Variation von Bundestrojaner gefunden - Durch Systemwiederherstellung gelöscht?

MrBoat · 29.01.2013, 14:06

Hallo liebes Trojanerboard,
ich hab mir vorgestern eine Variation dieses Bundestrojaners eingefangen (oben rechts stand "Bundesamt für Sicherheit und Informationstechnik" oben links "GVU" und ich wurde aufgefordert 100 Euro zu zahlen).
Mit der Wiederherstellungs-DVD hab ich eine Systemwiederherstellung vom 24.1 gemacht und konnte meinen PC danach wieder benutzen. Nun hab ich aber gehört das das Ding noch drauf ist und suche deshalb hier nach Hilfe.
Mit PCs kenn ich mich übrigends nicht so aus.

1) Defogger

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:54 on 29/01/2013 (***)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

2) OTL.txt (OTL Extra gabs bei mir nicht)

Code:

ATTFilter

OTL logfile created on: 29.01.2013 12:54:16 - Run 3
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\***\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
8,00 Gb Total Physical Memory | 6,20 Gb Available Physical Memory | 77,50% Memory free
16,00 Gb Paging File | 14,11 Gb Available in Paging File | 88,19% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 1862,92 Gb Total Space | 1691,73 Gb Free Space | 90,81% Space Free | Partition Type: NTFS
 
Computer Name: ***-PC | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.01.28 15:00:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
PRC - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.11.22 16:58:14 | 001,522,312 | ---- | M] (pdfforge GbR) -- C:\Program Files (x86)\PDF Architect\HelperService.exe
PRC - [2012.11.22 16:56:10 | 000,905,864 | ---- | M] (pdfforge GbR) -- C:\Program Files (x86)\PDF Architect\ConversionService.exe
PRC - [2012.07.18 17:04:33 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.07.18 17:04:24 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
PRC - [2012.07.18 17:04:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.07.18 17:04:22 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.06.20 12:18:08 | 001,568,976 | ---- | M] (Ask) -- C:\Program Files (x86)\Ask.com\Updater\Updater.exe
PRC - [2012.02.25 19:51:19 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2011.09.01 02:22:18 | 000,169,624 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe
PRC - [2011.06.17 18:33:04 | 000,272,528 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\3.0.207\SSScheduler.exe
PRC - [2011.04.15 10:43:20 | 002,280,312 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
PRC - [2011.02.07 05:14:24 | 000,143,360 | ---- | M] () -- C:\Program Files (x86)\MSI Afterburner\Bundle\OSDServer\RTSS.exe
PRC - [2010.10.27 18:17:52 | 000,207,424 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
PRC - [2010.09.30 21:26:54 | 000,393,216 | ---- | M] (AMD) -- C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
PRC - [2010.08.25 10:27:44 | 000,309,824 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
PRC - [2010.06.14 10:00:26 | 005,309,056 | ---- | M] (
ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\EPU\EPU.exe
PRC - [2010.04.27 09:09:52 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
PRC - [2010.03.18 10:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2009.03.30 14:00:54 | 000,221,184 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files (x86)\Brother\Brmfcmon\BrMfcmon.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.03.21 16:30:20 | 000,067,872 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.02.07 05:14:24 | 000,143,360 | ---- | M] () -- C:\Program Files (x86)\MSI Afterburner\Bundle\OSDServer\RTSS.exe
MOD - [2011.02.07 05:14:22 | 000,061,440 | ---- | M] () -- C:\Program Files (x86)\MSI Afterburner\Bundle\OSDServer\RTMUI.dll
MOD - [2011.02.07 05:14:18 | 000,081,920 | ---- | M] () -- C:\Program Files (x86)\MSI Afterburner\Bundle\OSDServer\RTSSHooks.dll
MOD - [2011.02.07 05:14:16 | 000,147,456 | ---- | M] () -- C:\Program Files (x86)\MSI Afterburner\Bundle\OSDServer\RTUI.dll
MOD - [2011.02.07 05:14:14 | 000,061,440 | ---- | M] () -- C:\Program Files (x86)\MSI Afterburner\Bundle\OSDServer\RTFC.dll
MOD - [2010.07.27 05:37:16 | 000,013,312 | ---- | M] () -- C:\Program Files (x86)\MSI Afterburner\Bundle\OSDServer\RTTSH.dll
MOD - [2010.01.08 16:17:24 | 000,565,248 | ---- | M] () -- C:\Program Files (x86)\ASUS\EPU\pngio.dll
MOD - [2010.01.08 16:17:24 | 000,053,248 | ---- | M] () -- C:\Program Files (x86)\ASUS\EPU\AsSpindownTimeout.dll
MOD - [2009.09.30 04:33:08 | 000,024,576 | R--- | M] () -- C:\Windows\SysWOW64\AsIO.dll
MOD - [2009.04.22 19:20:00 | 000,179,712 | ---- | M] () -- C:\Program Files (x86)\ASUS\EPU\ASUSSERVICE.DLL
MOD - [2009.02.27 15:38:22 | 000,139,264 | R--- | M] () -- C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - File not found [Auto | Stopped] -- C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe -- (IswSvc)
SRV:64bit: - [2012.12.19 20:56:00 | 000,240,640 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2012.12.19 15:32:12 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV - [2013.01.20 17:58:06 | 000,541,608 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2013.01.19 12:06:49 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.01.10 18:37:51 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.11.22 16:58:14 | 001,522,312 | ---- | M] (pdfforge GbR) [Auto | Running] -- C:\Program Files (x86)\PDF Architect\HelperService.exe -- (PDF Architect Helper Service)
SRV - [2012.11.22 16:56:10 | 000,905,864 | ---- | M] (pdfforge GbR) [Auto | Running] -- C:\Program Files (x86)\PDF Architect\ConversionService.exe -- (PDF Architect Service)
SRV - [2012.11.09 11:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.07.18 17:04:33 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.07.18 17:04:24 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)
SRV - [2012.07.18 17:04:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.02.25 19:51:19 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011.11.23 14:17:26 | 000,094,992 | ---- | M] (SANDBOXIE L.T.D) [Auto | Running] -- C:\Programme\Sandboxie\SbieSvc.exe -- (SbieSvc)
SRV - [2011.09.01 02:22:18 | 000,169,624 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor10.0)
SRV - [2011.06.17 18:33:04 | 000,237,008 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\3.0.207\McCHSvc.exe -- (McComponentHostService)
SRV - [2011.04.15 10:43:20 | 002,280,312 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.03.18 10:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009.08.18 11:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - File not found [Kernel | Auto | Stopped] -- C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys -- (ISWKL)
DRV:64bit: - [2012.12.19 21:48:48 | 011,278,336 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2012.12.19 20:32:54 | 000,552,960 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2012.11.06 12:11:52 | 000,096,256 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2012.07.18 17:04:42 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.07.18 17:04:42 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.07.18 17:04:41 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.09.21 10:25:54 | 000,021,992 | ---- | M] (CPUID) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\cpuz135_x64.sys -- (cpuz135)
DRV:64bit: - [2011.05.10 07:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.06.23 10:10:56 | 000,344,680 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010.04.27 08:30:52 | 000,184,968 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010.04.27 08:29:54 | 000,083,080 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010.03.19 03:00:00 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2010.02.18 08:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)
DRV:64bit: - [2010.01.27 10:25:42 | 001,584,640 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009.08.23 23:55:32 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie)
DRV:64bit: - [2009.07.16 04:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2012.04.09 09:13:58 | 000,057,472 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Stopped] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.2)
DRV - [2012.04.09 09:13:58 | 000,057,472 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.01)
DRV - [2011.11.23 14:17:24 | 000,158,336 | ---- | M] (SANDBOXIE L.T.D) [Kernel | On_Demand | Running] -- C:\Programme\Sandboxie\SbieDrv.sys -- (SbieDrv)
DRV - [2010.05.27 01:43:00 | 000,014,648 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\MSI Afterburner\RTCore64.sys -- (RTCore64)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 04 EE E3 00 BE F5 CD 01  [binary data]
IE - HKCU\..\URLSearchHook: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "ZoneAlarm-Sicherheit Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2613550&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://search.avira.com/?l=dis&o=APN10395&gct=hp&dc=EU&locale=de_DE"
FF - prefs.js..extensions.enabledAddons: ich%40maltegoetz.de:1.4.3
FF - prefs.js..extensions.enabledAddons: %7Ba0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7%7D:20130116
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.1
FF - prefs.js..keyword.URL: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=AVR-3&o=APN10395&locale=de_DE&apn_uid=2498ed90-d4b1-46aa-b024-81aba1ef5423&apn_ptnrs=%5EABT&apn_sauid=FAEA9189-B55B-4290-A7DA-20761B9B917D&apn_dtid=%5EYYYYYY%5EYY%5EDE&&q="
FF - prefs.js..network.proxy.type: 2
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.0: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.0\npesnsonar.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.102.0: C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.110.0: C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.118.0: C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.132.0: C:\Program Files (x86)\Battlelog Web Plugins\1.132.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=2.1.2: C:\Program Files (x86)\Battlelog Web Plugins\2.1.2\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\PROGRAM FILES\CHECKPOINT\ZAFORCEFIELD\TRUSTCHECKER
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\FFPDFArchitectConverter@pdfarchitect.com: C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2012.12.09 15:52:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.01.19 12:06:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.01.19 12:06:49 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2011.04.30 17:42:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2013.01.22 22:35:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\vym8tsne.default\extensions
[2013.01.22 22:35:14 | 000,000,000 | ---D | M] (WOT) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\vym8tsne.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2011.12.15 11:17:54 | 000,000,000 | ---D | M] (DealPly) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\vym8tsne.default\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}
[2012.11.09 17:22:10 | 000,000,000 | ---D | M] (ZoneAlarm-Sicherheit Community Toolbar) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\vym8tsne.default\extensions\{fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}
[2012.09.15 17:00:54 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\vym8tsne.default\extensions\ich@maltegoetz.de
[2012.08.12 21:23:18 | 000,156,179 | ---- | M] () (No name found) -- C:\Users\***\AppData\Roaming\mozilla\firefox\profiles\vym8tsne.default\extensions\arpit3@techraga.in.xpi
[2012.12.11 17:11:48 | 000,036,098 | ---- | M] () (No name found) -- C:\Users\***\AppData\Roaming\mozilla\firefox\profiles\vym8tsne.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
[2012.11.23 18:05:19 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\***\AppData\Roaming\mozilla\firefox\profiles\vym8tsne.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2011.03.23 20:42:12 | 000,000,943 | ---- | M] () -- C:\Users\***\AppData\Roaming\mozilla\firefox\profiles\vym8tsne.default\searchplugins\conduit.xml
[2013.01.19 12:06:47 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.01.19 12:06:47 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013.01.19 12:06:49 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.04.27 18:45:10 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.29 19:26:35 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.04.27 18:45:10 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.04.27 18:45:10 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.04.27 18:45:10 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.04.27 18:45:10 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Programme\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O2:64bit: - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll File not found
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (PDF Architect Helper) - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
O2 - BHO: (SteadyVideoBHO Class) - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll File not found
O2 - BHO: (DealPly) - {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} - C:\Program Files (x86)\DealPly\DealPlyIE.dll (DealPly Technologies Ltd)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll File not found
O3 - HKLM\..\Toolbar: (PDF Architect Toolbar) - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll (pdfforge GbR)
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll File not found
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll File not found
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [ISW]  File not found
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [Nikon Message Center 2] C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe (Nikon Corporation)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [Six Engine] C:\Program Files (x86)\ASUS\EPU\EPU.exe (
ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [HydraVisionDesktopManager] C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe (AMD)
O4 - HKCU..\Run: [SandboxieControl] C:\Program Files\Sandboxie\SbieCtrl.exe (SANDBOXIE L.T.D)
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube Download - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000019 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{62A5CB83-62D3-4FC2-B87C-19FC67DFEBFA}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18:64bit: - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18:64bit: - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Programme\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\video/mp4 {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O18 - Protocol\Filter\video/x-flv {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.01.28 15:05:22 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2013.01.27 13:02:00 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Abiturmaterialien
[2013.01.24 14:54:31 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2013.01.24 14:53:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT
[2013.01.24 14:53:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2013.01.24 14:53:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center
[2013.01.23 11:53:45 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\WindSolutions
[2013.01.23 11:37:33 | 000,000,000 | ---D | C] -- C:\ProgramData\WindSolutions
[2013.01.22 15:36:13 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Tobias Saxophon
[2013.01.19 12:06:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.01.17 12:48:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Sonic Shared
[2013.01.17 12:48:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PX Storage Engine
[2013.01.05 19:16:02 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2013.01.05 19:13:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games
[2012.12.30 19:47:29 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\ESN
[3 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[2 C:\Users\Public\Documents\*.tmp files -> C:\Users\Public\Documents\*.tmp -> ]
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.01.29 12:39:17 | 000,000,000 | ---- | M] () -- C:\Users\***\defogger_reenable
[2013.01.29 12:15:47 | 000,014,800 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.01.29 12:15:47 | 000,014,800 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.01.29 12:08:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.01.29 12:08:20 | 2146,820,095 | -HS- | M] () -- C:\hiberfil.sys
[2013.01.28 22:56:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.01.28 20:51:38 | 000,282,296 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2013.01.28 20:51:38 | 000,282,296 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2013.01.28 20:50:30 | 000,215,128 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2013.01.28 15:06:27 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.01.28 15:06:27 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.01.28 15:06:27 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.01.28 15:06:27 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.01.28 15:06:27 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.01.28 15:02:22 | 000,365,568 | ---- | M] () -- C:\Users\***\Desktop\gmer-2.0.18444.exe
[2013.01.28 15:00:40 | 000,050,477 | ---- | M] () -- C:\Users\***\Desktop\Defogger.exe
[2013.01.28 15:00:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2013.01.28 13:01:40 | 003,189,130 | ---- | M] () -- C:\Users\***\Desktop\Bild.jpg
[2013.01.17 12:55:39 | 004,876,640 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.01.17 12:48:44 | 000,001,896 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Photoshop Elements 10.lnk
[3 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[2 C:\Users\Public\Documents\*.tmp files -> C:\Users\Public\Documents\*.tmp -> ]
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.01.29 12:39:17 | 000,000,000 | ---- | C] () -- C:\Users\***\defogger_reenable
[2013.01.28 15:05:22 | 000,365,568 | ---- | C] () -- C:\Users\***\Desktop\gmer-2.0.18444.exe
[2013.01.28 15:05:22 | 000,050,477 | ---- | C] () -- C:\Users\***\Desktop\Defogger.exe
[2013.01.28 13:01:40 | 003,189,130 | ---- | C] () -- C:\Users\***\Desktop\Bild.jpg
[2013.01.17 12:53:29 | 000,000,997 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
[2013.01.17 12:48:44 | 000,001,912 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop Elements 10.lnk
[2013.01.17 12:48:44 | 000,001,896 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Photoshop Elements 10.lnk
[2012.05.02 13:58:10 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2012.02.15 03:36:36 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.02.15 03:36:36 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.01.10 20:27:55 | 000,056,832 | ---- | C] () -- C:\Users\Kuipers\AppData\Roaming\skype.dat
[2011.12.30 19:42:32 | 000,002,384 | ---- | C] () -- C:\Windows\Sandboxie.ini
[2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011.08.02 20:34:40 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Grapher
[2011.08.02 20:34:40 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Grand Piano
[2011.08.02 20:34:40 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Generic
[2011.08.02 20:34:40 | 000,000,268 | RH-- | C] () -- C:\Users\***\AppData\Roaming\Galaxy Swirl
[2011.08.02 20:34:40 | 000,000,268 | RH-- | C] () -- C:\Users\***\AppData\Roaming\Galactic Static
[2011.08.02 20:34:40 | 000,000,268 | RH-- | C] () -- C:\Users\***\AppData\Roaming\Funk Animals
[2011.08.02 20:34:40 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLev.DAT
[2011.08.02 20:34:40 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLet.DAT
[2011.08.02 20:34:40 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLes.DAT
[2011.04.30 18:47:32 | 000,282,296 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.04.30 18:47:28 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe
[2011.04.30 18:47:28 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.04.30 17:56:30 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.04.30 17:36:50 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2011.04.30 17:36:50 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2011.04.14 16:57:51 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.binf
[2011.04.14 16:41:39 | 000,024,576 | R--- | C] () -- C:\Windows\SysWow64\AsIO.dll
[2011.04.14 16:41:39 | 000,013,440 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys
[2011.04.14 16:41:37 | 000,011,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys
[2011.04.14 16:41:37 | 000,010,216 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp32.sys
[2011.04.14 16:37:33 | 000,044,434 | ---- | C] () -- C:\Windows\Ascd_log.ini
[2011.04.14 16:37:06 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2011.04.14 16:37:00 | 000,033,683 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
"ThreadingModel" = Both
"" = C:\$Recycle.Bin\S-1-5-21-2714413572-685484061-1826461873-1000\$2730c4019128e3f2af1b40bb2ec1861d\n.
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\$Recycle.Bin\S-1-5-18\$2730c4019128e3f2af1b40bb2ec1861d\n.
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.12.09 15:52:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\APP_NAME_NON_STRING
[2011.04.30 17:45:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\CheckPoint
[2011.11.30 18:37:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2011.11.30 20:20:01 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoft
[2011.11.30 20:19:54 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.03.14 18:06:49 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\e-academy Inc
[2013.01.28 14:33:10 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\IrfanView
[2012.05.06 08:36:39 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\LolClient
[2011.08.02 20:41:03 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Nikon
[2012.12.05 16:30:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Origin
[2012.12.09 15:53:59 | 000,000,000 | ---D | M] -- C:\Users\***s\AppData\Roaming\PDF Architect
[2012.12.09 15:51:51 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\pdfforge
[2012.09.10 10:45:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Spotify
[2012.06.22 17:10:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TS3Client
[2013.01.23 11:53:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\WindSolutions
 
========== Purity Check ==========
 
 

< End of report >

3)Gmer.txt

Code:

ATTFilter

GMER 2.0.18444 - hxxp://www.gmer.net
Rootkit scan 2013-01-29 13:34:22
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 SAMSUNG_HD204UI rev.1AQ10001 1863,02GB
Running: gmer-2.0.18444.exe; Driver: C:\Users\***\AppData\Local\Temp\uftiafoc.sys


---- User code sections - GMER 2.0 ----

.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1648] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17      00000000761e1401 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1648] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17        00000000761e1419 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1648] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17      00000000761e1431 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1648] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42      00000000761e144a 2 bytes [1E, 76]
.text    ...                                                                                                                                                 * 9
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1648] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17         00000000761e14dd 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1648] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17  00000000761e14f5 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1648] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17         00000000761e150d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1648] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17  00000000761e1525 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1648] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17        00000000761e153d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1648] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17             00000000761e1555 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1648] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17      00000000761e156d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1648] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17        00000000761e1585 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1648] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17           00000000761e159d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1648] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17        00000000761e15b5 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1648] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17      00000000761e15cd 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1648] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20  00000000761e16b2 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1648] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31  00000000761e16bd 2 bytes [1E, 76]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1972] C:\Windows\SysWOW64\WSOCK32.dll!recv + 82                                                                    0000000072a617fa 2 bytes [A6, 72]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1972] C:\Windows\SysWOW64\WSOCK32.dll!recvfrom + 88                                                                0000000072a61860 2 bytes [A6, 72]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1972] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 98                                                              0000000072a61942 2 bytes [A6, 72]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1972] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 109                                                             0000000072a6194d 2 bytes [A6, 72]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1972] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                      00000000761e1401 2 bytes [1E, 76]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1972] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                        00000000761e1419 2 bytes [1E, 76]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1972] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                      00000000761e1431 2 bytes [1E, 76]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1972] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                      00000000761e144a 2 bytes [1E, 76]
.text    ...                                                                                                                                                 * 9
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1972] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                         00000000761e14dd 2 bytes [1E, 76]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1972] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                  00000000761e14f5 2 bytes [1E, 76]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1972] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                         00000000761e150d 2 bytes [1E, 76]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1972] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                  00000000761e1525 2 bytes [1E, 76]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1972] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                        00000000761e153d 2 bytes [1E, 76]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1972] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                             00000000761e1555 2 bytes [1E, 76]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1972] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                      00000000761e156d 2 bytes [1E, 76]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1972] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                        00000000761e1585 2 bytes [1E, 76]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1972] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                           00000000761e159d 2 bytes [1E, 76]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1972] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                        00000000761e15b5 2 bytes [1E, 76]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1972] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                      00000000761e15cd 2 bytes [1E, 76]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1972] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                  00000000761e16b2 2 bytes [1E, 76]
.text    C:\Windows\SysWOW64\PnkBstrA.exe[1972] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                  00000000761e16bd 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[2312] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                            00000000761e1401 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[2312] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                              00000000761e1419 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[2312] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                            00000000761e1431 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[2312] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                            00000000761e144a 2 bytes [1E, 76]
.text    ...                                                                                                                                                 * 9
.text    C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[2312] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                               00000000761e14dd 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[2312] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                        00000000761e14f5 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[2312] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                               00000000761e150d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[2312] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                        00000000761e1525 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[2312] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                              00000000761e153d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[2312] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                   00000000761e1555 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[2312] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                            00000000761e156d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[2312] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                              00000000761e1585 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[2312] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                 00000000761e159d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[2312] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                              00000000761e15b5 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[2312] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                            00000000761e15cd 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[2312] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                        00000000761e16b2 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[2312] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                        00000000761e16bd 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2912] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17       00000000761e1401 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2912] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17         00000000761e1419 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2912] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17       00000000761e1431 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2912] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42       00000000761e144a 2 bytes [1E, 76]
.text    ...                                                                                                                                                 * 9
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2912] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17          00000000761e14dd 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2912] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17   00000000761e14f5 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2912] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17          00000000761e150d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2912] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17   00000000761e1525 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2912] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17         00000000761e153d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2912] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17              00000000761e1555 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2912] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17       00000000761e156d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2912] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17         00000000761e1585 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2912] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17            00000000761e159d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2912] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17         00000000761e15b5 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2912] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17       00000000761e15cd 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2912] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20   00000000761e16b2 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2912] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31   00000000761e16bd 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[3124] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17          00000000761e1401 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[3124] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17            00000000761e1419 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[3124] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17          00000000761e1431 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[3124] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42          00000000761e144a 2 bytes [1E, 76]
.text    ...                                                                                                                                                 * 9
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[3124] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17             00000000761e14dd 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[3124] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17      00000000761e14f5 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[3124] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17             00000000761e150d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[3124] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17      00000000761e1525 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[3124] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17            00000000761e153d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[3124] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                 00000000761e1555 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[3124] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17          00000000761e156d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[3124] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17            00000000761e1585 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[3124] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17               00000000761e159d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[3124] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17            00000000761e15b5 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[3124] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17          00000000761e15cd 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[3124] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20      00000000761e16b2 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[3124] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31      00000000761e16bd 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3140] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                    00000000761e1401 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3140] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                      00000000761e1419 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3140] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                    00000000761e1431 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3140] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                    00000000761e144a 2 bytes [1E, 76]
.text    ...                                                                                                                                                 * 9
.text    C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3140] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                       00000000761e14dd 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3140] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                00000000761e14f5 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3140] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                       00000000761e150d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3140] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                00000000761e1525 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3140] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                      00000000761e153d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3140] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                           00000000761e1555 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3140] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                    00000000761e156d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3140] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                      00000000761e1585 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3140] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                         00000000761e159d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3140] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                      00000000761e15b5 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3140] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                    00000000761e15cd 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3140] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                00000000761e16b2 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Ask.com\Updater\Updater.exe[3140] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                00000000761e16bd 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                      00000000761e1401 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3280] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                        00000000761e1419 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                      00000000761e1431 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                      00000000761e144a 2 bytes [1E, 76]
.text    ...                                                                                                                                                 * 9
.text    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3280] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                         00000000761e14dd 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                  00000000761e14f5 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3280] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                         00000000761e150d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                  00000000761e1525 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                        00000000761e153d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3280] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                             00000000761e1555 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                      00000000761e156d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                        00000000761e1585 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3280] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                           00000000761e159d 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                        00000000761e15b5 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                      00000000761e15cd 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                  00000000761e16b2 2 bytes [1E, 76]
.text    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                  00000000761e16bd 2 bytes [1E, 76]

---- Threads - GMER 2.0 ----

Thread   C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [1712:2652]                                                                                000000001000e2eb
Thread   C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [1712:3212]                                                                                0000000001ab66e0
Thread   C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [1712:3216]                                                                                0000000001ab66e0
Thread   C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [1712:3220]                                                                                0000000001ab66e0
Thread   C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [1712:3224]                                                                                0000000001ab2560
Thread   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [3252:3388]                                                                                  0000000074508f84
Thread   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [3252:3392]                                                                                  000000007450925e
Thread   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [3252:3396]                                                                                  0000000074508bd0
Thread   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [3744:4632]                                                                     000007fefbc82a7c
Thread   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [3744:4448]                                                                     00000000697dd068
Thread   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [3744:4416]                                                                     000007fee975cec4
Thread   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [3744:4792]                                                                     000007fee975cec4
Thread   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [3744:4796]                                                                     000007fee975cec4
Thread   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [3744:4724]                                                                     000007fee975cec4
Thread   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [3744:4760]                                                                     000007fee975cec4
Thread   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [3744:4772]                                                                     000007fee975cec4
Thread   C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [3744:4764]                                                                     0000000066e6bccc
---- Processes - GMER 2.0 ----

Library  ? (*** suspicious ***) @ C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [1436]                                                              0000000074a30000
Library  ? (*** suspicious ***) @ C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [1712]                                                            0000000076370000
Library  ? (*** suspicious ***) @ C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [3252]                                                              0000000074760000
Library  ? (*** suspicious ***) @ C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe [3352]                                                 000007fef3b60000
Library  ? (*** suspicious ***) @ C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [3744]                                                 000000006a170000
Library  ? (*** suspicious ***) @ C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [1208]                                   0000000074a30000

---- EOF - GMER 2.0 ----

Namen wurden mit "***" ersetzt.
Danke schonmal im Vorraus

.

Variation von Bundestrojaner gefunden - Durch Systemwiederherstellung gelöscht?

Log-Analyse und Auswertung: Variation von Bundestrojaner gefunden - Durch Systemwiederherstellung gelöscht?

Variation von Bundestrojaner gefunden - Durch Systemwiederherstellung gelöscht?

Ähnliche Themen: Variation von Bundestrojaner gefunden - Durch Systemwiederherstellung gelöscht?