| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows 7: Firefox zeigt Overlay Werbung und schiebt "Ads not by this site" Blöcke einWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
22.11.2013, 09:46
| #1 |
| |  Windows 7: Firefox zeigt Overlay Werbung und schiebt "Ads not by this site" Blöcke ein Moin moin zusammen, ich hab mir vor einiger Zeit wohl auch etwas gefangen und hoffe darauf hier Hilfe zu bekommen den Plagegeist wieder los zu werden. Eigentlich hatte ich geplant das System komplett neu zu installieren, da ich derzeit meine Lizenzunterlagen jedoch nicht finde muss ich davon erstmal absehen. Meine Browser sind scheinbar mit Adons verseucht. Im Firefox und IE sehe ich Overlay Werbung und die Websiten verschieben sich weil wohl versucht wird Werbebanner einzublenden. Chrome bekomme ich nichtmal mehr gestartet. Als Virenscanner läuft bei mir Kaspersky der immer wieder folgendes findet (bin auf der Suche nach der Logfunktion für .txt Dateien noch nicht fündig geworden): Code:
ATTFilter C:\Documents and Settings\User\AppData\Local\Temp\FEED.tmp//pack 2.6.1673.238.7z//protector.dll
C:\Documents and Settings\User\AppData\Local\Temp\FEED.tmp//pack 2.6.1673.238.7z//bprotect.exe
Ich bin dann die Analyseschritte wie in der Anleitung durchgegangen, hier die Logs: Defogger: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 09:01 on 22/11/2013 (User)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Pro Agent -> Removed
Checking for services/drivers...
-=E.O.F=-
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-11-2013
Ran by User (administrator) on USER-THINK on 22-11-2013 09:02:17
Running from C:\Users\User\Downloads\Aufräumen
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Lenovo.) C:\Windows\system32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe
() C:\ProgramData\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Conexant Systems Inc.) C:\Windows\system32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
(Lenovo Group Limited) C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
(Microsoft Corporation) c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SAsrv.exe
(Iminent) C:\Program Files (x86)\Common Files\Umbrella\umbrella.exe
(Microsoft Corporation) c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
() C:\Program Files (x86)\SmartSVN 6.6\bin\statuscached.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Ulead Systems, Inc.) C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(X-Rite Inc.) C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe
(X-Rite Inc.) C:\Program Files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(UPEK Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Lenovo Group Limited) C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe
(Lenovo Group Limited) C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE
(Lenovo Group Limited) C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE
(Lenovo Group Limited) C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe
(hxxp://tortoisesvn.net) C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Avanquest Software ) C:\Program Files (x86)\Digital Line Detect\DLG.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
() C:\Program Files (x86)\SmartSVN 6.6\bin\smartsvn.exe
(X-Rite Inc.) C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe
(Dropbox, Inc.) C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Visual Studio 10.0\Common7\IDE\devenv.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Lenovo Group Limited) C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Nokia) C:\Program Files (x86)\Nokia\Qt4VSAddin\qtappwrapper.exe
() C:\Program Files\ThinkPad\Bluetooth Software\Bluetooth Headset Helper.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\System Update\SUService.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
() C:\ProgramData\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winamp.exe
( ) C:\Users\User\Downloads\miranda-im-v0.9.32-x64\miranda64.exe
(Microsoft Corporation) C:\Windows\system32\prevhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(FileZilla Project) C:\Program Files (x86)\FileZilla FTP Client\filezilla.exe
(Microsoft Corporation) C:\Windows\system32\mspaint.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmprph.exe
(Microsoft Corporation) c:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\vcpackages\VCPkgSrv.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BluetoothHeadsetProxy.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BtStackServer.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil64_11_9_900_117_ActiveX.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2731304 2011-03-24] (Synaptics Incorporated)
HKLM\...\Run: [TpShocks] - C:\Windows\System32\TpShocks.exe [380776 2010-12-09] (Lenovo.)
HKLM\...\Run: [ForteConfig] - C:\Program Files\CONEXANT\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2011-03-15] (Conexant systems, Inc.)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [LENOVO.TPKNRRES] - C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe [41320 2011-04-04] (Lenovo Group Limited)
HKLM\...\Run: [ALCKRESI.EXE] - C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe [281448 2011-02-28] (Lenovo Group Limited)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE [2779024 2011-03-14] (CANON INC.)
HKLM-x32\...\RunOnce: [SPUpdSentinel] - "C:\Program Files (x86)\Common Files\Umbrella\umbrella_bkp.exe" -SERVICEARGS=c [2864448 2013-11-07] (Iminent)
Winlogon\Notify\igfxcui: C:\Windows\SYSTEM32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (UPEK Inc.)
HKLM\...\Policies\Explorer: [NoDriveTypeAutoRun_KL_notset] 1
HKCU\...\Run: [Personal ID] - C:\coolspot AG\Personal ID\pid.exe [1134008 2009-03-04] (coolspot AG, Düsseldorf)
HKCU\...\Run: [GoogleChromeAutoLaunch_BCEA24321E5E4F1401136BBEDFB545FE] - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [863184 2013-11-14] (Google Inc.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20549280 2013-10-21] (Skype Technologies S.A.)
HKCU\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_9_900_117_Plugin.exe -update plugin [829832 2013-10-09] (Adobe Systems Incorporated)
MountPoints2: {b241c197-ea61-11e0-9f4c-806e6f6e6963} - Q:\LenovoQDrive.exe
HKLM-x32\...\Run: [RotateImage] - C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [IMSS] - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [112152 2011-01-17] (Intel Corporation)
HKLM-x32\...\Run: [PWMTRV] - C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL [1544040 2011-03-23] (Lenovo Group Limited)
HKLM-x32\...\Run: [X-Rite Legacy Device] - C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe [105984 2010-09-28] (X-Rite Inc.)
HKLM-x32\...\Run: [Lenovo Registration] - C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe [4351712 2011-07-13] (Lenovo, Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254896 2012-09-17] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe [356128 2013-10-09] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1612920 2011-08-04] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] - C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2011-01-15] (CANON INC.)
HKLM-x32\...\Run: [Iminent] - C:\Program Files (x86)\Iminent\Iminent.exe /warmup "F77F87E5-A6BD-4922-A530-EDF63D7E9F8C"
HKLM-x32\...\Run: [IminentMessenger] - C:\Program Files (x86)\Iminent\Iminent.Messengers.exe
HKU\Default\...\RunOnce: [] - [x]
HKU\Default\...\RunOnce: [Lenovoautoqdrive] - C:\Program Files (x86)\Common Files\Lenovo\LenovoDrive\LenovoAutoRunReg.exe [159744 2009-03-24] ()
HKU\Default User\...\RunOnce: [] - [x]
HKU\Default User\...\RunOnce: [Lenovoautoqdrive] - C:\Program Files (x86)\Common Files\Lenovo\LenovoDrive\LenovoAutoRunReg.exe [159744 2009-03-24] ()
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [226920 2011-06-01] (NVIDIA Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/welcome/thinkpad
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENP
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.iminent.com/?appId=F09826C3-2A87-48FE-AFFF-62867ECC10F1
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page =
URLSearchHook: HKCU - (No Name) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - No File
URLSearchHook: HKCU - (No Name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No File
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.greatresults.info/?l=1&q={searchTerms}
SearchScopes: HKLM-x32 - {BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} URL = hxxp://start.iminent.com/?appId=F09826C3-2A87-48FE-AFFF-62867ECC10F1&ref=toolbox&q={searchTerms}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=117065&tt=4812_6&babsrc=SP_ss&mntrId=d69fddbb0000000000000024d7e74974
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
SearchScopes: HKCU - {5568DBFC-F548-4D81-AFFA-21A76CC3B5E0} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://websearch.greatresults.info/?l=1&q={searchTerms}
SearchScopes: HKCU - {BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} URL = hxxp://start.iminent.com/?appId=F09826C3-2A87-48FE-AFFF-62867ECC10F1&ref=toolbox&q={searchTerms}
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Symantec VIP Access Add-On - {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} - C:\Program Files (x86)\Symantec\VIP Access Client\64bit\VIPAddOnForIE64.dll (Symantec Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: iminent Helper Object - {112BA211-334C-4A90-90EC-2AD1CDAB287C} - C:\Program Files (x86)\IminentToolbar\1.8.25.0\bh\iminent.dll No File
BHO-x32: Vaudix Class - {3DAC0B5C-D5DB-8E8F-6AC2-3D4C04A8456E} - C:\ProgramData\Vaudix\50b3953e94be5.ocx ()
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: IMinent WebBooster (BHO) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Program Files (x86)\Iminent\Iminent.WebBooster.InternetExplorer.dll No File
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Symantec VIP Access Add-On - {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} - C:\Program Files (x86)\Symantec\VIP Access Client\VIPAddOnForIE.dll (Symantec Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Microsoft-Webtestaufzeichnung 10.0-Hilfsprogramm - {DDA57003-0068-4ed2-9D32-4D1EC707D94D} - C:\Program Files (x86)\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll (Microsoft Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKLM-x32 - Iminent Toolbar - {1FAFD711-ABF9-4F6A-8130-5166C7371427} - C:\Program Files (x86)\IminentToolbar\1.8.25.0\iminentTlbr.dll No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {40C3CC16-7269-4B32-9531-17F2950FB06F} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\43xh5f3u.default
FF user.js: detected! => C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\43xh5f3u.default\user.js
FF NewTab: hxxp://start.iminent.com/?ref=NewTab&appId=F09826C3-2A87-48FE-AFFF-62867ECC10F1
FF SearchEngineOrder.1: Delta Search
FF SearchEngineOrder.user_pref("browser.search.order.1,S", "WebSearch");: user_pref("browser.search.order.1,S", "WebSearch");
FF SelectedSearchEngine: StartWeb
FF Homepage: hxxp://start.iminent.com/?appId=F09826C3-2A87-48FE-AFFF-62867ECC10F1
FF Keyword.URL: hxxp://websearch.greatresults.info/?l=1&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_39 - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nullsoft.com/winampDetector;version=1 - C:\Program Files (x86)\Winamp Detect\npwachk.dll (Nullsoft, Inc.)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.4 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\43xh5f3u.default\searchplugins\delta.xml
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\43xh5f3u.default\searchplugins\iminent.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\StartWeb.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\StartWeb.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Vaudix - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\43xh5f3u.default\Extensions\50b3953e94a5f@50b3953e94a98.com
FF Extension: Delta Toolbar - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\43xh5f3u.default\Extensions\ffxtlbr@delta.com
FF Extension: Iminent Toolbar - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\43xh5f3u.default\Extensions\ffxtlbr@iminent.com
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\43xh5f3u.default\Extensions\ich@maltegoetz.de
FF Extension: YouTube Unblocker - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\43xh5f3u.default\Extensions\youtubeunblocker@unblocker.yt
FF Extension: Updated Ad Blocker for Firefox 11+ - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\43xh5f3u.default\Extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3618C}
FF Extension: webbooster - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\43xh5f3u.default\Extensions\webbooster@iminent.com.xpi
FF Extension: youtube2mp3 - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\43xh5f3u.default\Extensions\youtube2mp3@mondayx.de.xpi
FF Extension: gadrm - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\43xh5f3u.default\Extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3618C}.xpi
FF Extension: prefs - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\43xh5f3u.default\Extensions\{b9d65cc7-5cff-4878-9241-9c009113c7ea}.xpi
FF Extension: Adblock Plus - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\43xh5f3u.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\43xh5f3u.default\Extensions\{f00daf3b-72a1-4e29-be81-89da89935604}.xpi
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA}
FF HKLM-x32\...\Firefox\Extensions: [VIP@verisign.com] - C:\Program Files (x86)\Symantec\VIP Access Client\
FF Extension: Symantec VIP Access Add-On - C:\Program Files (x86)\Symantec\VIP Access Client\
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\FFExt\url_advisor@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\FFExt\virtual_keyboard@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\FFExt\content_blocker@kaspersky.com
FF Extension: Content Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\FFExt\content_blocker@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
Chrome:
=======
CHR HomePage: hxxp://start.iminent.com/?appId=F09826C3-2A87-48FE-AFFF-62867ECC10F1
CHR RestoreOnStartup: "hxxp://start.iminent.com/?appId=F09826C3-2A87-48FE-AFFF-62867ECC10F1"
CHR DefaultSearchURL: (WebSearch) - hxxp://websearch.greatresults.info/?l=1&q={searchTerms}
CHR DefaultSuggestURL: (WebSearch) - none
CHR Extension: (Kaspersky URL Advisor) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0
CHR Extension: (Vaudix) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\didafkngkbkeojodacbingfkhfgnefji\1.3_0
CHR Extension: (Iminent) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\igdhbblpcellaljokkpfhcjlagemhgjl\7.41.2.1_0
CHR Extension: (Virtual Keyboard) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_0
CHR Extension: (Skype Click to Call) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.2.3.3_0
CHR Extension: (Iminent Chrome Toolbar) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [didafkngkbkeojodacbingfkhfgnefji] - C:\ProgramData\Vaudix\didafkngkbkeojodacbingfkhfgnefji.crx
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\ChromeExt\content_blocker_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\ChromeExt\virtkbd.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
CHR HKLM-x32\...\Chrome\Extension: [pkhojieggfgllhllcegoffdcnmdeojgb] - C:\Program Files (x86)\IminentToolbar\1.8.25.0\iminent.crx
==================== Services (Whitelisted) =================
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe [356128 2013-10-09] (Kaspersky Lab ZAO)
R2 BrowserProtect; C:\ProgramData\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [2847696 2013-07-26] ()
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [477032 2011-03-23] (Lenovo.)
R2 i1 Display Service; C:\Program Files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe [163328 2010-09-28] (X-Rite Inc.)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [93032 2010-04-07] (Lenovo Group Limited)
R2 MSSQL$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [57617752 2009-03-30] (Microsoft Corporation)
R2 SProtection; C:\Program Files (x86)\Common Files\Umbrella\umbrella.exe [2864448 2013-11-07] (Iminent)
S4 SQLAgent$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [427880 2009-03-30] (Microsoft Corporation)
R2 statuscached; C:\Program Files (x86)\SmartSVN 6.6\bin\statuscached.exe [216576 2011-07-29] ()
R2 VIPAppService; C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe [84088 2011-04-13] (Symantec Corporation)
R2 xritedeviced; C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe [142848 2010-09-28] (X-Rite Inc.)
==================== Drivers (Whitelisted) ====================
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [271424 2011-10-10] (DT Soft Ltd)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [7717984 2013-10-09] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [626272 2013-10-09] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-10-09] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-09] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-06-17] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-04-28] (Kaspersky Lab ZAO)
R3 LenovoRd; C:\Windows\System32\Drivers\LenovoRd.sys [118016 2009-05-11] (Lenovo)
S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2011-09-29] ()
R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13840 2009-03-13] (UPEK Inc.)
R3 TVTI2C; C:\Windows\System32\DRIVERS\Tvti2c.sys [41536 2009-09-24] (Lenovo (United States) Inc.)
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [90208 2013-04-28] (Kaspersky Lab ZAO)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-22 09:01 - 2013-11-22 09:02 - 00000000 ____D C:\Users\User\Downloads\Aufräumen
2013-11-22 09:01 - 2013-11-22 09:01 - 00000178 _____ C:\Users\User\defogger_reenable
2013-11-22 08:50 - 2013-11-22 08:50 - 00000000 ____D C:\FRST
2013-11-21 18:02 - 2013-11-21 18:02 - 00021154 _____ C:\Users\User\Downloads\ak16_ende.dat
2013-11-17 10:59 - 2013-11-17 10:59 - 00001161 _____ C:\Users\User\Desktop\Content Manager 2.lnk
2013-11-17 10:59 - 2013-11-17 10:59 - 00000000 ____D C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Becker
2013-11-17 10:59 - 2013-11-17 10:59 - 00000000 ____D C:\Users\User\AppData\Roaming\becker
2013-11-17 10:59 - 2013-11-17 10:59 - 00000000 ____D C:\Program Files (x86)\Becker
2013-11-17 10:58 - 2013-11-17 10:58 - 00000000 ____D C:\ProgramData\NNG
2013-11-16 03:07 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-16 03:07 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-16 03:07 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-16 03:07 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-16 03:07 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-16 03:07 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-16 03:07 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-16 03:07 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-16 03:07 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-16 03:07 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-16 03:07 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-16 03:07 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-16 03:07 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-16 03:07 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-16 03:07 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-16 03:07 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-16 03:07 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-16 03:07 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-16 03:07 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-16 03:07 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-16 03:07 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-16 03:07 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-16 03:07 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-16 03:07 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-16 03:07 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-16 03:07 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-16 03:07 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-16 03:07 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-16 03:07 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-16 03:07 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-16 03:07 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-16 03:02 - 2013-11-16 03:02 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-14 03:20 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-14 03:20 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-14 03:20 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-14 03:20 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-14 03:20 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-14 03:20 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-14 03:20 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-14 03:20 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-14 03:20 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-14 03:20 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-14 03:20 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-14 03:20 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-14 03:20 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-14 03:20 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-14 03:20 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-14 03:20 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-14 03:20 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-14 03:20 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-14 03:20 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-14 03:20 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-14 03:20 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-14 03:20 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-14 03:20 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-14 03:19 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-14 03:19 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-14 03:19 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-14 03:19 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-14 03:19 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-14 03:19 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-14 03:19 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-12 17:18 - 2013-11-12 17:18 - 00002130 _____ C:\Users\Public\Desktop\Fritz8.lnk
2013-11-12 17:18 - 2013-11-12 17:18 - 00000000 ____D C:\Users\User\AppData\Roaming\ChessBase
2013-11-12 17:16 - 2013-11-12 17:23 - 00000000 ____D C:\Users\User\Documents\ChessBase
2013-11-12 17:16 - 2013-11-12 17:18 - 00000000 ____D C:\Program Files (x86)\ChessBase
2013-11-08 22:12 - 2013-11-08 22:12 - 00020006 _____ C:\Users\User\Downloads\sms_no9_whf.dat
2013-11-08 20:27 - 2013-11-08 20:27 - 00009100 _____ C:\Users\User\Documents\Ulisses_Bestellliste.xlsx
2013-11-04 16:03 - 2013-11-06 19:10 - 00000000 ____D C:\Users\User\Downloads\Geburtstag
2013-11-04 15:55 - 2013-11-04 15:55 - 00491359 _____ C:\Users\User\Downloads\Geburtstag.zip
2013-11-02 11:06 - 2013-11-02 11:06 - 00035364 _____ C:\Users\User\Documents\Praiodan von Liebfeld.html
2013-11-02 11:05 - 2013-11-02 11:05 - 00033808 _____ C:\Users\User\Documents\Hjal Ingason.html
2013-11-01 17:27 - 2013-11-01 17:27 - 00014725 _____ C:\Users\User\Documents\Shop_Übersicht.xlsx
2013-10-31 14:57 - 2013-10-31 14:57 - 00013014 _____ C:\Users\User\Downloads\Turnier.dat
2013-10-28 17:10 - 2013-10-28 16:33 - 00002640 _____ C:\Users\User\Documents\ELO-Datei TGH Cup III - Ordnung & Chaos.txt
2013-10-28 16:34 - 2013-10-28 16:34 - 00032230 _____ C:\Users\User\Downloads\MAPM 2013a.dat
2013-10-28 16:33 - 2013-10-28 16:33 - 00002640 _____ C:\Users\User\Downloads\ELO-Datei TGH Cup III - Ordnung & Chaos.txt
2013-10-23 14:40 - 2013-10-23 14:40 - 00029870 _____ C:\Users\User\Downloads\k1.dat
==================== One Month Modified Files and Folders =======
2013-11-22 09:02 - 2013-11-22 09:01 - 00000000 ____D C:\Users\User\Downloads\Aufräumen
2013-11-22 09:02 - 2013-02-22 11:23 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-22 09:01 - 2013-11-22 09:01 - 00000178 _____ C:\Users\User\defogger_reenable
2013-11-22 08:50 - 2013-11-22 08:50 - 00000000 ____D C:\FRST
2013-11-22 08:50 - 2013-04-28 08:27 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-11-22 08:50 - 2011-09-29 16:58 - 00764636 _____ C:\Windows\system32\perfh007.dat
2013-11-22 08:50 - 2011-09-29 16:58 - 00173492 _____ C:\Windows\system32\perfc007.dat
2013-11-22 08:50 - 2009-07-14 06:13 - 01797814 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-22 08:48 - 2011-10-20 20:29 - 00000000 ____D C:\Users\User\AppData\Roaming\Skype
2013-11-22 08:34 - 2011-09-29 07:41 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-22 08:34 - 2011-09-29 07:13 - 01569808 _____ C:\Windows\WindowsUpdate.log
2013-11-21 22:54 - 2013-02-09 15:54 - 00024274 _____ C:\Users\User\Documents\IWDZ_Georg.xlsx
2013-11-21 18:48 - 2013-09-13 21:46 - 00002088 _____ C:\Windows\wininit.ini
2013-11-21 18:23 - 2013-03-14 14:59 - 00000000 ____D C:\Users\User\AppData\Roaming\FileZilla
2013-11-21 18:02 - 2013-11-21 18:02 - 00021154 _____ C:\Users\User\Downloads\ak16_ende.dat
2013-11-21 16:32 - 2011-09-29 07:41 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-21 16:00 - 2011-10-11 00:17 - 00003494 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest
2013-11-21 16:00 - 2011-10-11 00:17 - 00003448 _____ C:\Windows\System32\Tasks\PCDEventLauncher
2013-11-21 16:00 - 2011-10-11 00:17 - 00000466 _____ C:\Windows\Tasks\SystemToolsDailyTest.job
2013-11-21 15:48 - 2012-07-29 10:06 - 00000000 ____D C:\Users\User\AppData\Roaming\Dropbox
2013-11-19 18:00 - 2011-10-11 00:17 - 00004234 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2013-11-19 18:00 - 2011-10-11 00:17 - 00000528 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2013-11-18 22:59 - 2009-07-14 05:45 - 00031296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-18 22:59 - 2009-07-14 05:45 - 00031296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-17 10:59 - 2013-11-17 10:59 - 00001161 _____ C:\Users\User\Desktop\Content Manager 2.lnk
2013-11-17 10:59 - 2013-11-17 10:59 - 00000000 ____D C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Becker
2013-11-17 10:59 - 2013-11-17 10:59 - 00000000 ____D C:\Users\User\AppData\Roaming\becker
2013-11-17 10:59 - 2013-11-17 10:59 - 00000000 ____D C:\Program Files (x86)\Becker
2013-11-17 10:58 - 2013-11-17 10:58 - 00000000 ____D C:\ProgramData\NNG
2013-11-17 10:57 - 2009-07-14 05:51 - 00081190 _____ C:\Windows\setupact.log
2013-11-16 09:21 - 2012-05-05 18:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-16 03:50 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-16 03:26 - 2012-07-29 10:08 - 00000000 ___RD C:\Users\User\Dropbox
2013-11-16 03:26 - 2011-10-20 20:28 - 00000000 ____D C:\ProgramData\Skype
2013-11-16 03:25 - 2011-11-16 16:54 - 00000000 ____D C:\Users\User\AppData\Local\TSVNCache
2013-11-16 03:24 - 2013-09-30 15:20 - 00003432 _____ C:\Windows\System32\Tasks\BrowserProtect
2013-11-16 03:24 - 2012-11-26 17:12 - 00000368 ____H C:\Windows\Tasks\VaudiXUpdaterTask{707219F4-58A9-45E2-AC8C-90620FA71B2D}.job
2013-11-16 03:24 - 2011-09-29 07:29 - 00000000 ____D C:\ProgramData\NVIDIA
2013-11-16 03:23 - 2010-11-21 04:47 - 00101090 _____ C:\Windows\PFRO.log
2013-11-16 03:23 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-16 03:07 - 2011-10-19 17:48 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-16 03:04 - 2013-07-21 02:01 - 00000000 ____D C:\Windows\system32\MRT
2013-11-16 03:02 - 2013-11-16 03:02 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-16 03:02 - 2012-10-12 06:25 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-12 17:23 - 2013-11-12 17:16 - 00000000 ____D C:\Users\User\Documents\ChessBase
2013-11-12 17:21 - 2011-10-11 00:16 - 00000000 ____D C:\Users\User\AppData\Local\VirtualStore
2013-11-12 17:18 - 2013-11-12 17:18 - 00002130 _____ C:\Users\Public\Desktop\Fritz8.lnk
2013-11-12 17:18 - 2013-11-12 17:18 - 00000000 ____D C:\Users\User\AppData\Roaming\ChessBase
2013-11-12 17:18 - 2013-11-12 17:16 - 00000000 ____D C:\Program Files (x86)\ChessBase
2013-11-12 17:18 - 2009-07-14 03:34 - 00000485 _____ C:\Windows\win.ini
2013-11-12 17:16 - 2011-09-29 07:17 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-11-09 11:47 - 2013-03-28 09:32 - 00022201 _____ C:\Users\User\Documents\Eisenbahn_Schuld.xlsx
2013-11-09 11:46 - 2013-03-27 14:30 - 00004070 _____ C:\Users\User\.heldEinstellungen4_1.xml
2013-11-08 22:12 - 2013-11-08 22:12 - 00020006 _____ C:\Users\User\Downloads\sms_no9_whf.dat
2013-11-08 20:27 - 2013-11-08 20:27 - 00009100 _____ C:\Users\User\Documents\Ulisses_Bestellliste.xlsx
2013-11-06 19:10 - 2013-11-04 16:03 - 00000000 ____D C:\Users\User\Downloads\Geburtstag
2013-11-04 15:55 - 2013-11-04 15:55 - 00491359 _____ C:\Users\User\Downloads\Geburtstag.zip
2013-11-02 11:06 - 2013-11-02 11:06 - 00035364 _____ C:\Users\User\Documents\Praiodan von Liebfeld.html
2013-11-02 11:05 - 2013-11-02 11:05 - 00033808 _____ C:\Users\User\Documents\Hjal Ingason.html
2013-11-02 11:05 - 2011-12-24 09:39 - 00000471 _____ C:\Windows\BRWMARK.INI
2013-11-02 11:05 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-11-02 09:44 - 2013-03-27 14:30 - 00000285 _____ C:\Users\User\.dsa4.properties
2013-11-02 09:44 - 2013-03-27 14:30 - 00000000 ____D C:\Users\User\helden
2013-11-01 17:27 - 2013-11-01 17:27 - 00014725 _____ C:\Users\User\Documents\Shop_Übersicht.xlsx
2013-10-31 14:57 - 2013-10-31 14:57 - 00013014 _____ C:\Users\User\Downloads\Turnier.dat
2013-10-28 16:34 - 2013-10-28 16:34 - 00032230 _____ C:\Users\User\Downloads\MAPM 2013a.dat
2013-10-28 16:33 - 2013-10-28 17:10 - 00002640 _____ C:\Users\User\Documents\ELO-Datei TGH Cup III - Ordnung & Chaos.txt
2013-10-28 16:33 - 2013-10-28 16:33 - 00002640 _____ C:\Users\User\Downloads\ELO-Datei TGH Cup III - Ordnung & Chaos.txt
2013-10-24 19:10 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-10-23 14:40 - 2013-10-23 14:40 - 00029870 _____ C:\Users\User\Downloads\k1.dat
Some content of TEMP:
====================
C:\Users\User\AppData\Local\Temp\cm_setup.exe
C:\Users\User\AppData\Local\Temp\i4j4181291544882764591.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-20 00:19
==================== End Of Log ============================
Scheinbar benutze ich das tool aber falsch, zumindest ist keine additions.txt erzeugt worden. Und das GMER Log: GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-22 09:54:52
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.AXM0 238,47GB
Running: 6ppugixb.exe; Driver: C:\Users\User\AppData\Local\Temp\kgtiraoc.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002ff5000 76 bytes [8B, 04, D3, A8, 01, 0F, 85, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 607 fffff80002ff504f 74 bytes [41, 3B, 58, 08, 0F, 87, A0, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe[3128] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076a41465 2 bytes [A4, 76]
.text C:\Program Files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe[3128] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076a414bb 2 bytes [A4, 76]
.text ... * 2
.text C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[4144] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd822db0 5 bytes JMP 000007fffd810180
.text C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[4144] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd8237d0 7 bytes JMP 000007fffd8100d8
.text C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[4144] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd828ef0 6 bytes JMP 000007fffd810148
.text C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[4144] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd83af60 5 bytes JMP 000007fffd810110
.text C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[4144] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefdfd89e0 8 bytes JMP 000007fffd8101f0
.text C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[4144] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefdfdbe40 8 bytes JMP 000007fffd8101b8
.text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[4412] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd822db0 5 bytes JMP 000007fffd810180
.text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[4412] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd8237d0 7 bytes JMP 000007fffd8100d8
.text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[4412] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd828ef0 6 bytes JMP 000007fffd810148
.text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[4412] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd83af60 5 bytes JMP 000007fffd810110
.text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[4412] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefdfd89e0 8 bytes JMP 000007fffd8101f0
.text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[4412] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefdfdbe40 8 bytes JMP 000007fffd8101b8
.text C:\Windows\system32\Dwm.exe[5044] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd822db0 5 bytes JMP 000007fffd810180
.text C:\Windows\system32\Dwm.exe[5044] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd8237d0 7 bytes JMP 000007fffd8100d8
.text C:\Windows\system32\Dwm.exe[5044] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd828ef0 6 bytes JMP 000007fffd810148
.text C:\Windows\system32\Dwm.exe[5044] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd83af60 5 bytes JMP 000007fffd810110
.text C:\Windows\system32\Dwm.exe[5044] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefdfd89e0 8 bytes JMP 000007fffd8101f0
.text C:\Windows\system32\Dwm.exe[5044] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefdfdbe40 8 bytes JMP 000007fffd8101b8
.text C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[5300] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd822db0 5 bytes JMP 000007fffd810180
.text C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[5300] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd8237d0 7 bytes JMP 000007fffd8100d8
.text C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[5300] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd828ef0 6 bytes JMP 000007fffd810148
.text C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[5300] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd83af60 5 bytes JMP 000007fffd810110
.text C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[5300] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefdfd89e0 8 bytes JMP 000007fffd8101f0
.text C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[5300] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefdfdbe40 8 bytes JMP 000007fffd8101b8
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[6128] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 00000000775befe0 5 bytes JMP 000000016fff0148
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[6128] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 00000000775e99b0 7 bytes JMP 000000016fff00d8
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[6128] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000775f94d0 5 bytes JMP 000000016fff0180
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[6128] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 00000000775f9640 5 bytes JMP 000000016fff0110
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[6128] C:\Windows\system32\kernel32.dll!RegSetValueExA 000000007761a500 7 bytes JMP 000000016fff01b8
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[6128] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd822db0 5 bytes JMP 000007fffd810180
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[6128] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd8237d0 7 bytes JMP 000007fffd8100d8
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[6128] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd828ef0 6 bytes JMP 000007fffd810148
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[6128] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd83af60 5 bytes JMP 000007fffd810110
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[6128] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefdfd89e0 8 bytes JMP 000007fffd8101f0
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[6128] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefdfdbe40 8 bytes JMP 000007fffd8101b8
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[6128] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe6c7490 11 bytes JMP 000007fffd810228
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[6128] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe6dbf00 7 bytes JMP 000007fffd810260
.text C:\Windows\System32\TpShocks.exe[580] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd822db0 5 bytes JMP 000007fffd810180
.text C:\Windows\System32\TpShocks.exe[580] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd8237d0 7 bytes JMP 000007fffd8100d8
.text C:\Windows\System32\TpShocks.exe[580] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd828ef0 6 bytes JMP 000007fffd810148
.text C:\Windows\System32\TpShocks.exe[580] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd83af60 5 bytes JMP 000007fffd810110
.text C:\Windows\System32\TpShocks.exe[580] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefdfd89e0 8 bytes JMP 000007fffd8101f0
.text C:\Windows\System32\TpShocks.exe[580] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefdfdbe40 8 bytes JMP 000007fffd8101b8
.text C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[2904] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd822db0 5 bytes JMP 000007fffd810180
.text C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[2904] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd8237d0 7 bytes JMP 000007fffd8100d8
.text C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[2904] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd828ef0 6 bytes JMP 000007fffd810148
.text C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[2904] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd83af60 5 bytes JMP 000007fffd810110
.text C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[2904] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefdfd89e0 8 bytes JMP 000007fffd8101f0
.text C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[2904] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefdfdbe40 8 bytes JMP 000007fffd8101b8
.text C:\Windows\System32\igfxpers.exe[2984] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 00000000775befe0 5 bytes JMP 000000016fff0148
.text C:\Windows\System32\igfxpers.exe[2984] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 00000000775e99b0 7 bytes JMP 000000016fff00d8
.text C:\Windows\System32\igfxpers.exe[2984] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000775f94d0 5 bytes JMP 000000016fff0180
.text C:\Windows\System32\igfxpers.exe[2984] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 00000000775f9640 5 bytes JMP 000000016fff0110
.text C:\Windows\System32\igfxpers.exe[2984] C:\Windows\system32\kernel32.dll!RegSetValueExA 000000007761a500 7 bytes JMP 000000016fff01b8
.text C:\Windows\System32\igfxpers.exe[2984] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd822db0 5 bytes JMP 000007fffd810180
.text C:\Windows\System32\igfxpers.exe[2984] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd8237d0 7 bytes JMP 000007fffd8100d8
.text C:\Windows\System32\igfxpers.exe[2984] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd828ef0 6 bytes JMP 000007fffd810148
.text C:\Windows\System32\igfxpers.exe[2984] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd83af60 5 bytes JMP 000007fffd810110
.text C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[5632] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd822db0 5 bytes JMP 000007fffd810180
.text C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[5632] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd8237d0 7 bytes JMP 000007fffd8100d8
.text C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[5632] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd828ef0 6 bytes JMP 000007fffd810148
.text C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[5632] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd83af60 5 bytes JMP 000007fffd810110
.text C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[5632] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefdfd89e0 8 bytes JMP 000007fffd8101f0
.text C:\Program Files\TortoiseSVN\bin\TSVNCache.exe[5632] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefdfdbe40 8 bytes JMP 000007fffd8101b8
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[5664] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefdfd89e0 8 bytes JMP 000007fffd8101f0
.text C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[5664] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefdfdbe40 8 bytes JMP 000007fffd8101b8
.text C:\Program Files\Windows Sidebar\sidebar.exe[4012] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd822db0 5 bytes JMP 000007fffd7a0180
.text C:\Program Files\Windows Sidebar\sidebar.exe[4012] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd8237d0 7 bytes JMP 000007fffd7a00d8
.text C:\Program Files\Windows Sidebar\sidebar.exe[4012] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd828ef0 6 bytes JMP 000007fffd7a0148
.text C:\Program Files\Windows Sidebar\sidebar.exe[4012] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd83af60 5 bytes JMP 000007fffd7a0110
.text C:\Program Files\Windows Sidebar\sidebar.exe[4012] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefdfd89e0 8 bytes JMP 000007fffd7a01f0
.text C:\Program Files\Windows Sidebar\sidebar.exe[4012] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefdfdbe40 8 bytes JMP 000007fffd7a01b8
.text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3556] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd822db0 5 bytes JMP 000007fffd810180
.text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3556] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd8237d0 7 bytes JMP 000007fffd8100d8
.text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3556] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd828ef0 6 bytes JMP 000007fffd810148
.text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3556] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd83af60 5 bytes JMP 000007fffd810110
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[2296] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 00000000775befe0 5 bytes JMP 000000016fff0148
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[2296] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 00000000775e99b0 7 bytes JMP 000000016fff00d8
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[2296] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000775f94d0 5 bytes JMP 000000016fff0180
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[2296] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 00000000775f9640 5 bytes JMP 000000016fff0110
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[2296] C:\Windows\system32\kernel32.dll!RegSetValueExA 000000007761a500 7 bytes JMP 000000016fff01b8
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[2296] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd822db0 5 bytes JMP 000007fffd810180
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[2296] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd8237d0 7 bytes JMP 000007fffd8100d8
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[2296] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd828ef0 6 bytes JMP 000007fffd810148
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[2296] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd83af60 5 bytes JMP 000007fffd810110
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[2296] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefdfd89e0 8 bytes JMP 000007fffd8101f0
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[2296] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefdfdbe40 8 bytes JMP 000007fffd8101b8
.text C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[3436] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd822db0 5 bytes JMP 000007fffd810180
.text C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[3436] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd8237d0 7 bytes JMP 000007fffd8100d8
.text C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[3436] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd828ef0 6 bytes JMP 000007fffd810148
.text C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[3436] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd83af60 5 bytes JMP 000007fffd810110
.text C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[824] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076a41465 2 bytes [A4, 76]
.text C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[824] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076a414bb 2 bytes [A4, 76]
.text ... * 2
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[6152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076a41465 2 bytes [A4, 76]
.text C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[6152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076a414bb 2 bytes [A4, 76]
.text ... * 2
.text C:\Windows\splwow64.exe[6824] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 00000000775befe0 5 bytes JMP 000000016fff0148
.text C:\Windows\splwow64.exe[6824] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 00000000775e99b0 7 bytes JMP 000000016fff00d8
.text C:\Windows\splwow64.exe[6824] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000775f94d0 5 bytes JMP 000000016fff0180
.text C:\Windows\splwow64.exe[6824] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 00000000775f9640 5 bytes JMP 000000016fff0110
.text C:\Windows\splwow64.exe[6824] C:\Windows\system32\kernel32.dll!RegSetValueExA 000000007761a500 7 bytes JMP 000000016fff01b8
.text C:\Windows\splwow64.exe[6824] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd822db0 5 bytes JMP 000007fffd810180
.text C:\Windows\splwow64.exe[6824] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd8237d0 7 bytes JMP 000007fffd8100d8
.text C:\Windows\splwow64.exe[6824] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd828ef0 6 bytes JMP 000007fffd810148
.text C:\Windows\splwow64.exe[6824] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd83af60 5 bytes JMP 000007fffd810110
.text C:\Windows\splwow64.exe[6824] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefdfd89e0 8 bytes JMP 000007fffd8101f0
.text C:\Windows\splwow64.exe[6824] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefdfdbe40 8 bytes JMP 000007fffd8101b8
.text C:\Windows\splwow64.exe[6824] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe6c7490 11 bytes JMP 000007fffd810228
.text C:\Windows\splwow64.exe[6824] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe6dbf00 7 bytes JMP 000007fffd810260
.text C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[7156] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076a41465 2 bytes [A4, 76]
.text C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[7156] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076a414bb 2 bytes [A4, 76]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe[10176] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd822db0 5 bytes JMP 000007fffd810180
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe[10176] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd8237d0 7 bytes JMP 000007fffd8100d8
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe[10176] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd828ef0 6 bytes JMP 000007fffd810148
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe[10176] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd83af60 5 bytes JMP 000007fffd810110
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe[10176] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefdfd89e0 8 bytes JMP 000007fffd8101f0
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe[10176] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefdfdbe40 8 bytes JMP 000007fffd8101b8
.text C:\Windows\system32\prevhost.exe[30376] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 00000000775befe0 5 bytes JMP 000000016fff0148
.text C:\Windows\system32\prevhost.exe[30376] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 00000000775e99b0 7 bytes JMP 000000016fff00d8
.text C:\Windows\system32\prevhost.exe[30376] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000775f94d0 5 bytes JMP 000000016fff0180
.text C:\Windows\system32\prevhost.exe[30376] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 00000000775f9640 5 bytes JMP 000000016fff0110
.text C:\Windows\system32\prevhost.exe[30376] C:\Windows\system32\kernel32.dll!RegSetValueExA 000000007761a500 7 bytes JMP 000000016fff01b8
.text C:\Windows\system32\prevhost.exe[30376] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd822db0 5 bytes JMP 000007fffd810180
.text C:\Windows\system32\prevhost.exe[30376] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd8237d0 7 bytes JMP 000007fffd8100d8
.text C:\Windows\system32\prevhost.exe[30376] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd828ef0 6 bytes JMP 000007fffd810148
.text C:\Windows\system32\prevhost.exe[30376] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd83af60 5 bytes JMP 000007fffd810110
.text C:\Windows\system32\prevhost.exe[30376] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefdfd89e0 8 bytes JMP 000007fffd8101f0
.text C:\Windows\system32\prevhost.exe[30376] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefdfdbe40 8 bytes JMP 000007fffd8101b8
.text C:\Windows\system32\prevhost.exe[30376] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe6c7490 11 bytes JMP 000007fffd810228
.text C:\Windows\system32\prevhost.exe[30376] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe6dbf00 7 bytes JMP 000007fffd810260
.text C:\Program Files\Windows Media Player\wmprph.exe[37628] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 00000000775befe0 5 bytes JMP 000000016fff0148
.text C:\Program Files\Windows Media Player\wmprph.exe[37628] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 00000000775e99b0 7 bytes JMP 000000016fff00d8
.text C:\Program Files\Windows Media Player\wmprph.exe[37628] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000775f94d0 5 bytes JMP 000000016fff0180
.text C:\Program Files\Windows Media Player\wmprph.exe[37628] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 00000000775f9640 5 bytes JMP 000000016fff0110
.text C:\Program Files\Windows Media Player\wmprph.exe[37628] C:\Windows\system32\kernel32.dll!RegSetValueExA 000000007761a500 7 bytes JMP 000000016fff01b8
.text C:\Program Files\Windows Media Player\wmprph.exe[37628] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd822db0 5 bytes JMP 000007fffd810180
.text C:\Program Files\Windows Media Player\wmprph.exe[37628] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd8237d0 7 bytes JMP 000007fffd8100d8
.text C:\Program Files\Windows Media Player\wmprph.exe[37628] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd828ef0 6 bytes JMP 000007fffd810148
.text C:\Program Files\Windows Media Player\wmprph.exe[37628] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd83af60 5 bytes JMP 000007fffd810110
.text C:\Program Files\Windows Media Player\wmprph.exe[37628] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefdfd89e0 8 bytes JMP 000007fffd8101f0
.text C:\Program Files\Windows Media Player\wmprph.exe[37628] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefdfdbe40 8 bytes JMP 000007fffd8101b8
.text C:\Program Files\Windows Media Player\wmprph.exe[37628] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe6c7490 11 bytes JMP 000007fffd810228
.text C:\Program Files\Windows Media Player\wmprph.exe[37628] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe6dbf00 7 bytes JMP 000007fffd810260
.text C:\Program Files (x86)\TextPad 5\TextPad.exe[17884] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076a41465 2 bytes [A4, 76]
.text C:\Program Files (x86)\TextPad 5\TextPad.exe[17884] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076a414bb 2 bytes [A4, 76]
.text ... * 2
.text C:\Windows\system32\taskeng.exe[38176] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd822db0 5 bytes JMP 000007fffd810180
.text C:\Windows\system32\taskeng.exe[38176] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd8237d0 7 bytes JMP 000007fffd8100d8
.text C:\Windows\system32\taskeng.exe[38176] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd828ef0 6 bytes JMP 000007fffd810148
.text C:\Windows\system32\taskeng.exe[38176] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd83af60 5 bytes JMP 000007fffd810110
.text C:\Windows\system32\taskeng.exe[38176] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefdfd89e0 8 bytes JMP 000007fffd8101f0
.text C:\Windows\system32\taskeng.exe[38176] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefdfdbe40 8 bytes JMP 000007fffd8101b8
.text C:\Windows\system32\taskeng.exe[38176] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe6c7490 11 bytes JMP 000007fffd810228
.text C:\Windows\system32\taskeng.exe[38176] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe6dbf00 7 bytes JMP 000007fffd810260
---- Threads - GMER 2.1 ----
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [7248:7468] 000007fefc4e2a7c
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\402cf46a0a8d
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\402cf46a0a8d (not active ControlSet)
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Ansonsten sage ich schonmal vielen Dank für eure/deine Unterstützung, es wäre toll wenn sich das System wieder in einen besser nutzbaren Zustand bringen ließe bis ich mein Lizenzproblem gelöst habe und alles einmal neu aufziehen kann. Geändert von Speci0815 (22.11.2013 um 09:56 Uhr) |
| Themen zu Windows 7: Firefox zeigt Overlay Werbung und schiebt "Ads not by this site" Blöcke ein |
| adblock, canon, chromium, dvdvideosoft ltd., newtab, plug-in, pup.bprotector, pup.optional.babsolution.a, pup.optional.babylon.a, pup.optional.bprotector.a, pup.optional.conduit.a, pup.optional.datamngr.a, pup.optional.delta, pup.optional.delta.a, pup.optional.filescout.a, pup.optional.iminent, pup.optional.iminent.a, pup.optional.mediasoft, pup.optional.opencandy, pup.optional.performersoft.a, pup.optional.softonic.a, pup.optional.sprotector.a, pup.optional.umbrella.a, pup.optional.vaudix.a, pup.optional.websearchinfo, pwmtr64v.dll, vaudix, win32/adware.multiplug.d, win32/adware.multiplug.h |
Baum-Darstellung