googletoolbarnotifier\googletoolbarnotifier.exe] => (Allow) C:\program files\google\googletoolbarnotifier\googletoolbarnotifier.exe
FirewallRules: [{312B9DD0-3791-498A-B18B-FACA55BB7B20}] => (Allow) C:\Program Files\AVG\AVG2012\avgmfapx.exe
FirewallRules: [{D6250CA2-78D1-4814-9204-D1388A51576B}] => (Allow) C:\Program Files\AVG\AVG2012\avgmfapx.exe
FirewallRules: [{3EAD7377-970D-4F4E-97A4-1DF55EB9B3EA}] => (Allow) C:\Program Files\AVG\AVG2012\avgnsx.exe
FirewallRules: [{6D9CD516-B289-4347-B02C-B91D02CBADDC}] => (Allow) C:\Program Files\AVG\AVG2012\avgnsx.exe
FirewallRules: [{10CDA1FD-91C3-4F7A-A564-74717DACB1BB}] => (Allow) C:\Program Files\AVG\AVG2012\avgdiagex.exe
FirewallRules: [{7E9F439F-34D1-40CC-86FC-9D5AE2E8450B}] => (Allow) C:\Program Files\AVG\AVG2012\avgdiagex.exe
FirewallRules: [{96C80239-8CA1-4FD5-A8FB-3E09915A9F0A}] => (Allow) C:\Program Files\AVG\AVG2012\avgemcx.exe
FirewallRules: [{0C96C273-C250-4F19-BFA4-9D9137D4895D}] => (Allow) C:\Program Files\AVG\AVG2012\avgemcx.exe
FirewallRules: [TCP Query User{F1307184-6C31-416D-B401-7CF73E54A0C3}C:\wolfgang\teamviewer\teamviewer.exe] => (Block) C:\wolfgang\teamviewer\teamviewer.exe
FirewallRules: [UDP Query User{62304667-39BF-421C-8B34-2B3BF7E13966}C:\wolfgang\teamviewer\teamviewer.exe] => (Block) C:\wolfgang\teamviewer\teamviewer.exe
FirewallRules: [{2F2A8527-3503-4EEA-A7D6-92E35DB00494}] => (Allow) G:\fsetup.exe
FirewallRules: [{8AAAD6F1-29D6-4C12-A2C3-F9054B37269E}] => (Allow) G:\fsetup.exe
FirewallRules: [{8800AC48-1A0A-4402-86C9-4D7377CEE53E}] => (Allow) C:\Users\LISA\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{8DA49D81-7375-4FA7-AFB9-7E24CBA6734E}] => (Allow) C:\Users\LISA\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{27EE8BDA-E7FF-4E30-87A5-AF90F4C38E4D}C:\program files\internet explorer\iexplore.exe] => (Block) C:\program files\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{65A481EB-9FE9-43F1-A1F0-AB539F7FA3B7}C:\program files\internet explorer\iexplore.exe] => (Block) C:\program files\internet explorer\iexplore.exe
FirewallRules: [TCP Query User{A5104C3D-DBF2-4394-817C-AD2B711DADD6}C:\users\LISA\appdata\local\apps\2.0\jqmwgayt.cjk\gqcet5g5.oaa\frit..tion_f8d772dfbb3f7453_0001.0000_b68ab747cee305c3\fritzmini.exe] => (Allow) C:\users\LISA\appdata\local\apps\2.0\jqmwgayt.cjk\gqcet5g5.oaa\frit..tion_f8d772dfbb3f7453_0001.0000_b68ab747cee305c3\fritzmini.exe
FirewallRules: [UDP Query User{A1E7F78A-871F-4517-B388-77FD5B9DD458}C:\users\LISA\appdata\local\apps\2.0\jqmwgayt.cjk\gqcet5g5.oaa\frit..tion_f8d772dfbb3f7453_0001.0000_b68ab747cee305c3\fritzmini.exe] => (Allow) C:\users\LISA\appdata\local\apps\2.0\jqmwgayt.cjk\gqcet5g5.oaa\frit..tion_f8d772dfbb3f7453_0001.0000_b68ab747cee305c3\fritzmini.exe
FirewallRules: [{227C0614-C8CB-4001-B115-AAD4E57D8533}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{FAFBFAAF-6A68-46DB-9A4D-884BE65AAB7A}] => (Allow) C:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [TCP Query User{FF12CD27-E108-4740-B84F-220672498C50}C:\users\LISA\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\LISA\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{713718C9-1894-4F39-92BF-2AC0CABDD659}C:\users\LISA\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\LISA\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{D045E469-D838-48D3-85E4-1634FBF1734A}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{9F209F04-2231-4395-A55A-0DDD6CB5A129}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{E64E06D0-1FD8-415C-A047-F5387ACF8577}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{B3F1FAC7-239C-4F8E-942E-4E914A4E7763}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{C622AD62-2960-462F-9420-66DF5EB1A8DB}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{72A5D9DB-9F58-4D4B-9DFC-9EC97C6C6EDB}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{8C32C589-26C3-451B-A18F-5CB9540B5BD5}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{4AD4EADD-C3E6-4585-A33C-9D6ABE9D4E98}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{EB741C88-7C2E-4AC6-8EB8-3BC6197623B8}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{3CE11B05-932D-44F9-BE82-92D240A152E9}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{450015D1-499F-4CC5-9372-8DE95D20005C}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
FirewallRules: [{4D5B56E4-EFCA-40DD-B81A-8ADFCD4804D7}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{3B696181-DEF5-4527-A8AC-2A1A417F0CEF}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{6904A79B-3C34-47A0-B3BB-C8D56A17721D}C:\program files\videolan\vlc\vlc.exe] => (Allow) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [UDP Query User{45EC918E-1344-404E-90DE-B5267A8CC61D}C:\program files\videolan\vlc\vlc.exe] => (Allow) C:\program files\videolan\vlc\vlc.exe
FirewallRules: [{2C03A0B9-9274-4EFF-B836-206CCA4CC046}] => (Allow) C:\Program Files\BubbleUPnP Server\BubbleUPnPServer.exe
FirewallRules: [{6828776E-6B69-4650-84D5-C039BEBD193D}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{532589C0-BF43-40C6-B74A-E1FBF7C5E7DD}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe
FirewallRules: [{15E2F363-F033-4D0E-8661-957D8194C9F6}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [{73D0AD8F-16C3-41F7-B8B0-D0539A2A8329}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe
FirewallRules: [TCP Query User{457A1018-827F-4F0A-BE33-61FE40FB14C6}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{B55E9A13-2660-4D60-8B8B-017AB7CB8572}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [{1DB4C96B-9E2C-4CCD-9767-6A2441C1155E}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{6F4B12AE-F1DE-421F-BD62-83077C31D24D}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{2A72DD3B-69D3-4695-BA23-FB6B63049DCE}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{4B6C1134-3DE1-4CEB-9BD2-858431074089}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{45609A17-6CFC-4C75-B19C-C9E41A2855DE}] => (Allow) C:\Program Files\AVG\AVG2015\avgnsx.exe
FirewallRules: [{752D5D4F-D84D-4971-9012-97D56DF1DC1B}] => (Allow) C:\Program Files\AVG\AVG2015\avgnsx.exe
FirewallRules: [{12F0D718-D918-455E-BE3E-BDC817B4E9C7}] => (Allow) C:\Program Files\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{9D71418E-4B7D-4B16-8DA7-068E5E416EF0}] => (Allow) C:\Program Files\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{693904F7-0F39-409E-ACE0-7CF255727787}] => (Allow) C:\Program Files\AVG\AVG2015\avgemcx.exe
FirewallRules: [{DB209CBC-2A11-4FC7-BC8A-31FB16690207}] => (Allow) C:\Program Files\AVG\AVG2015\avgemcx.exe
FirewallRules: [{5E363C2D-25F5-4EF6-8456-F0EFB545C47D}] => (Allow) C:\Program Files\AVG\AVG2015\avgnsx.exe
FirewallRules: [{326FAEA1-5778-43D0-A9C7-0D0828F2FE64}] => (Allow) C:\Program Files\AVG\AVG2015\avgnsx.exe
FirewallRules: [{62DDA8AF-6D66-4425-B4B6-8C58AE23AFCE}] => (Allow) C:\Program Files\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{861E59E2-36E5-4596-B283-BE886B75B5E5}] => (Allow) C:\Program Files\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{DB209D3C-78A6-4DE6-B7AE-A25094B35A4F}] => (Allow) C:\Program Files\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{D024151B-EB13-4689-AD67-FB47109E7063}] => (Allow) C:\Program Files\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{1AB17DD5-296B-4C79-B68D-0E2A60DFD4AF}] => (Allow) C:\Program Files\AVG\AVG2015\avgemcx.exe
FirewallRules: [{A2CD7C23-3FA9-4E51-AE22-05A8FC959AB9}] => (Allow) C:\Program Files\AVG\AVG2015\avgemcx.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (09/07/2015 04:46:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4102
Error: (09/07/2015 04:46:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4102
Error: (09/07/2015 04:46:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (09/07/2015 04:46:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3088
Error: (09/07/2015 04:46:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3088
Error: (09/07/2015 04:46:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (09/07/2015 04:46:25 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2090
Error: (09/07/2015 04:46:25 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2090
Error: (09/07/2015 04:46:25 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (09/07/2015 04:46:24 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1060
System errors:
=============
Error: (09/07/2015 01:00:57 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80240020: Upgrade to Windows 10 Pro.
Error: (09/07/2015 12:47:15 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the HomeGroupListener service.
Error: (09/07/2015 01:01:31 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the HP Wireless Assistant Service service.
Error: (09/07/2015 12:17:51 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the RapiMgr service.
Error: (09/06/2015 09:46:25 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80240020: Upgrade to Windows 10 Pro.
Error: (09/05/2015 01:40:34 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80240020: Upgrade to Windows 10 Pro.
Error: (09/04/2015 04:18:02 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80240020: Upgrade to Windows 10 Pro.
Error: (09/04/2015 04:04:43 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the BFE service.
Error: (09/04/2015 11:08:00 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
Error: (09/03/2015 06:13:36 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80240020: Upgrade to Windows 10 Pro.
Microsoft Office:
=========================
Error: (09/07/2015 04:46:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4102
Error: (09/07/2015 04:46:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4102
Error: (09/07/2015 04:46:27 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (09/07/2015 04:46:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3088
Error: (09/07/2015 04:46:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3088
Error: (09/07/2015 04:46:26 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (09/07/2015 04:46:25 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2090
Error: (09/07/2015 04:46:25 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2090
Error: (09/07/2015 04:46:25 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (09/07/2015 04:46:24 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1060
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3 CPU M 350 @ 2.27GHz
Percentage of memory in use: 68%
Total physical RAM: 2927.43 MB
Available physical RAM: 918.22 MB
Total Virtual: 7107.16 MB
Available Virtual: 3484.96 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:280.8 GB) (Free:76.09 GB) NTFS ==>[system with boot components (obtained from reading drive)]
Drive f: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.48 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298.1 GB) (Disk ID: BA1AE47F)
Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=280.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=0C)
==================== End of Addition.txt ============================
|
|
08.09.2015, 23:29
| #4 |
| | Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und crome Gmer hat den Scan abgebrochen, ohne Devices ging es dann Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-09-08 22:57:01
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST932042 rev.0006 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\LISA\AppData\Local\Temp\fxldapow.sys
---- System - GMER 2.1 ----
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwNotifyChangeKey [0x93D1D6F0]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwNotifyChangeMultipleKeys [0x93D1D820]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwOpenProcess [0x93D1D010]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwOpenThread [0x93D1D4E0]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwSuspendProcess [0x93D1D300]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwSuspendThread [0x93D1D3F0]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwTerminateProcess [0x93D1D120]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwTerminateThread [0x93D1D210]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwWriteVirtualMemory [0x93D1D5F0]
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!ZwReplaceKey + 1525 8325AB55 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 83294BB2 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 1357 8329C23C 8 Bytes [F0, D6, D1, 93, 20, D8, D1, ...] {SALC ; RCL DWORD [EBX-0x6c2e27e0], 0x1}
.text ntkrnlpa.exe!KeRemoveQueueEx + 139F 8329C284 4 Bytes [10, D0, D1, 93]
.text ntkrnlpa.exe!KeRemoveQueueEx + 13BF 8329C2A4 4 Bytes [E0, D4, D1, 93]
.text ntkrnlpa.exe!KeRemoveQueueEx + 165F 8329C544 8 Bytes [00, D3, D1, 93, F0, D3, D1, ...] {ADD BL, DL; RCL DWORD [EBX-0x6c2e2c10], 0x1}
.text ntkrnlpa.exe!KeRemoveQueueEx + 166F 8329C554 8 Bytes [20, D1, D1, 93, 10, D2, D1, ...] {AND CL, DL; RCL DWORD [EBX-0x6c2e2df0], 0x1}
.text ...
? C:\windows\System32\Drivers\SafeBoot.sys The process cannot access the file because it is being used by another process.
---- User code sections - GMER 2.1 ----
.text C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe[1380] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe[1380] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe[1380] KERNEL32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe[1836] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe[1836] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe[1836] KERNEL32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\AVG\AVG2015\avgui.exe[2016] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\AVG\AVG2015\avgui.exe[2016] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\AVG\AVG2015\avgui.exe[2016] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\svchost.exe[2184] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\svchost.exe[2184] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\svchost.exe[2184] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe[2368] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe[2368] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe[2368] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe[2408] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe[2408] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe[2408] KERNEL32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\System32\svchost.exe[2468] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\System32\svchost.exe[2468] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\System32\svchost.exe[2468] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2536] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2536] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2536] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\PDF Complete\pdfsvc.exe[2592] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\PDF Complete\pdfsvc.exe[2592] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\PDF Complete\pdfsvc.exe[2592] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\uArcCapture.exe[2832] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\uArcCapture.exe[2832] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\uArcCapture.exe[2832] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[2920] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[2920] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe[2920] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\IDT\WDM\sttray.exe[2944] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\IDT\WDM\sttray.exe[2944] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\IDT\WDM\sttray.exe[2944] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe[3300] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe[3300] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe[3300] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\GWX\GWX.exe[3316] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\GWX\GWX.exe[3316] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\GWX\GWX.exe[3316] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\AVG\AVG2015\avgnsx.exe[3416] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\AVG\AVG2015\avgnsx.exe[3416] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\AVG\AVG2015\avgnsx.exe[3416] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\AVG\AVG2015\avgemcx.exe[3424] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\AVG\AVG2015\avgemcx.exe[3424] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\AVG\AVG2015\avgemcx.exe[3424] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\FRITZ!Fernzugang\certsrv.exe[3532] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\FRITZ!Fernzugang\certsrv.exe[3532] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\FRITZ!Fernzugang\certsrv.exe[3532] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\System32\svchost.exe[3560] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\System32\svchost.exe[3560] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\System32\svchost.exe[3560] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe[3588] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe[3588] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe[3588] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\svchost.exe[3608] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\svchost.exe[3608] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\svchost.exe[3608] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe[3644] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe[3644] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe[3644] KERNEL32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe[3860] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe[3860] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe[3860] KERNEL32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text c:\Program Files\Hewlett-Packard\HP QuickLook\HPDayStarterService.exe[3904] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text c:\Program Files\Hewlett-Packard\HP QuickLook\HPDayStarterService.exe[3904] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text c:\Program Files\Hewlett-Packard\HP QuickLook\HPDayStarterService.exe[3904] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe[3940] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe[3940] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe[3940] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe[3964] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe[3964] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe[3964] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[4000] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[4000] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Common Files\LightScribe\LSSrvc.exe[4000] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4048] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4048] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4048] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\System32\svchost.exe[4084] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\System32\svchost.exe[4084] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\System32\svchost.exe[4084] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Windows\WindowsMobile\wmdc.exe[4108] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Windows\WindowsMobile\wmdc.exe[4108] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Windows\WindowsMobile\wmdc.exe[4108] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\AVG Secure Search\vprot.exe[4176] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\AVG Secure Search\vprot.exe[4176] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\AVG Secure Search\vprot.exe[4176] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Windows\System32\hkcmd.exe[4204] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Windows\System32\hkcmd.exe[4204] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Windows\System32\hkcmd.exe[4204] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\1&1 Surf-Stick\AssistantServices.exe[4256] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\1&1 Surf-Stick\AssistantServices.exe[4256] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\1&1 Surf-Stick\AssistantServices.exe[4256] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\PROGRA~1\VIDEOD~2\bar\1.bin\4zbarsvc.exe[4280] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\PROGRA~1\VIDEOD~2\bar\1.bin\4zbarsvc.exe[4280] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\PROGRA~1\VIDEOD~2\bar\1.bin\4zbarsvc.exe[4280] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.8.0\ToolbarUpdater.exe[4312] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.8.0\ToolbarUpdater.exe[4312] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.8.0\ToolbarUpdater.exe[4312] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Windows\System32\igfxtray.exe[4324] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Windows\System32\igfxtray.exe[4324] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Windows\System32\igfxtray.exe[4324] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.8.0\loggingserver.exe[4376] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.8.0\loggingserver.exe[4376] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.8.0\loggingserver.exe[4376] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\conhost.exe[4384] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\conhost.exe[4384] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\conhost.exe[4384] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe[4400] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe[4400] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe[4400] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Windows\System32\igfxpers.exe[4656] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Windows\System32\igfxpers.exe[4656] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Windows\System32\igfxpers.exe[4656] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[4708] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[4708] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[4708] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe[4720] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe[4720] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe[4720] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[4768] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[4768] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\4zbrmon.exe[4768] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[4792] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[4792] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Common Files\Java\Java Update\jusched.exe[4792] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\iTunes\iTunesHelper.exe[4816] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\iTunes\iTunesHelper.exe[4816] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\iTunes\iTunesHelper.exe[4816] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\APPINTEGRATOR.EXE[4828] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\APPINTEGRATOR.EXE[4828] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\APPINTEGRATOR.EXE[4828] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe[5048] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe[5048] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe[5048] KERNEL32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\wbem\unsecapp.exe[5060] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\wbem\unsecapp.exe[5060] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\wbem\unsecapp.exe[5060] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\wbem\wmiprvse.exe[5076] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\wbem\wmiprvse.exe[5076] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\wbem\wmiprvse.exe[5076] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\wbem\wmiprvse.exe[5176] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\wbem\wmiprvse.exe[5176] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\wbem\wmiprvse.exe[5176] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\1&1 Surf-Stick\UIExec.exe[5264] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\1&1 Surf-Stick\UIExec.exe[5264] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\1&1 Surf-Stick\UIExec.exe[5264] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe[5356] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe[5356] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe[5356] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\HP\HP Software Update\hpwuschd2.exe[5408] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\HP\HP Software Update\hpwuschd2.exe[5408] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\HP\HP Software Update\hpwuschd2.exe[5408] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\svchost.exe[5448] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\svchost.exe[5448] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\svchost.exe[5448] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5560] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5560] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5560] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\servicing\TrustedInstaller.exe[5608] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\servicing\TrustedInstaller.exe[5608] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\servicing\TrustedInstaller.exe[5608] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5680] ntdll.dll!NtCreateFile 775156B0 5 Bytes JMP 0F8C374A C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5680] ntdll.dll!NtFlushBuffersFile 77515A40 5 Bytes JMP 0F8C348A C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5680] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5680] ntdll.dll!NtQueryFullAttributesFile 775160D0 5 Bytes JMP 0F8C35C2 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5680] ntdll.dll!NtReadFile 775163A0 5 Bytes JMP 0F8C34C4 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5680] ntdll.dll!NtReadFileScatter 775163B0 5 Bytes JMP 0FC1CB1D C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5680] ntdll.dll!NtWriteFile 77516B50 5 Bytes JMP 0F8C38EE C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5680] ntdll.dll!NtWriteFileGather 77516B60 5 Bytes JMP 0FC1CB6D C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5680] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5680] ntdll.dll!LdrLoadDll 77532576 5 Bytes JMP 6686A161 C:\Program Files\Mozilla Firefox\mozglue.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5680] kernel32.dll!K32GetDeviceDriverBaseNameW + 5D 7639952E 7 Bytes JMP 0FC0510F C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5680] kernel32.dll!QueryPerformanceCounter + 13 7639C535 7 Bytes JMP 0FC05EF6 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5680] kernel32.dll!LoadAppInitDlls + 355 7639F5F6 7 Bytes JMP 0F98DBC1 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5680] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5680] USER32.dll!GetWindowInfo 76164B5E 5 Bytes JMP 106FE1E3 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5680] GDI32.dll!GetViewportOrgEx + 26C 74AD87DB 7 Bytes JMP 0FC04981 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe[5736] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe[5736] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe[5736] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe[5824] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe[5824] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe[5824] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\System32\rundll32.exe[5924] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\System32\rundll32.exe[5924] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\System32\rundll32.exe[5924] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe[5948] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe[5948] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe[5948] KERNEL32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP HotKey Support\QLBController.exe[5992] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP HotKey Support\QLBController.exe[5992] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP HotKey Support\QLBController.exe[5992] KERNEL32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[6000] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[6000] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[6000] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe[6012] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe[6012] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe[6012] KERNEL32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[6048] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[6048] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[6048] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\File Sanitizer\coreshredder.exe[6096] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\File Sanitizer\coreshredder.exe[6096] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Hewlett-Packard\File Sanitizer\coreshredder.exe[6096] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Skype\Phone\Skype.exe[6124] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Skype\Phone\Skype.exe[6124] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Skype\Phone\Skype.exe[6124] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\1&1 Internet-Radio-Player\phonostarTimer.exe[6248] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\1&1 Internet-Radio-Player\phonostarTimer.exe[6248] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\1&1 Internet-Radio-Player\phonostarTimer.exe[6248] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\svchost.exe[6264] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\svchost.exe[6264] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\svchost.exe[6264] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[6316] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[6316] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[6316] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Users\LISA\AppData\Roaming\Dropbox\bin\Dropbox.exe[6332] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Users\LISA\AppData\Roaming\Dropbox\bin\Dropbox.exe[6332] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Users\LISA\AppData\Roaming\Dropbox\bin\Dropbox.exe[6332] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE[6372] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE[6372] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE[6372] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[6388] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[6388] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[6388] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[6612] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[6612] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\OpenOffice.org 3\program\soffice.exe[6612] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\OpenOffice.org 3\program\soffice.bin[6772] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\OpenOffice.org 3\program\soffice.bin[6772] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\OpenOffice.org 3\program\soffice.bin[6772] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\SearchIndexer.exe[6864] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\SearchIndexer.exe[6864] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\SearchIndexer.exe[6864] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\iPod\bin\iPodService.exe[7040] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\iPod\bin\iPodService.exe[7040] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\iPod\bin\iPodService.exe[7040] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[7468] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[7468] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[7468] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\System32\svchost.exe[7580] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\System32\svchost.exe[7580] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\System32\svchost.exe[7580] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\ctfmon.exe[7732] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\ctfmon.exe[7732] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\ctfmon.exe[7732] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[7888] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[7888] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe[7888] KERNEL32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\taskeng.exe[8104] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\taskeng.exe[8104] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\windows\system32\taskeng.exe[8104] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\AVG\AVG2015\avgcfgex.exe[8492] ntdll.dll!NtMapViewOfSection 77515D10 5 Bytes JMP 6B541920 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\AVG\AVG2015\avgcfgex.exe[8492] ntdll.dll!NtWriteVirtualMemory 77516B80 5 Bytes JMP 6B5415D0 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\AVG\AVG2015\avgcfgex.exe[8492] kernel32.dll!CreateProcessInternalW 763A08A2 5 Bytes JMP 6B541700 C:\Program Files\AVG\AVG2015\avghookx.dll
---- Threads - GMER 2.1 ----
Thread System [4:564] 9712AE28
Thread System [4:568] 95F8C83C
Thread System [4:572] 9476DBB8
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002713cfb82a
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002713cfb82a@001a7db0013b 0xBA 0x71 0xE0 0x24 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002713cfb82a@00123d004c4c 0xC9 0x66 0xAC 0x0C ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002713da1aa0
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002713cfb82a (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002713cfb82a@001a7db0013b 0xBA 0x71 0xE0 0x24 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002713cfb82a@00123d004c4c 0xC9 0x66 0xAC 0x0C ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002713da1aa0 (not active ControlSet)
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active@304239A9 1358
---- EOF - GMER 2.1 ----
Wolfgang |
|
09.09.2015, 17:46
| #5 |
| /// the machine /// TB-Ausbilder    | Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und crome hi, Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Windows 7: gotut.ru als Startseite beim Firefox, IExplorer und crome |
| administrator, adobe, antivirus, avg, avg security toolbar, bonjour, browser, cid, explorer, firefox, geänderte startseite, google, home, homepage, mozilla, pdf, popup, registry, rundll, scan, secure search, security, server, software, symantec, system, usb, windows |
dann auf 
und dann auf 
. 
WARNUNG an die MITLESER: 
Linear-Darstellung
