search.conduit mit SpyHunter zu beseitigen versucht....

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-10-2013
Ran by admin (administrator) on WATT-7CU9UZCUCX on 07-11-2013 12:39:07
Running from C:\Documents and Settings\admin\My Documents\Downloads
Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(AVM Berlin) c:\program files\fritz!box\IGDCTRL.EXE
(Conduit) C:\Program Files\SearchProtect\bin\CltMngSvc.exe
(Oracle Corporation) C:\Program Files\Java\jre7\bin\jqs.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(ScanSoft, Inc.) C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
(Nokia) C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
(shbox.de) C:\Program Files\FreePDF_XP\fpassist.exe
(Apple Computer, Inc.) C:\Program Files\QuickTime\qttask.exe
(Lavasoft) C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe
(Nokia.) C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\documents and settings\admin\my documents\internet_und_technisches\WCESCOMM.EXE
(Microsoft Corporation) C:\Program Files\Messenger\msmsgs.exe
(Sony) C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe
(Conduit) C:\Documents and Settings\admin\Application Data\SearchProtect\bin\cltmng.exe
() C:\Program Files\Sony\Sony PC Companion\PCCompanionInfo.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [OpwareSE2] - C:\Program Files\ScanSoft\OmniPageSE2.0\opwareSE2.exe [49152 2003-05-08] (ScanSoft, Inc.)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray.exe [409600 2007-11-10] (IDT, Inc.)
HKLM\...\Run: [PCSuiteTrayApplication] - C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [227328 2007-03-23] (Nokia)
HKLM\...\Run: [FreePDF Assistant] - C:\Program Files\FreePDF_XP\fpassist.exe [370176 2010-06-17] (shbox.de)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\qttask.exe [282624 2006-09-01] (Apple Computer, Inc.)
HKLM\...\Run: [Ad-Aware Browsing Protection] - C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe [542104 2012-12-12] (Lavasoft)
HKLM\...\Run: [SearchProtection] - C:\Documents and Settings\All Users\Application Data\Search Protection\_run.bat
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-02] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SearchProtectAll] - C:\Program Files\SearchProtect\bin\cltmng.exe [3470624 2013-09-22] (Conduit)
HKCU\...\Run: [H/PC Connection Agent] - C:\Documents and Settings\admin\My Documents\Internet_und_Technisches\wcescomm.exe [405583 2005-01-04] (Microsoft Corporation)
HKCU\...\Run: [MSMSGS] - C:\Program Files\Messenger\msmsgs.exe [1695232 2008-04-14] (Microsoft Corporation)
HKCU\...\Run: [Sony PC Companion] - C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe [449248 2013-05-29] (Sony)
HKCU\...\Run: [SearchProtect] - C:\Documents and Settings\admin\Application Data\SearchProtect\bin\cltmng.exe [3470624 2013-09-22] (Conduit)
MountPoints2: {62db740b-1ef5-11e2-b2e8-0019213fd15e} - E:\Startme.exe
MountPoints2: {b926a685-a81b-11e2-b3dd-0019213fd15e} - E:\Startme.exe
HKU\Guest\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\qttask.exe [ 2006-09-01] (Apple Computer, Inc.)
Startup: C:\Documents and Settings\admin\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Disk Cleaner.lnk
ShortcutTarget: Disk Cleaner.lnk -> C:\Program Files\Disk Cleaner\dclean.exe (No File)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com/?ctid=CT3317892&octid=CT3317892&SearchSource=61&CUI=UN40030008692765112&UM=2&UP=SP57A2C6E5-80BF-4BB2-AEC1-12B50411C00F
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
URLSearchHook: HKCU - RadioTotal1 Toolbar - {422f7661-9403-4da4-b4ef-cc3e268817b5} - C:\Program Files\RadioTotal1\prxtbRadi.dll (Conduit Ltd.)
SearchScopes: HKLM - DefaultScope {977A0D3B-1489-476B-8B6A-2C76F51D7DEA} URL = 
SearchScopes: HKCU - DefaultScope {977A0D3B-1489-476B-8B6A-2C76F51D7DEA} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus
SearchScopes: HKCU - {2B260005-5D99-4D8D-80E9-BE18A9158C30} URL = hxxp://flvdirect.iamwired.net/websearch.php?src=tops&search={SearchTerms}
SearchScopes: HKCU - {977A0D3B-1489-476B-8B6A-2C76F51D7DEA} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus
SearchScopes: HKCU - {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = 
BHO: Plus-HD-3.8 - {11111111-1111-1111-1111-110311901130} - C:\Program Files\Plus-HD-3.8\Plus-HD-3.8-bho.dll (Plus HD)
BHO: RadioTotal1 Toolbar - {422f7661-9403-4da4-b4ef-cc3e268817b5} - C:\Program Files\RadioTotal1\prxtbRadi.dll (Conduit Ltd.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Web Optimizer - {bbb1d54d-cf70-4a80-bf2f-3bafca0225ce} - C:\Program Files\Web Optimizer\weboptimizer.dll (Web Optimizer)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - RadioTotal1 Toolbar - {422f7661-9403-4da4-b4ef-cc3e268817b5} - C:\Program Files\RadioTotal1\prxtbRadi.dll (Conduit Ltd.)
Toolbar: HKCU - &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKCU - RadioTotal1 Toolbar - {422F7661-9403-4DA4-B4EF-CC3E268817B5} - C:\Program Files\RadioTotal1\prxtbRadi.dll (Conduit Ltd.)
DPF: {33564D57-0000-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1275388002703
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: mctp - {d7b95390-b1c5-11d0-b111-0080c712fe82} - C:\Documents and Settings\admin\My Documents\Internet_und_Technisches\aatp.dll (Microsoft Corporation)
Winsock: Catalog5 04 c:\program files\fritz!box\sarah.dll [19456] (AVM Berlin)
Winsock: Catalog9 01 c:\program files\fritz!box\sarah.dll [19456] (AVM Berlin)
Winsock: Catalog9 02 c:\program files\fritz!box\sarah.dll [19456] (AVM Berlin)
Winsock: Catalog9 03 c:\program files\fritz!box\sarah.dll [19456] (AVM Berlin)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 21 c:\program files\fritz!box\sarah.dll [19456] (AVM Berlin)
Winsock: Catalog9 22 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox
FF DefaultSearchEngine: Search
FF SelectedSearchEngine: Search
FF Homepage: hxxp://search.conduit.com/?ctid=CT3317892&octid=CT3317892&SearchSource=61&CUI=UN30628829501142719&UM=2&UP=SP57A2C6E5-80BF-4BB2-AEC1-12B50411C00F&SSPV=
FF Keyword.URL: hxxp://flvdirect.iamwired.net/websearch.php?src=tops&search=
FF NetworkProxy: "backup.ftp", "127.0.0.1"
FF NetworkProxy: "backup.ftp_port", 4001
FF NetworkProxy: "backup.gopher", "127.0.0.1"
FF NetworkProxy: "backup.gopher_port", 4001
FF NetworkProxy: "backup.socks", ""
FF NetworkProxy: "backup.socks_port", 0
FF NetworkProxy: "backup.ssl", "127.0.0.1"
FF NetworkProxy: "backup.ssl_port", 4001
FF NetworkProxy: "ftp", "127.0.0.1"
FF NetworkProxy: "ftp_port", 4001
FF NetworkProxy: "gopher", "127.0.0.1"
FF NetworkProxy: "gopher_port", 4001
FF NetworkProxy: "http", "127.0.0.1"
FF NetworkProxy: "http_port", 4001
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks_remote_dns", true
FF NetworkProxy: "ssl", "127.0.0.1"
FF NetworkProxy: "ssl_port", 4001
FF NetworkProxy: "type", 1
FF SelectedSearchEngine: blekko
FF Homepage: hxxp://safesearchr.lavasoft.com/?source=3336ca5f&tbp=homepage&toolbarid=adawaretb&v=2_2&u=90828A4F9CBBA1AB1FC7FB50F7FCB104
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\WINDOWS\system32\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @adobe.com/FlashPlayer - C:\WINDOWS\System32\Macromed\Flash\NPSWF32.dll No File
FF SearchPlugin: C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\searchplugins\amazondotcom-en.xml
FF SearchPlugin: C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\searchplugins\answers.xml
FF SearchPlugin: C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\searchplugins\askcom.xml
FF SearchPlugin: C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\searchplugins\creativecommons.xml
FF SearchPlugin: C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\searchplugins\google-de.xml
FF SearchPlugin: C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\searchplugins\google-en.xml
FF SearchPlugin: C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\searchplugins\leo-eng-ger.xml
FF SearchPlugin: C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\searchplugins\leo-esp-ale.xml
FF SearchPlugin: C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\searchplugins\leo-fra-all.xml
FF SearchPlugin: C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\searchplugins\live-search.xml
FF SearchPlugin: C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\searchplugins\metager2.xml
FF SearchPlugin: C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\searchplugins\Search.xml
FF SearchPlugin: C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\searchplugins\technorati.xml
FF SearchPlugin: C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\searchplugins\wikipedia_en.xml
FF SearchPlugin: C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\searchplugins\yahoo-de.xml
FF SearchPlugin: C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\searchplugins\yahoo-en.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\adawaretb.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Add Bookmark Here ² - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\abhere2@moztw.org
FF Extension: DT Whois - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\beysim@beysim.net
FF Extension: Plus-HD-3.8 - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\c17236e8-fd66-44bc-aeef-1e00981cbb64@0a4ee0fe-5356-4fd3-b37c-5cd5671a315c.com
FF Extension: Adblock Plus: Element Hiding Helper - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\elemhidehelper@adblockplus.org
FF Extension: Lavasoft Search Plugin - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\jid1-yZwVFzbsyfMrqQ@jetpack
FF Extension: No Name - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\staged
FF Extension: CS Lite - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{00084897-021a-4361-8423-083407a033e0}
FF Extension: Image Zoom - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}
FF Extension: Groowe Search Toolbar - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{268ad77e-cff8-42d7-b479-da60a7b93305}
FF Extension: Forecastbar Enhanced - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{3CE993BF-A3D9-4fd2-B3B6-768CBBC337F8}
FF Extension: JonDoFox - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{437be45a-4114-11dd-b9ab-71d256d89593}
FF Extension: ChatZilla - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}
FF Extension: Dr.Web anti-virus link checker - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{6614d11d-d21d-b211-ae23-815234e1ebb5}
FF Extension: SafeCache - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{670a77c5-010e-4476-a8ce-d09171318839}
FF Extension: Copy Plain Text - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{723AAF16-AF1F-4404-A5D7-0BFE39766605}
FF Extension: NoScript - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
FF Extension: TabRenamizer - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{792BDDFE-2E7C-42ed-B18D-18154D2761BD}
FF Extension: TinyUrl Creator - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{89736E8E-4B14-4042-8C75-AD00B6BD3900}
FF Extension: MR Tech Toolkit - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{9669CC8F-B388-42FE-86F4-CB5E7F5A8BDC}
FF Extension: CacheIt! - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{98449521-9320-4257-aa35-9e1a39c8cbe0}
FF Extension: Sage - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{a6ca9b3b-5e52-4f47-85d8-cca35bb57596}
FF Extension: Calculator - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{AA052FD6-366A-4771-A591-0D8DC551585D}
FF Extension: Temporary Inbox - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{ac1e10b8-206d-4746-a18e-0483852dc20b}
FF Extension: DownloadHelper - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: Plain Text to Link - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{C90B0826-5A17-4970-A5BF-A43D22452E21}
FF Extension: Media Pirate - The video downloader - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{cc265d3d-3f6f-0170-a78b-bbbaef7a868c}
FF Extension: JSView - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{cf15270e-cf08-4def-b4ea-6a5ac23f3bca}
FF Extension: Adblock Plus - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF Extension: FoxClocks - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{d37dc5d0-431d-44e5-8c91-49419370caa1}
FF Extension: Menu Editor - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{EDA7B1D7-F793-4e03-B074-E6F303317FB0}
FF Extension: ScribeFire - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\{F807FACD-E46A-4793-B345-D58CB177673C}
FF Extension: No Name - C:\Documents and Settings\admin\Application Data\Mozilla\Firefox\Profiles\JonDoFox\Extensions\performancing-notes.xml
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [{ff0f24dd-184a-42ca-9ce8-8ca6184fd0ac}] - C:\Program Files\Web Optimizer\weboptimizer.xpi
FF Extension: No Name - C:\Program Files\Web Optimizer\weboptimizer.xpi

========================== Services (Whitelisted) =================

R2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AVM IGD CTRL Service; c:\program files\fritz!box\IGDCTRL.EXE [118784 2005-03-04] (AVM Berlin)
R2 CltMngSvc; C:\Program Files\SearchProtect\bin\CltMngSvc.exe [220960 2013-09-22] (Conduit)
S3 de_serv; C:\Program Files\Common Files\AVM\de_serv.exe [315392 2005-03-04] (AVM Berlin)
S3 Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software)
R2 JavaQuickStarterService; "C:\Program Files\Java\jre7\bin\jqs.exe" -service -config "C:\Program Files\Java\jre7\lib\deploy\jqs\jqs.conf"
S3 MozillaMaintenance; "C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe" [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-08-05] (Avira Operations GmbH & Co. KG)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [13560 2013-01-17] (GFI Software)
S3 MHIKEY10; C:\Windows\System32\Drivers\MHIKEY10.sys [51968 2011-02-10] (Generic USB smartcard reader)
R3 rtl8139; C:\Windows\System32\DRIVERS\RTL8139.SYS [20992 2004-08-04] (Realtek Semiconductor Corporation)
R2 Sentinel; C:\Windows\System32\Drivers\SENTINEL.SYS [64512 1997-05-29] ()
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-05] (Avira GmbH)
R3 STHDA; C:\Windows\System32\drivers\sthda.sys [1260744 2007-11-10] (IDT, Inc.)
S3 wceusbsh; C:\Windows\System32\DRIVERS\wceusbsh.sys [104064 2004-12-06] (Microsoft Corporation)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S4 IntelIde; No ImagePath
U5 ScsiPort; C:\Windows\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-07 12:39 - 2013-11-07 12:39 - 00000000 ____D C:\FRST
2013-11-07 12:28 - 2013-11-07 12:28 - 00000000 _____ C:\Documents and Settings\admin\defogger_reenable
2013-11-07 12:13 - 2013-11-07 12:13 - 102894578 _____ C:\WINDOWS\system32\宫떚L�
2013-11-07 00:51 - 2013-11-07 00:51 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-11-07 00:50 - 2013-11-07 01:39 - 00000000 ____D C:\WINDOWS\220FB0354744483A9A0B41DF77061583.TMP
2013-11-07 00:50 - 2013-11-07 00:50 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-11-06 01:59 - 2013-11-06 01:59 - 00207078 _____ C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
2013-11-05 12:27 - 2013-11-06 00:27 - 105119039 _____ C:\WINDOWS\system32\칄佤厔6
2013-11-05 01:17 - 2013-11-05 01:17 - 00119680 _____ C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2013-11-04 18:00 - 2013-11-05 17:44 - 00000830 _____ C:\WINDOWS\system32\InstallUtil.InstallLog
2013-11-04 17:55 - 2013-11-07 01:39 - 00000000 ____D C:\Documents and Settings\admin\Application Data\PriceGong
2013-11-04 17:54 - 2013-11-05 13:40 - 00000000 ____D C:\Documents and Settings\admin\Local Settings\Application Data\Plus-HD-3.8
2013-11-04 17:36 - 2013-11-04 17:36 - 00000000 ____D C:\Program Files\Microsoft.NET
2013-11-04 17:34 - 2013-11-04 17:34 - 00000000 ____D C:\Program Files\Web Optimizer
2013-11-04 17:34 - 2013-11-04 17:34 - 00000000 ____D C:\Documents and Settings\admin\Application Data\GutscheinCodes
2013-11-04 17:26 - 2013-11-07 12:17 - 00001284 _____ C:\WINDOWS\Tasks\Plus-HD-3.8-updater.job
2013-11-04 17:26 - 2013-11-07 12:17 - 00001186 _____ C:\WINDOWS\Tasks\Plus-HD-3.8-codedownloader.job
2013-11-04 17:26 - 2013-11-07 12:17 - 00001086 _____ C:\WINDOWS\Tasks\Plus-HD-3.8-enabler.job
2013-11-04 17:26 - 2013-11-04 17:26 - 00000000 ____D C:\Documents and Settings\admin\Application Data\Windows Net Data
2013-11-04 17:25 - 2013-11-07 12:17 - 00001806 _____ C:\WINDOWS\Tasks\Plus-HD-3.8-firefoxinstaller.job
2013-11-04 17:25 - 2013-11-04 17:26 - 00000000 ____D C:\Program Files\Plus-HD-3.8
2013-11-04 17:20 - 2013-11-04 17:57 - 00000000 ____D C:\Documents and Settings\admin\Local Settings\Application Data\Conduit
2013-11-04 17:20 - 2013-11-04 17:55 - 00000000 ____D C:\Documents and Settings\admin\Local Settings\Application Data\RadioTotal1
2013-11-04 17:20 - 2013-11-04 17:20 - 00000000 ____D C:\Program Files\RadioTotal1
2013-11-04 17:20 - 2013-11-04 17:20 - 00000000 ____D C:\Program Files\Conduit
2013-11-04 17:20 - 2013-11-04 17:20 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Conduit
2013-11-04 17:19 - 2013-11-04 17:19 - 00000000 ____D C:\Program Files\SearchProtect
2013-11-04 17:19 - 2013-11-04 17:19 - 00000000 ____D C:\Documents and Settings\admin\Application Data\SearchProtect
2013-11-04 17:18 - 2013-11-04 17:54 - 00000000 ____D C:\Documents and Settings\admin\Local Settings\Application Data\DownloadGuide
2013-11-04 17:18 - 2013-11-04 17:20 - 00000009 _____ C:\END
2013-11-04 17:18 - 2013-11-04 17:18 - 00000175 _____ C:\Documents and Settings\admin\Desktop\Amazon.url
2013-10-31 13:50 - 2013-11-01 12:27 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-10-30 16:31 - 2013-11-06 15:01 - 00000000 ____D C:\Documents and Settings\admin\My Documents\Auto
2013-10-30 13:09 - 2013-10-30 13:09 - 17226632 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerInstaller.exe
2013-10-30 13:03 - 2013-11-07 02:09 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2013-10-10 20:49 - 2013-10-10 20:49 - 00000940 _____ C:\Documents and Settings\admin\.recently-used.xbel

==================== One Month Modified Files and Folders =======

2013-11-07 12:39 - 2013-11-07 12:39 - 00000000 ____D C:\FRST
2013-11-07 12:28 - 2013-11-07 12:28 - 00000000 _____ C:\Documents and Settings\admin\defogger_reenable
2013-11-07 12:28 - 2008-01-11 08:27 - 00000000 ____D C:\Documents and Settings\admin
2013-11-07 12:22 - 2010-06-03 00:26 - 00000664 _____ C:\WINDOWS\system32\d3d9caps.dat
2013-11-07 12:22 - 2010-06-01 11:27 - 01244487 _____ C:\WINDOWS\WindowsUpdate.log
2013-11-07 12:17 - 2013-11-04 17:26 - 00001284 _____ C:\WINDOWS\Tasks\Plus-HD-3.8-updater.job
2013-11-07 12:17 - 2013-11-04 17:26 - 00001186 _____ C:\WINDOWS\Tasks\Plus-HD-3.8-codedownloader.job
2013-11-07 12:17 - 2013-11-04 17:26 - 00001086 _____ C:\WINDOWS\Tasks\Plus-HD-3.8-enabler.job
2013-11-07 12:17 - 2013-11-04 17:25 - 00001806 _____ C:\WINDOWS\Tasks\Plus-HD-3.8-firefoxinstaller.job
2013-11-07 12:13 - 2013-11-07 12:13 - 102894578 _____ C:\WINDOWS\system32\宫떚L�
2013-11-07 12:11 - 2008-01-12 03:23 - 00000157 _____ C:\WINDOWS\wiadebug.log
2013-11-07 12:11 - 2008-01-12 03:23 - 00000049 _____ C:\WINDOWS\wiaservc.log
2013-11-07 12:11 - 2008-01-11 08:04 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-11-07 02:26 - 2012-01-21 16:23 - 00504050 _____ C:\WINDOWS\setupapi.log
2013-11-07 02:26 - 2008-01-11 08:27 - 00000178 ___SH C:\Documents and Settings\admin\ntuser.ini
2013-11-07 02:26 - 2008-01-11 08:11 - 00032630 _____ C:\WINDOWS\SchedLgU.Txt
2013-11-07 02:23 - 2008-01-14 11:08 - 00000000 ___HD C:\BJPrinter
2013-11-07 02:09 - 2013-10-30 13:03 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2013-11-07 01:39 - 2013-11-07 00:50 - 00000000 ____D C:\WINDOWS\220FB0354744483A9A0B41DF77061583.TMP
2013-11-07 01:39 - 2013-11-04 17:55 - 00000000 ____D C:\Documents and Settings\admin\Application Data\PriceGong
2013-11-07 01:05 - 2009-03-06 20:59 - 00001599 _____ C:\Documents and Settings\Guest\Start Menu\Programs\Remote Assistance.lnk
2013-11-07 01:05 - 2008-01-11 08:04 - 00001599 _____ C:\Documents and Settings\Default User\Start Menu\Programs\Remote Assistance.lnk
2013-11-07 01:04 - 2008-01-11 08:27 - 00001599 _____ C:\Documents and Settings\admin\Start Menu\Programs\Remote Assistance.lnk
2013-11-07 00:51 - 2013-11-07 00:51 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-11-07 00:50 - 2013-11-07 00:50 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-11-06 15:01 - 2013-10-30 16:31 - 00000000 ____D C:\Documents and Settings\admin\My Documents\Auto
2013-11-06 10:29 - 2013-09-14 14:43 - 00001739 _____ C:\Documents and Settings\All Users\Desktop\Sony PC Companion 2.1.lnk
2013-11-06 10:29 - 2013-09-14 14:43 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Sony
2013-11-06 10:29 - 2012-11-26 16:32 - 00708420 _____ C:\WINDOWS\DPINST.LOG
2013-11-06 10:28 - 2008-01-14 10:57 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-11-06 01:59 - 2013-11-06 01:59 - 00207078 _____ C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
2013-11-06 00:27 - 2013-11-05 12:27 - 105119039 _____ C:\WINDOWS\system32\칄佤厔6
2013-11-05 17:44 - 2013-11-04 18:00 - 00000830 _____ C:\WINDOWS\system32\InstallUtil.InstallLog
2013-11-05 14:11 - 2008-09-05 21:48 - 00000000 ____D C:\Documents and Settings\admin\Application Data\Canon
2013-11-05 13:40 - 2013-11-04 17:54 - 00000000 ____D C:\Documents and Settings\admin\Local Settings\Application Data\Plus-HD-3.8
2013-11-05 12:25 - 2003-07-16 17:46 - 00002422 _____ C:\WINDOWS\system32\wpa.dbl
2013-11-05 01:17 - 2013-11-05 01:17 - 00119680 _____ C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2013-11-04 19:50 - 2008-08-09 21:20 - 00000000 ____D C:\WINDOWS\Microsoft.NET
2013-11-04 18:00 - 2008-08-09 21:22 - 00054768 _____ C:\Documents and Settings\admin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-11-04 17:57 - 2013-11-04 17:20 - 00000000 ____D C:\Documents and Settings\admin\Local Settings\Application Data\Conduit
2013-11-04 17:55 - 2013-11-04 17:20 - 00000000 ____D C:\Documents and Settings\admin\Local Settings\Application Data\RadioTotal1
2013-11-04 17:54 - 2013-11-04 17:18 - 00000000 ____D C:\Documents and Settings\admin\Local Settings\Application Data\DownloadGuide
2013-11-04 17:40 - 2008-01-12 03:22 - 00554740 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2013-11-04 17:36 - 2013-11-04 17:36 - 00000000 ____D C:\Program Files\Microsoft.NET
2013-11-04 17:34 - 2013-11-04 17:34 - 00000000 ____D C:\Program Files\Web Optimizer
2013-11-04 17:34 - 2013-11-04 17:34 - 00000000 ____D C:\Documents and Settings\admin\Application Data\GutscheinCodes
2013-11-04 17:26 - 2013-11-04 17:26 - 00000000 ____D C:\Documents and Settings\admin\Application Data\Windows Net Data
2013-11-04 17:26 - 2013-11-04 17:25 - 00000000 ____D C:\Program Files\Plus-HD-3.8
2013-11-04 17:20 - 2013-11-04 17:20 - 00000000 ____D C:\Program Files\RadioTotal1
2013-11-04 17:20 - 2013-11-04 17:20 - 00000000 ____D C:\Program Files\Conduit
2013-11-04 17:20 - 2013-11-04 17:20 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Conduit
2013-11-04 17:20 - 2013-11-04 17:18 - 00000009 _____ C:\END
2013-11-04 17:19 - 2013-11-04 17:19 - 00000000 ____D C:\Program Files\SearchProtect
2013-11-04 17:19 - 2013-11-04 17:19 - 00000000 ____D C:\Documents and Settings\admin\Application Data\SearchProtect
2013-11-04 17:18 - 2013-11-04 17:18 - 00000175 _____ C:\Documents and Settings\admin\Desktop\Amazon.url
2013-11-04 17:17 - 2008-01-14 17:10 - 00000000 ____D C:\Documents and Settings\admin\My Documents\Internet_und_Technisches
2013-11-01 12:27 - 2013-10-31 13:50 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-01 12:23 - 2012-04-25 20:12 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-10-31 23:00 - 2008-01-14 17:56 - 00000000 ____D C:\Documents and Settings\admin\My Documents\mehl
2013-10-30 13:09 - 2013-10-30 13:09 - 17226632 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerInstaller.exe
2013-10-30 13:09 - 2013-02-22 00:36 - 00692616 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2013-10-30 13:09 - 2013-02-22 00:36 - 00071048 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2013-10-29 19:38 - 2008-01-14 17:57 - 00000000 ____D C:\Documents and Settings\admin\My Documents\********
2013-10-29 15:19 - 2011-06-16 07:46 - 00000000 ____D C:\Documents and Settings\admin\Local Settings\Application Data\FreePDF_XP
2013-10-24 16:52 - 2008-01-14 17:59 - 00000000 ____D C:\Documents and Settings\admin\My Documents\**********
2013-10-10 20:49 - 2013-10-10 20:49 - 00000940 _____ C:\Documents and Settings\admin\.recently-used.xbel
2013-10-10 20:49 - 2008-10-08 06:18 - 00000000 ____D C:\Documents and Settings\admin\.gimp-2.6

Some content of TEMP:
====================
C:\Documents and Settings\admin\Local Settings\Temp\29bf2a33-eb06-4d5a-839c-99e9d1550dd0.exe
C:\Documents and Settings\admin\Local Settings\Temp\879b817b-2c1e-4198-8141-492ad5064cbb.exe
C:\Documents and Settings\admin\Local Settings\Temp\AskSLib.dll
C:\Documents and Settings\admin\Local Settings\Temp\dotNetFx40_Client_setup.exe
C:\Documents and Settings\admin\Local Settings\Temp\firefoxjre_exe.exe
C:\Documents and Settings\admin\Local Settings\Temp\install_flashplayer11x32au_mssa_aih.exe
C:\Documents and Settings\admin\Local Settings\Temp\jre-6u35-windows-i586-iftw.exe
C:\Documents and Settings\admin\Local Settings\Temp\jre-7u15-windows-i586-iftw.exe
C:\Documents and Settings\admin\Local Settings\Temp\nsh4A.exe
C:\Documents and Settings\admin\Local Settings\Temp\nso5C.exe
C:\Documents and Settings\admin\Local Settings\Temp\nsu61.exe
C:\Documents and Settings\admin\Local Settings\Temp\nsv4F.exe
C:\Documents and Settings\admin\Local Settings\Temp\setup.exe
C:\Documents and Settings\admin\Local Settings\Temp\setup_wm.exe
C:\Documents and Settings\admin\Local Settings\Temp\SHSetup.exe
C:\Documents and Settings\admin\Local Settings\Temp\SPStub.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 31-10-2013
Ran by admin at 2013-11-07 12:40:03
Running from C:\Documents and Settings\admin\My Documents\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}
Could not list Security Center items. Check WMI.


==================== Installed Programs ======================

7-PDF Maker Version 1.1.0 (Build 145) (Version: 7-PDF Maker - Version 1.1.0 (Build 145))
Ad-Aware Browsing Protection (Version: 1.0.1.82)
Adobe Flash Player 11 ActiveX (Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (Version: 11.9.900.117)
Adobe Reader XI (11.0.05) - Deutsch (Version: 11.0.05)
Adobe Shockwave Player 12.0 (Version: 12.0.2.122)
Avira Antivirus Premium (Version: 13.0.0.4052)
AVM FRITZ!DSL
Canon MP Drivers 6.0
Canon MP Navigator 1.0
Canon MX370 series On-screen Manual
Canon ScanGear Starter
Canon Utilities Easy-PhotoPrint
CD-LabelPrint
Compatibility Pack for the 2007 Office system (Version: 12.0.6514.5001)
ElsterFormular 2007/2008 (Version: 9.1.0.0)
ElsterFormular 2008/2009 (Version: 10.1.0.0)
ElsterFormular-Upgrade (Version: 14.0.0.10899)
EVEREST Home Edition v2.20 (Version: 2.20)
FreePDF (Remove only)
Gimp 2.6.0
GPL Ghostscript (Version: 9.02)
IDT Audio (Version: 5.10.5404.0)
Java 7 Update 21 (Version: 7.0.210)
Java Auto Updater (Version: 2.1.9.5)
jZip
Microsoft .NET Framework 2.0 Language Pack - DEU
Microsoft .NET Framework 2.0 Language Pack - DEU (Version: 1.1.50727.42)
Microsoft .NET Framework 2.0 Service Pack 2 (Version: 2.2.30729)
Microsoft .NET Framework 3.0 Service Pack 2 (Version: 3.2.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft ActiveSync 3.8
Microsoft Compression Client Pack 1.0 for Windows XP (Version: 1)
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft Office Word Viewer 2003 (Version: 11.0.8173.0)
Microsoft Silverlight (Version: 5.1.10411.0)
Microsoft User-Mode Driver Framework Feature Pack 1.5
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Mozilla Firefox 25.0 (x86 de) (Version: 25.0)
Mozilla Maintenance Service (Version: 25.0)
MSXML 6.0 Parser (KB933579) (Version: 6.10.1200.0)
Nokia Connectivity Cable Driver (Version: 6.83.9.0)
Nokia PC Suite (Version: 6.83.14.1)
OmniPage SE 2.0 (Version: 2.00.0004)
OpenOffice.org 3.3 (Version: 3.3.9567)
PC Connectivity Solution (Version: 7.7.10.0)
Plus-HD-3.8 (Version: 1.29.153.2)
Presto! PageManager 6.01
QuickTime (Version: 7.1.3.100)
RadioTotal1 Toolbar for IE (Version: 6.17.1.25)
RedMon - Redirection Port Monitor
Search Protect by conduit (Version: 1.7.0.72)
Sony PC Companion 2.10.181 (Version: 2.10.181)
swMSM (Version: 12.0.0.1)
Uninstall 1.0.0.1
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Windows Internet Explorer 8 (KB2598845) (Version: 1)
Update for Windows XP (KB2345886) (Version: 1)
Update for Windows XP (KB2467659) (Version: 1)
Update for Windows XP (KB2541763) (Version: 1)
Update for Windows XP (KB2641690) (Version: 1)
Update for Windows XP (KB2661254-v2) (Version: 2)
Update for Windows XP (KB2718704) (Version: 1)
Update for Windows XP (KB2736233) (Version: 1)
Update for Windows XP (KB2749655) (Version: 1)
Update for Windows XP (KB951978) (Version: 1)
Update for Windows XP (KB955759) (Version: 1)
Update for Windows XP (KB967715) (Version: 1)
Update for Windows XP (KB968389) (Version: 1)
Update for Windows XP (KB971029) (Version: 1)
Update for Windows XP (KB971737) (Version: 1)
Update for Windows XP (KB973687) (Version: 1)
Update for Windows XP (KB973815) (Version: 1)
VideoLAN VLC media player 0.8.6h (Version: 0.8.6h)
Visual Basic 6.0 Runtime&Steuerelemente
Web Optimizer
WebFldrs XP (Version: 9.50.6513)
Winamp (Version: 5.51 )
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component (Version: 3.0.0.0)
Windows Internet Explorer 8 (Version: 20090308.140743)
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3 (Version: 20080414.031525)
XnView 1.50.1 (Version: 1.50.1)

==================== Restore Points  =========================

09-08-2013 09:58:41 System Checkpoint
10-08-2013 13:29:10 System Checkpoint
11-08-2013 13:52:10 System Checkpoint
12-08-2013 16:27:42 System Checkpoint
14-08-2013 13:56:00 System Checkpoint
16-08-2013 16:56:55 System Checkpoint
17-08-2013 18:39:59 System Checkpoint
24-08-2013 13:01:11 System Checkpoint
25-08-2013 14:07:26 System Checkpoint
26-08-2013 16:05:01 System Checkpoint
27-08-2013 18:58:14 System Checkpoint
29-08-2013 10:39:27 System Checkpoint
30-08-2013 12:59:09 System Checkpoint
31-08-2013 13:23:27 System Checkpoint
02-09-2013 11:06:12 System Checkpoint
09-09-2013 10:01:06 System Checkpoint
10-09-2013 12:45:38 System Checkpoint
11-09-2013 15:04:59 System Checkpoint
12-09-2013 15:41:49 System Checkpoint
13-09-2013 16:20:46 System Checkpoint
14-09-2013 13:43:51 Sony PC Companion
14-09-2013 13:49:55 Sony PC Companion
16-09-2013 10:00:45 System Checkpoint
17-09-2013 14:12:40 System Checkpoint
18-09-2013 15:08:48 System Checkpoint
20-09-2013 09:43:49 System Checkpoint
21-09-2013 10:57:42 System Checkpoint
22-09-2013 13:15:46 System Checkpoint
23-09-2013 13:55:37 System Checkpoint
24-09-2013 14:48:44 System Checkpoint
25-09-2013 15:09:40 System Checkpoint
26-09-2013 16:09:12 System Checkpoint
01-10-2013 17:09:03 System Checkpoint
02-10-2013 19:23:08 System Checkpoint
04-10-2013 11:20:55 System Checkpoint
05-10-2013 15:03:32 System Checkpoint
07-10-2013 09:40:01 System Checkpoint
08-10-2013 11:13:48 System Checkpoint
09-10-2013 15:19:53 System Checkpoint
11-10-2013 14:55:12 System Checkpoint
14-10-2013 11:33:18 System Checkpoint
15-10-2013 14:39:21 System Checkpoint
16-10-2013 15:02:34 System Checkpoint
17-10-2013 18:41:34 System Checkpoint
18-10-2013 20:02:08 System Checkpoint
19-10-2013 20:09:09 System Checkpoint
21-10-2013 12:17:03 System Checkpoint
23-10-2013 11:33:46 System Checkpoint
24-10-2013 12:35:28 System Checkpoint
25-10-2013 13:22:45 System Checkpoint
27-10-2013 10:55:56 System Checkpoint
28-10-2013 11:47:18 System Checkpoint
29-10-2013 12:25:06 System Checkpoint
30-10-2013 18:28:11 System Checkpoint
01-11-2013 14:32:06 System Checkpoint
02-11-2013 14:41:55 System Checkpoint
03-11-2013 14:50:40 System Checkpoint
04-11-2013 18:56:37 System Checkpoint
05-11-2013 22:41:38 System Checkpoint
06-11-2013 23:51:05 SpyHunter wird installiert
07-11-2013 00:40:04 SpyHunter wird entfernt

==================== Hosts content: ==========================

2003-07-16 17:23 - 2008-01-25 17:56 - 00000761 ____N C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1       localhost
127.0.0.1       localhost


==================== Scheduled Tasks (whitelisted) =============

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\Plus-HD-3.8-codedownloader.job => C:\Program Files\Plus-HD-3.8\Plus-HD-3.8-codedownloader.exe
Task: C:\WINDOWS\Tasks\Plus-HD-3.8-enabler.job => C:\Program Files\Plus-HD-3.8\Plus-HD-3.8-enabler.exe
Task: C:\WINDOWS\Tasks\Plus-HD-3.8-firefoxinstaller.job => C:\Program Files\Plus-HD-3.8\Plus-HD-3.8-firefoxinstaller.exe
Task: C:\WINDOWS\Tasks\Plus-HD-3.8-updater.job => C:\Program Files\Plus-HD-3.8\Plus-HD-3.8-updater.exe

==================== Loaded Modules (whitelisted) =============

2011-06-16 07:42 - 2010-06-17 20:56 - 00116224 _____ () C:\WINDOWS\system32\redmonnt.dll
2013-08-05 09:22 - 2013-08-05 09:15 - 00394824 _____ () C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
2008-01-14 10:45 - 2005-03-04 11:47 - 00155648 ____N () c:\program files\fritz!box\SSLEAY32.dll
2008-01-14 10:45 - 2005-03-04 11:46 - 00790528 ____N () c:\program files\fritz!box\LIBEAY32.dll
2013-09-14 14:43 - 2012-04-30 10:57 - 00039936 _____ () C:\Program Files\Sony\Sony PC Companion\TMonitorAPI.dll
2013-09-14 14:43 - 2013-09-13 10:02 - 00208896 _____ () C:\Program Files\Sony\Sony PC Companion\MExplorer.dll
2011-01-17 15:19 - 2012-05-04 15:02 - 00985088 _____ () C:\Program Files\OpenOffice.org 3\program\libxml2.dll
2013-10-31 13:50 - 2013-10-31 13:50 - 03368048 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2013-10-30 13:03 - 2013-10-30 13:03 - 16233864 _____ () C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\UploadMgr => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== Faulty Device Manager Devices =============

Name: Video Controller (VGA Compatible)
Description: Video Controller (VGA Compatible)
Class Guid: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
Description: Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
Class Guid: {4D36E96B-E325-11CE-BFC1-08002BE10318}
Manufacturer: (Standard keyboards)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: SM Bus Controller
Description: SM Bus Controller
Class Guid: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Nokia 6500c
Description: Nokia 6500c
Class Guid: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
Manufacturer: Nokia
Service: WUDFRd
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/07/2013 01:30:30 AM) (Source: CltMngSvc) (User: )
Description: CltMngSvcFailed Running the process (Error: 193)

Error: (11/04/2013 05:20:11 PM) (Source: CltMngSvc) (User: )
Description: CltMngSvcServiceInstall: Fail to Start serviceSearch Protect by Conduit Updater (Error: 1056)

Error: (11/04/2013 05:17:30 PM) (Source: crypt32) (User: )
Description: Failed extract of third-party root list from auto update cab at: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: The data is invalid.

Error: (08/05/2013 09:23:18 AM) (Source: crypt32) (User: )
Description: Failed extract of third-party root list from auto update cab at: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (08/05/2013 09:23:18 AM) (Source: crypt32) (User: )
Description: Failed extract of third-party root list from auto update cab at: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (05/04/2013 03:30:17 PM) (Source: Avira Antivirus) (User: NT AUTHORITY)
Description: AUSNAHMEFEHLER beim Aufruf der Funktion AVEPROC_TestFile() für die Datei
C:\Documents and Settings\admin\My Documents\Downloads\registrybooster.exe
[ACCESS_VIOLATION Exception!! EIP = 0x137afe8]
Bitte Avira informieren und die obige Datei übersenden!

Error: (05/02/2013 10:55:57 AM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (05/02/2013 10:55:57 AM) (Source: crypt32) (User: )
Description: Failed extract of third-party root list from auto update cab at: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: The data is invalid.

Error: (05/02/2013 10:55:56 AM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (05/02/2013 10:55:56 AM) (Source: crypt32) (User: )
Description: Failed extract of third-party root list from auto update cab at: <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: The data is invalid.


System errors:
=============
Error: (11/06/2013 03:40:41 PM) (Source: Print) (User: WATT-7CU9UZCUCX)
Description: The document ******** owned by admin failed to print on printer Canon MP780 Series Printer. Data type: NT EMF 1.008. Size of the spool file in bytes: 1114112. Number of bytes printed: 761328. Total number of pages in the document: 1. Number of pages printed: 0. Client machine: \\WATT-7CU9UZCUCX. Win32 error code returned by the print processor: 

Error: (11/06/2013 01:44:01 PM) (Source: Print) (User: WATT-7CU9UZCUCX)
Description: The document owned by admin failed to print on printer Canon MP780 Series Printer. Data type: NT EMF 1.008. Size of the spool file in bytes: 65536. Number of bytes printed: 27100. Total number of pages in the document: 1. Number of pages printed: 0. Client machine: \\WATT-7CU9UZCUCX. Win32 error code returned by the print processor: ******

Error: (11/03/2013 07:40:45 PM) (Source: Print) (User: WATT-7CU9UZCUCX)
Description: The document Print owned by admin failed to print on printer Canon MP780 Series Printer. Data type: NT EMF 1.008. Size of the spool file in bytes: 65536. Number of bytes printed: 23108. Total number of pages in the document: 1. Number of pages printed: 0. Client machine: \\WATT-7CU9UZCUCX. Win32 error code returned by the print processor: Print0. Print1

Error: (10/28/2013 07:12:16 PM) (Source: Print) (User: WATT-7CU9UZCUCX)
Description: The document Print owned by admin failed to print on printer Canon MP780 Series Printer. Data type: NT EMF 1.008. Size of the spool file in bytes: 137396. Number of bytes printed: 47336. Total number of pages in the document: 2. Number of pages printed: 0. Client machine: \\WATT-7CU9UZCUCX. Win32 error code returned by the print processor: Print0. Print1

Error: (10/17/2013 05:21:29 PM) (Source: Print) (User: WATT-7CU9UZCUCX)
Description: The document LV_RS_JS_102013 owned by admin failed to print on printer Canon MP780 Series Printer. Data type: NT EMF 1.008. Size of the spool file in bytes: 291796. Number of bytes printed: 200332. Total number of pages in the document: 10. Number of pages printed: 0. Client machine: \\WATT-7CU9UZCUCX. Win32 error code returned by the print processor: LV_RS_JS_1020130. LV_RS_JS_1020131

Error: (10/16/2013 02:28:38 PM) (Source: Print) (User: WATT-7CU9UZCUCX)
Description: The document Wie berechne ich meine Rente? – neue Bundesländer–.pdf owned by admin failed to print on printer Canon MP780 Series Printer. Data type: NT EMF 1.008. Size of the spool file in bytes: 1638400. Number of bytes printed: 1378888. Total number of pages in the document: 2. Number of pages printed: 0. Client machine: \\WATT-7CU9UZCUCX. Win32 error code returned by the print processor: Wie berechne ich meine Rente? – neue Bundesländer–.pdf0. Wie berechne ich meine Rente? – neue Bundesländer–.pdf1

Error: (10/16/2013 02:28:10 PM) (Source: Print) (User: WATT-7CU9UZCUCX)
Description: The document Wie berechne ich meine Rente? – neue Bundesländer–.pdf owned by admin failed to print on printer Canon MP780 Series Printer. Data type: NT EMF 1.008. Size of the spool file in bytes: 2031616. Number of bytes printed: 1492560. Total number of pages in the document: 2. Number of pages printed: 0. Client machine: \\WATT-7CU9UZCUCX. Win32 error code returned by the print processor: Wie berechne ich meine Rente? – neue Bundesländer–.pdf0. Wie berechne ich meine Rente? – neue Bundesländer–.pdf1

Error: (10/16/2013 02:27:43 PM) (Source: Print) (User: WATT-7CU9UZCUCX)
Description: The document Wie berechne ich meine Rente? – neue Bundesländer–.pdf owned by admin failed to print on printer Canon MP780 Series Printer. Data type: NT EMF 1.008. Size of the spool file in bytes: 13598124. Number of bytes printed: 53312. Total number of pages in the document: 31. Number of pages printed: 0. Client machine: \\WATT-7CU9UZCUCX. Win32 error code returned by the print processor: Wie berechne ich meine Rente? – neue Bundesländer–.pdf0. Wie berechne ich meine Rente? – neue Bundesländer–.pdf1

Error: (10/15/2013 08:02:35 PM) (Source: Print) (User: WATT-7CU9UZCUCX)
Description: The document  owned by admin failed to print on printer Canon MP780 Series Printer. Data type: NT EMF 1.008. Size of the spool file in bytes: 65536. Number of bytes printed: 27492. Total number of pages in the document: 1. Number of pages printed: 0. Client machine: \\WATT-7CU9UZCUCX. Win32 error code returned by the print processor: Rechnung_********

Error: (10/15/2013 08:02:12 PM) (Source: Print) (User: WATT-7CU9UZCUCX)
Description: The document ***** owned by admin failed to print on printer Canon MP780 Series Printer. Data type: NT EMF 1.008. Size of the spool file in bytes: 65536. Number of bytes printed: 27492. Total number of pages in the document: 1. Number of pages printed: 0. Client machine: \\WATT-7CU9UZCUCX. Win32 error code returned by the print processor: 


Microsoft Office Sessions:
=========================
Error: (11/07/2013 01:30:30 AM) (Source: CltMngSvc)(User: )
Description: CltMngSvcFailed Running the process (Error: 193)

Error: (11/04/2013 05:20:11 PM) (Source: CltMngSvc)(User: )
Description: CltMngSvcServiceInstall: Fail to Start serviceSearch Protect by Conduit Updater (Error: 1056)

Error: (11/04/2013 05:17:30 PM) (Source: crypt32)(User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabThe data is invalid.

Error: (08/05/2013 09:23:18 AM) (Source: crypt32)(User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (08/05/2013 09:23:18 AM) (Source: crypt32)(User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (05/04/2013 03:30:17 PM) (Source: Avira Antivirus)(User: NT AUTHORITY)
Description: C:\Documents and Settings\admin\My Documents\Downloads\registrybooster.exeACCESS_VIOLATION0x137afe8AVEPROC_TestFile()

Error: (05/02/2013 10:55:57 AM) (Source: crypt32)(User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (05/02/2013 10:55:57 AM) (Source: crypt32)(User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabThe data is invalid.

Error: (05/02/2013 10:55:56 AM) (Source: crypt32)(User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (05/02/2013 10:55:56 AM) (Source: crypt32)(User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabThe data is invalid.


==================== Memory info =========================== 

Percentage of memory in use: 51%
Total physical RAM: 2039.29 MB
Available physical RAM: 987.63 MB
Total Pagefile: 3935.83 MB
Available Pagefile: 2786.21 MB
Total Virtual: 2047.88 MB
Available Virtual: 1946.2 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.75 GB) (Free:427.61 GB) NTFS ==>[Drive with boot components (Windows XP)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 466 GB) (Disk ID: 00B200B2)
Partition 1: (Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-07 16:04:16
Windows 5.1.2600 Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T1L0-10 Hitachi_HDT725050VLA380 rev.V56OA73A 465,76GB
Running: dhurwq62.exe; Driver: C:\DOCUME~1\admin\LOCALS~1\Temp\kfkyiaoc.sys


---- System - GMER 2.1 ----

SSDT   B9E7306C                                                                                          ZwClose
SSDT   B9E73026                                                                                          ZwCreateKey
SSDT   B9E73076                                                                                          ZwCreateSection
SSDT   B9E7304E                                                                                          ZwCreateSymbolicLinkObject
SSDT   B9E7301C                                                                                          ZwCreateThread
SSDT   B9E7302B                                                                                          ZwDeleteKey
SSDT   B9E73035                                                                                          ZwDeleteValueKey
SSDT   B9E73067                                                                                          ZwDuplicateObject
SSDT   B9E73053                                                                                          ZwLoadDriver
SSDT   B9E7303A                                                                                          ZwLoadKey
SSDT   B9E73008                                                                                          ZwOpenProcess
SSDT   B9E73049                                                                                          ZwOpenSection
SSDT   B9E7300D                                                                                          ZwOpenThread
SSDT   B9E7308F                                                                                          ZwQueryValueKey
SSDT   B9E73044                                                                                          ZwReplaceKey
SSDT   B9E73080                                                                                          ZwRequestWaitReplyPort
SSDT   B9E7303F                                                                                          ZwRestoreKey
SSDT   B9E7307B                                                                                          ZwSetContextThread
SSDT   B9E73085                                                                                          ZwSetSecurityObject
SSDT   B9E73058                                                                                          ZwSetSystemInformation
SSDT   B9E73030                                                                                          ZwSetValueKey
SSDT   B9E7308A                                                                                          ZwSystemDebugControl
SSDT   B9E73017                                                                                          ZwTerminateProcess
SSDT   B9E73012                                                                                          ZwWriteVirtualMemory

---- User code sections - GMER 2.1 ----

.text  C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe[3480] USER32.dll!DefWindowProcA + 11A     7E42C298 7 Bytes  JMP 10053C10 C:\Program Files\Sony\Sony PC Companion\NewUI.dll
.text  C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe[3480] USER32.dll!SetWindowRgn + 2BD       7E42E7E5 7 Bytes  JMP 10053AC0 C:\Program Files\Sony\Sony PC Companion\NewUI.dll
.text  C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe[3480] USER32.dll!SetClipboardData + 19D   7E43113B 7 Bytes  JMP 10053BF0 C:\Program Files\Sony\Sony PC Companion\NewUI.dll
.text  C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe[3480] USER32.dll!MessageBoxA + 49         7E450833 7 Bytes  JMP 10053CE0 C:\Program Files\Sony\Sony PC Companion\NewUI.dll
.text  C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe[3480] USER32.dll!MessageBoxExW + 1F       7E450857 7 Bytes  JMP 10053D30 C:\Program Files\Sony\Sony PC Companion\NewUI.dll
.text  C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe[3480] USER32.dll!MessageBoxTimeoutA + CA  7E4664D0 7 Bytes  JMP 10053C60 C:\Program Files\Sony\Sony PC Companion\NewUI.dll

---- EOF - GMER 2.1 ----