Kein Zugriff auf Google Kontoeinstellungen mit Firefox

OTL logfile created on: 30.08.2012 17:53:57 - Run 2
OTL by OldTimer - Version 3.2.59.1     Folder = D:\Dokumente und Einstellungen\***\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,97 Gb Total Physical Memory | 2,51 Gb Available Physical Memory | 84,78% Memory free
4,81 Gb Paging File | 4,59 Gb Available in Paging File | 95,42% Paging File free
Paging file location(s): D:\pagefile.sys 2046 2046 [binary data]
 
%SystemDrive% = D: | %SystemRoot% = D:\WINDOWS | %ProgramFiles% = D:\Programme
Drive C: | 29,29 Gb Total Space | 19,30 Gb Free Space | 65,87% Space Free | Partition Type: NTFS
Drive D: | 43,95 Gb Total Space | 21,90 Gb Free Space | 49,83% Space Free | Partition Type: NTFS
Drive E: | 224,84 Gb Total Space | 111,90 Gb Free Space | 49,77% Space Free | Partition Type: NTFS
 
Computer Name: CHANGEME | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.08.30 15:21:31 | 000,598,528 | ---- | M] (OldTimer Tools) -- D:\Dokumente und Einstellungen\***\Desktop\OTL.exe
PRC - [2012.08.21 11:12:26 | 004,282,728 | ---- | M] (AVAST Software) -- D:\Programme\Alwil Software\Avast5\AvastUI.exe
PRC - [2012.08.21 11:12:25 | 000,044,808 | ---- | M] (AVAST Software) -- D:\Programme\Alwil Software\Avast5\AvastSvc.exe
PRC - [2012.07.05 22:07:00 | 000,161,704 | ---- | M] (Oracle Corporation) -- D:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
PRC - [2012.01.17 11:07:54 | 000,252,296 | ---- | M] (Sun Microsystems, Inc.) -- D:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2009.06.10 06:42:00 | 008,568,832 | ---- | M] (ASUS) -- D:\Programme\ASUS\ATKOSD2\ATKOSD2.exe
PRC - [2009.04.23 18:54:44 | 000,178,744 | ---- | M] (ASUS) -- D:\Programme\ASUS\ATK Hotkey\HControl.exe
PRC - [2009.04.01 18:35:34 | 000,098,304 | ---- | M] (ASUS) -- D:\Programme\ASUS\ATK Hotkey\HControlUser.exe
PRC - [2008.12.22 14:45:34 | 000,174,648 | ---- | M] (ASUS) -- D:\Programme\ASUS\ATK Hotkey\WDC.exe
PRC - [2008.08.13 13:51:56 | 002,482,176 | ---- | M] (ASUS) -- D:\Programme\ASUS\ATK Hotkey\ATKOSD.exe
PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- D:\WINDOWS\explorer.exe
PRC - [2007.08.07 21:38:40 | 000,094,208 | ---- | M] () -- D:\Programme\ATKGFNEX\GFNEXSrv.exe
PRC - [2003.06.19 20:55:00 | 000,322,120 | ---- | M] (Microsoft Corporation) -- D:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.08.30 11:38:21 | 001,805,312 | ---- | M] () -- D:\Programme\Alwil Software\Avast5\defs\12083000\algo.dll
MOD - [2007.08.07 21:38:40 | 000,094,208 | ---- | M] () -- D:\Programme\ATKGFNEX\GFNEXSrv.exe
MOD - [2006.08.23 21:02:26 | 000,163,840 | ---- | M] () -- D:\Programme\ASUS\ATK Hotkey\ASUSNet.dll
MOD - [2005.01.06 16:03:30 | 000,116,224 | ---- | M] () -- D:\WINDOWS\system32\redmonnt.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2012.08.29 07:09:32 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- D:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.08.27 17:48:05 | 000,250,568 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- D:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.08.21 11:12:25 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- D:\Programme\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012.07.05 22:07:00 | 000,161,704 | ---- | M] (Oracle Corporation) [Auto | Running] -- D:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2009.11.07 00:33:33 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- D:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2007.08.07 21:38:40 | 000,094,208 | ---- | M] () [Auto | Running] -- D:\Programme\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)
SRV - [2003.07.28 09:58:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- D:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2003.06.19 20:55:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- D:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- F:\I386\AsProcOb.sys -- (ASUSProcObsrv)
DRV - File not found [Kernel | On_Demand | Unknown] -- D:\DOKUME~1\PHILLI~1\LOKALE~1\Temp\agtcqpow.sys -- (agtcqpow)
DRV - [2012.08.21 11:13:15 | 000,729,752 | ---- | M] (AVAST Software) [File_System | System | Running] -- D:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012.08.21 11:13:15 | 000,355,632 | ---- | M] (AVAST Software) [Kernel | System | Running] -- D:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012.08.21 11:13:15 | 000,054,232 | ---- | M] (AVAST Software) [Kernel | System | Running] -- D:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012.08.21 11:13:14 | 000,097,608 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- D:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2012.08.21 11:13:14 | 000,035,928 | ---- | M] (AVAST Software) [Kernel | System | Running] -- D:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2012.08.21 11:13:13 | 000,025,256 | ---- | M] (AVAST Software) [Kernel | System | Running] -- D:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2012.08.21 11:13:13 | 000,021,256 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- D:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2009.03.20 08:21:28 | 001,057,280 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- D:\WINDOWS\system32\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV - [2009.02.13 15:30:02 | 001,503,840 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- D:\WINDOWS\system32\drivers\athw.sys -- (AR5416)
DRV - [2008.12.16 08:12:48 | 000,038,400 | R--- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- D:\WINDOWS\system32\drivers\l1e51x86.sys -- (L1e)
DRV - [2008.09.26 15:36:24 | 000,129,824 | ---- | M] (Paragon) [Kernel | System | Running] -- D:\WINDOWS\system32\drivers\Uim_IM.sys -- (Uim_IM)
DRV - [2008.09.26 15:36:24 | 000,040,496 | ---- | M] (Paragon Software Group) [Kernel | Boot | Running] -- D:\WINDOWS\system32\drivers\hotcore3.sys -- (hotcore3)
DRV - [2008.09.26 15:36:24 | 000,032,048 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | System | Running] -- D:\WINDOWS\system32\drivers\UimBus.sys -- (UimBus)
DRV - [2008.02.14 08:12:00 | 001,389,056 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- D:\WINDOWS\system32\drivers\monfilt.sys -- (monfilt)
DRV - [2007.08.24 11:46:48 | 000,005,760 | R--- | M] () [Kernel | On_Demand | Running] -- D:\WINDOWS\system32\drivers\ATKACPI.sys -- (MTsensor)
DRV - [2007.07.24 08:39:04 | 000,013,880 | ---- | M] () [Kernel | Auto | Running] -- D:\Programme\ATKGFNEX\ASMMAP.sys -- (ASMMAP)
DRV - [2004.05.27 15:43:04 | 000,016,269 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] -- D:\Programme\ASUS\ATK Hotkey\ASNDIS5.SYS -- (ASNDIS5)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.ask.com?o=102869&l=dis&gct=hp
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{26A911E9-9C56-47BA-9E34-02ED63E7E2B1}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=MYC-ST&o=102869&src=crm&q={searchTerms}&locale=&apn_ptnrs=5J&apn_dtid=YYYYYYYYDE&apn_uid=603ee7d1-2476-408c-a46e-7e1631f87322&apn_sauid=AA8F0C52-B213-44EC-90AA-2682FA9BF5BB
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Wikipedia (de)"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..extensions.enabledItems: {8AA36F4F-6DC7-4c06-77AF-5035170634FE}:2010.01.21
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: D:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: D:\Programme\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: D:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: D:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: D:\Programme\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: D:\Programme\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: D:\Programme\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: D:\Programme\Veetle\Player\npvlc.dll (Veetle Inc)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{EB132DB0-A4CA-11DF-9732-0E29E0D72085}: D:\Programme\Object\facetheme [2011.07.21 20:16:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\wrc@avast.com: D:\Programme\Alwil Software\Avast5\WebRep\FF [2012.08.26 16:09:03 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: D:\Programme\Mozilla Firefox\components [2012.08.29 07:09:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: D:\Programme\Mozilla Firefox\plugins [2012.08.12 23:07:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: D:\Programme\Mozilla Thunderbird\components [2012.06.19 22:58:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: D:\Programme\Mozilla Thunderbird\plugins [2010.06.28 10:45:16 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{EB132DB0-A4CA-11DF-9732-0E29E0D72085}: D:\Programme\Object\facetheme [2011.07.21 20:16:23 | 000,000,000 | ---D | M]
 
[2010.09.04 16:02:53 | 000,000,000 | ---D | M] (No name found) -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Extensions
[2010.09.04 16:02:53 | 000,000,000 | ---D | M] (No name found) -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.07.26 13:39:28 | 000,000,000 | ---D | M] (No name found) -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\3ki1nwps.default\extensions
[2011.05.14 15:42:38 | 000,000,000 | ---D | M] (Gutscheinrausch.de) -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\3ki1nwps.default\extensions\rfdyfbya.g0i
[2011.05.14 15:41:44 | 000,000,000 | ---D | M] (Gutscheinrausch.de) -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\3ki1nwps.default\extensions\uc1dcelk.fkn
[2011.05.03 17:21:18 | 000,002,400 | ---- | M] () -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\3ki1nwps.default\searchplugins\askcom.xml
[2012.04.30 16:42:19 | 000,000,000 | ---D | M] (No name found) -- D:\Programme\Mozilla Firefox\extensions
[2009.12.10 15:39:06 | 000,000,000 | ---D | M] ("Citavi Picker") -- D:\Programme\Mozilla Firefox\extensions\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}
[2012.08.26 16:09:03 | 000,000,000 | ---D | M] (avast! WebRep) -- D:\PROGRAMME\ALWIL SOFTWARE\AVAST5\WEBREP\FF
[2012.08.29 07:09:33 | 000,266,720 | ---- | M] (Mozilla Foundation) -- D:\Programme\mozilla firefox\components\browsercomps.dll
[2010.06.28 10:44:32 | 000,075,208 | ---- | M] (Foxit Software Company) -- D:\Programme\mozilla firefox\plugins\npFoxitReaderPlugin.dll
[2012.06.21 18:18:03 | 000,001,392 | ---- | M] () -- D:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.29 07:09:31 | 000,002,465 | ---- | M] () -- D:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.06.21 18:18:03 | 000,001,153 | ---- | M] () -- D:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.21 18:18:03 | 000,006,805 | ---- | M] () -- D:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.21 18:18:03 | 000,001,178 | ---- | M] () -- D:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.21 18:18:03 | 000,001,105 | ---- | M] () -- D:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.11.07 00:26:07 | 000,001,879 | ---- | M]) - D:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - D:\Programme\facemoods.com\facemoods\1.4.17.8\bh\facemoods.dll (facemoods.com BHO)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programme\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Facetheme) - {cbc5b60a-aa4d-45f6-84c2-d086f320299a} - D:\Programme\Object\bho_project.dll (InternetEngine)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\Programme\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - D:\Programme\facemoods.com\facemoods\1.4.17.8\facemoodsTlbr.dll (facemoods.com)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [ATKHOTKEY] D:\Programme\ASUS\ATK Hotkey\HControl.exe (ASUS)
O4 - HKLM..\Run: [ATKOSD2] D:\Programme\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [avast5] D:\Programme\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [HControlUser] D:\Programme\ASUS\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [SunJavaUpdateSched] D:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [4E3E0230AEBB4E96] D:\Recycle.Bin\Recycle.Bin.exe File not found
O4 - Startup: D:\Dokumente und Einstellungen\***\Startmenü\Programme\Autostart\Dropbox.lnk = D:\Dokumente und Einstellungen\***\Anwendungsdaten\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - D:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (D:\WINDOWS\system32\userinit.exe) - D:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.11.07 06:10:25 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{3cd9ccfa-e15f-11e1-a19d-1c4bd632b370}\Shell\AutoRun\command - "" = H:\UL2YTUBE.EXE
O33 - MountPoints2\{5de1fe9c-eb56-11de-96b2-1c4bd632b370}\Shell\AutoRun\command - "" = G:\Setup_FlipShare.exe
O33 - MountPoints2\{5de1fe9c-eb56-11de-96b2-1c4bd632b370}\Shell\Setup FlipShare\command - "" = G:\Setup_FlipShare.exe
O33 - MountPoints2\{9cb8822c-aefb-11e1-a101-1c4bd632b370}\Shell\AutoRun\command - "" = G:\ActivateWarranty(JF).exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.30 15:21:30 | 000,598,528 | ---- | C] (OldTimer Tools) -- D:\Dokumente und Einstellungen\***\Desktop\OTL.exe
[2012.08.29 12:12:28 | 000,000,000 | ---D | C] -- D:\WINDOWS\RegisteredPackages
[2012.08.12 23:08:01 | 000,000,000 | ---D | C] -- D:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Sun
[2012.08.12 23:07:52 | 000,000,000 | ---D | C] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sun
[2012.08.12 23:07:52 | 000,000,000 | ---D | C] -- D:\Programme\Gemeinsame Dateien\Java
[2012.08.12 23:07:32 | 000,000,000 | ---D | C] -- D:\Programme\Oracle
[2012.08.12 23:07:31 | 000,000,000 | ---D | C] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\Oracle
[2011.07.01 22:07:09 | 007,760,687 | ---- | C] (Boraxsoft) -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\SetupGFD.exe
[2011.07.01 22:06:54 | 004,284,535 | ---- | C] (ffdshow                                                     ) -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\ffdshow.exe
[2011.07.01 22:06:52 | 000,642,685 | ---- | C] (Xvid team                                                   ) -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\xvid.exe
[2011.07.01 22:06:47 | 005,514,668 | ---- | C] (LIGHTNING UK!) -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\Imgburn.exe
[2011.07.01 22:06:41 | 004,182,178 | ---- | C] (The Public) -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\Avisynth.exe
[3 D:\WINDOWS\*.tmp files -> D:\WINDOWS\*.tmp -> ]
[1 D:\WINDOWS\System32\*.tmp files -> D:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.30 17:08:10 | 000,001,106 | ---- | M] () -- D:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.30 17:02:00 | 000,000,884 | ---- | M] () -- D:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.08.30 16:10:00 | 000,000,310 | -H-- | M] () -- D:\WINDOWS\tasks\avast! Emergency Update.job
[2012.08.30 15:37:17 | 000,001,102 | ---- | M] () -- D:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.30 15:37:11 | 000,002,048 | --S- | M] () -- D:\WINDOWS\bootstat.dat
[2012.08.30 15:26:01 | 000,000,000 | ---- | M] () -- D:\Dokumente und Einstellungen\***\defogger_reenable
[2012.08.30 15:22:01 | 000,302,592 | ---- | M] () -- D:\Dokumente und Einstellungen\***\Desktop\fb79hxu6.exe
[2012.08.30 15:21:31 | 000,598,528 | ---- | M] (OldTimer Tools) -- D:\Dokumente und Einstellungen\***\Desktop\OTL.exe
[2012.08.30 15:20:54 | 000,050,477 | ---- | M] () -- D:\Dokumente und Einstellungen\***\Desktop\Defogger.exe
[2012.08.30 15:18:36 | 000,002,206 | ---- | M] () -- D:\WINDOWS\System32\wpa.dbl
[2012.08.29 12:39:52 | 000,055,808 | ---- | M] () -- D:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.08.28 17:12:08 | 002,260,672 | ---- | M] () -- D:\WINDOWS\System32\FNTCACHE.DAT
[2012.08.28 15:17:40 | 000,028,898 | ---- | M] () -- D:\Dokumente und Einstellungen\***\Desktop\DGK.JPG
[2012.08.27 11:54:28 | 000,182,258 | ---- | M] () -- D:\Dokumente und Einstellungen\***\Desktop\flyer.JPG
[2012.08.26 16:09:04 | 000,003,002 | ---- | M] () -- D:\WINDOWS\System32\CONFIG.NT
[2012.08.21 11:13:15 | 000,729,752 | ---- | M] (AVAST Software) -- D:\WINDOWS\System32\drivers\aswSnx.sys
[2012.08.21 11:13:15 | 000,355,632 | ---- | M] (AVAST Software) -- D:\WINDOWS\System32\drivers\aswSP.sys
[2012.08.21 11:13:15 | 000,054,232 | ---- | M] (AVAST Software) -- D:\WINDOWS\System32\drivers\aswTdi.sys
[2012.08.21 11:13:14 | 000,097,608 | ---- | M] (AVAST Software) -- D:\WINDOWS\System32\drivers\aswmon2.sys
[2012.08.21 11:13:14 | 000,089,624 | ---- | M] (AVAST Software) -- D:\WINDOWS\System32\drivers\aswmon.sys
[2012.08.21 11:13:14 | 000,035,928 | ---- | M] (AVAST Software) -- D:\WINDOWS\System32\drivers\aswRdr.sys
[2012.08.21 11:13:13 | 000,025,256 | ---- | M] (AVAST Software) -- D:\WINDOWS\System32\drivers\aavmker4.sys
[2012.08.21 11:13:13 | 000,021,256 | ---- | M] (AVAST Software) -- D:\WINDOWS\System32\drivers\aswFsBlk.sys
[2012.08.21 11:12:33 | 000,041,224 | ---- | M] (AVAST Software) -- D:\WINDOWS\avastSS.scr
[2012.08.21 11:12:23 | 000,227,648 | ---- | M] (AVAST Software) -- D:\WINDOWS\System32\aswBoot.exe
[3 D:\WINDOWS\*.tmp files -> D:\WINDOWS\*.tmp -> ]
[1 D:\WINDOWS\System32\*.tmp files -> D:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.08.30 15:26:01 | 000,000,000 | ---- | C] () -- D:\Dokumente und Einstellungen\***\defogger_reenable
[2012.08.30 15:22:01 | 000,302,592 | ---- | C] () -- D:\Dokumente und Einstellungen\***\Desktop\fb79hxu6.exe
[2012.08.30 15:20:54 | 000,050,477 | ---- | C] () -- D:\Dokumente und Einstellungen\***\Desktop\Defogger.exe
[2012.08.28 15:17:40 | 000,028,898 | ---- | C] () -- D:\Dokumente und Einstellungen\***\Desktop\DGK.JPG
[2012.08.27 11:54:28 | 000,182,258 | ---- | C] () -- D:\Dokumente und Einstellungen\***\Desktop\flyer.JPG
[2012.08.13 19:18:17 | 000,000,884 | ---- | C] () -- D:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2011.07.01 22:07:03 | 005,243,208 | ---- | C] (                                                            ) -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\AvsP.exe
[2011.06.02 12:48:11 | 000,000,040 | -HS- | C] () -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\.zreglib
[2011.05.13 14:11:27 | 000,765,952 | ---- | C] () -- D:\WINDOWS\System32\xvidcore.dll
[2011.05.13 14:11:26 | 000,180,224 | ---- | C] () -- D:\WINDOWS\System32\xvidvfw.dll
[2011.02.20 20:17:50 | 000,111,932 | ---- | C] () -- D:\WINDOWS\System32\EPPICPrinterDB.dat
[2011.02.20 20:17:50 | 000,031,053 | ---- | C] () -- D:\WINDOWS\System32\EPPICPattern131.dat
[2011.02.20 20:17:50 | 000,027,417 | ---- | C] () -- D:\WINDOWS\System32\EPPICPattern121.dat
[2011.02.20 20:17:50 | 000,026,154 | ---- | C] () -- D:\WINDOWS\System32\EPPICPattern1.dat
[2011.02.20 20:17:50 | 000,024,903 | ---- | C] () -- D:\WINDOWS\System32\EPPICPattern3.dat
[2011.02.20 20:17:50 | 000,021,390 | ---- | C] () -- D:\WINDOWS\System32\EPPICPattern5.dat
[2011.02.20 20:17:50 | 000,020,148 | ---- | C] () -- D:\WINDOWS\System32\EPPICPattern2.dat
[2011.02.20 20:17:50 | 000,011,811 | ---- | C] () -- D:\WINDOWS\System32\EPPICPattern4.dat
[2011.02.20 20:17:50 | 000,004,943 | ---- | C] () -- D:\WINDOWS\System32\EPPICPattern6.dat
[2011.02.20 20:17:50 | 000,001,146 | ---- | C] () -- D:\WINDOWS\System32\EPPICPresetData_DU.dat
[2011.02.20 20:17:50 | 000,001,139 | ---- | C] () -- D:\WINDOWS\System32\EPPICPresetData_PT.dat
[2011.02.20 20:17:50 | 000,001,139 | ---- | C] () -- D:\WINDOWS\System32\EPPICPresetData_BP.dat
[2011.02.20 20:17:50 | 000,001,136 | ---- | C] () -- D:\WINDOWS\System32\EPPICPresetData_ES.dat
[2011.02.20 20:17:50 | 000,001,129 | ---- | C] () -- D:\WINDOWS\System32\EPPICPresetData_FR.dat
[2011.02.20 20:17:50 | 000,001,129 | ---- | C] () -- D:\WINDOWS\System32\EPPICPresetData_CF.dat
[2011.02.20 20:17:50 | 000,001,120 | ---- | C] () -- D:\WINDOWS\System32\EPPICPresetData_IT.dat
[2011.02.20 20:17:50 | 000,001,107 | ---- | C] () -- D:\WINDOWS\System32\EPPICPresetData_GE.dat
[2011.02.20 20:17:50 | 000,001,104 | ---- | C] () -- D:\WINDOWS\System32\EPPICPresetData_EN.dat
[2011.02.20 20:17:50 | 000,000,097 | ---- | C] () -- D:\WINDOWS\System32\PICSDK.ini
[2010.12.28 15:10:15 | 000,000,159 | ---- | C] () -- D:\WINDOWS\ChssBase.ini
[2010.11.20 10:46:40 | 000,000,069 | ---- | C] () -- D:\WINDOWS\NeroDigital.ini
[2010.11.07 20:28:25 | 000,000,026 | ---- | C] () -- D:\WINDOWS\neosetup.INI
[2009.12.27 19:10:40 | 000,209,504 | ---- | C] () -- D:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2009.12.11 15:38:02 | 000,055,808 | ---- | C] () -- D:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.11.07 01:05:10 | 000,000,604 | -H-- | C] () -- D:\Programme\STLL Notifier
 
========== LOP Check ==========
 
[2010.04.11 12:04:27 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Alwil Software
[2009.11.07 00:19:07 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BIFAB
[2011.12.09 19:25:46 | 000,000,000 | -H-D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonBJ
[2011.12.09 19:36:50 | 000,000,000 | -H-D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonEPP
[2011.12.12 17:53:34 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJ
[2011.12.09 19:44:18 | 000,000,000 | -H-D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJEGV
[2011.12.09 19:37:23 | 000,000,000 | -H-D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJEPPEX
[2011.12.09 19:36:50 | 000,000,000 | -H-D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJEPPEX2
[2011.12.09 19:29:44 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJMSetup
[2011.12.09 19:36:48 | 000,000,000 | -H-D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJMyPrinter
[2011.12.12 17:50:29 | 000,000,000 | -H-D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJScan
[2011.12.09 19:36:51 | 000,000,000 | -H-D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJSolutionMenuEX
[2011.12.09 19:28:57 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJWSpt
[2011.05.14 18:00:02 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\clone.AD
[2011.02.20 20:17:16 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON
[2009.11.14 17:51:21 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FreePDF
[2010.12.07 17:19:39 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GARMIN
[2010.08.19 21:39:22 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\KETTLER
[2011.07.01 21:08:35 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX
[2011.06.02 12:48:17 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SlySoft
[2012.06.06 17:31:58 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2010.05.10 11:37:58 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\Academic Software Zurich
[2011.12.12 17:50:29 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\Canon
[2012.07.16 19:55:54 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\ChessBase
[2012.08.30 15:37:18 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\Dropbox
[2011.06.26 12:28:43 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\EPSON
[2011.08.29 12:53:17 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\facemoods.com
[2011.07.04 19:53:35 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\FFRend
[2011.09.11 15:42:36 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\FileZilla
[2009.11.07 00:09:40 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\Foxit
[2010.01.28 11:39:00 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\Foxit Software
[2010.12.07 17:19:40 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\GARMIN
[2011.07.02 11:48:16 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\ImgBurn
[2011.06.03 14:20:34 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\Izot
[2011.07.01 21:08:35 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\MAGIX
[2011.05.03 16:50:32 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\ManyCam
[2009.11.08 19:06:49 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\OpenOffice.org
[2012.08.12 23:07:31 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\Oracle
[2012.06.12 15:43:04 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\PhotoFiltre 7
[2010.05.16 22:54:12 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\Radmin
[2009.12.27 19:04:47 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\Sony Setup
[2010.09.04 16:02:50 | 000,000,000 | ---D | M] -- D:\Dokumente und Einstellungen\***\Anwendungsdaten\Thunderbird
[2012.08.30 16:10:00 | 000,000,310 | -H-- | M] () -- D:\WINDOWS\Tasks\avast! Emergency Update.job
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 128 bytes -> D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:C8B8CEBD

< End of report >
         

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-08-30 20:18:08
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST932032 rev.0002
Running: fb79hxu6.exe; Driver: D:\DOKUME~1\PHILLI~1\LOKALE~1\Temp\agtcqpow.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwAddBootEntry [0x9B2F1708]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                        ZwAllocateVirtualMemory [0xA01597C8]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwAssignProcessToJobObject [0x9B2F211C]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwClose [0x9B333401]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwCreateEvent [0x9B2FCF28]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwCreateEventPair [0x9B2FCF74]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwCreateIoCompletion [0x9B2FD0F6]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwCreateKey [0x9B332DB5]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwCreateMutant [0x9B2FCE96]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwCreateSection [0x9B2FCFB8]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwCreateSemaphore [0x9B2FCEDE]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwCreateThread [0x9B2F2310]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwCreateTimer [0x9B2FD0B0]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwDebugActiveProcess [0x9B2F2A9C]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwDeleteBootEntry [0x9B2F1756]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwDeleteKey [0x9B333AC7]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwDeleteValueKey [0x9B333D7D]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwDuplicateObject [0x9B2F60E4]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwEnumerateKey [0x9B333932]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwEnumerateValueKey [0x9B33379D]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                        ZwFreeVirtualMemory [0xA01598AC]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwLoadDriver [0x9B2F13BE]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwModifyBootEntry [0x9B2F17A4]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwNotifyChangeKey [0x9B2F6456]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwNotifyChangeMultipleKeys [0x9B2F3464]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwOpenEvent [0x9B2FCF52]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwOpenEventPair [0x9B2FCF96]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwOpenIoCompletion [0x9B2FD11A]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwOpenKey [0x9B333111]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwOpenMutant [0x9B2FCEBC]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwOpenProcess [0x9B2F5C5A]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwOpenSection [0x9B2FD03A]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwOpenSemaphore [0x9B2FCF06]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwOpenThread [0x9B2F5E8C]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwOpenTimer [0x9B2FD0D4]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                        ZwProtectVirtualMemory [0xA0159A2C]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwQueryKey [0x9B333618]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwQueryObject [0x9B2F3330]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwQueryValueKey [0x9B33346A]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwQueueApcThread [0x9B2F2EDA]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                        ZwRenameKey [0xA016530E]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwRestoreKey [0x9B332428]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwSetBootEntryOrder [0x9B2F17F2]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwSetBootOptions [0x9B2F1840]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwSetContextThread [0x9B2F291C]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwSetSystemInformation [0x9B2F1448]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwSetSystemPowerState [0x9B2F15F8]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwSetValueKey [0x9B333BCE]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwShutdownSystem [0x9B2F159E]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwSuspendProcess [0x9B2F2BFE]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwSuspendThread [0x9B2F2D5A]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwSystemDebugControl [0x9B2F1668]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwTerminateProcess [0x9B2F2632]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwTerminateThread [0x9B2F2794]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwVdmControl [0x9B2F188E]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                        ZwWriteVirtualMemory [0x9B2F2160]

Code            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                        ZwCreateProcessEx [0xA0171966]
Code            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                        ObInsertObject
Code            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                        ObMakeTemporaryObject

---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!ZwCallbackReturn + 2C99                                                                         80504535 7 Bytes  [23, 2F, 9B, B0, D0, 2F, 9B] {AND EBP, [EDI]; WAIT ; MOV AL, 0xd0; DAS ; WAIT }
.text           ntkrnlpa.exe!ZwCallbackReturn + 2F10                                                                         805047AC 12 Bytes  [F2, 17, 2F, 9B, 40, 18, 2F, ...]
.text           ntkrnlpa.exe!ZwCallbackReturn + 2FB8                                                                         80504854 12 Bytes  [FE, 2B, 2F, 9B, 5A, 2D, 2F, ...]
PAGE            ntkrnlpa.exe!ZwReplyWaitReceivePortEx + 5EC                                                                  805A64B8 4 Bytes  CALL 9B2F3AF1 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
PAGE            ntkrnlpa.exe!ObMakeTemporaryObject                                                                           805BC54A 5 Bytes  JMP A016E806 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE            ntkrnlpa.exe!ObInsertObject                                                                                  805C2FCE 5 Bytes  JMP A0170320 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE            ntkrnlpa.exe!ZwCreateProcessEx                                                                               805D1172 7 Bytes  JMP A017196A \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
init            D:\WINDOWS\system32\drivers\monfilt.sys                                                                      entry point in "init" section [0xA0413280]
.text           win32k.sys!EngFreeUserMem + 674                                                                              BF80997F 5 Bytes  JMP 9B2F7A6E \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!EngFreeUserMem + 35D0                                                                             BF80C8DB 5 Bytes  JMP 9B2F795E \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!EngDeleteSurface + 45                                                                             BF81396E 5 Bytes  JMP 9B2F7918 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!BRUSHOBJ_pvAllocRbrush + 11F0                                                                     BF81C797 5 Bytes  JMP 9B2F6FCA \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!EngSetLastError + 7786                                                                            BF8240E5 5 Bytes  JMP 9B2F66E6 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!EngCreateBitmap + 1F5D                                                                            BF834E73 5 Bytes  JMP 9B2F7BD8 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!EngCreateBitmap + 39FF                                                                            BF836915 5 Bytes  JMP 9B2F7DE0 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!EngCreateBitmap + CED2                                                                            BF83FDE8 5 Bytes  JMP 9B2F781E \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!EngCreateBitmap + 10746                                                                           BF84365C 5 Bytes  JMP 9B2F6FB2 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!EngStretchBlt + 37BB                                                                              BF8504B5 5 Bytes  JMP 9B2F79A8 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!EngStretchBlt + 41E3                                                                              BF850EDD 5 Bytes  JMP 9B2F708C \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!EngStretchBlt + 42A3                                                                              BF850F9D 2 Bytes  JMP 9B2F6592 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!EngStretchBlt + 42A6                                                                              BF850FA0 2 Bytes  [AA, DB]
.text           win32k.sys!EngGetCurrentCodePage + 3617                                                                      BF86DE73 5 Bytes  JMP 9B2F6C00 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!EngGetCurrentCodePage + 413A                                                                      BF86E996 5 Bytes  JMP 9B2F6DC0 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!EngGetLastError + 1606                                                                            BF88BC0F 5 Bytes  JMP 9B2F70A4 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!EngGradientFill + 3FB4                                                                            BF890A80 5 Bytes  JMP 9B2F7B20 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!EngStretchBltROP + 607D                                                                           BF897052 5 Bytes  JMP 9B2F65AA \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!FONTOBJ_pxoGetXform + 5959                                                                        BF8B52F1 5 Bytes  JMP 9B2F6756 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!FONTOBJ_pxoGetXform + A8E8                                                                        BF8BA280 5 Bytes  JMP 9B2F6B40 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!FONTOBJ_pxoGetXform + A973                                                                        BF8BA30B 5 Bytes  JMP 9B2F6E06 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!FONTOBJ_pxoGetXform + E62A                                                                        BF8BDFC2 5 Bytes  JMP 9B2F7D3E \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!EngAlphaBlend + 1A08                                                                              BF8C3153 5 Bytes  JMP 9B2F6866 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!PATHOBJ_vGetBounds + 5039                                                                         BF8EDBC3 5 Bytes  JMP 9B2F693E \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!PATHOBJ_vGetBounds + 52B9                                                                         BF8EDE43 4 Bytes  JMP 9B2F6A6A \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!PATHOBJ_vGetBounds + 74DF                                                                         BF8F0069 5 Bytes  JMP 9B2F648C \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!PATHOBJ_vGetBounds + EDBC                                                                         BF8F7946 5 Bytes  JMP 9B2F6FE2 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!EngCreateClip + 19C1                                                                              BF912A7E 5 Bytes  JMP 9B2F6682 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!EngCreateClip + 2595                                                                              BF913652 5 Bytes  JMP 9B2F6812 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!EngCreateClip + 4EF4                                                                              BF915FB1 5 Bytes  JMP 9B2F6F20 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text           win32k.sys!EngPlgBlt + 18FC                                                                                  BF943EFD 5 Bytes  JMP 9B2F7C96 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)

---- User code sections - GMER 1.0.15 ----

.text           D:\WINDOWS\system32\hkcmd.exe[496] ntdll.dll!RtlDosSearchPath_U + 1D1                                        7C926ADA 1 Byte  [62]
.text           D:\WINDOWS\system32\hkcmd.exe[496] kernel32.dll!GetBinaryTypeW + 80                                          7C86936C 1 Byte  [62]
.text           D:\Programme\ASUS\ATK Hotkey\HControlUser.exe[528] ntdll.dll!RtlDosSearchPath_U + 1D1                        7C926ADA 1 Byte  [62]
.text           D:\Programme\ASUS\ATK Hotkey\HControlUser.exe[528] kernel32.dll!GetBinaryTypeW + 80                          7C86936C 1 Byte  [62]
.text           D:\Programme\ASUS\ATK Hotkey\HControl.exe[536] ntdll.dll!RtlDosSearchPath_U + 1D1                            7C926ADA 1 Byte  [62]
.text           D:\Programme\ASUS\ATK Hotkey\HControl.exe[536] kernel32.dll!GetBinaryTypeW + 80                              7C86936C 1 Byte  [62]
.text           D:\Programme\ASUS\ATKOSD2\ATKOSD2.exe[544] ntdll.dll!RtlDosSearchPath_U + 1D1                                7C926ADA 1 Byte  [62]
.text           D:\Programme\ASUS\ATKOSD2\ATKOSD2.exe[544] kernel32.dll!GetBinaryTypeW + 80                                  7C86936C 1 Byte  [62]
.text           D:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[564] ntdll.dll!RtlDosSearchPath_U + 1D1                              7C926ADA 1 Byte  [62]
.text           D:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe[564] kernel32.dll!GetBinaryTypeW + 80                                7C86936C 1 Byte  [62]
.text           D:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[652] ntdll.dll!RtlDosSearchPath_U + 1D1         7C926ADA 1 Byte  [62]
.text           D:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[652] kernel32.dll!GetBinaryTypeW + 80           7C86936C 1 Byte  [62]
.text           D:\WINDOWS\System32\smss.exe[660] ntdll.dll!RtlDosSearchPath_U + 1D1                                         7C926ADA 1 Byte  [62]
.text           D:\WINDOWS\system32\csrss.exe[716] ntdll.dll!RtlDosSearchPath_U + 1D1                                        7C926ADA 1 Byte  [62]
.text           D:\WINDOWS\system32\csrss.exe[716] KERNEL32.dll!GetBinaryTypeW + 80                                          7C86936C 1 Byte  [62]
.text           D:\WINDOWS\system32\winlogon.exe[740] ntdll.dll!RtlDosSearchPath_U + 1D1                                     7C926ADA 1 Byte  [62]
.text           D:\WINDOWS\system32\winlogon.exe[740] kernel32.dll!GetBinaryTypeW + 80                                       7C86936C 1 Byte  [62]
.text           D:\WINDOWS\system32\services.exe[784] ntdll.dll!RtlDosSearchPath_U + 1D1                                     7C926ADA 1 Byte  [62]
.text           D:\WINDOWS\system32\services.exe[784] kernel32.dll!GetBinaryTypeW + 80                                       7C86936C 1 Byte  [62]
.text           D:\WINDOWS\system32\lsass.exe[796] ntdll.dll!RtlDosSearchPath_U + 1D1                                        7C926ADA 1 Byte  [62]
.text           D:\WINDOWS\system32\lsass.exe[796] kernel32.dll!GetBinaryTypeW + 80                                          7C86936C 1 Byte  [62]
.text           D:\Programme\ASUS\ATK Hotkey\WDC.exe[976] ntdll.dll!RtlDosSearchPath_U + 1D1                                 7C926ADA 1 Byte  [62]
.text           D:\Programme\ASUS\ATK Hotkey\WDC.exe[976] kernel32.dll!GetBinaryTypeW + 80                                   7C86936C 1 Byte  [62]
.text           D:\WINDOWS\system32\svchost.exe[984] ntdll.dll!RtlDosSearchPath_U + 1D1                                      7C926ADA 1 Byte  [62]
.text           D:\WINDOWS\system32\svchost.exe[984] kernel32.dll!GetBinaryTypeW + 80                                        7C86936C 1 Byte  [62]
.text           D:\WINDOWS\system32\svchost.exe[1088] ntdll.dll!RtlDosSearchPath_U + 1D1                                     7C926ADA 1 Byte  [62]
.text           D:\WINDOWS\system32\svchost.exe[1088] kernel32.dll!GetBinaryTypeW + 80                                       7C86936C 1 Byte  [62]
.text           D:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!RtlDosSearchPath_U + 1D1                                     7C926ADA 1 Byte  [62]
.text           D:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!GetBinaryTypeW + 80                                       7C86936C 1 Byte  [62]
.text           D:\WINDOWS\system32\svchost.exe[1196] ntdll.dll!RtlDosSearchPath_U + 1D1                                     7C926ADA 1 Byte  [62]
.text           D:\WINDOWS\system32\svchost.exe[1196] kernel32.dll!GetBinaryTypeW + 80                                       7C86936C 1 Byte  [62]
.text           D:\WINDOWS\system32\svchost.exe[1264] ntdll.dll!RtlDosSearchPath_U + 1D1                                     7C926ADA 1 Byte  [62]
.text           D:\WINDOWS\system32\svchost.exe[1264] kernel32.dll!GetBinaryTypeW + 80                                       7C86936C 1 Byte  [62]
.text           D:\WINDOWS\System32\alg.exe[1304] ntdll.dll!RtlDosSearchPath_U + 1D1                                         7C926ADA 1 Byte  [62]
.text           D:\WINDOWS\System32\alg.exe[1304] kernel32.dll!GetBinaryTypeW + 80                                           7C86936C 1 Byte  [62]
.text           D:\Programme\ATKGFNEX\GFNEXSrv.exe[1384] ntdll.dll!RtlDosSearchPath_U + 1D1                                  7C926ADA 1 Byte  [62]
.text           D:\Programme\ATKGFNEX\GFNEXSrv.exe[1384] kernel32.dll!GetBinaryTypeW + 80                                    7C86936C 1 Byte  [62]
.text           D:\Programme\ASUS\ATK Hotkey\ATKOSD.exe[1404] ntdll.dll!RtlDosSearchPath_U + 1D1                             7C926ADA 1 Byte  [62]
.text           D:\Programme\ASUS\ATK Hotkey\ATKOSD.exe[1404] kernel32.dll!GetBinaryTypeW + 80                               7C86936C 1 Byte  [62]
.text           D:\Programme\Alwil Software\Avast5\AvastSvc.exe[1480] ntdll.dll!RtlDosSearchPath_U + 1D1                     7C926ADA 1 Byte  [62]
.text           D:\Programme\Alwil Software\Avast5\AvastSvc.exe[1480] kernel32.dll!SetUnhandledExceptionFilter               7C844935 4 Bytes  [C2, 04, 00, 90] {RET 0x4; NOP }
.text           D:\Programme\Alwil Software\Avast5\AvastSvc.exe[1480] kernel32.dll!GetBinaryTypeW + 80                       7C86936C 1 Byte  [62]
.text           D:\WINDOWS\Explorer.EXE[1520] ntdll.dll!RtlDosSearchPath_U + 1D1                                             7C926ADA 1 Byte  [62]
.text           D:\WINDOWS\Explorer.EXE[1520] kernel32.dll!GetBinaryTypeW + 80                                               7C86936C 1 Byte  [62]
.text           D:\WINDOWS\system32\spoolsv.exe[1620] ntdll.dll!RtlDosSearchPath_U + 1D1                                     7C926ADA 1 Byte  [62]
.text           D:\WINDOWS\system32\spoolsv.exe[1620] kernel32.dll!GetBinaryTypeW + 80                                       7C86936C 1 Byte  [62]
.text           D:\WINDOWS\system32\svchost.exe[1692] ntdll.dll!RtlDosSearchPath_U + 1D1                                     7C926ADA 1 Byte  [62]
.text           D:\WINDOWS\system32\svchost.exe[1692] kernel32.dll!GetBinaryTypeW + 80                                       7C86936C 1 Byte  [62]
.text           D:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe[1780] ntdll.dll!RtlDosSearchPath_U + 1D1                  7C926ADA 1 Byte  [62]
.text           D:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe[1780] kernel32.dll!GetBinaryTypeW + 80                    7C86936C 1 Byte  [62]
.text           D:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE[1824] ntdll.dll!RtlDosSearchPath_U + 1D1   7C926ADA 1 Byte  [62]
.text           D:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE[1824] kernel32.dll!GetBinaryTypeW + 80     7C86936C 1 Byte  [62]
.text           D:\WINDOWS\system32\svchost.exe[1932] ntdll.dll!RtlDosSearchPath_U + 1D1                                     7C926ADA 1 Byte  [62]
.text           D:\WINDOWS\system32\svchost.exe[1932] kernel32.dll!GetBinaryTypeW + 80                                       7C86936C 1 Byte  [62]
.text           D:\WINDOWS\system32\wbem\wmiapsrv.exe[2572] ntdll.dll!LdrLoadDll                                             7C925CD3 5 Bytes  JMP 000901F8 
.text           D:\WINDOWS\system32\wbem\wmiapsrv.exe[2572] ntdll.dll!RtlDosSearchPath_U + 1D1                               7C926ADA 1 Byte  [62]
.text           D:\WINDOWS\system32\wbem\wmiapsrv.exe[2572] ntdll.dll!LdrUnloadDll                                           7C926C9B 5 Bytes  JMP 000903FC 
.text           D:\WINDOWS\system32\wbem\wmiapsrv.exe[2572] kernel32.dll!GetBinaryTypeW + 80                                 7C86936C 1 Byte  [62]
.text           D:\WINDOWS\system32\wbem\wmiapsrv.exe[2572] ADVAPI32.dll!SetServiceObjectSecurity                            77E06D81 5 Bytes  JMP 002B1014 
.text           D:\WINDOWS\system32\wbem\wmiapsrv.exe[2572] ADVAPI32.dll!ChangeServiceConfigA                                77E06E69 5 Bytes  JMP 002B0804 
.text           D:\WINDOWS\system32\wbem\wmiapsrv.exe[2572] ADVAPI32.dll!ChangeServiceConfigW                                77E07001 5 Bytes  JMP 002B0A08 
.text           D:\WINDOWS\system32\wbem\wmiapsrv.exe[2572] ADVAPI32.dll!ChangeServiceConfig2A                               77E07101 5 Bytes  JMP 002B0C0C 
.text           D:\WINDOWS\system32\wbem\wmiapsrv.exe[2572] ADVAPI32.dll!ChangeServiceConfig2W                               77E07189 5 Bytes  JMP 002B0E10 
.text           D:\WINDOWS\system32\wbem\wmiapsrv.exe[2572] ADVAPI32.dll!CreateServiceA                                      77E07211 5 Bytes  JMP 002B01F8 
.text           D:\WINDOWS\system32\wbem\wmiapsrv.exe[2572] ADVAPI32.dll!CreateServiceW                                      77E073A9 5 Bytes  JMP 002B03FC 
.text           D:\WINDOWS\system32\wbem\wmiapsrv.exe[2572] ADVAPI32.dll!DeleteService                                       77E074B1 5 Bytes  JMP 002B0600 
.text           D:\WINDOWS\system32\wbem\wmiapsrv.exe[2572] USER32.dll!SetWindowsHookExW                                     7E37820F 5 Bytes  JMP 002C0804 
.text           D:\WINDOWS\system32\wbem\wmiapsrv.exe[2572] USER32.dll!UnhookWindowsHookEx                                   7E37D5F3 5 Bytes  JMP 002C0A08 
.text           D:\WINDOWS\system32\wbem\wmiapsrv.exe[2572] USER32.dll!SetWindowsHookExA                                     7E381211 5 Bytes  JMP 002C0600 
.text           D:\WINDOWS\system32\wbem\wmiapsrv.exe[2572] USER32.dll!SetWinEventHook                                       7E3817F7 5 Bytes  JMP 002C01F8 
.text           D:\WINDOWS\system32\wbem\wmiapsrv.exe[2572] USER32.dll!UnhookWinEvent                                        7E3818AC 5 Bytes  JMP 002C03FC 
.text           D:\Dokumente und Einstellungen\***\Desktop\fb79hxu6.exe[3988] ntdll.dll!RtlDosSearchPath_U + 1D1  7C926ADA 1 Byte  [62]
.text           D:\Dokumente und Einstellungen\***\Desktop\fb79hxu6.exe[3988] kernel32.dll!GetBinaryTypeW + 80    7C86936C 1 Byte  [62]

---- Devices - GMER 1.0.15 ----

Device          \FileSystem\Ntfs \Ntfs                                                                                       aswSP.SYS (avast! self protection module/AVAST Software)

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                       aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software)
AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                     aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                    aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume1                                                                       hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume2                                                                       hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume3                                                                       hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                    aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                  aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)

---- EOF - GMER 1.0.15 ----