Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Amazon + E-mail account gehackt (https://www.trojaner-board.de/131447-amazon-e-mail-account-gehackt.html)

-Mausi- 24.02.2013 02:41
Amazon + E-mail account gehackt
 
Hallöchen,

ihr habt mir vor ein paar Jahren schon mal ziemlich geholfen und ich hoffe ich erhalte jetzt auch wieder hilfe.

Und zwar wurde vor einer Woche meine E-mail account gehackt. Zumindest bekamm ich immer mails zurück, das Mails von meiner E-mail adresse nicht zugestellt werden konnten. Ich hab dann direkt meine Zugangsdaten geändert und das Problem war behoben.

Heut der neueste Schreck. Irgendjemand hat von meinem Amazonkonto wohl ein Gutschein verschenkt und keine Stunde später kam von Amazon eine Nachricht, dass mein Account gehackt wurde und die meine Konten gesperrt jetzt hätten und zur Sicherheit Passwort geändert und die Bestellung storniert. Ich soll jetzt nur gucken ob noch was von meinem Konto abgeht.

Ja ich Konten gelöscht und Zugangsdaten geändert, dass erstmal nichts mehr angerichtet werden kann.

Hab jetzt auch reiner Vorsorge noch ein paar andere Zugangsdaten von anderen Seiten geändert.

Puhh.. trotzdem bin ich mir jetzt voll unsicher. Nicht das irgendwann mein Konto leer geräumt ist. Wie kommen die an mein Passwort? Und was kann ich noch tun?

Danke für eure Hilfe.

Ich hab jetzt als erstes das Malwarebytesystem durchlaufen lassen und meinen Virenscanner. Vorallem ich hab doch null Ahnung von sowas :(

Lieben Dank.

-Mausi-


Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.02.23.08

Windows 7 x86 NTFS
Internet Explorer 9.0.8112.16421
xxx :: xxx [Administrator]

24.02.2013 02:18:51
mbam-log-2013-02-24 (02-18-51).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 204008
Laufzeit: 9 Minute(n), 15 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

aharonov 24.02.2013 16:01
Hallo -Mausi- und :hallo:

Mein Name ist Leo und ich werde dich durch die Bereinigung deines Rechners begleiten.

Eine Bereinigung beinhaltet nebst dem Entfernen von Malware auch das Schliessen von Sicherheitslücken und sollte gründlich durchgeführt werden. Sie erfolgt deshalb in mehreren Schritten und bedeutet einigen Aufwand für dich.
Beachte: Das Verschwinden der offensichtlichen Symptome bedeutet nicht, dass das System schon sauber ist.
Arbeite daher in deinem eigenen Interesse solange mit, bis du das OK bekommst, dass alles erledigt ist.

Hinweise zum Ablauf
  • Du bekommst von mir jeweils eine individuell auf dich abgestimmte schrittweise Anleitung.
    • Lese diese Anweisungen immer zuerst vollständig durch und frag bei Unklarheiten nach, bevor du beginnst.
    • Arbeite die Anleitungen dann sorgfältig und in der angegebenen Reihenfolge ab und poste deine Rückmeldungen und Logfiles gesammelt in einer Antwort.
    • Füge den Inhalt der Logfiles wenn immer möglich innerhalb von Code-Tags in deine Antwort ein.
    • Sollten Probleme auftauchen, dann brich an dieser Stelle ab und schildere sie so gut wie möglich.
  • Es ist wichtig für mich, dass sich der Zustand deines Systems nicht plötzlich unvorhersehbar ändert. Deshalb: Bitte
    • .. lasse keine Scanner oder Tools ohne Aufforderung laufen. Lösche nichts auf eigene Faust.
    • .. installiere oder deinstalliere während der Bereinigung keine Software.
    • .. frag nicht parallel in anderen Foren nach Hilfe (Crossposting).
  • Ich kann dir keine Garantien geben, dass die Bereinigung schlussendlich erfolgreich sein wird und wir alles finden werden.
    • Ein Formatieren und Neuinstallieren ist meist der schnellere und immer der sicherere Weg.
    • Sollte ich eine schwerwiegende Infektion bei dir finden, werde ich dich nochmals darauf hinweisen. Es bleibt aber deine Entscheidung.
Los geht's: Alle Tools immer auf den Desktop speichern und von dort starten.


Zitat:
Hab jetzt auch reiner Vorsorge noch ein paar andere Zugangsdaten von anderen Seiten geändert.
Das ist sicher schon mal gut.

Schauen wir uns das mal an:


Schritt 1

Downloade dir bitte defogger (von jpshortstuff) auf deinen Desktop.
  • Starte das Tool mit Doppelklick.
  • Klicke nun auf den Disable Button.
  • Bestätige diese Sicherheitsabfrage mit Ja.
  • Wenn der Scan beendet wurde (Finished), klicke auf OK.
  • Falls Defogger zu einem Neustart auffordert, bestätige dies mit OK.
  • Defogger erstellt auf dem Desktop eine Logdatei mit dem Namen defogger_disable.txt.
  • Nur falls Probleme aufgetreten sind, poste deren Inhalt mit deiner nächsten Antwort.
Klicke den Re-enable Button nicht ohne Anweisung!



Schritt 2

Lade dir Gmer herunter (auf den Button Download EXE drücken) und speichere das Programm auf den Desktop.
  • Deaktiviere alle Antivirenprogramme und Malware/Spyware Scanner.
  • Trenne alle bestehenden Verbindungen zu einem Netzwerk/Internet (WLAN nicht vergessen).
  • Schliesse bitte alle anderen Programme.
  • Starte gmer.exe (die Datei hat einen zufälligen Dateinamen).
    Vista und Win7 User mit Rechtsklick "als Administrator starten".
  • Sollte sich ein Fenster mit folgender Warnung öffnen
    WARNING !!!
    GMER has found system modification, which might have been caused by ROOTKIT activity.
    Do you want to fully scan your system ?
    dann klicke unbedingt auf No.
  • Entferne rechts den Haken bei:
    • IAT/EAT
    • Show all
  • Setze rechts den Haken bei deiner Systempartition (normalerweise C:\).
  • Starte den Scan mit einem Klick auf Scan.
  • Mache gar nichts am Computer, während der Scan läuft!
  • Wenn der Scan fertig ist, klicke auf Save und speichere das Logfile unter Gmer.txt auf deinen Desktop.
  • Schliesse dann GMER und führe unmittelbar einen Neustart des Computers durch.
  • Füge bitte den Inhalt des Logfiles hier in deine Thread ein.
Antiviren-Programm und sonstige Scanner wieder einschalten, bevor du ins Netz gehst.



Schritt 3

Lade dir bitte OTL (von Oldtimer) herunter und speichere es auf deinen Desktop.
  • Doppelklick auf die OTL.exe.
  • Unter Extra Registry, wähle bitte Use SafeList.
  • Setze den Haken bei Scan all Users.
  • Klicke nun auf Run Scan.
  • Wenn der Scan beendet ist, werden 2 Logfiles (OTL.txt und Extras.txt) erstellt.
  • Poste den Inhalt dieser Logfiles hier in den Thread.



Bitte poste in deiner nächsten Antwort:
  • Log von Gmer
  • Logs von OTL

-Mausi- 24.02.2013 21:03
Soo.. hier ist das Ergebnis:

OTLOTL Logfile:
Code:
OTL logfile created on: 24.02.2013 20:29:16 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\xxx\Desktop\Projektarbeit\Bilder
 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,11 Gb Available Physical Memory | 37,04% Memory free
6,00 Gb Paging File | 4,13 Gb Available in Paging File | 68,92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 273,40 Gb Total Space | 184,66 Gb Free Space | 67,54% Space Free | Partition Type: NTFS
Drive D: | 182,26 Gb Total Space | 158,71 Gb Free Space | 87,08% Space Free | Partition Type: NTFS
Unable to calculate disk information.
 
Computer Name: xxx | User Name: xxx | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.02.24 20:27:43 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\Projektarbeit\Bilder\OTL.exe
PRC - [2013.02.21 16:49:47 | 000,917,400 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2012.12.18 20:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.10.30 23:50:59 | 004,297,136 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2011.09.01 13:25:38 | 000,671,552 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
PRC - [2011.09.01 13:23:08 | 001,526,080 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
PRC - [2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.04.15 09:16:48 | 000,288,064 | ---- | M] (DT Soft Ltd) -- C:\Program Files\DAEMON Tools Pro\DTShellHlp.exe
PRC - [2010.04.05 20:55:01 | 000,116,104 | ---- | M] () -- C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
PRC - [2010.04.02 10:18:54 | 001,185,112 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE
PRC - [2010.03.25 03:50:00 | 002,516,296 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
PRC - [2010.03.18 10:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2010.03.13 11:58:58 | 000,075,048 | ---- | M] (cyberlink) -- C:\Program Files\CyberLink\Shared files\brs.exe
PRC - [2010.02.02 23:08:56 | 000,087,336 | ---- | M] (CyberLink Corp.) -- C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe
PRC - [2009.08.26 19:36:00 | 002,684,256 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
PRC - [2009.08.05 21:28:20 | 002,072,576 | ---- | M] (Micro-Star International Co., Ltd.) -- C:\Program Files\System Control Manager\MGSysCtrl.exe
PRC - [2009.07.31 05:20:00 | 000,144,752 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
PRC - [2009.07.14 02:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009.07.10 06:05:00 | 000,348,160 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2009.07.10 06:04:30 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2009.07.09 23:54:42 | 000,160,768 | ---- | M] (Micro-Star International Co., Ltd.) -- C:\Program Files\System Control Manager\MSIService.exe
PRC - [2009.06.08 22:34:00 | 000,660,808 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
PRC - [2009.06.05 03:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2009.06.05 03:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
PRC - [2009.06.03 23:33:00 | 000,308,552 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
PRC - [2009.03.27 11:10:56 | 000,014,336 | ---- | M] (LSI Corporation) -- C:\Program Files\LSI SoftModem\agrsmsvc.exe
PRC - [2008.07.24 19:24:00 | 000,083,272 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
PRC - [2006.04.18 04:00:00 | 000,102,400 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.02.21 16:49:47 | 003,067,288 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2013.02.14 18:08:03 | 011,824,128 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\a00aab40bdf5aed84b4d4294965cf20d\System.Web.ni.dll
MOD - [2013.02.14 18:07:47 | 012,433,920 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\05682429807d34d6ff05a77ea153935f\System.Windows.Forms.ni.dll
MOD - [2013.01.10 18:52:44 | 000,771,584 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\01b47a246b4ec7bfec31bf4503aceda1\System.Runtime.Remoting.ni.dll
MOD - [2013.01.10 18:52:10 | 001,592,832 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\e2ee5d77ebe0bd025e7a7a317a43d677\System.Drawing.ni.dll
MOD - [2013.01.10 18:51:49 | 005,453,312 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\10aba2c167cc1119b80159fd9ac71ca8\System.Xml.ni.dll
MOD - [2013.01.10 18:51:45 | 000,971,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\96a3b737db1e72adaf32d2b350e50c23\System.Configuration.ni.dll
MOD - [2013.01.10 18:51:44 | 007,974,400 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\c54750e64ba10d0fb7b6a636fb3695ca\System.ni.dll
MOD - [2013.01.10 18:51:32 | 011,490,816 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b0b8554c05f194f546a8ed531320760b\mscorlib.ni.dll
MOD - [2010.01.03 22:46:18 | 000,094,208 | ---- | M] () -- C:\Program Files\FileZilla FTP Client\fzshellext.dll
MOD - [2009.09.16 23:43:17 | 000,434,176 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2009.09.16 23:43:15 | 000,315,392 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009.09.16 23:39:15 | 001,732,608 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.3478.18702__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll
MOD - [2009.09.16 23:39:15 | 000,339,968 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3478.18684__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:15 | 000,204,800 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3478.18704__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll
MOD - [2009.09.16 23:39:15 | 000,077,824 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3478.18756__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:15 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3478.18698__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll
MOD - [2009.09.16 23:39:15 | 000,036,864 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3478.18727__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:15 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3478.18693__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:14 | 000,950,272 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager2.Graphics.Dashboard\2.0.3478.18802__90ba9c70f846762e\CLI.Aspect.DisplaysManager2.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,782,336 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3478.18730__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,573,440 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3478.18705__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,491,520 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3478.18776__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll
MOD - [2009.09.16 23:39:14 | 000,409,600 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3478.18751__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll
MOD - [2009.09.16 23:39:14 | 000,393,216 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3478.18728__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,360,448 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.3478.18724__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,331,776 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3478.18742__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,315,392 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Dashboard\2.0.3478.18736__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,307,200 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Wizard\2.0.3478.18709__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Wizard.dll
MOD - [2009.09.16 23:39:14 | 000,270,336 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,196,608 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3478.18704__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,118,784 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard\2.0.3478.18775__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,094,208 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3478.18742__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll
MOD - [2009.09.16 23:39:14 | 000,094,208 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3478.18734__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,081,920 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3478.18729__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:14 | 000,073,728 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3478.18692__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,065,536 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3478.18737__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:14 | 000,061,440 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3478.18741__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:14 | 000,061,440 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3478.18728__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:14 | 000,045,056 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3478.18776__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,045,056 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime\2.0.3478.18775__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:14 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3478.18708__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:14 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3478.18729__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:14 | 000,036,864 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3478.18734__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:14 | 000,032,768 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3478.18735__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:13 | 000,651,264 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Implementation\2.0.3478.18800__90ba9c70f846762e\ResourceManagement.Foundation.Implementation.dll
MOD - [2009.09.16 23:39:13 | 000,098,304 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3428.28305__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,094,208 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Foundation\2.0.3428.28298__90ba9c70f846762e\CLI.Foundation.dll
MOD - [2009.09.16 23:39:13 | 000,065,536 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3428.28316__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,053,248 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3428.28315__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,053,248 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.3428.28314__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,053,248 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3428.28314__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,049,152 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3428.28314__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,045,056 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll
MOD - [2009.09.16 23:39:13 | 000,045,056 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3478.18781__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll
MOD - [2009.09.16 23:39:13 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3428.28324__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3428.28315__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,032,768 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\LOG.Foundation\2.0.3428.28296__90ba9c70f846762e\LOG.Foundation.dll
MOD - [2009.09.16 23:39:13 | 000,032,768 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3428.28309__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,028,672 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3428.28297__90ba9c70f846762e\NEWAEM.Foundation.dll
MOD - [2009.09.16 23:39:13 | 000,028,672 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3428.28354__90ba9c70f846762e\CLI.Foundation.XManifest.dll
MOD - [2009.09.16 23:39:13 | 000,028,672 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Shared\2.0.3428.28323__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,028,672 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.3428.28313__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,028,672 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3428.28312__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,028,672 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3428.28311__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,024,576 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3428.28304__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,024,576 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.3428.28314__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Private\2.0.3428.28303__90ba9c70f846762e\ResourceManagement.Foundation.Private.dll
MOD - [2009.09.16 23:39:13 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3428.28308__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3428.28302__90ba9c70f846762e\CLI.Component.Client.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3428.28312__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\APM.Foundation\2.0.3428.28310__90ba9c70f846762e\APM.Foundation.dll
MOD - [2009.09.16 23:39:13 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3428.28304__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3428.28302__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\MOM.Foundation\2.0.3428.28310__90ba9c70f846762e\MOM.Foundation.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\DEM.Graphics\2.0.3428.28324__90ba9c70f846762e\DEM.Graphics.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3428.28303__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3428.28313__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3428.28312__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3428.28304__90ba9c70f846762e\AEM.Server.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3428.28311__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Plugin.REG.Shared\2.0.3428.28329__90ba9c70f846762e\AEM.Plugin.REG.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3428.28327__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3428.28311__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3428.28327__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,007,168 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3478.18679__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll
MOD - [2009.09.16 23:39:13 | 000,007,168 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll
MOD - [2009.09.16 23:39:12 | 001,212,416 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3478.18688__90ba9c70f846762e\CLI.Component.Dashboard.dll
MOD - [2009.09.16 23:39:12 | 000,552,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3478.18764__90ba9c70f846762e\CLI.Component.Systemtray.dll
MOD - [2009.09.16 23:39:12 | 000,405,504 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3478.18698__90ba9c70f846762e\CLI.Component.Wizard.dll
MOD - [2009.09.16 23:39:12 | 000,106,496 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3478.18770__90ba9c70f846762e\MOM.Implementation.dll
MOD - [2009.09.16 23:39:12 | 000,065,536 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3478.18769__90ba9c70f846762e\LOG.Foundation.Implementation.dll
MOD - [2009.09.16 23:39:12 | 000,061,440 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\APM.Server\2.0.3478.18680__90ba9c70f846762e\APM.Server.dll
MOD - [2009.09.16 23:39:12 | 000,057,344 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3478.18683__90ba9c70f846762e\CLI.Component.SkinFactory.dll
MOD - [2009.09.16 23:39:12 | 000,057,344 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3478.18681__90ba9c70f846762e\CLI.Component.Runtime.dll
MOD - [2009.09.16 23:39:12 | 000,045,056 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3428.28311__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll
MOD - [2009.09.16 23:39:12 | 000,045,056 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Server\2.0.3478.18679__90ba9c70f846762e\AEM.Server.dll
MOD - [2009.09.16 23:39:12 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3428.28301__90ba9c70f846762e\CLI.Foundation.Private.dll
MOD - [2009.09.16 23:39:12 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3428.28308__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll
MOD - [2009.09.16 23:39:12 | 000,036,864 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3428.28303__90ba9c70f846762e\LOG.Foundation.Private.dll
MOD - [2009.09.16 23:39:12 | 000,032,768 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll
MOD - [2009.09.16 23:39:12 | 000,024,576 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3428.28311__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll
MOD - [2009.09.16 23:39:12 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3428.28310__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
MOD - [2009.09.16 23:39:12 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3428.28309__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll
MOD - [2009.09.16 23:39:12 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3428.28316__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll
MOD - [2009.09.16 23:39:12 | 000,019,456 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3478.18770__90ba9c70f846762e\CCC.Implementation.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2013.02.21 16:49:47 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.01.08 12:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.12.18 20:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012.03.09 10:21:22 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2011.09.01 13:23:08 | 001,526,080 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2011.09.01 13:19:26 | 000,029,504 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2011.06.29 14:59:18 | 000,155,344 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe -- (Sony Ericsson PCCompanion)
SRV - [2010.04.05 20:55:01 | 000,116,104 | ---- | M] () [Auto | Running] -- C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE -- (IJPLMSVC)
SRV - [2010.03.18 10:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009.07.31 05:20:00 | 000,144,752 | ---- | M] (TOSHIBA CORPORATION) [On_Demand | Running] -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2009.07.10 06:04:30 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2009.07.09 23:54:42 | 000,160,768 | ---- | M] (Micro-Star International Co., Ltd.) [Auto | Running] -- C:\Program Files\System Control Manager\MSIService.exe -- (Micro Star SCM)
SRV - [2009.06.05 03:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMON)
SRV - [2009.03.27 11:10:56 | 000,014,336 | ---- | M] (LSI Corporation) [Auto | Running] -- C:\Program Files\LSI SoftModem\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2006.04.18 04:00:00 | 000,102,400 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE -- (EPSON_PM_RPCV4_01)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Unknown] -- C:\Users\xx~1\AppData\Local\Temp\uglyypod.sys -- (uglyypod)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\smserial.sys -- (smserial)
DRV - [2012.10.30 23:51:58 | 000,738,504 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012.10.30 23:51:58 | 000,361,032 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012.10.30 23:51:58 | 000,054,232 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012.10.30 23:51:57 | 000,058,680 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2012.10.30 23:51:56 | 000,021,256 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012.10.15 17:59:28 | 000,044,784 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr2.sys -- (aswRdr)
DRV - [2011.07.07 15:46:56 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2010.09.14 16:52:53 | 000,697,328 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2010.07.01 17:52:18 | 000,044,432 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dc3d.sys -- (dc3d)
DRV - [2010.03.13 11:58:52 | 000,087,536 | ---- | M] (CyberLink Corp.) [2010/09/14 18:21:14] [Kernel | Auto | Running] -- C:\Program Files\CyberLink\PowerDVD10\NavFilter\000.fcl -- ({1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC})
DRV - [2009.12.05 15:00:19 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2009.12.05 15:00:19 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2009.08.28 19:49:00 | 000,169,064 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfbd.sys -- (tosrfbd)
DRV - [2009.08.05 22:44:00 | 000,049,400 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfusb.sys -- (Tosrfusb)
DRV - [2009.08.05 20:55:00 | 000,061,168 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TosRfSnd.sys -- (TosRfSnd)
DRV - [2009.07.29 04:01:00 | 000,069,480 | ---- | M] (TOSHIBA Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\tosrfcom.sys -- (Tosrfcom)
DRV - [2009.07.24 19:31:00 | 000,021,608 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfnds.sys -- (tosrfnds)
DRV - [2009.07.14 00:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009.07.10 06:40:02 | 004,994,048 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009.06.24 11:23:12 | 000,159,776 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RtHDMIV.sys -- (RTHDMIAzAudService)
DRV - [2009.06.19 17:58:00 | 000,009,608 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Toshidpt.sys -- (toshidpt)
DRV - [2009.06.19 17:57:00 | 000,079,872 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Tosrfhid.sys -- (Tosrfhid)
DRV - [2009.06.19 17:56:00 | 000,042,472 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfbnp.sys -- (tosrfbnp)
DRV - [2009.06.17 19:59:00 | 000,046,984 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosporte.sys -- (tosporte)
DRV - [2009.06.09 05:01:44 | 001,161,664 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2009.05.20 08:08:40 | 000,059,904 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\enecir.sys -- (enecir)
DRV - [2009.05.19 15:59:26 | 000,011,776 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\enecirhid.sys -- (enecirhid)
DRV - [2009.05.18 08:20:40 | 000,119,256 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\jmcr.sys -- (JMCR)
DRV - [2009.05.14 01:40:38 | 004,231,680 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32)
DRV - [2008.07.30 06:51:30 | 000,277,736 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\acedrv11.sys -- (acedrv11)
DRV - [2008.05.16 11:33:14 | 000,115,752 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016unic.sys -- (s0016unic)
DRV - [2008.05.16 11:33:14 | 000,025,512 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016nd5.sys -- (s0016nd5)
DRV - [2008.05.16 11:33:14 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016mdfl.sys -- (s0016mdfl)
DRV - [2008.05.16 11:33:12 | 000,120,744 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016mdm.sys -- (s0016mdm)
DRV - [2008.05.16 11:33:12 | 000,114,216 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016mgmt.sys -- (s0016mgmt)
DRV - [2008.05.16 11:33:12 | 000,110,632 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016obex.sys -- (s0016obex)
DRV - [2008.05.16 11:33:12 | 000,089,256 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016bus.sys -- (s0016bus)
DRV - [2008.04.25 14:06:40 | 000,017,920 | ---- | M] (ArcSoft, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ArcSoftKsUFilter.sys -- (ArcSoftKsUFilter)
DRV - [2008.04.24 12:16:00 | 000,005,632 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\enecirhidma.sys -- (enecirhidma)
DRV - [2007.06.28 07:18:10 | 001,310,720 | ---- | M] (C-Media Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CM108.sys -- (USBPNPA)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1198974828-708339163-1388959167-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL =
IE - HKU\S-1-5-21-1198974828-708339163-1388959167-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =
IE - HKU\S-1-5-21-1198974828-708339163-1388959167-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKU\S-1-5-21-1198974828-708339163-1388959167-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1198974828-708339163-1388959167-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1198974828-708339163-1388959167-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = AE EC D4 5D D8 AB CD 01  [binary data]
IE - HKU\S-1-5-21-1198974828-708339163-1388959167-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1198974828-708339163-1388959167-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1198974828-708339163-1388959167-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "SweetIM Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.sweetim.com/search.asp?src=2&q="
FF - prefs.js..browser.search.selectedEngine: "SweetIM Search"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: 2020Player@2020Technologies.com:4.5.4.0
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.9.0.9216
FF - prefs.js..extensions.enabledItems: {dd3d7613-0246-469d-bc65-2a3cc1668adc}:0.7.1.1
FF - prefs.js..keyword.URL: "hxxp://search.sweetim.com/search.asp?src=2&q="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.15.2: C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.15.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.05.01 09:15:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.05.01 09:15:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\Alwil Software\Avast5\WebRep\FF [2013.02.15 16:36:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.02.21 16:49:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.02.24 00:36:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.3\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2013.02.19 21:08:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.3\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
 
[2010.11.11 18:40:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\Extensions
[2010.11.11 18:40:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.01.14 22:34:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2013.01.26 09:53:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\oengctvk.default\extensions
[2011.05.12 18:57:09 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\xxxx\AppData\Roaming\mozilla\Firefox\Profiles\oengctvk.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.12.17 17:02:11 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\oengctvk.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.10.18 17:47:14 | 000,000,000 | ---D | M] (BlockSite) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\oengctvk.default\extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc}
[2011.01.09 09:31:37 | 000,000,000 | ---D | M] (20-20 3D Viewer) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\oengctvk.default\extensions\2020Player@2020Technologies.com
[2009.11.26 22:12:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\vyeaovdz.default\extensions
[2013.01.26 09:53:04 | 000,242,136 | ---- | M] () (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2013.02.22 16:59:24 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-1.xml
[2009.09.10 21:21:04 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-10.xml
[2009.10.29 17:45:54 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-11.xml
[2009.10.29 21:01:15 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-12.xml
[2009.12.16 21:44:09 | 000,000,961 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-13.xml
[2009.02.05 17:20:29 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-2.xml
[2009.03.06 17:47:40 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-3.xml
[2009.03.29 20:21:41 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-4.xml
[2009.04.22 22:01:21 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-5.xml
[2009.04.29 05:48:41 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-6.xml
[2009.06.14 17:26:11 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-7.xml
[2009.07.22 21:24:51 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-8.xml
[2009.08.04 19:51:31 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-9.xml
[2008.12.11 17:30:39 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin.xml
[2010.01.18 20:27:50 | 000,003,915 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\sweetim.xml
[2013.02.21 16:49:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2013.02.21 16:49:30 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013.02.21 16:49:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2013.02.21 16:49:47 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.11.29 10:19:31 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.11.29 10:19:31 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.11.29 10:19:31 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.11.29 10:19:32 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.11.29 10:19:31 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.11.29 10:19:31 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.08.27 20:05:39 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1      localhost
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O3 - HKU\S-1-5-21-1198974828-708339163-1388959167-1000\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared files\brs.exe (cyberlink)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe (Micro-Star International Co., Ltd.)
O4 - HKLM..\Run: [RemoteControl10] C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-21-1198974828-708339163-1388959167-1000..\Run: [EPSON Stylus DX5000 Series] C:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIBVE.EXE (SEIKO EPSON CORPORATION)
O4 - HKU\S-1-5-21-1198974828-708339163-1388959167-1000..\Run: [Sony Ericsson PC Companion] C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe (Sony Ericsson)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 10.15.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 213.187.64.1 217.69.224.73
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{187DB023-6E9C-41FB-967F-3207F2EA9B3D}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{19C28733-FCF7-45AE-A5F1-6BE27B963194}: DhcpNameServer = 213.187.64.1 217.69.224.73
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O24 - Desktop Components:0 () - file:///C:/DOKUME~1/xx~1/LOKALE~1/Temp/msohtml1/01/clip_image002.jpg
O24 - Desktop Components:1 () - file:///C:/DOKUME~1/xx~1/LOKALE~1/Temp/msohtml1/01/clip_image002.gif
O24 - Desktop Components:2 (Die derzeitige Homepage) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{02218112-f96f-11df-97e9-40618613128f}\Shell - "" = AutoRun
O33 - MountPoints2\{02218112-f96f-11df-97e9-40618613128f}\Shell\AutoRun\command - "" = G:\SETUP.EXE
O33 - MountPoints2\{02218112-f96f-11df-97e9-40618613128f}\Shell\configure\command - "" = G:\SETUP.EXE
O33 - MountPoints2\{02218112-f96f-11df-97e9-40618613128f}\Shell\install\command - "" = G:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.02.21 16:50:12 | 000,262,560 | ---- | C] (Oracle Corporation) -- C:\windows\System32\javaws.exe
[2013.02.21 16:50:03 | 000,094,112 | ---- | C] (Oracle Corporation) -- C:\windows\System32\WindowsAccessBridge.dll
[2013.02.21 16:49:26 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013.02.19 21:08:21 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird
[2013.02.15 16:38:18 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\windows\System32\javaw.exe
[2013.02.15 16:38:17 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\windows\System32\java.exe
[2013.02.15 16:36:49 | 000,044,784 | ---- | C] (AVAST Software) -- C:\windows\System32\drivers\aswRdr2.sys
[2013.02.13 20:42:17 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\mshtml.tlb
[2013.02.13 20:42:16 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\msfeeds.dll
[2013.02.13 20:42:16 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ieui.dll
[2013.02.13 20:42:16 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ieUnatt.exe
[2013.02.13 20:42:16 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\jsproxy.dll
[2013.02.13 20:42:14 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\jscript9.dll
[2013.02.13 20:42:14 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\url.dll
[2013.02.13 20:42:12 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\inetcpl.cpl
[2013.02.13 19:47:30 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Projektarbeit
[2013.02.13 17:58:01 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\win32k.sys
[2013.02.13 17:57:57 | 003,957,608 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ntkrnlpa.exe
[2013.02.13 17:57:56 | 003,902,312 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\ntoskrnl.exe
[2013.02.13 17:57:55 | 000,187,240 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\drivers\FWPKCLNT.SYS
[2013.02.13 17:57:49 | 000,271,360 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\conhost.exe
[2013.02.13 17:57:49 | 000,169,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\winsrv.dll
[2013.02.13 17:57:49 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-file-l1-1-0.dll
[2013.02.13 17:57:49 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2013.02.13 17:57:49 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2013.02.13 17:57:49 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2013.02.13 17:57:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-string-l1-1-0.dll
[2013.02.13 17:57:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013.02.13 17:57:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2013.02.13 17:57:49 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2013.02.13 17:57:48 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-security-base-l1-1-0.dll
[2013.02.13 17:57:48 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2013.02.13 17:57:48 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2013.02.13 17:57:48 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2013.02.13 17:57:48 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2013.02.13 17:57:48 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2013.02.13 17:57:48 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2013.02.13 17:57:48 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2013.02.13 17:57:48 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2013.02.13 17:57:48 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2013.02.13 17:57:48 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2013.02.13 17:57:48 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2013.02.13 17:57:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-util-l1-1-0.dll
[2013.02.13 17:57:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-io-l1-1-0.dll
[2013.02.13 17:57:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2013.02.13 17:57:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2013.02.13 17:57:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2013.02.13 17:57:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2013.02.13 17:57:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2013.02.13 17:57:48 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\windows\System32\api-ms-win-core-console-l1-1-0.dll
[2013.01.29 16:43:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013.01.29 16:43:15 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
 
========== Files - Modified Within 30 Days ==========
 
[2013.02.24 20:32:30 | 000,017,600 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.02.24 20:32:30 | 000,017,600 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.02.24 16:21:52 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2013.02.24 16:21:44 | 2415,255,552 | -HS- | M] () -- C:\hiberfil.sys
[2013.02.24 16:20:48 | 000,000,186 | ---- | M] () -- C:\Users\xxx\defogger_reenable
[2013.02.24 11:42:49 | 000,696,870 | ---- | M] () -- C:\windows\System32\perfh007.dat
[2013.02.24 11:42:49 | 000,652,148 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2013.02.24 11:42:49 | 000,148,134 | ---- | M] () -- C:\windows\System32\perfc007.dat
[2013.02.24 11:42:49 | 000,121,080 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2013.02.24 02:17:57 | 000,001,077 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.02.21 16:50:00 | 000,094,112 | ---- | M] (Oracle Corporation) -- C:\windows\System32\WindowsAccessBridge.dll
[2013.02.21 16:49:59 | 000,262,560 | ---- | M] (Oracle Corporation) -- C:\windows\System32\javaws.exe
[2013.02.21 16:49:59 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\windows\System32\javaw.exe
[2013.02.21 16:49:59 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\windows\System32\java.exe
[2013.02.21 16:49:58 | 000,861,088 | ---- | M] (Oracle Corporation) -- C:\windows\System32\npDeployJava1.dll
[2013.02.21 16:49:58 | 000,782,240 | ---- | M] (Oracle Corporation) -- C:\windows\System32\deployJava1.dll
[2013.02.15 16:36:49 | 000,002,577 | ---- | M] () -- C:\windows\System32\config.nt
[2013.02.14 18:06:47 | 000,435,720 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2013.02.24 16:20:32 | 000,000,186 | ---- | C] () -- C:\Users\xxx\defogger_reenable
[2013.02.24 02:17:57 | 000,001,077 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2011.08.12 21:47:38 | 000,000,295 | ---- | C] () -- C:\windows\SIERRA.INI
[2010.10.15 20:27:42 | 000,008,192 | ---- | C] () -- C:\Users\xxx\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.12.02 20:21:37 | 000,000,336 | ---- | C] () -- C:\Users\xxx\AppData\Roaming\wklnhst.dat
[2009.11.26 20:28:16 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:46:56 | 012,868,608 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 02:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:CB0FEE2B

< End of report >
--- --- ---





OTL Logfile:
Code:
OTL Extras logfile created on: 24.02.2013 20:29:16 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\xxx\Desktop\Projektarbeit\Bilder
 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,11 Gb Available Physical Memory | 37,04% Memory free
6,00 Gb Paging File | 4,13 Gb Available in Paging File | 68,92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 273,40 Gb Total Space | 184,66 Gb Free Space | 67,54% Space Free | Partition Type: NTFS
Drive D: | 182,26 Gb Total Space | 158,71 Gb Free Space | 87,08% Space Free | Partition Type: NTFS
Unable to calculate disk information.
 
Computer Name: xxx | User Name: xxx | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-1198974828-708339163-1388959167-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L"
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\fotobuch.de\Designer 2.0\Designer.exe" = C:\Program Files\fotobuch.de\Designer 2.0\Designer.exe:*:Designer.exe
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0AC93771-4485-4258-BA82-F08AD382880E}" = rport=139 | protocol=6 | dir=out | app=system |
"{0F4B0D00-9985-4B4B-8262-FFCB86544EA5}" = rport=10243 | protocol=6 | dir=out | app=system |
"{17531843-707D-436A-A498-AB9222A136DA}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{1A8D7A66-CFAF-49C4-A76B-A5515C0C8B7E}" = rport=445 | protocol=6 | dir=out | app=system |
"{1D8F5358-55E3-4EC7-B2E9-2A914BE89BDE}" = lport=139 | protocol=6 | dir=in | app=system |
"{28008E92-C108-4CA7-A0B7-3870C5772A10}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2B6488FD-1281-433D-AA48-1A08287A55BD}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{4B508D53-FB07-48C8-9459-7911154D0153}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{52F76F4B-6C7A-4296-952B-7DD9D1B83B15}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{57CBAE59-AF86-4F32-9918-0F12FB1DD0AD}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5E24DDD4-7A95-481F-8713-615FBAB0961B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{63DEEBAD-4AFE-44C5-93DA-A1CCCAF7CCA4}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{73F5E9D0-35F6-4154-B103-C9D722ABF5FF}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{785E6829-F9C9-4231-B10D-2AC51275E6FE}" = lport=2869 | protocol=6 | dir=in | app=system |
"{78E549E6-F21F-4174-828E-C5A70B62FFD0}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{82EBDB38-D89E-4407-A165-8C58E36ED3CE}" = lport=137 | protocol=17 | dir=in | app=system |
"{9E3D66A1-7D70-4954-86CC-C6EB2BC1FA88}" = lport=445 | protocol=6 | dir=in | app=system |
"{A21A93AA-533E-4F69-8357-AF1B9112D445}" = lport=138 | protocol=17 | dir=in | app=system |
"{A851F4ED-2517-4D28-AE12-292FE466E798}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe |
"{A9639627-7AD6-400E-A8C5-4129FF8B66A5}" = lport=10243 | protocol=6 | dir=in | app=system |
"{B1FB23D5-6663-45C4-9043-CDB650ECF9A7}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{BAF9A000-4D28-41AC-8AEE-A96ABF761CDD}" = rport=138 | protocol=17 | dir=out | app=system |
"{C1DE3428-75F7-4FB7-899A-F53DEEFF7342}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{CCAEF283-AC28-4424-8FC0-D4B945E092ED}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{EF0BDD3B-972A-4074-8F8F-056FFB471FB8}" = rport=137 | protocol=17 | dir=out | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06E47C9E-C9FA-4D8B-B586-7695FA631994}" = protocol=6 | dir=out | app=system |
"{0FF67138-C2E7-4DE7-9CE1-6F1932EB324E}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{118F3958-DBF8-457C-96C9-23CD8733B05F}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{1BD03C2F-1A9B-40D5-AF2D-F05A494AFED2}" = dir=in | app=c:\program files\cyberlink\powerdvd10\powerdvd9.exe |
"{1F00FD07-DC79-41AB-AEFA-4E25B5647357}" = protocol=17 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\anno4.exe |
"{2230E4C1-0121-4382-883E-D20A68734FC6}" = protocol=6 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\anno4.exe |
"{25A9FBB3-EE37-410B-B7A4-B2D51AE321BF}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{274DB632-356B-4554-B2DB-9F8872D75714}" = protocol=6 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\tools\addonweb.exe |
"{3E8168E5-25F0-4BF6-868A-7F6175D1EE57}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{3FD89883-1717-4099-824F-C30DA24B0560}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{4B06C965-C6DF-490D-8513-1971120A6F79}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{5C2DB5AE-AA28-4C67-8FE1-5B5F44B22BD2}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{618A9894-120D-4130-8CD2-F2A8BC0272B4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{69C52F77-2A70-469B-B0E7-AFC6B860E1CA}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{72427D2D-DC24-4E35-B92C-E2803A0305DA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7FB728EA-FC94-4EC1-8F1B-071DFCDF178C}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"{80D89A96-C6A3-4259-B522-CF99182FCF96}" = dir=in | app=c:\program files\cyberlink\powerdvd10\powerdvd cinema\powerdvdcinema10.exe |
"{841841A0-BB59-4D28-A61B-CD3FA6AC040B}" = protocol=17 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\tools\anno4web.exe |
"{860C7AAF-2CFD-4598-8E70-57F015EC1F62}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{86FCE91B-66D2-4BD5-9F2F-6075AD9F3ED0}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{94173B39-1685-47F8-BEEA-DD05A5FAD842}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{9718F366-ABF0-427A-934E-C5A550B6F266}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{9DBCDA20-BA90-4C2E-B60E-004075306A8A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A86B86FB-755D-4EE3-AD36-4882C31C05B9}" = protocol=17 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\tools\addonweb.exe |
"{A86F8ABF-A89C-43B0-BDD3-C0B44DD6831C}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"{B8CF30A3-0DCC-4437-9BF3-FC681272BC8B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{BBCCCD9F-32A2-4FEF-A90E-8A5A6038AD8F}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{BC10AD75-7707-478E-8F52-0D5DD925978E}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{BD8779E9-4249-4EE7-BB6F-200D7E430D52}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{C512BFAA-A837-4911-8E68-F53C19A0DE62}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{C5F90971-E804-4920-B73F-E95137DDB066}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{CAB2D4CE-F9E9-4DFC-AC3D-B68E776BA508}" = protocol=6 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\addon.exe |
"{CC2E61C3-4459-4999-8B92-99C422989090}" = protocol=17 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\addon.exe |
"{DB56036C-D5DE-4D6F-A258-9CB1AA26FC34}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{EB1F6931-BE5A-4B9E-9551-73AAA81C9235}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{ED61ED38-E6BF-4AAA-9BE5-DA466E1FDD79}" = protocol=6 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\tools\anno4web.exe |
"TCP Query User{4DDC21FE-B05C-4C53-B8DB-B958F5D03535}C:\program files\cyberlink\powerdvd10\powerdvd10.exe" = protocol=6 | dir=in | app=c:\program files\cyberlink\powerdvd10\powerdvd10.exe |
"TCP Query User{6D95DF75-1532-4EDF-A4DC-CAFA9B03A37B}C:\program files\ubisoft\related designs\anno 1404\tools\anno4web.exe" = protocol=6 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\tools\anno4web.exe |
"TCP Query User{8B4EB717-232F-47CF-8EDF-53AACCF43D33}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{8CFF3E69-76A2-4743-942A-82A7D7017B5F}C:\program files\ubisoft\related designs\anno 1404\tools\addonweb.exe" = protocol=6 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\tools\addonweb.exe |
"TCP Query User{A43F1CC8-142A-4ED9-B15B-11E538738D29}F:\skypeportable\app\skype\phone\skype.exe" = protocol=6 | dir=in | app=f:\skypeportable\app\skype\phone\skype.exe |
"UDP Query User{455D908D-4111-487E-874F-BF71873510E3}F:\skypeportable\app\skype\phone\skype.exe" = protocol=17 | dir=in | app=f:\skypeportable\app\skype\phone\skype.exe |
"UDP Query User{7B8084B3-A87C-4FD8-8D27-1A300A6C3453}C:\program files\cyberlink\powerdvd10\powerdvd10.exe" = protocol=17 | dir=in | app=c:\program files\cyberlink\powerdvd10\powerdvd10.exe |
"UDP Query User{873487EF-BA10-4C17-BE7C-17975C185A29}C:\program files\ubisoft\related designs\anno 1404\tools\addonweb.exe" = protocol=17 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\tools\addonweb.exe |
"UDP Query User{A3CC3838-0661-4165-AF87-4ACD5522FB9B}C:\program files\ubisoft\related designs\anno 1404\tools\anno4web.exe" = protocol=17 | dir=in | app=c:\program files\ubisoft\related designs\anno 1404\tools\anno4web.exe |
"UDP Query User{C5617C28-BAF0-40AF-A2B1-88048F168CC1}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0187A501-2FF6-6D6B-B184-BA6A032C4AF4}" = Catalyst Control Center Core Implementation
"{07690F1C-04B1-4060-9691-6748ED1826B9}" = MSI Software Install
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0B475977-CCA0-B0EB-B4CC-FC128E55DF65}" = Catalyst Control Center Graphics Full Existing
"{0C07E086-F067-2750-9EBF-CC73A2BEA0A1}" = CCC Help Portuguese
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5100_series" = Canon MG5100 series MP Drivers
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{180FE2CC-0FAD-85C4-C987-9BD3CB2A1044}" = Catalyst Control Center InstallProxy
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{1AF922C4-C111-83C5-73EC-684E78C2C093}" = CCC Help Hungarian
"{1C39C407-37B1-45EF-4792-7B796A8EC014}" = Catalyst Control Center Localization All
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}" = TuneUp Utilities 2011
"{25478065-4CB1-448C-80E4-8C4529017EE3}" = ArcSoft WebCam Companion 3
"{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron Flash Media Controller Driver
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 29
"{26A24AE4-039D-4CA4-87B4-2F83217015FF}" = Java 7 Update 15
"{2892E1B7-E24D-4CCB-B8A7-B63D4B66F89F}" = BurnRecovery
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{33BD9689-83E9-D8E3-9A13-3E42476087B8}" = CCC Help Italian
"{38140CA0-7632-2601-BB62-D0F9BAF28781}" = CCC Help French
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}" = ANNO 1404
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{469D7228-FA20-320C-4AC8-3E9C84CBBC3E}" = CCC Help Spanish
"{49FBD89B-044F-2DE7-8992-56B86A5E0926}" = Catalyst Control Center Graphics Full New
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{55D39D7E-0475-450B-A7A9-919EBCBC9F53}" = Camera RAW Plug-In for EPSON Creativity Suite
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{588E49B4-095D-986B-C28C-5262FA721902}" = CCC Help German
"{5C1E13D7-496E-59E9-822D-C9D09964AD46}" = ATI Catalyst Install Manager
"{5D4C60AA-84E6-4E1A-8A68-69970D387BE1}" = TuneUp Utilities Language Pack (de-DE)
"{5E87AA2F-924A-2B1A-375B-38CA3248E26B}" = CCC Help Russian
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{62F6ED58-8248-2FCE-057B-8F30872BDA23}" = CCC Help Chinese Standard
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{70858C67-8761-4444-895A-0A8B2E9E144E}" = Opera 10.61
"{70E0CA5A-C047-4847-8FF0-735D4E77A5FB}" = WISO Haushaltsbuch 2010
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7C9C4474-74D6-42F4-A6D3-C9BD5C8871D3}" = Anno 1404
"{7EABB309-64F7-11D7-B796-0050BFE4DB80}" = Restaurant Empire
"{7EC0AB45-D838-BCFB-644F-4D57B0D8B7DE}" = CCC Help English
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83BEEFB4-8C28-4F4F-8A9D-E0D1ADCE335B}" = Die*Sims*Mittelalter
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8136 8168 8169 Ethernet Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E90189A-A5D4-4C0E-A908-06C4236F98EE}" = ArcSoft Magic-i Visual Effects 2
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-040C-0000-0000000FF1CE}" = Microsoft Office Excel MUI (French) 2007
"{90120000-0016-040C-0000-0000000FF1CE}_HOMESTUDENTR_{CF3C20A6-47B7-48DA-95C1-6FBB5A439AF8}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0410-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Italian) 2007
"{90120000-0016-0410-0000-0000000FF1CE}_HOMESTUDENTR_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0C0A-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Spanish) 2007
"{90120000-0016-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{D79E9128-A250-4155-BE90-2BE81DE0406A}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-040C-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (French) 2007
"{90120000-0018-040C-0000-0000000FF1CE}_HOMESTUDENTR_{CF3C20A6-47B7-48DA-95C1-6FBB5A439AF8}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0410-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Italian) 2007
"{90120000-0018-0410-0000-0000000FF1CE}_HOMESTUDENTR_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0C0A-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Spanish) 2007
"{90120000-0018-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{D79E9128-A250-4155-BE90-2BE81DE0406A}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-040C-0000-0000000FF1CE}" = Microsoft Office Word MUI (French) 2007
"{90120000-001B-040C-0000-0000000FF1CE}_HOMESTUDENTR_{CF3C20A6-47B7-48DA-95C1-6FBB5A439AF8}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0410-0000-0000000FF1CE}" = Microsoft Office Word MUI (Italian) 2007
"{90120000-001B-0410-0000-0000000FF1CE}_HOMESTUDENTR_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0C0A-0000-0000000FF1CE}" = Microsoft Office Word MUI (Spanish) 2007
"{90120000-001B-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{D79E9128-A250-4155-BE90-2BE81DE0406A}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0401-0000-0000000FF1CE}" = Microsoft Office Proof (Arabic) 2007
"{90120000-001F-0401-0000-0000000FF1CE}_HOMESTUDENTR_{3E8EA473-ECCE-405F-A9CA-59446AEADD3A}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0403-0000-0000000FF1CE}" = Microsoft Office Proof (Catalan) 2007
"{90120000-001F-0403-0000-0000000FF1CE}_HOMESTUDENTR_{BEADB115-DB47-4BD0-A9EC-AE585AFAB2D8}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0413-0000-0000000FF1CE}" = Microsoft Office Proof (Dutch) 2007
"{90120000-001F-0413-0000-0000000FF1CE}_HOMESTUDENTR_{2C95E7EE-FEA7-4B3A-A6E5-DF90A88B816A}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0416-0000-0000000FF1CE}" = Microsoft Office Proof (Portuguese (Brazil)) 2007
"{90120000-001F-0416-0000-0000000FF1CE}_HOMESTUDENTR_{8A524694-0CA4-476A-9301-B1E9D70FC952}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-042D-0000-0000000FF1CE}" = Microsoft Office Proof (Basque) 2007
"{90120000-001F-042D-0000-0000000FF1CE}_HOMESTUDENTR_{017A6981-5E03-4A97-830A-35FE0927BB7F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0456-0000-0000000FF1CE}" = Microsoft Office Proof (Galician) 2007
"{90120000-001F-0456-0000-0000000FF1CE}_HOMESTUDENTR_{A3A03B41-14EA-4E50-97D8-FCF429AE0CCB}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-002C-040C-0000-0000000FF1CE}" = Microsoft Office Proofing (French) 2007
"{90120000-002C-0410-0000-0000000FF1CE}" = Microsoft Office Proofing (Italian) 2007
"{90120000-002C-0C0A-0000-0000000FF1CE}" = Microsoft Office Proofing (Spanish) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-040C-0000-0000000FF1CE}" = Microsoft Office Shared MUI (French) 2007
"{90120000-006E-040C-0000-0000000FF1CE}_HOMESTUDENTR_{8283FD64-6A3B-4104-9E12-7CA25EF29A1A}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0410-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Italian) 2007
"{90120000-006E-0410-0000-0000000FF1CE}_HOMESTUDENTR_{C0C7E58F-D0A1-4102-855B-0B7AA2E8F1C1}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0C0A-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Spanish) 2007
"{90120000-006E-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{430AE3E6-E982-4958-90FC-1C062BC74E22}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-040C-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (French) 2007
"{90120000-00A1-040C-0000-0000000FF1CE}_HOMESTUDENTR_{CF3C20A6-47B7-48DA-95C1-6FBB5A439AF8}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0410-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Italian) 2007
"{90120000-00A1-0410-0000-0000000FF1CE}_HOMESTUDENTR_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0C0A-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Spanish) 2007
"{90120000-00A1-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{D79E9128-A250-4155-BE90-2BE81DE0406A}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91003CC2-9F3C-973F-FD11-AC8FE08542B6}" = CCC Help Korean
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{96B046CC-39DD-9AB1-51E9-39EB224C0641}" = CCC Help Polish
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9CC90219-7C80-B6B3-CBB8-62ACCC081952}" = CCC Help Chinese Traditional
"{A07B2C21-863B-47AB-AE7E-20BB00BD7D33}" = ANNO 1404 - Venedig
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.02) - Deutsch
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B6A24D2D-1ADB-4553-87FD-38F3FAADC18E}_is1" = The Book of Unwritten Tales 1.0.0.0
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B90450DF-E781-46FD-B1F1-0C86DA40E443}" = PIF DESIGNER
"{BD009869-6498-4CF9-9016-E9EA6E3742B2}" = The Whispered World
"{C9295533-FEDF-F3D7-A6CD-DB463E81A37B}" = Catalyst Control Center Graphics Light
"{C9C6CF79-89BF-12F2-F47A-28D948C6E5EB}" = ccc-core-static
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"{DF436A67-211E-D9DF-D587-817A5E611F85}" = CCC Help Czech
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E4F27E8F-434B-0182-7324-60E5EDADC159}" = ccc-utility
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}" = System Control Manager
"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony Ericsson PC Companion 2.01.217
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2BB4DC9-B4C2-8E40-7948-C99678ADF096}" = Catalyst Control Center Graphics Previews Vista
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FB096FBD-F771-CF4A-4DA4-B4EDBEF44516}" = CCC Help Turkish
"5B73F775A90397BAF80173B8A6C0B327BE3872FB" = ENE CIR Receiver Driver
"AC3Filter_is1" = AC3Filter 1.63b
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"avast" = avast! Free Antivirus
"Benutzerhandbuch ESDX5000_CX4900" = Benutzerhandbuch ESDX5000_CX4900
"Canon MG5100 series Benutzerregistrierung" = Canon MG5100 series Benutzerregistrierung
"CANONIJPLM100" = Canon Inkjet Printer/Scanner/Fax Extended Survey Program
"CanonMyPrinter" = Canon My Printer
"CanonSolutionMenuEX" = Canon Solution Menu EX
"Deponia" = Deponia
"Der verborgene Kontinent 2 - Die Saeule der Maya" = Der verborgene Kontinent 2 - Die Saeule der Maya
"Die Gilde 2 - Gold Edition" = Die Gilde 2 - Gold Edition
"DivX Setup.divx.com" = DivX-Setup
"DSGPlayer" = RTL GAME CENTER
"Easy-PhotoPrint EX" = Canon Easy-PhotoPrint EX
"Easy-WebPrint EX" = Canon Easy-WebPrint EX
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"Farm Frenzy - Pizza Party 1.2.0.0" = Farm Frenzy - Pizza Party 1.2.0.0
"Farm Frenzy 2 1.0.0.0" = Farm Frenzy 2 1.0.0.0
"Farm Frenzy 3" = Farm Frenzy 3
"Farm Frenzy 3 0.5.0.0" = Farm Frenzy 3 0.5.0.0
"FileZilla Client" = FileZilla Client 3.3.1
"Gardenscapes – Gestalte dein Haus_is1" = Gardenscapes – Gestalte dein Haus
"Gehirnjogging" = Gehirnjogging
"Glory of the Roman Empire" = Die Römer
"GPL Ghostscript 9.00" = GPL Ghostscript 9.00
"Herr des Wetters" = Herr des Wetters
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"LSI Soft Modem" = LSI HDA Modem
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox 19.0 (x86 de)" = Mozilla Firefox 19.0 (x86 de)
"Mozilla Thunderbird 17.0.3 (x86 de)" = Mozilla Thunderbird 17.0.3 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 4.0" = Canon MP Navigator EX 4.0
"OpenAL" = OpenAL
"PDF Blender" = PDF Blender
"Pharao" = Pharao
"PharaoAufbauPack_BestSeller" = PharaoAufbauPack_BestSeller
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TuneUp Utilities 2011" = TuneUp Utilities 2011
"VirtualCloneDrive" = VirtualCloneDrive
"VLC media player" = VLC media player 1.1.4
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"WISO Haushaltsbuch 2010" = WISO Haushaltsbuch 2010
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1198974828-708339163-1388959167-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Game Organizer" = EasyBits GO
 
========== Last 20 Event Log Errors ==========
 
[ Antivirus Events ]
Error - 08.12.2009 16:24:59 | Computer Name = xxx | Source = avast! | ID = 33554522
Description =
 
Error - 08.12.2009 16:25:24 | Computer Name = xxx | Source = avast! | ID = 33554522
Description =
 
Error - 08.12.2009 16:25:25 | Computer Name = xxx | Source = avast! | ID = 33554522
Description =
 
[ Application Events ]
Error - 31.01.2013 16:23:44 | Computer Name = xxx | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\windows
 live\messenger\wlcsdk.exe".  Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 31.01.2013 16:24:47 | Computer Name = xxx | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\sony
 ericsson\sony ericsson pc companion\Drivers\DPInst64.exe".  Die abhängige Assemblierung
 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 13.02.2013 13:38:53 | Computer Name = xxx | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\windows
 live\messenger\wlcsdk.exe".  Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 13.02.2013 13:40:01 | Computer Name = xxx | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\sony
 ericsson\sony ericsson pc companion\Drivers\DPInst64.exe".  Die abhängige Assemblierung
 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 19.02.2013 13:51:11 | Computer Name = xxx | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\windows
 live\messenger\wlcsdk.exe".  Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 19.02.2013 13:52:14 | Computer Name = xxx | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\sony
 ericsson\sony ericsson pc companion\Drivers\DPInst64.exe".  Die abhängige Assemblierung
 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 22.02.2013 12:50:03 | Computer Name = xxx | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\windows
 live\messenger\wlcsdk.exe".  Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 22.02.2013 12:51:04 | Computer Name = xxx | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\sony
 ericsson\sony ericsson pc companion\Drivers\DPInst64.exe".  Die abhängige Assemblierung
 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 24.02.2013 02:07:13 | Computer Name = xxx | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\windows
 live\messenger\wlcsdk.exe".  Die abhängige Assemblierung "UCCAPI,processorArchitecture="x86",type="win32",version="2.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 24.02.2013 02:08:13 | Computer Name = xxx | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\sony
 ericsson\sony ericsson pc companion\Drivers\DPInst64.exe".  Die abhängige Assemblierung
 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
[ System Events ]
Error - 23.02.2013 11:14:24 | Computer Name = xxx | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 23.02.2013 11:14:24 | Computer Name = xxx | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 23.02.2013 19:34:12 | Computer Name = xxx | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 23.02.2013 19:34:12 | Computer Name = xxx| Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 24.02.2013 05:36:53 | Computer Name = xxx | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 24.02.2013 05:36:53 | Computer Name = xxx | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 24.02.2013 09:38:37 | Computer Name = xxx | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 24.02.2013 09:38:37 | Computer Name = xxx | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 24.02.2013 11:21:52 | Computer Name = xxx | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 24.02.2013 11:21:52 | Computer Name = xxx | Source = atikmdag | ID = 43029
Description = Display is not active
 
 
< End of report >
--- --- ---

-Mausi- 24.02.2013 21:04
GMER
GMER Logfile:
Code:
GMER 2.1.19081 - GMER - Rootkit Detector and Remover
Rootkit scan 2013-02-24 20:26:07
Windows 6.1.7600  \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.FG00 465,76GB
Running: bcb4db61.exe; Driver: C:\Users\xx~1\AppData\Local\Temp\uglyypod.sys


---- System - GMER 2.1 ----

SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwAddBootEntry [0x9093E4BA]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                              ZwAllocateVirtualMemory [0x916D4C22]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwAssignProcessToJobObject [0x9093EED6]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwCreateEvent [0x90949FA8]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwCreateEventPair [0x90949FF4]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwCreateIoCompletion [0x9094A176]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwCreateMutant [0x90949F16]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                              ZwCreateSection [0x916D4FA6]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwCreateSemaphore [0x90949F5E]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwCreateThread [0x9093F11C]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwCreateThreadEx [0x9093F2F4]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwCreateTimer [0x9094A130]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwDebugActiveProcess [0x9093F93E]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwDeleteBootEntry [0x9093E508]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                              ZwFreeVirtualMemory [0x916D4CEA]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                              ZwLoadDriver [0x916D33EC]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwModifyBootEntry [0x9093E556]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwNotifyChangeKey [0x90943534]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwNotifyChangeMultipleKeys [0x909403A6]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwOpenEvent [0x90949FD2]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwOpenEventPair [0x9094A016]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwOpenIoCompletion [0x9094A19A]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwOpenMutant [0x90949F3C]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwOpenSection [0x9094A0BA]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwOpenSemaphore [0x90949F86]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwOpenTimer [0x9094A154]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                              ZwProtectVirtualMemory [0x916D4E4A]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwQueryObject [0x90940272]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwQueueApcThreadEx [0x9093FF86]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwSetBootEntryOrder [0x9093E5A4]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwSetBootOptions [0x9093E5F2]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwSetContextThread [0x9093F7BE]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwSetSystemInformation [0x9093E1FA]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwSetSystemPowerState [0x9093E3AA]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwShutdownSystem [0x9093E350]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwSuspendProcess [0x9093FAF8]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwSuspendThread [0x9093FC54]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwSystemDebugControl [0x9093E41A]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                              ZwTerminateProcess [0x916D4EFE]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwTerminateThread [0x9093F636]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                              ZwUnloadDriver [0x916D341C]
SSDT            \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)                              ZwVdmControl [0x9093E640]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                              ZwWriteVirtualMemory [0x916D4D96]

Code            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                              ZwCreateProcessEx [0x916EDE56]
Code            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                              ObMakeTemporaryObject

---- Kernel code sections - GMER 2.1 ----

.text          ntkrnlpa.exe!ZwRollbackTransaction + 13E9                                                                          832958D9 1 Byte  [06]
.text          ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                              832BA312 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text          ntkrnlpa.exe!RtlSidHashLookup + 244                                                                                832C1B04 4 Bytes  [BA, E4, 93, 90]
.text          ntkrnlpa.exe!RtlSidHashLookup + 26C                                                                                832C1B2C 4 Bytes  [22, 4C, 6D, 91] {AND CL, [EBP+EBP*2-0x6f]}
.text          ntkrnlpa.exe!RtlSidHashLookup + 2CC                                                                                832C1B8C 4 Bytes  [D6, EE, 93, 90] {SALC ; OUT DX, AL; XCHG EBX, EAX; NOP }
.text          ntkrnlpa.exe!RtlSidHashLookup + 320                                                                                832C1BE0 8 Bytes  [A8, 9F, 94, 90, F4, 9F, 94, ...] {TEST AL, 0x9f; XCHG ESP, EAX; NOP ; HLT ; LAHF ; XCHG ESP, EAX; NOP }
.text          ntkrnlpa.exe!RtlSidHashLookup + 32C                                                                                832C1BEC 4 Bytes  [76, A1, 94, 90] {JBE 0xffffffa3; XCHG ESP, EAX; NOP }
.text          ...                                                                                                               
PAGE            ntkrnlpa.exe!ObMakeTemporaryObject                                                                                  8345C387 5 Bytes  JMP 916EACF6 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE            ntkrnlpa.exe!ObInsertObject + 27                                                                                    83476095 5 Bytes  JMP 916EC828 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE            ntkrnlpa.exe!ZwReplyWaitReceivePortEx + 108                                                                        834C0700 4 Bytes  CALL 90940A8D \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
PAGE            ntkrnlpa.exe!ZwAlpcSendWaitReceivePort + 122                                                                        834C87A8 4 Bytes  CALL 90940AA3 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
PAGE            ntkrnlpa.exe!ZwCreateProcessEx                                                                                      8352E3F0 7 Bytes  JMP 916EDE5A \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
.text          C:\windows\system32\DRIVERS\atikmdag.sys                                                                            section is writeable [0x91E21000, 0x2D51C8, 0xE8000020]
.text          win32k.sys!EngMultiByteToUnicodeN + 723C                                                                            8263A085 5 Bytes  JMP 90943EB8 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!EngIsSemaphoreOwned + 8A3A                                                                              82651107 5 Bytes  JMP 90943FFE \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!EngIsSemaphoreOwned + 8B91                                                                              8265125E 5 Bytes  JMP 90943CDE \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!EngEraseSurface + 7EB3                                                                                  8266E4E0 5 Bytes  JMP 909440C0 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!EngEraseSurface + C1FC                                                                                  82672829 5 Bytes  JMP 90944CB6 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!XFORMOBJ_iGetXform + 1C30                                                                                8268504D 5 Bytes  JMP 90944182 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!XFORMOBJ_iGetXform + 3330                                                                                8268674D 5 Bytes  JMP 909437C4 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!XFORMOBJ_iGetXform + 4035                                                                                82687452 5 Bytes  JMP 90944A86 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!EngCTGetGammaTable + 6CB                                                                                8268BF36 5 Bytes  JMP 90944090 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!EngCTGetGammaTable + 18AB                                                                                8268D116 5 Bytes  JMP 90943EE4 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!EngAllocMem + 8FCE                                                                                      82698154 5 Bytes  JMP 909440A8 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!PATHOBJ_bEnum + 79D8                                                                                    826A96E6 5 Bytes  JMP 90943834 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!PATHOBJ_bEnum + 86BF                                                                                    826AA3CD 5 Bytes  JMP 90943670 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!PATHOBJ_bEnum + 92AF                                                                                    826AAFBD 5 Bytes  JMP 90943C1E \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!EngCreateSemaphore + A699                                                                                826C5E9D 5 Bytes  JMP 9094494C \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!EngCreateSemaphore + CA47                                                                                826C824B 5 Bytes  JMP 9094356A \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!EngBitBlt + 56E                                                                                          826D18AD 5 Bytes  JMP 909449F6 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!EngBitBlt + 523A                                                                                        826D6579 5 Bytes  JMP 90944EBE \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!EngLpkInstalled + 6146                                                                                  826E98F7 5 Bytes  JMP 90943688 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!EngLpkInstalled + 11695                                                                                  826F4E46 5 Bytes  JMP 90944A3C \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!EngLpkInstalled + 1AECC                                                                                  826FE67D 5 Bytes  JMP 909468D4 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!STROBJ_bEnum + 9A6A                                                                                      82711E5C 5 Bytes  JMP 90943B48 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!EngPlgBlt + 26C1                                                                                        82719F56 5 Bytes  JMP 90944D74 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!PATHOBJ_bPolyBezierTo + F8                                                                              8272DA20 5 Bytes  JMP 90943A1C \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!EngAcquireSemaphoreSharedNoWait + 1F5A                                                                  8273DD9C 5 Bytes  JMP 90944E1C \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!PATHOBJ_vGetBounds + EB5                                                                                82767CAF 5 Bytes  JMP 909438F0 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!EngCTGetCurrentGamma + 1C94                                                                              8276BCF6 5 Bytes  JMP 90943944 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!EngSetPointerShape + B39                                                                                8276E85F 5 Bytes  JMP 9094416A \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!EngSetPointerShape + C8E                                                                                8276E9B4 5 Bytes  JMP 90944BFE \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!CLIPOBJ_cEnumStart + 6DCE                                                                                82777785 5 Bytes  JMP 90943760 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text          win32k.sys!CLIPOBJ_cEnumStart + A4E3                                                                                8277AE9A 5 Bytes  JMP 90943AB2 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.reloc          C:\windows\system32\drivers\acedrv11.sys                                                                            section is executable [0xA1F77600, 0x25B0C, 0xE0000060]
.text          C:\windows\system32\DRIVERS\atksgt.sys                                                                              section is writeable [0xA1F9E300, 0x3B6D8, 0xE8000020]
.text          C:\windows\system32\DRIVERS\lirsgt.sys                                                                              section is writeable [0xA1FE1300, 0x1BEE, 0xE8000020]
.text          C:\Program Files\CyberLink\PowerDVD10\NavFilter\000.fcl                                                            section is writeable [0xA2AFE000, 0x2892, 0xE8000020]
.vmp2          C:\Program Files\CyberLink\PowerDVD10\NavFilter\000.fcl                                                            entry point in ".vmp2" section [0xA2B21050]
.text          kernel32.dll!GetBinaryTypeW + 70                                                                                    76FE7934 1 Byte  [62]

---- User code sections - GMER 2.1 ----

.text          C:\windows\system32\svchost.exe[384] kernel32.dll!GetBinaryTypeW + 70                                              76FE7934 1 Byte  [62]
.text          C:\windows\system32\taskhost.exe[404] kernel32.dll!GetBinaryTypeW + 70                                              76FE7934 1 Byte  [62]
.text          C:\windows\system32\csrss.exe[584] kernel32.dll!GetBinaryTypeW + 70                                                76FE7934 1 Byte  [62]
.text          C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE[648] ntdll.dll!LdrUnloadDll                                    77C3BD1F 5 Bytes  JMP 001E03FC
.text          C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE[648] ntdll.dll!LdrLoadDll                                      77C3F425 5 Bytes  JMP 001E01F8
.text          C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE[648] KERNEL32.dll!GetBinaryTypeW + 70                          76FE7934 1 Byte  [62]
.text          C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE[648] USER32.dll!UnhookWindowsHookEx                            76D5CC7B 5 Bytes  JMP 001F0A08
.text          C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE[648] USER32.dll!UnhookWinEvent                                76D5D924 5 Bytes  JMP 001F03FC
.text          C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE[648] USER32.dll!SetWindowsHookExW                              76D6210A 5 Bytes  JMP 001F0804
.text          C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE[648] USER32.dll!SetWinEventHook                                76D6507E 5 Bytes  JMP 001F01F8
.text          C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE[648] USER32.dll!SetWindowsHookExA                              76D86DFA 5 Bytes  JMP 001F0600
.text          C:\windows\system32\wininit.exe[660] kernel32.dll!GetBinaryTypeW + 70                                              76FE7934 1 Byte  [62]
.text          C:\windows\system32\csrss.exe[668] kernel32.dll!GetBinaryTypeW + 70                                                76FE7934 1 Byte  [62]
.text          C:\windows\system32\services.exe[716] kernel32.dll!GetBinaryTypeW + 70                                              76FE7934 1 Byte  [62]
.text          C:\windows\system32\winlogon.exe[748] kernel32.dll!GetBinaryTypeW + 70                                              76FE7934 1 Byte  [62]
.text          C:\windows\system32\lsass.exe[760] kernel32.dll!GetBinaryTypeW + 70                                                76FE7934 1 Byte  [62]
.text          ...                                                                                                               
.text          C:\windows\System32\svchost.exe[1464] ntdll.dll!LdrUnloadDll                                                        77C3BD1F 5 Bytes  JMP 001303FC
.text          C:\windows\System32\svchost.exe[1464] ntdll.dll!LdrLoadDll                                                          77C3F425 5 Bytes  JMP 001301F8
.text          C:\windows\System32\svchost.exe[1464] KERNEL32.dll!GetBinaryTypeW + 70                                              76FE7934 1 Byte  [62]
.text          C:\windows\System32\svchost.exe[1464] user32.dll!UnhookWindowsHookEx                                                76D5CC7B 5 Bytes  JMP 00270A08
.text          C:\windows\System32\svchost.exe[1464] user32.dll!UnhookWinEvent                                                    76D5D924 5 Bytes  JMP 002703FC
.text          C:\windows\System32\svchost.exe[1464] user32.dll!SetWindowsHookExW                                                  76D6210A 5 Bytes  JMP 00270804
.text          C:\windows\System32\svchost.exe[1464] user32.dll!SetWinEventHook                                                    76D6507E 5 Bytes  JMP 002701F8
.text          C:\windows\System32\svchost.exe[1464] user32.dll!SetWindowsHookExA                                                  76D86DFA 5 Bytes  JMP 00270600
.text          C:\Program Files\DAEMON Tools Pro\DTShellHlp.exe[1508] kernel32.dll!GetBinaryTypeW + 70                            76FE7934 1 Byte  [62]
.text          C:\windows\system32\Dwm.exe[1636] kernel32.dll!GetBinaryTypeW + 70                                                  76FE7934 1 Byte  [62]
.text          C:\windows\Explorer.EXE[1660] kernel32.dll!GetBinaryTypeW + 70                                                      76FE7934 1 Byte  [62]
.text          C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE[1672] kernel32.dll!GetBinaryTypeW + 70                                    76FE7934 1 Byte  [62]
.text          C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe[1712] kernel32.dll!GetBinaryTypeW + 70          76FE7934 1 Byte  [62]
.text          ...                                                                                                               
.text          C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1896] kernel32.dll!SetUnhandledExceptionFilter                  76FD3122 4 Bytes  [C2, 04, 00, 90] {RET 0x4; NOP }
.text          C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1896] kernel32.dll!GetBinaryTypeW + 70                          76FE7934 1 Byte  [62]
.text          C:\windows\System32\spoolsv.exe[1976] kernel32.dll!GetBinaryTypeW + 70                                              76FE7934 1 Byte  [62]
.text          C:\windows\system32\svchost.exe[2016] kernel32.dll!GetBinaryTypeW + 70                                              76FE7934 1 Byte  [62]
.text          C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe[2380] ntdll.dll!LdrUnloadDll                        77C3BD1F 5 Bytes  JMP 000703FC
.text          C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe[2380] ntdll.dll!LdrLoadDll                          77C3F425 5 Bytes  JMP 000701F8
.text          C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe[2380] KERNEL32.dll!GetBinaryTypeW + 70              76FE7934 1 Byte  [62]
.text          C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe[2380] USER32.dll!UnhookWindowsHookEx                76D5CC7B 5 Bytes  JMP 00080A08
.text          C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe[2380] USER32.dll!UnhookWinEvent                    76D5D924 5 Bytes  JMP 000803FC
.text          C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe[2380] USER32.dll!SetWindowsHookExW                  76D6210A 5 Bytes  JMP 00080804
.text          C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe[2380] USER32.dll!SetWinEventHook                    76D6507E 5 Bytes  JMP 000801F8
.text          C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe[2380] USER32.dll!SetWindowsHookExA                  76D86DFA 5 Bytes  JMP 00080600
.text          C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe[2420] ntdll.dll!LdrUnloadDll                      77C3BD1F 5 Bytes  JMP 001E03FC
.text          C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe[2420] ntdll.dll!LdrLoadDll                        77C3F425 5 Bytes  JMP 001E01F8
.text          C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe[2420] KERNEL32.dll!GetBinaryTypeW + 70            76FE7934 1 Byte  [62]
.text          C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe[2420] USER32.dll!UnhookWindowsHookEx              76D5CC7B 5 Bytes  JMP 001F0A08
.text          C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe[2420] USER32.dll!UnhookWinEvent                    76D5D924 5 Bytes  JMP 001F03FC
.text          C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe[2420] USER32.dll!SetWindowsHookExW                76D6210A 5 Bytes  JMP 001F0804
.text          C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe[2420] USER32.dll!SetWinEventHook                  76D6507E 5 Bytes  JMP 001F01F8
.text          C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe[2420] USER32.dll!SetWindowsHookExA                76D86DFA 5 Bytes  JMP 001F0600
.text          C:\Program Files\Common Files\Java\Java Update\jusched.exe[2580] ntdll.dll!LdrUnloadDll                            77C3BD1F 5 Bytes  JMP 002F03FC
.text          C:\Program Files\Common Files\Java\Java Update\jusched.exe[2580] ntdll.dll!LdrLoadDll                              77C3F425 5 Bytes  JMP 002F01F8
.text          C:\Program Files\Common Files\Java\Java Update\jusched.exe[2580] KERNEL32.dll!GetBinaryTypeW + 70                  76FE7934 1 Byte  [62]
.text          C:\Program Files\Common Files\Java\Java Update\jusched.exe[2580] USER32.dll!UnhookWindowsHookEx                    76D5CC7B 5 Bytes  JMP 00310A08
.text          C:\Program Files\Common Files\Java\Java Update\jusched.exe[2580] USER32.dll!UnhookWinEvent                          76D5D924 5 Bytes  JMP 003103FC
.text          C:\Program Files\Common Files\Java\Java Update\jusched.exe[2580] USER32.dll!SetWindowsHookExW                      76D6210A 5 Bytes  JMP 00310804
.text          C:\Program Files\Common Files\Java\Java Update\jusched.exe[2580] USER32.dll!SetWinEventHook                        76D6507E 5 Bytes  JMP 003101F8
.text          C:\Program Files\Common Files\Java\Java Update\jusched.exe[2580] USER32.dll!SetWindowsHookExA                      76D86DFA 5 Bytes  JMP 00310600
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[2624] ntdll.dll!LdrUnloadDll                          77C3BD1F 5 Bytes  JMP 001E03FC
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[2624] ntdll.dll!LdrLoadDll                            77C3F425 5 Bytes  JMP 001E01F8
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[2624] KERNEL32.dll!GetBinaryTypeW + 70                76FE7934 1 Byte  [62]
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[2624] USER32.dll!UnhookWindowsHookEx                  76D5CC7B 5 Bytes  JMP 00200A08
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[2624] USER32.dll!UnhookWinEvent                      76D5D924 5 Bytes  JMP 002003FC
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[2624] USER32.dll!SetWindowsHookExW                    76D6210A 5 Bytes  JMP 00200804
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[2624] USER32.dll!SetWinEventHook                      76D6507E 5 Bytes  JMP 002001F8
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe[2624] USER32.dll!SetWindowsHookExA                    76D86DFA 5 Bytes  JMP 00200600
.text          C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2648] ntdll.dll!LdrUnloadDll                          77C3BD1F 5 Bytes  JMP 000E03FC
.text          C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2648] ntdll.dll!LdrLoadDll                            77C3F425 5 Bytes  JMP 000E01F8
.text          C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2648] KERNEL32.dll!GetBinaryTypeW + 70                76FE7934 1 Byte  [62]
.text          C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2648] USER32.dll!UnhookWindowsHookEx                  76D5CC7B 5 Bytes  JMP 00100A08
.text          C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2648] USER32.dll!UnhookWinEvent                      76D5D924 5 Bytes  JMP 001003FC
.text          C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2648] USER32.dll!SetWindowsHookExW                    76D6210A 5 Bytes  JMP 00100804
.text          C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2648] USER32.dll!SetWinEventHook                      76D6507E 5 Bytes  JMP 001001F8
.text          C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[2648] USER32.dll!SetWindowsHookExA                    76D86DFA 5 Bytes  JMP 00100600
.text          C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe[2660] ntdll.dll!LdrUnloadDll                                        77C3BD1F 5 Bytes  JMP 001E03FC
.text          C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe[2660] ntdll.dll!LdrLoadDll                                          77C3F425 5 Bytes  JMP 001E01F8
.text          C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe[2660] KERNEL32.dll!GetBinaryTypeW + 70                              76FE7934 1 Byte  [62]
.text          C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe[2660] USER32.dll!UnhookWindowsHookEx                                76D5CC7B 5 Bytes  JMP 00200A08
.text          C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe[2660] USER32.dll!UnhookWinEvent                                    76D5D924 5 Bytes  JMP 002003FC
.text          C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe[2660] USER32.dll!SetWindowsHookExW                                  76D6210A 5 Bytes  JMP 00200804
.text          C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe[2660] USER32.dll!SetWinEventHook                                    76D6507E 5 Bytes  JMP 002001F8
.text          C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe[2660] USER32.dll!SetWindowsHookExA                                  76D86DFA 5 Bytes  JMP 00200600
.text          C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[2728] ntdll.dll!LdrUnloadDll                      77C3BD1F 5 Bytes  JMP 001E03FC
.text          C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[2728] ntdll.dll!LdrLoadDll                        77C3F425 5 Bytes  JMP 001E01F8
.text          C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[2728] KERNEL32.dll!GetBinaryTypeW + 70            76FE7934 1 Byte  [62]
.text          C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[2728] USER32.dll!UnhookWindowsHookEx              76D5CC7B 5 Bytes  JMP 001F0A08
.text          C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[2728] USER32.dll!UnhookWinEvent                    76D5D924 5 Bytes  JMP 001F03FC
.text          C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[2728] USER32.dll!SetWindowsHookExW                76D6210A 5 Bytes  JMP 001F0804
.text          C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[2728] USER32.dll!SetWinEventHook                  76D6507E 5 Bytes  JMP 001F01F8
.text          C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe[2728] USER32.dll!SetWindowsHookExA                76D86DFA 5 Bytes  JMP 001F0600
.text          C:\Program Files\System Control Manager\MGSysCtrl.exe[2876] ntdll.dll!LdrUnloadDll                                  77C3BD1F 5 Bytes  JMP 001E03FC
.text          C:\Program Files\System Control Manager\MGSysCtrl.exe[2876] ntdll.dll!LdrLoadDll                                    77C3F425 5 Bytes  JMP 001E01F8
.text          C:\Program Files\System Control Manager\MGSysCtrl.exe[2876] KERNEL32.dll!GetBinaryTypeW + 70                        76FE7934 1 Byte  [62]
.text          C:\Program Files\System Control Manager\MGSysCtrl.exe[2876] USER32.dll!UnhookWindowsHookEx                          76D5CC7B 5 Bytes  JMP 001F0A08
.text          C:\Program Files\System Control Manager\MGSysCtrl.exe[2876] USER32.dll!UnhookWinEvent                              76D5D924 5 Bytes  JMP 001F03FC
.text          C:\Program Files\System Control Manager\MGSysCtrl.exe[2876] USER32.dll!SetWindowsHookExW                            76D6210A 5 Bytes  JMP 001F0804
.text          C:\Program Files\System Control Manager\MGSysCtrl.exe[2876] USER32.dll!SetWinEventHook                              76D6507E 5 Bytes  JMP 001F01F8
.text          C:\Program Files\System Control Manager\MGSysCtrl.exe[2876] USER32.dll!SetWindowsHookExA                            76D86DFA 5 Bytes  JMP 001F0600
.text          C:\windows\system32\wuauclt.exe[2948] ntdll.dll!LdrUnloadDll                                                        77C3BD1F 5 Bytes  JMP 000F03FC
.text          C:\windows\system32\wuauclt.exe[2948] ntdll.dll!LdrLoadDll                                                          77C3F425 5 Bytes  JMP 000F01F8
.text          C:\windows\system32\wuauclt.exe[2948] KERNEL32.dll!GetBinaryTypeW + 70                                              76FE7934 1 Byte  [62]
.text          C:\windows\system32\wuauclt.exe[2948] USER32.dll!UnhookWindowsHookEx                                                76D5CC7B 5 Bytes  JMP 00100A08
.text          C:\windows\system32\wuauclt.exe[2948] USER32.dll!UnhookWinEvent                                                    76D5D924 5 Bytes  JMP 001003FC
.text          C:\windows\system32\wuauclt.exe[2948] USER32.dll!SetWindowsHookExW                                                  76D6210A 5 Bytes  JMP 00100804
.text          C:\windows\system32\wuauclt.exe[2948] USER32.dll!SetWinEventHook                                                    76D6507E 5 Bytes  JMP 001001F8
.text          C:\windows\system32\wuauclt.exe[2948] USER32.dll!SetWindowsHookExA                                                  76D86DFA 5 Bytes  JMP 00100600
.text          C:\windows\system32\wbem\unsecapp.exe[2972] ntdll.dll!LdrUnloadDll                                                  77C3BD1F 5 Bytes  JMP 000703FC
.text          C:\windows\system32\wbem\unsecapp.exe[2972] ntdll.dll!LdrLoadDll                                                    77C3F425 5 Bytes  JMP 000701F8
.text          C:\windows\system32\wbem\unsecapp.exe[2972] KERNEL32.dll!GetBinaryTypeW + 70                                        76FE7934 1 Byte  [62]
.text          C:\windows\system32\wbem\unsecapp.exe[2972] USER32.dll!UnhookWindowsHookEx                                          76D5CC7B 5 Bytes  JMP 00080A08
.text          C:\windows\system32\wbem\unsecapp.exe[2972] USER32.dll!UnhookWinEvent                                              76D5D924 5 Bytes  JMP 000803FC
.text          C:\windows\system32\wbem\unsecapp.exe[2972] USER32.dll!SetWindowsHookExW                                            76D6210A 5 Bytes  JMP 00080804
.text          C:\windows\system32\wbem\unsecapp.exe[2972] USER32.dll!SetWinEventHook                                              76D6507E 5 Bytes  JMP 000801F8
.text          C:\windows\system32\wbem\unsecapp.exe[2972] USER32.dll!SetWindowsHookExA                                            76D86DFA 5 Bytes  JMP 00080600
.text          C:\Program Files\Windows Media Player\wmpnetwk.exe[3320] ntdll.dll!LdrUnloadDll                                    77C3BD1F 5 Bytes  JMP 000703FC
.text          C:\Program Files\Windows Media Player\wmpnetwk.exe[3320] ntdll.dll!LdrLoadDll                                      77C3F425 5 Bytes  JMP 000701F8
.text          C:\Program Files\Windows Media Player\wmpnetwk.exe[3320] KERNEL32.dll!GetBinaryTypeW + 70                          76FE7934 1 Byte  [62]
.text          C:\Program Files\Windows Media Player\wmpnetwk.exe[3320] USER32.dll!UnhookWindowsHookEx                            76D5CC7B 5 Bytes  JMP 00090A08
.text          C:\Program Files\Windows Media Player\wmpnetwk.exe[3320] USER32.dll!UnhookWinEvent                                  76D5D924 5 Bytes  JMP 000903FC
.text          C:\Program Files\Windows Media Player\wmpnetwk.exe[3320] USER32.dll!SetWindowsHookExW                              76D6210A 5 Bytes  JMP 00090804
.text          C:\Program Files\Windows Media Player\wmpnetwk.exe[3320] USER32.dll!SetWinEventHook                                76D6507E 5 Bytes  JMP 000901F8
.text          C:\Program Files\Windows Media Player\wmpnetwk.exe[3320] USER32.dll!SetWindowsHookExA                              76D86DFA 5 Bytes  JMP 00090600
.text          C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe[3352] ntdll.dll!LdrUnloadDll                                  77C3BD1F 5 Bytes  JMP 001703FC
.text          C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe[3352] ntdll.dll!LdrLoadDll                                    77C3F425 5 Bytes  JMP 001701F8
.text          C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe[3352] KERNEL32.dll!GetBinaryTypeW + 70                        76FE7934 1 Byte  [62]
.text          C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe[3352] USER32.dll!UnhookWindowsHookEx                          76D5CC7B 5 Bytes  JMP 00180A08
.text          C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe[3352] USER32.dll!UnhookWinEvent                                76D5D924 5 Bytes  JMP 001803FC
.text          C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe[3352] USER32.dll!SetWindowsHookExW                            76D6210A 5 Bytes  JMP 00180804
.text          C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe[3352] USER32.dll!SetWinEventHook                              76D6507E 5 Bytes  JMP 001801F8
.text          C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe[3352] USER32.dll!SetWindowsHookExA                            76D86DFA 5 Bytes  JMP 00180600
.text          C:\Program Files\CyberLink\Shared files\brs.exe[3416] ntdll.dll!LdrUnloadDll                                        77C3BD1F 5 Bytes  JMP 001603FC
.text          C:\Program Files\CyberLink\Shared files\brs.exe[3416] ntdll.dll!LdrLoadDll                                          77C3F425 5 Bytes  JMP 001601F8
.text          C:\Program Files\CyberLink\Shared files\brs.exe[3416] KERNEL32.dll!GetBinaryTypeW + 70                              76FE7934 1 Byte  [62]
.text          C:\Program Files\CyberLink\Shared files\brs.exe[3416] USER32.dll!UnhookWindowsHookEx                                76D5CC7B 5 Bytes  JMP 00170A08
.text          C:\Program Files\CyberLink\Shared files\brs.exe[3416] USER32.dll!UnhookWinEvent                                    76D5D924 5 Bytes  JMP 001703FC
.text          C:\Program Files\CyberLink\Shared files\brs.exe[3416] USER32.dll!SetWindowsHookExW                                  76D6210A 5 Bytes  JMP 00170804
.text          C:\Program Files\CyberLink\Shared files\brs.exe[3416] USER32.dll!SetWinEventHook                                    76D6507E 5 Bytes  JMP 001701F8
.text          C:\Program Files\CyberLink\Shared files\brs.exe[3416] USER32.dll!SetWindowsHookExA                                  76D86DFA 5 Bytes  JMP 00170600
.text          C:\Program Files\Alwil Software\Avast5\AvastUI.exe[3492] kernel32.dll!GetBinaryTypeW + 70                          76FE7934 1 Byte  [62]
.text          C:\windows\system32\wbem\wmiprvse.exe[3520] ntdll.dll!LdrUnloadDll                                                  77C3BD1F 5 Bytes  JMP 000E03FC
.text          C:\windows\system32\wbem\wmiprvse.exe[3520] ntdll.dll!LdrLoadDll                                                    77C3F425 5 Bytes  JMP 000E01F8
.text          C:\windows\system32\wbem\wmiprvse.exe[3520] KERNEL32.dll!GetBinaryTypeW + 70                                        76FE7934 1 Byte  [62]
.text          C:\windows\system32\wbem\wmiprvse.exe[3520] USER32.dll!UnhookWindowsHookEx                                          76D5CC7B 5 Bytes  JMP 00110A08
.text          C:\windows\system32\wbem\wmiprvse.exe[3520] USER32.dll!UnhookWinEvent                                              76D5D924 5 Bytes  JMP 001103FC
.text          C:\windows\system32\wbem\wmiprvse.exe[3520] USER32.dll!SetWindowsHookExW                                            76D6210A 5 Bytes  JMP 00110804
.text          C:\windows\system32\wbem\wmiprvse.exe[3520] USER32.dll!SetWinEventHook                                              76D6507E 5 Bytes  JMP 001101F8
.text          C:\windows\system32\wbem\wmiprvse.exe[3520] USER32.dll!SetWindowsHookExA                                            76D86DFA 5 Bytes  JMP 00110600
.text          C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[3720] ntdll.dll!LdrUnloadDll                      77C3BD1F 5 Bytes  JMP 001E03FC
.text          C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[3720] ntdll.dll!LdrLoadDll                        77C3F425 5 Bytes  JMP 001E01F8
.text          C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[3720] KERNEL32.dll!GetBinaryTypeW + 70            76FE7934 1 Byte  [62]
.text          C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[3720] USER32.dll!UnhookWindowsHookEx              76D5CC7B 5 Bytes  JMP 001F0A08
.text          C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[3720] USER32.dll!UnhookWinEvent                    76D5D924 5 Bytes  JMP 001F03FC
.text          C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[3720] USER32.dll!SetWindowsHookExW                76D6210A 5 Bytes  JMP 001F0804
.text          C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[3720] USER32.dll!SetWinEventHook                  76D6507E 5 Bytes  JMP 001F01F8
.text          C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[3720] USER32.dll!SetWindowsHookExA                76D86DFA 5 Bytes  JMP 001F0600
.text          C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3728] ntdll.dll!LdrUnloadDll                          77C3BD1F 5 Bytes  JMP 001703FC
.text          C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3728] ntdll.dll!LdrLoadDll                            77C3F425 5 Bytes  JMP 001701F8
.text          C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3728] KERNEL32.dll!GetBinaryTypeW + 70                76FE7934 1 Byte  [62]
.text          C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3728] USER32.dll!UnhookWindowsHookEx                  76D5CC7B 5 Bytes  JMP 00180A08
.text          C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3728] USER32.dll!UnhookWinEvent                        76D5D924 5 Bytes  JMP 001803FC
.text          C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3728] USER32.dll!SetWindowsHookExW                    76D6210A 5 Bytes  JMP 00180804
.text          C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3728] USER32.dll!SetWinEventHook                      76D6507E 5 Bytes  JMP 001801F8
.text          C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe[3728] USER32.dll!SetWindowsHookExA                    76D86DFA 5 Bytes  JMP 00180600
.text          C:\windows\system32\svchost.exe[3744] ntdll.dll!LdrUnloadDll                                                        77C3BD1F 5 Bytes  JMP 000E03FC
.text          C:\windows\system32\svchost.exe[3744] ntdll.dll!LdrLoadDll                                                          77C3F425 5 Bytes  JMP 000E01F8
.text          C:\windows\system32\svchost.exe[3744] KERNEL32.dll!GetBinaryTypeW + 70                                              76FE7934 1 Byte  [62]
.text          C:\windows\system32\svchost.exe[3744] USER32.dll!UnhookWindowsHookEx                                                76D5CC7B 5 Bytes  JMP 00100A08
.text          C:\windows\system32\svchost.exe[3744] USER32.dll!UnhookWinEvent                                                    76D5D924 5 Bytes  JMP 001003FC
.text          C:\windows\system32\svchost.exe[3744] USER32.dll!SetWindowsHookExW                                                  76D6210A 5 Bytes  JMP 00100804
.text          C:\windows\system32\svchost.exe[3744] USER32.dll!SetWinEventHook                                                    76D6507E 5 Bytes  JMP 001001F8
.text          C:\windows\system32\svchost.exe[3744] USER32.dll!SetWindowsHookExA                                                  76D86DFA 5 Bytes  JMP 00100600
.text          C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3884] ntdll.dll!LdrUnloadDll                          77C3BD1F 5 Bytes  JMP 000703FC
.text          C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3884] ntdll.dll!LdrLoadDll                            77C3F425 5 Bytes  JMP 000701F8
.text          C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3884] KERNEL32.dll!GetBinaryTypeW + 70                76FE7934 1 Byte  [62]
.text          C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3884] USER32.dll!UnhookWindowsHookEx                  76D5CC7B 5 Bytes  JMP 00200A08
.text          C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3884] USER32.dll!UnhookWinEvent                      76D5D924 5 Bytes  JMP 002003FC
.text          C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3884] USER32.dll!SetWindowsHookExW                    76D6210A 5 Bytes  JMP 00200804
.text          C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3884] USER32.dll!SetWinEventHook                      76D6507E 5 Bytes  JMP 002001F8
.text          C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3884] USER32.dll!SetWindowsHookExA                    76D86DFA 5 Bytes  JMP 00200600
.text          C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[3992] ntdll.dll!LdrUnloadDll                                          77C3BD1F 5 Bytes  JMP 001F03FC
.text          C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[3992] ntdll.dll!LdrLoadDll                                            77C3F425 5 Bytes  JMP 001F01F8
.text          C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[3992] KERNEL32.dll!GetBinaryTypeW + 70                                76FE7934 1 Byte  [62]
.text          C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[3992] USER32.dll!UnhookWindowsHookEx                                  76D5CC7B 5 Bytes  JMP 00200A08
.text          C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[3992] USER32.dll!UnhookWinEvent                                        76D5D924 5 Bytes  JMP 002003FC
.text          C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[3992] USER32.dll!SetWindowsHookExW                                    76D6210A 5 Bytes  JMP 00200804
.text          C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[3992] USER32.dll!SetWinEventHook                                      76D6507E 5 Bytes  JMP 002001F8
.text          C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[3992] USER32.dll!SetWindowsHookExA                                    76D86DFA 5 Bytes  JMP 00200600
.text          C:\windows\system32\AUDIODG.EXE[4176] kernel32.dll!GetBinaryTypeW + 70                                              76FE7934 1 Byte  [62]
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe[4316] ntdll.dll!LdrUnloadDll                          77C3BD1F 5 Bytes  JMP 001703FC
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe[4316] ntdll.dll!LdrLoadDll                            77C3F425 5 Bytes  JMP 001701F8
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe[4316] KERNEL32.dll!GetBinaryTypeW + 70                76FE7934 1 Byte  [62]
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe[4316] USER32.dll!UnhookWindowsHookEx                  76D5CC7B 5 Bytes  JMP 00180A08
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe[4316] USER32.dll!UnhookWinEvent                      76D5D924 5 Bytes  JMP 001803FC
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe[4316] USER32.dll!SetWindowsHookExW                    76D6210A 5 Bytes  JMP 00180804
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe[4316] USER32.dll!SetWinEventHook                      76D6507E 5 Bytes  JMP 001801F8
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe[4316] USER32.dll!SetWindowsHookExA                    76D86DFA 5 Bytes  JMP 00180600
.text          C:\windows\System32\svchost.exe[4768] ntdll.dll!LdrUnloadDll                                                        77C3BD1F 5 Bytes  JMP 000703FC
.text          C:\windows\System32\svchost.exe[4768] ntdll.dll!LdrLoadDll                                                          77C3F425 5 Bytes  JMP 000701F8
.text          C:\windows\System32\svchost.exe[4768] KERNEL32.dll!GetBinaryTypeW + 70                                              76FE7934 1 Byte  [62]
.text          C:\windows\System32\svchost.exe[4768] USER32.dll!UnhookWindowsHookEx                                                76D5CC7B 5 Bytes  JMP 00140A08
.text          C:\windows\System32\svchost.exe[4768] USER32.dll!UnhookWinEvent                                                    76D5D924 5 Bytes  JMP 001403FC
.text          C:\windows\System32\svchost.exe[4768] USER32.dll!SetWindowsHookExW                                                  76D6210A 5 Bytes  JMP 00140804
.text          C:\windows\System32\svchost.exe[4768] USER32.dll!SetWinEventHook                                                    76D6507E 5 Bytes  JMP 001401F8
.text          C:\windows\System32\svchost.exe[4768] USER32.dll!SetWindowsHookExA                                                  76D86DFA 5 Bytes  JMP 00140600
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[4772] ntdll.dll!LdrUnloadDll                          77C3BD1F 5 Bytes  JMP 001E03FC
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[4772] ntdll.dll!LdrLoadDll                            77C3F425 5 Bytes  JMP 001E01F8
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[4772] KERNEL32.dll!GetBinaryTypeW + 70                76FE7934 1 Byte  [62]
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[4772] USER32.dll!UnhookWindowsHookEx                  76D5CC7B 5 Bytes  JMP 002A0A08
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[4772] USER32.dll!UnhookWinEvent                        76D5D924 5 Bytes  JMP 002A03FC
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[4772] USER32.dll!SetWindowsHookExW                    76D6210A 5 Bytes  JMP 002A0804
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[4772] USER32.dll!SetWinEventHook                      76D6507E 5 Bytes  JMP 002A01F8
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[4772] USER32.dll!SetWindowsHookExA                    76D86DFA 5 Bytes  JMP 002A0600
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[4872] ntdll.dll!LdrUnloadDll                          77C3BD1F 5 Bytes  JMP 001E03FC
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[4872] ntdll.dll!LdrLoadDll                            77C3F425 5 Bytes  JMP 001E01F8
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[4872] KERNEL32.dll!GetBinaryTypeW + 70                76FE7934 1 Byte  [62]
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[4872] USER32.dll!UnhookWindowsHookEx                  76D5CC7B 5 Bytes  JMP 001F0A08
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[4872] USER32.dll!UnhookWinEvent                      76D5D924 5 Bytes  JMP 001F03FC
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[4872] USER32.dll!SetWindowsHookExW                    76D6210A 5 Bytes  JMP 001F0804
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[4872] USER32.dll!SetWinEventHook                      76D6507E 5 Bytes  JMP 001F01F8
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[4872] USER32.dll!SetWindowsHookExA                    76D86DFA 5 Bytes  JMP 001F0600
.text          C:\Users\xxx\Desktop\Projektarbeit\Bilder\bcb4db61.exe[4892] kernel32.dll!GetBinaryTypeW + 70            76FE7934 1 Byte  [62]
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[5032] ntdll.dll!LdrUnloadDll                          77C3BD1F 5 Bytes  JMP 001E03FC
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[5032] ntdll.dll!LdrLoadDll                            77C3F425 5 Bytes  JMP 001E01F8
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[5032] KERNEL32.dll!GetBinaryTypeW + 70                76FE7934 1 Byte  [62]
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[5032] USER32.dll!UnhookWindowsHookEx                  76D5CC7B 5 Bytes  JMP 002A0A08
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[5032] USER32.dll!UnhookWinEvent                      76D5D924 5 Bytes  JMP 002A03FC
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[5032] USER32.dll!SetWindowsHookExW                    76D6210A 5 Bytes  JMP 002A0804
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[5032] USER32.dll!SetWinEventHook                      76D6507E 5 Bytes  JMP 002A01F8
.text          C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe[5032] USER32.dll!SetWindowsHookExA                    76D86DFA 5 Bytes  JMP 002A0600
.text          C:\Program Files\Mozilla Firefox\firefox.exe[5252] ntdll.dll!LdrUnloadDll                                          77C3BD1F 5 Bytes  JMP 000703FC
.text          C:\Program Files\Mozilla Firefox\firefox.exe[5252] ntdll.dll!LdrLoadDll                                            77C3F425 5 Bytes  JMP 5E408BF0 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text          C:\Program Files\Mozilla Firefox\firefox.exe[5252] KERNEL32.dll!K32GetDeviceDriverBaseNameW + 16F                  76FCC0A7 7 Bytes  JMP 5E757FCD C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text          C:\Program Files\Mozilla Firefox\firefox.exe[5252] KERNEL32.dll!CloseHandle + 38                                    76FD05CF 7 Bytes  JMP 5E757FF0 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text          C:\Program Files\Mozilla Firefox\firefox.exe[5252] KERNEL32.dll!GetExitCodeProcess + 2C                            76FD311D 7 Bytes  JMP 5E41F1AD C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text          C:\Program Files\Mozilla Firefox\firefox.exe[5252] KERNEL32.dll!GetBinaryTypeW + 70                                76FE7934 1 Byte  [62]
.text          C:\Program Files\Mozilla Firefox\firefox.exe[5252] USER32.dll!UnhookWindowsHookEx                                  76D5CC7B 5 Bytes  JMP 00080A08
.text          C:\Program Files\Mozilla Firefox\firefox.exe[5252] USER32.dll!UnhookWinEvent                                        76D5D924 5 Bytes  JMP 000803FC
.text          C:\Program Files\Mozilla Firefox\firefox.exe[5252] USER32.dll!SetWindowsHookExW                                    76D6210A 5 Bytes  JMP 00080804
.text          C:\Program Files\Mozilla Firefox\firefox.exe[5252] USER32.dll!SetWinEventHook                                      76D6507E 5 Bytes  JMP 000801F8
.text          C:\Program Files\Mozilla Firefox\firefox.exe[5252] USER32.dll!SetWindowsHookExA                                    76D86DFA 5 Bytes  JMP 00080600
.text          C:\Program Files\Mozilla Firefox\firefox.exe[5252] GDI32.dll!GetViewportOrgEx + 21C                                76E285EB 7 Bytes  JMP 5E757F4E C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)

---- Devices - GMER 2.1 ----

Device          \FileSystem\Ntfs \Ntfs                                                                                              aswSP.SYS (avast! self protection module/AVAST Software)

AttachedDevice  \Driver\tdx \Device\Tcp                                                                                            aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice  \Driver\tdx \Device\Udp                                                                                            aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)

---- Registry - GMER 2.1 ----

Reg            HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002185eab0b4                                       
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                   
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                C:\Program Files\DAEMON Tools Pro\
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                0x87 0x73 0x00 0x00 ...
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                0
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0xE5 0xE7 0x80 0xBF ...
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                         
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0xA0 0x02 0x00 0x00 ...
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                    0xEA 0xC2 0x32 0xA3 ...
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                     
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0x79 0xCB 0x3D 0x7B ...
Reg            HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002185eab0b4 (not active ControlSet)                   
Reg            HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)               
Reg            HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                    C:\Program Files\DAEMON Tools Pro\
Reg            HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                    0x87 0x73 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                    0
Reg            HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0xE5 0xE7 0x80 0xBF ...
Reg            HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)     
Reg            HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0xA0 0x02 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                        0xEA 0xC2 0x32 0xA3 ...
Reg            HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0x79 0xCB 0x3D 0x7B ...

---- EOF - GMER 2.1 ----
--- --- ---

-Mausi- 24.02.2013 21:06
*edit*

aharonov 24.02.2013 22:17
Hallo,

noch nicht viel zu sehen bis jetzt.
Weiter:


Schritt 1

Downloade dir bitte AdwCleaner und speichere es auf deinen Desktop.
  • Schliesse alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Löschen.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet, je nach Schwere der Infektion auch mehrmals - das ist normal. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.



Schritt 2

Warnung für Mitleser:
Combofix sollte nur dann ausgeführt werden, wenn dies explizit von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix.
  • WICHTIG: Speichere Combofix auf deinen Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft, bitte gar nichts am Computer arbeiten, auch nicht die Maus bewegen!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen (C:\Combofix.txt).
  • Bitte poste den Inhalt dieses Logfiles in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.



Schritt 3

Starte bitte die OTL.exe.
  • Setze den Haken bei Scan all Users.
  • Drücke auf den Quick Scan Button.
  • Poste den Inhalt von OTL.txt hier in den Thread.



Bitte poste in deiner nächsten Antwort:
  • Log von AdwCleaner
  • Log von Combofix
  • Log von OTL

-Mausi- 24.02.2013 23:15
okay. die nächsten Schritte sind fertig:AdwCleaner Logfile:
Code:
# AdwCleaner v2.113 - Datei am 24/02/2013 um 22:40:56 erstellt
# Aktualisiert am 23/02/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium  (32 bits)
# Benutzer : xxx - xxx
# Bootmodus : Normal
# Ausgeführt unter : xxx
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\oengctvk.default\searchplugins\icqplugin.xml
Datei Gelöscht : C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\oengctvk.default\searchplugins\icqplugin-1.xml
Datei Gelöscht : C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\oengctvk.default\searchplugins\icqplugin-2.xml
Datei Gelöscht : C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\oengctvk.default\searchplugins\icqplugin-3.xml
Datei Gelöscht : C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\oengctvk.default\searchplugins\SweetIm.xml
Ordner Gelöscht : C:\Users\xxx\AppData\LocalLow\boost_interprocess
Ordner Gelöscht : C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\oengctvk.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
Ordner Gelöscht : C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\oengctvk.default\SweetIMToolbarData
Ordner Gelöscht : C:\Users\xxx\AppData\Roaming\pdfforge

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35D-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\14919ea49a8f3b4aa3cf1058d9a64cec
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6E4C89CF-3061-4EE4-B22A-B7A8AAEA5CB3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASMANCS

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16464

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v19.0 (de)

Datei : C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\oengctvk.default\prefs.js

Gelöscht : user_pref("browser.search.defaultenginename", "SweetIM Search");
Gelöscht : user_pref("browser.search.defaulturl", "hxxp://search.sweetim.com/search.asp?src=2&q=");
Gelöscht : user_pref("browser.search.selectedEngine", "SweetIM Search");
Gelöscht : user_pref("icqtoolbar.allowSendURL", false);
Gelöscht : user_pref("icqtoolbar.engineVerified", false);
Gelöscht : user_pref("icqtoolbar.hiddenElements", "itb_options");
Gelöscht : user_pref("icqtoolbar.history", "fernsehprogramm%20heute%2020.15||dict||tropical%20island||fernsehpr[...]
Gelöscht : user_pref("icqtoolbar.numberOfSearches", 0);
Gelöscht : user_pref("icqtoolbar.previousFFVersion", "3.5.5");
Gelöscht : user_pref("icqtoolbar.skip_default_search", "no");
Gelöscht : user_pref("icqtoolbar.suggestions", false);
Gelöscht : user_pref("icqtoolbar.uniqueID", "122824499312282443931228328417821");
Gelöscht : user_pref("icqtoolbar.usageStatstTimestamp", 1260905817);
Gelöscht : user_pref("icqtoolbar.version", "1.1.4.1");
Gelöscht : user_pref("icqtoolbar.xmlEnableSuggestions", false);
Gelöscht : user_pref("icqtoolbar.xmlLanguage", "de");
Gelöscht : user_pref("keyword.URL", "hxxp://search.sweetim.com/search.asp?src=2&q=");
Gelöscht : user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
Gelöscht : user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
Gelöscht : user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
Gelöscht : user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
Gelöscht : user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
Gelöscht : user_pref("sweetim.toolbar.mode.debug", "false");
Gelöscht : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "ICQ Search");
Gelöscht : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "ICQ Search");
Gelöscht : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "hxxp://www.google.de/");
Gelöscht : user_pref("sweetim.toolbar.previous.keyword.URL", "hxxp://search.icq.com/search/afe_results.php?ch_i[...]
Gelöscht : user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engin[...]
Gelöscht : user_pref("sweetim.toolbar.search.history", "bild.de,alchemie%20app,konstruktion%20expressionsvektor[...]
Gelöscht : user_pref("sweetim.toolbar.search.history.capacity", "10");
Gelöscht : user_pref("sweetim.toolbar.simapp_id", "{4B243B2C-CB0B-4789-88E4-1F379C92C19D}");
Gelöscht : user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com");
Gelöscht : user_pref("sweetim.toolbar.version", "1.0.0.10");

Datei : C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\vyeaovdz.default\prefs.js

[OK] Die Datei ist sauber.

-\\ Opera v10.61.3484.0

Datei : C:\Users\xxx\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [5527 octets] - [24/02/2013 22:40:56]

########## EOF - C:\AdwCleaner[S1].txt - [5587 octets] ##########
--- --- ---


Combofix Logfile:
Code:
ComboFix 13-02-24.01 - xxx 24.02.2013  22:49:55.1.2 - x86
Microsoft Windows 7 Home Premium  6.1.7600.0.1252.49.1031.18.3071.1799 [GMT 1:00]
ausgeführt von:: xxx
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\IsUn0407.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-01-24 bis 2013-02-24  ))))))))))))))))))))))))))))))
.
.
2013-02-24 21:58 . 2013-02-24 21:59        --------        d-----w-        c:\users\xxx\AppData\Local\temp
2013-02-24 21:58 . 2013-02-24 21:58        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-02-24 21:55 . 2013-02-24 21:55        60872        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{0AB700C6-3738-44ED-AFF0-B601F9589DDA}\offreg.dll
2013-02-22 15:55 . 2013-02-08 00:45        6954968        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{0AB700C6-3738-44ED-AFF0-B601F9589DDA}\mpengine.dll
2013-02-21 15:50 . 2013-02-21 15:50        94112        ----a-w-        c:\windows\system32\WindowsAccessBridge.dll
2013-02-19 20:08 . 2013-02-20 04:04        --------        d-----w-        c:\program files\Mozilla Thunderbird
2013-02-15 22:04 . 2013-02-15 22:04        208448        ----a-w-        c:\program files\Internet Explorer\Plugins\nppdf32.dll
2013-02-15 15:36 . 2012-10-15 16:59        44784        ----a-w-        c:\windows\system32\drivers\aswRdr2.sys
2013-02-13 16:58 . 2013-01-04 03:00        2345984        ----a-w-        c:\windows\system32\win32k.sys
2013-01-29 15:43 . 2013-01-29 15:43        --------        d-----w-        c:\program files\Common Files\Skype
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-21 15:49 . 2012-06-23 21:34        861088        ----a-w-        c:\windows\system32\npDeployJava1.dll
2013-02-21 15:49 . 2010-07-10 21:02        782240        ----a-w-        c:\windows\system32\deployJava1.dll
2013-01-17 00:28 . 2009-11-26 16:46        232336        ------w-        c:\windows\system32\MpSigStub.exe
2012-12-16 14:25 . 2012-12-21 18:36        295424        ----a-w-        c:\windows\system32\atmfd.dll
2012-12-16 14:25 . 2012-12-21 18:36        34304        ----a-w-        c:\windows\system32\atmlib.dll
2012-12-14 15:49 . 2010-08-27 17:10        21104        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-12-07 05:04 . 2013-01-09 19:40        308736        ----a-w-        c:\windows\system32\Wpc.dll
2012-12-07 04:57 . 2013-01-09 19:40        2576384        ----a-w-        c:\windows\system32\gameux.dll
2012-12-07 03:21 . 2013-01-09 19:40        45568        ----a-w-        c:\windows\system32\oflc-nz.rs
2012-12-07 03:21 . 2013-01-09 19:40        44544        ----a-w-        c:\windows\system32\pegibbfc.rs
2012-12-07 03:21 . 2013-01-09 19:40        43520        ----a-w-        c:\windows\system32\csrr.rs
2012-12-07 03:21 . 2013-01-09 19:40        30720        ----a-w-        c:\windows\system32\usk.rs
2012-12-07 03:21 . 2013-01-09 19:40        23552        ----a-w-        c:\windows\system32\oflc.rs
2012-12-07 03:21 . 2013-01-09 19:40        20480        ----a-w-        c:\windows\system32\pegi-pt.rs
2012-12-07 03:21 . 2013-01-09 19:40        20480        ----a-w-        c:\windows\system32\pegi.rs
2012-12-07 03:21 . 2013-01-09 19:40        20480        ----a-w-        c:\windows\system32\pegi-fi.rs
2012-12-07 03:21 . 2013-01-09 19:40        46592        ----a-w-        c:\windows\system32\fpb.rs
2012-12-07 03:21 . 2013-01-09 19:40        21504        ----a-w-        c:\windows\system32\grb.rs
2012-12-07 03:21 . 2013-01-09 19:40        55296        ----a-w-        c:\windows\system32\cero.rs
2012-12-07 03:21 . 2013-01-09 19:40        51712        ----a-w-        c:\windows\system32\esrb.rs
2012-12-07 03:21 . 2013-01-09 19:40        40960        ----a-w-        c:\windows\system32\cob-au.rs
2012-12-07 03:21 . 2013-01-09 19:40        15360        ----a-w-        c:\windows\system32\djctq.rs
2013-02-21 15:49 . 2013-02-21 15:49        263064        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-10-30 22:50        121528        ----a-w-        c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sony Ericsson PC Companion"="c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe" [2011-07-25 433360]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-01-08 18705664]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-10 98304]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-06 7600672]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"MGSysCtrl"="c:\program files\System Control Manager\MGSysCtrl.exe" [2009-08-05 2072576]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2012-12-14 824232]
"RemoteControl10"="c:\program files\CyberLink\PowerDVD10\PDVD10Serv.exe" [2010-02-02 87336]
"BDRegion"="c:\program files\Cyberlink\Shared files\brs.exe" [2010-03-13 75048]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-06-17 85160]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-03-25 2516296]
"CanonSolutionMenuEx"="c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE" [2010-04-02 1185112]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2009-8-26 2684256]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer3"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ArcSoft Connection Service"=c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
.
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [x]
R3 dc3d;Microsoft-Hardware – Geräteerkennungstreiber;c:\windows\system32\DRIVERS\dc3d.sys [x]
R3 enecirhid;ENE CIR HID Receiver;c:\windows\system32\DRIVERS\enecirhid.sys [x]
R3 enecirhidma;ENE CIR HIDmini Filter;c:\windows\system32\DRIVERS\enecirhidma.sys [x]
R3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\DRIVERS\s0016bus.sys [x]
R3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0016mdfl.sys [x]
R3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0016mdm.sys [x]
R3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0016mgmt.sys [x]
R3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\DRIVERS\s0016nd5.sys [x]
R3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0016obex.sys [x]
R3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\DRIVERS\s0016unic.sys [x]
R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [x]
R3 USBPNPA;USB PnP Sound Device Interface;c:\windows\system32\drivers\CM108.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2010/09/14 18:21];c:\program files\CyberLink\PowerDVD10\NavFilter\000.fcl [x]
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 Micro Star SCM;Micro Star SCM;c:\program files\System Control Manager\MSIService.exe [x]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe [x]
S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [x]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [x]
.
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
.
------- Zusätzlicher Suchlauf -------
.
mStart Page =
uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/fuji/defaults/su/*hxxp://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 213.187.64.1 217.69.224.73
FF - ProfilePath - c:\users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\oengctvk.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - ExtSQL: 2013-02-16 07:27; wrc@avast.com; c:\program files\Alwil Software\Avast5\WebRep\FF
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Farm Frenzy - Pizza Party 1.2.0.0 - c:\program files\LISA510\Farm Frenzy - Pizza Party\Uninstall.exe
AddRemove-LSI Soft Modem - c:\windows\agrsmdel
AddRemove-Pharao - c:\windows\IsUn0407.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD10\NavFilter\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-02-24  23:02:05
ComboFix-quarantined-files.txt  2013-02-24 22:02
.
Vor Suchlauf: 9 Verzeichnis(se), 201.332.383.744 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 201.420.132.352 Bytes frei
.
- - End Of File - - 47BCD51FD2604EBF415A3F978D190FF2
--- --- ---


OTL Logfile:
Code:
OTL logfile created on: 24.02.2013 23:03:01 - Run 2
OTL by OldTimer - Version 3.2.69.0    Folder = xxx
 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,62 Gb Available Physical Memory | 53,98% Memory free
6,00 Gb Paging File | 4,72 Gb Available in Paging File | 78,73% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 273,40 Gb Total Space | 187,67 Gb Free Space | 68,64% Space Free | Partition Type: NTFS
Drive D: | 182,26 Gb Total Space | 158,71 Gb Free Space | 87,08% Space Free | Partition Type: NTFS
Unable to calculate disk information.
 
Computer Name:xxx | User Name: xxx | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.02.24 20:27:43 | 000,602,112 | ---- | M] (OldTimer Tools) -- xxx
PRC - [2013.02.21 16:49:47 | 000,917,400 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2012.12.18 20:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.10.30 23:50:59 | 004,297,136 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2011.09.01 13:25:38 | 000,671,552 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe
PRC - [2011.09.01 13:23:08 | 001,526,080 | ---- | M] (TuneUp Software) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe
PRC - [2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.04.15 09:16:48 | 000,288,064 | ---- | M] (DT Soft Ltd) -- C:\Program Files\DAEMON Tools Pro\DTShellHlp.exe
PRC - [2010.04.05 20:55:01 | 000,116,104 | ---- | M] () -- C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
PRC - [2010.04.02 10:18:54 | 001,185,112 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE
PRC - [2010.03.25 03:50:00 | 002,516,296 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
PRC - [2010.03.18 10:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2010.03.13 11:58:58 | 000,075,048 | ---- | M] (cyberlink) -- C:\Program Files\CyberLink\Shared files\brs.exe
PRC - [2010.02.02 23:08:56 | 000,087,336 | ---- | M] (CyberLink Corp.) -- C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe
PRC - [2009.08.26 19:36:00 | 002,684,256 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
PRC - [2009.07.31 05:20:00 | 000,144,752 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
PRC - [2009.07.14 02:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009.07.10 06:05:00 | 000,348,160 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2009.07.10 06:04:30 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2009.07.09 23:54:42 | 000,160,768 | ---- | M] (Micro-Star International Co., Ltd.) -- C:\Program Files\System Control Manager\MSIService.exe
PRC - [2009.06.05 03:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2009.06.05 03:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
PRC - [2009.03.27 11:10:56 | 000,014,336 | ---- | M] (LSI Corporation) -- C:\Program Files\LSI SoftModem\agrsmsvc.exe
PRC - [2008.07.24 19:24:00 | 000,083,272 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.02.21 16:49:47 | 003,067,288 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2013.02.14 18:08:03 | 011,824,128 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\a00aab40bdf5aed84b4d4294965cf20d\System.Web.ni.dll
MOD - [2013.02.14 18:07:47 | 012,433,920 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\05682429807d34d6ff05a77ea153935f\System.Windows.Forms.ni.dll
MOD - [2013.01.10 18:52:44 | 000,771,584 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\01b47a246b4ec7bfec31bf4503aceda1\System.Runtime.Remoting.ni.dll
MOD - [2013.01.10 18:52:10 | 001,592,832 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\e2ee5d77ebe0bd025e7a7a317a43d677\System.Drawing.ni.dll
MOD - [2013.01.10 18:51:49 | 005,453,312 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\10aba2c167cc1119b80159fd9ac71ca8\System.Xml.ni.dll
MOD - [2013.01.10 18:51:45 | 000,971,264 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\96a3b737db1e72adaf32d2b350e50c23\System.Configuration.ni.dll
MOD - [2013.01.10 18:51:44 | 007,974,400 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\System\c54750e64ba10d0fb7b6a636fb3695ca\System.ni.dll
MOD - [2013.01.10 18:51:32 | 011,490,816 | ---- | M] () -- C:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b0b8554c05f194f546a8ed531320760b\mscorlib.ni.dll
MOD - [2012.07.03 17:58:43 | 006,277,280 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll
MOD - [2009.09.16 23:43:17 | 000,434,176 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2009.09.16 23:43:15 | 000,315,392 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009.09.16 23:39:15 | 001,732,608 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.3478.18702__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll
MOD - [2009.09.16 23:39:15 | 000,339,968 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3478.18684__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:15 | 000,204,800 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3478.18704__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll
MOD - [2009.09.16 23:39:15 | 000,077,824 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3478.18756__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:15 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3478.18698__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll
MOD - [2009.09.16 23:39:15 | 000,036,864 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3478.18727__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:15 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3478.18693__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:14 | 000,950,272 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager2.Graphics.Dashboard\2.0.3478.18802__90ba9c70f846762e\CLI.Aspect.DisplaysManager2.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,782,336 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3478.18730__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,573,440 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3478.18705__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,491,520 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3478.18776__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll
MOD - [2009.09.16 23:39:14 | 000,409,600 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3478.18751__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll
MOD - [2009.09.16 23:39:14 | 000,393,216 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3478.18728__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,360,448 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.3478.18724__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,331,776 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3478.18742__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,315,392 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Dashboard\2.0.3478.18736__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,307,200 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Wizard\2.0.3478.18709__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Wizard.dll
MOD - [2009.09.16 23:39:14 | 000,270,336 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,196,608 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3478.18704__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,118,784 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard\2.0.3478.18775__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,094,208 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3478.18742__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll
MOD - [2009.09.16 23:39:14 | 000,094,208 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3478.18734__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,081,920 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3478.18729__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:14 | 000,073,728 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3478.18692__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,065,536 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3478.18737__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:14 | 000,061,440 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3478.18741__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:14 | 000,061,440 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3478.18728__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:14 | 000,045,056 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3478.18776__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll
MOD - [2009.09.16 23:39:14 | 000,045,056 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime\2.0.3478.18775__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:14 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3478.18708__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:14 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3478.18729__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:14 | 000,036,864 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3478.18734__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:14 | 000,032,768 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3478.18735__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll
MOD - [2009.09.16 23:39:13 | 000,651,264 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Implementation\2.0.3478.18800__90ba9c70f846762e\ResourceManagement.Foundation.Implementation.dll
MOD - [2009.09.16 23:39:13 | 000,098,304 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3428.28305__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,094,208 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Foundation\2.0.3428.28298__90ba9c70f846762e\CLI.Foundation.dll
MOD - [2009.09.16 23:39:13 | 000,065,536 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3428.28316__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,053,248 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3428.28315__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,053,248 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.3428.28314__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,053,248 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3428.28314__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,049,152 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3428.28314__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,045,056 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll
MOD - [2009.09.16 23:39:13 | 000,045,056 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3478.18781__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll
MOD - [2009.09.16 23:39:13 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3428.28324__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3428.28315__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,032,768 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\LOG.Foundation\2.0.3428.28296__90ba9c70f846762e\LOG.Foundation.dll
MOD - [2009.09.16 23:39:13 | 000,032,768 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3428.28309__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,028,672 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3428.28297__90ba9c70f846762e\NEWAEM.Foundation.dll
MOD - [2009.09.16 23:39:13 | 000,028,672 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3428.28354__90ba9c70f846762e\CLI.Foundation.XManifest.dll
MOD - [2009.09.16 23:39:13 | 000,028,672 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Shared\2.0.3428.28323__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,028,672 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.3428.28313__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,028,672 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3428.28312__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,028,672 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3428.28311__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,024,576 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3428.28304__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,024,576 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.3428.28314__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Private\2.0.3428.28303__90ba9c70f846762e\ResourceManagement.Foundation.Private.dll
MOD - [2009.09.16 23:39:13 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3428.28308__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3428.28302__90ba9c70f846762e\CLI.Component.Client.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3428.28312__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\APM.Foundation\2.0.3428.28310__90ba9c70f846762e\APM.Foundation.dll
MOD - [2009.09.16 23:39:13 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3428.28304__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3428.28302__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\MOM.Foundation\2.0.3428.28310__90ba9c70f846762e\MOM.Foundation.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\DEM.Graphics\2.0.3428.28324__90ba9c70f846762e\DEM.Graphics.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3428.28303__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3428.28313__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3428.28312__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3428.28304__90ba9c70f846762e\AEM.Server.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3428.28311__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Plugin.REG.Shared\2.0.3428.28329__90ba9c70f846762e\AEM.Plugin.REG.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3428.28327__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3428.28311__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,016,384 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3428.28327__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll
MOD - [2009.09.16 23:39:13 | 000,007,168 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3478.18679__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll
MOD - [2009.09.16 23:39:13 | 000,007,168 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll
MOD - [2009.09.16 23:39:12 | 001,212,416 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3478.18688__90ba9c70f846762e\CLI.Component.Dashboard.dll
MOD - [2009.09.16 23:39:12 | 000,552,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3478.18764__90ba9c70f846762e\CLI.Component.Systemtray.dll
MOD - [2009.09.16 23:39:12 | 000,405,504 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3478.18698__90ba9c70f846762e\CLI.Component.Wizard.dll
MOD - [2009.09.16 23:39:12 | 000,106,496 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3478.18770__90ba9c70f846762e\MOM.Implementation.dll
MOD - [2009.09.16 23:39:12 | 000,065,536 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3478.18769__90ba9c70f846762e\LOG.Foundation.Implementation.dll
MOD - [2009.09.16 23:39:12 | 000,061,440 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\APM.Server\2.0.3478.18680__90ba9c70f846762e\APM.Server.dll
MOD - [2009.09.16 23:39:12 | 000,057,344 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3478.18683__90ba9c70f846762e\CLI.Component.SkinFactory.dll
MOD - [2009.09.16 23:39:12 | 000,057,344 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3478.18681__90ba9c70f846762e\CLI.Component.Runtime.dll
MOD - [2009.09.16 23:39:12 | 000,045,056 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3428.28311__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll
MOD - [2009.09.16 23:39:12 | 000,045,056 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\AEM.Server\2.0.3478.18679__90ba9c70f846762e\AEM.Server.dll
MOD - [2009.09.16 23:39:12 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3428.28301__90ba9c70f846762e\CLI.Foundation.Private.dll
MOD - [2009.09.16 23:39:12 | 000,040,960 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3428.28308__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll
MOD - [2009.09.16 23:39:12 | 000,036,864 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3428.28303__90ba9c70f846762e\LOG.Foundation.Private.dll
MOD - [2009.09.16 23:39:12 | 000,032,768 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll
MOD - [2009.09.16 23:39:12 | 000,024,576 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3428.28311__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll
MOD - [2009.09.16 23:39:12 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3428.28310__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
MOD - [2009.09.16 23:39:12 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3428.28309__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll
MOD - [2009.09.16 23:39:12 | 000,020,480 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3428.28316__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll
MOD - [2009.09.16 23:39:12 | 000,019,456 | ---- | M] () -- C:\windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3478.18770__90ba9c70f846762e\CCC.Implementation.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2013.02.21 16:49:47 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.01.08 12:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.12.18 20:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012.03.09 10:21:22 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2011.09.01 13:23:08 | 001,526,080 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2011.09.01 13:19:26 | 000,029,504 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2011.06.29 14:59:18 | 000,155,344 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe -- (Sony Ericsson PCCompanion)
SRV - [2010.04.05 20:55:01 | 000,116,104 | ---- | M] () [Auto | Running] -- C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE -- (IJPLMSVC)
SRV - [2010.03.18 10:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009.07.31 05:20:00 | 000,144,752 | ---- | M] (TOSHIBA CORPORATION) [On_Demand | Running] -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2009.07.10 06:04:30 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2009.07.09 23:54:42 | 000,160,768 | ---- | M] (Micro-Star International Co., Ltd.) [Auto | Running] -- C:\Program Files\System Control Manager\MSIService.exe -- (Micro Star SCM)
SRV - [2009.06.05 03:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMON)
SRV - [2009.03.27 11:10:56 | 000,014,336 | ---- | M] (LSI Corporation) [Auto | Running] -- C:\Program Files\LSI SoftModem\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2006.04.18 04:00:00 | 000,102,400 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Stopped] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE -- (EPSON_PM_RPCV4_01)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\smserial.sys -- (smserial)
DRV - File not found [Kernel | On_Demand | Unknown] -- C:\ComboFix\mbr.sys -- (mbr)
DRV - File not found [Kernel | On_Demand | Unknown] -- C:\Users\xx~1\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2012.10.30 23:51:58 | 000,738,504 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012.10.30 23:51:58 | 000,361,032 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012.10.30 23:51:58 | 000,054,232 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012.10.30 23:51:57 | 000,058,680 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2012.10.30 23:51:56 | 000,021,256 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012.10.15 17:59:28 | 000,044,784 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr2.sys -- (aswRdr)
DRV - [2011.07.07 15:46:56 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2010.09.14 16:52:53 | 000,697,328 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2010.07.01 17:52:18 | 000,044,432 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dc3d.sys -- (dc3d)
DRV - [2010.03.13 11:58:52 | 000,087,536 | ---- | M] (CyberLink Corp.) [2010/09/14 18:21:14] [Kernel | Auto | Running] -- C:\Program Files\CyberLink\PowerDVD10\NavFilter\000.fcl -- ({1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC})
DRV - [2009.12.05 15:00:19 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2009.12.05 15:00:19 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2009.08.28 19:49:00 | 000,169,064 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfbd.sys -- (tosrfbd)
DRV - [2009.08.05 22:44:00 | 000,049,400 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfusb.sys -- (Tosrfusb)
DRV - [2009.08.05 20:55:00 | 000,061,168 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TosRfSnd.sys -- (TosRfSnd)
DRV - [2009.07.29 04:01:00 | 000,069,480 | ---- | M] (TOSHIBA Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\tosrfcom.sys -- (Tosrfcom)
DRV - [2009.07.24 19:31:00 | 000,021,608 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfnds.sys -- (tosrfnds)
DRV - [2009.07.14 00:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009.07.10 06:40:02 | 004,994,048 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009.06.24 11:23:12 | 000,159,776 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RtHDMIV.sys -- (RTHDMIAzAudService)
DRV - [2009.06.19 17:58:00 | 000,009,608 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Toshidpt.sys -- (toshidpt)
DRV - [2009.06.19 17:57:00 | 000,079,872 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Tosrfhid.sys -- (Tosrfhid)
DRV - [2009.06.19 17:56:00 | 000,042,472 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfbnp.sys -- (tosrfbnp)
DRV - [2009.06.17 19:59:00 | 000,046,984 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosporte.sys -- (tosporte)
DRV - [2009.06.09 05:01:44 | 001,161,664 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2009.05.20 08:08:40 | 000,059,904 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\enecir.sys -- (enecir)
DRV - [2009.05.19 15:59:26 | 000,011,776 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\enecirhid.sys -- (enecirhid)
DRV - [2009.05.18 08:20:40 | 000,119,256 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\jmcr.sys -- (JMCR)
DRV - [2009.05.14 01:40:38 | 004,231,680 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32)
DRV - [2008.07.30 06:51:30 | 000,277,736 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\acedrv11.sys -- (acedrv11)
DRV - [2008.05.16 11:33:14 | 000,115,752 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016unic.sys -- (s0016unic)
DRV - [2008.05.16 11:33:14 | 000,025,512 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016nd5.sys -- (s0016nd5)
DRV - [2008.05.16 11:33:14 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016mdfl.sys -- (s0016mdfl)
DRV - [2008.05.16 11:33:12 | 000,120,744 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016mdm.sys -- (s0016mdm)
DRV - [2008.05.16 11:33:12 | 000,114,216 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016mgmt.sys -- (s0016mgmt)
DRV - [2008.05.16 11:33:12 | 000,110,632 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016obex.sys -- (s0016obex)
DRV - [2008.05.16 11:33:12 | 000,089,256 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016bus.sys -- (s0016bus)
DRV - [2008.04.25 14:06:40 | 000,017,920 | ---- | M] (ArcSoft, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ArcSoftKsUFilter.sys -- (ArcSoftKsUFilter)
DRV - [2008.04.24 12:16:00 | 000,005,632 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\enecirhidma.sys -- (enecirhidma)
DRV - [2007.06.28 07:18:10 | 001,310,720 | ---- | M] (C-Media Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CM108.sys -- (USBPNPA)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-21-1198974828-708339163-1388959167-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1198974828-708339163-1388959167-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = AE EC D4 5D D8 AB CD 01  [binary data]
IE - HKU\S-1-5-21-1198974828-708339163-1388959167-1000\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-1198974828-708339163-1388959167-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1198974828-708339163-1388959167-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-1198974828-708339163-1388959167-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: 2020Player@2020Technologies.com:4.5.4.0
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.9.0.9216
FF - prefs.js..extensions.enabledItems: {dd3d7613-0246-469d-bc65-2a3cc1668adc}:0.7.1.1
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.15.2: C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.15.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.05.01 09:15:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.05.01 09:15:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\Alwil Software\Avast5\WebRep\FF [2013.02.15 16:36:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.02.21 16:49:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.02.24 00:36:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.3\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2013.02.19 21:08:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.3\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
 
[2010.11.11 18:40:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xx\AppData\Roaming\mozilla\Extensions
[2010.11.11 18:40:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xx\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.01.14 22:34:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xx\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2013.02.24 22:41:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\oengctvk.default\extensions
[2011.05.12 18:57:09 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\oengctvk.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.10.18 17:47:14 | 000,000,000 | ---D | M] (BlockSite) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\oengctvk.default\extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc}
[2011.01.09 09:31:37 | 000,000,000 | ---D | M] (20-20 3D Viewer) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\oengctvk.default\extensions\2020Player@2020Technologies.com
[2009.11.26 22:12:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\Firefox\Profiles\vyeaovdz.default\extensions
[2013.01.26 09:53:04 | 000,242,136 | ---- | M] () (No name found) -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2009.09.10 21:21:04 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-10.xml
[2009.10.29 17:45:54 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-11.xml
[2009.10.29 21:01:15 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-12.xml
[2009.12.16 21:44:09 | 000,000,961 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-13.xml
[2009.03.29 20:21:41 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-4.xml
[2009.04.22 22:01:21 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-5.xml
[2009.04.29 05:48:41 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-6.xml
[2009.06.14 17:26:11 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-7.xml
[2009.07.22 21:24:51 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-8.xml
[2009.08.04 19:51:31 | 000,000,950 | ---- | M] () -- C:\Users\xxx\AppData\Roaming\mozilla\firefox\profiles\oengctvk.default\searchplugins\icqplugin-9.xml
[2013.02.21 16:49:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2013.02.21 16:49:30 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013.02.21 16:49:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2013.02.21 16:49:47 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.11.29 10:19:31 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.11.29 10:19:31 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.11.29 10:19:31 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.11.29 10:19:32 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.11.29 10:19:31 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.11.29 10:19:31 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2013.02.24 22:59:32 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O3 - HKU\S-1-5-21-1198974828-708339163-1388959167-1000\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O4 - HKLM..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared files\brs.exe (cyberlink)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe (Micro-Star International Co., Ltd.)
O4 - HKLM..\Run: [RemoteControl10] C:\Program Files\CyberLink\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-21-1198974828-708339163-1388959167-1000..\Run: [Sony Ericsson PC Companion] C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe (Sony Ericsson)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1198974828-708339163-1388959167-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1198974828-708339163-1388959167-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 10.15.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 213.187.64.1 217.69.224.73
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{187DB023-6E9C-41FB-967F-3207F2EA9B3D}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{19C28733-FCF7-45AE-A5F1-6BE27B963194}: DhcpNameServer = 213.187.64.1 217.69.224.73
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O24 - Desktop Components:0 () - file:///C:/DOKUME~1/xxx~1/LOKALE~1/Temp/msohtml1/01/clip_image002.jpg
O24 - Desktop Components:1 () - file:///C:/DOKUME~1/xxx~1/LOKALE~1/Temp/msohtml1/01/clip_image002.gif
O24 - Desktop Components:2 (Die derzeitige Homepage) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.02.24 23:02:08 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.02.24 23:02:07 | 000,000,000 | ---D | C] -- C:\Users\xxx\AppData\Local\temp
[2013.02.24 22:58:35 | 000,000,000 | ---D | C] -- C:\windows\temp
[2013.02.24 22:46:48 | 000,518,144 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe
[2013.02.24 22:46:48 | 000,406,528 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe
[2013.02.24 22:46:48 | 000,060,416 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe
[2013.02.24 22:46:40 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.02.24 22:46:20 | 000,000,000 | ---D | C] -- C:\windows\erdnt
[2013.02.21 16:49:26 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013.02.19 21:08:21 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird
[2013.02.15 16:36:49 | 000,044,784 | ---- | C] (AVAST Software) -- C:\windows\System32\drivers\aswRdr2.sys
[2013.02.13 19:47:30 | 000,000,000 | ---D | C] -- C:\Users\xxx\Desktop\Projektarbeit
[2013.01.29 16:43:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013.01.29 16:43:15 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
 
========== Files - Modified Within 30 Days ==========
 
[2013.02.24 22:59:32 | 000,000,027 | ---- | M] () -- C:\windows\System32\drivers\etc\hosts
[2013.02.24 22:49:56 | 000,017,600 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.02.24 22:49:56 | 000,017,600 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.02.24 22:42:10 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2013.02.24 22:42:01 | 2415,255,552 | -HS- | M] () -- C:\hiberfil.sys
[2013.02.24 16:20:48 | 000,000,186 | ---- | M] () -- C:\Users\xxx\defogger_reenable
[2013.02.24 11:42:49 | 000,696,870 | ---- | M] () -- C:\windows\System32\perfh007.dat
[2013.02.24 11:42:49 | 000,652,148 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2013.02.24 11:42:49 | 000,148,134 | ---- | M] () -- C:\windows\System32\perfc007.dat
[2013.02.24 11:42:49 | 000,121,080 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2013.02.24 02:17:57 | 000,001,077 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.02.15 16:36:49 | 000,002,577 | ---- | M] () -- C:\windows\System32\config.nt
[2013.02.14 18:06:47 | 000,435,720 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2013.02.24 22:46:48 | 000,256,000 | ---- | C] () -- C:\windows\PEV.exe
[2013.02.24 22:46:48 | 000,208,896 | ---- | C] () -- C:\windows\MBR.exe
[2013.02.24 22:46:48 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe
[2013.02.24 22:46:48 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe
[2013.02.24 22:46:48 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe
[2013.02.24 16:20:32 | 000,000,186 | ---- | C] () -- C:\Users\xxx\defogger_reenable
[2013.02.24 02:17:57 | 000,001,077 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2011.08.12 21:47:38 | 000,000,295 | ---- | C] () -- C:\windows\SIERRA.INI
[2010.10.15 20:27:42 | 000,008,192 | ---- | C] () -- C:\Users\xxx\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.12.02 20:21:37 | 000,000,336 | ---- | C] () -- C:\Users\xxx\AppData\Roaming\wklnhst.dat
[2009.11.26 20:28:16 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:46:56 | 012,868,608 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 02:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2012.09.03 20:44:27 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Boomzap
[2010.11.26 19:15:09 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Buhl Data Service GmbH
[2011.01.30 19:59:36 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Canon
[2010.09.14 16:59:21 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\DAEMON Tools Pro
[2011.07.24 16:25:59 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Die Saeule der Maya
[2010.09.23 19:43:18 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\EPSON
[2010.02.16 20:13:21 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\FileZilla
[2011.04.18 17:07:02 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\fotobuch.de AG
[2012.02.21 13:04:00 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Glory of the Roman Empire
[2011.07.10 07:40:28 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\go
[2010.08.27 19:35:54 | 000,000,000 | ---D | M] -- C:\Users\xxxr\AppData\Roaming\ICQ
[2010.11.26 19:15:11 | 000,000,000 | ---D | M] -- C:\Users\xxxr\AppData\Roaming\LetsTrade
[2010.08.07 13:37:36 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Opera
[2010.06.07 20:40:17 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Orneon
[2010.06.26 11:42:15 | 000,000,000 | ---D | M] -- C:\Users\xxxr\AppData\Roaming\ProtectDisc
[2011.04.15 17:53:03 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Sony
[2009.12.02 20:21:38 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Template
[2010.11.11 18:40:15 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Thunderbird
[2010.01.14 22:34:34 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\TomTom
[2010.07.10 11:14:59 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\TS3Client
[2011.09.26 20:55:39 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\TuneUp Software
[2010.10.04 15:37:32 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\Ubisoft
[2012.07.21 22:04:16 | 000,000,000 | ---D | M] -- C:\Users\xxx\AppData\Roaming\WeatherLord
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:CB0FEE2B

< End of report >
--- --- ---

aharonov 25.02.2013 00:34
Hallo,

ich seh bis jetzt auch nichts Verdächtiges.
Hattest du denn in letzter Zeit mal Malwarebefall, welcher von deinem Antivirenprogramm entfernt wurde?
Oder waren möglicherweise deine Passwörter zu schwach gewählt (zu kurz, vollständige Namen oder Begriffe darin) und an beiden gehackten Orten dieselben?
Machen wir noch eine Kontrolle:


Hinweis: Registry Cleaner

Ich sehe, dass du sogenannte Registry Cleaner installiert hast.
In deinem Fall TuneUp Utilities 2011.

Wir raten von der Verwendung jeglicher Art von Registry Cleaner ab.

Der Grund ist ganz einfach:
Die Registry ist das Hirn des Systems. Funktioniert das Hirn nicht, funktioniert der Rest nicht mehr wirklich.
Man sollte nicht unnötigerweise an der Registry rumbasteln. Schon ein kleiner Fehler kann gravierende Folgen haben und auch Programme machen manchmal Fehler.
Zerstörst du die Registry, zerstörst du Windows.

Zudem ist der Nutzen zur Performancesteigerung umstritten und meist kaum im wahrnehmbaren Bereich.

Ich würde dir empfehlen, Registry Cleaner nicht weiterhin zu verwenden und über
Start --> Systemsteuerung --> Software (bei Windows XP)
Start --> Systemsteuerung --> Programme und Funktionen (bei Vista / Win 7)
zu deinstallieren.



Schritt 1
  • Starte bitte die OTL.exe.
  • Kopiere nun den folgenden Inhalt aus der Codebox in die http://larusso.trojaner-board.de/Images/otlfix.jpg Textbox.
    Wichtig: Falls du deinen Benutzernamen im Log unkenntlich gemacht hast (z.B. durch ***), dann mach das hier wieder rückgängig.
Code:
:OTL
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:CB0FEE2B

:commands
[emptytemp]
  • Schliesse nun bitte alle anderen Programme.
  • Klicke jetzt auf den Fix Button.
  • OTL kann gegebenfalls einen Neustart verlangen. Diesen bitte zulassen.
  • Nach dem Neustart findest du ein Textdokument auf deinem Desktop.
    (Auch zu finden unter C:\_OTL\MovedFiles\<date_time>.log)
  • Kopiere nun dessen Inhalt hier in deinen Thread.



Schritt 2

Lade das Setup des ESET Online Scanners herunter und speichere es auf den Desktop.
  • Schliesse evtl. vorhandene externe Festplatten und USB-Sticks an den Rechner an.
  • Deaktiviere jetzt temporär für diesen Scan dein Antivirenprogramm und die Firewall.
    (Danach nicht vergessen, sie wieder einzuschalten.)
  • Starte nun die heruntergeladene esetsmartinstaller_enu.exe.
  • Setze den Haken bei Yes, I accept the Terms of Use und drücke Start.
  • Warte bis die Komponenten heruntergeladen sind.
  • Setze den Haken bei Scan archives.
  • Gehe sicher, dass bei Remove found Threats kein Haken gesetzt ist.
  • Drücke dann auf Start.
  • Die Signaturen werden heruntergeladen und der Scan startet automatisch.
    Hinweis: Dieser Scan kann unter Umständen ziemlich lange dauern!
  • Falls nach Beendigung des Scans Funde angezeigt werden, dann:
    • Drücke auf List of found threats.
    • Klicke dann auf Export to text file... und speichere die Textdatei als ESET.txt auf den Desktop.
    • Drücke danach auf << Back.
  • Schliesse nun den Scanner mit einem Klick auf Finish.
Poste bitte den Inhalt der ESET.txt oder teile mir mit, wenn es keine Funde gegeben hat.



Schritt 3

Downloade dir bitte SecurityCheck (Link 1, Link 2).
  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Wenn der Scan beendet wurde, sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.



Bitte poste in deiner nächsten Antwort:
  • Fixlog von OTL
  • Log von ESET
  • Log von SecurityCheck

-Mausi- 25.02.2013 20:21
Hallöchen,

vielen Dank für deine tolle Hilfe.
Also das Passwort war nicht wirklich dolle und E-mail und Amazon Account hatte auch dasselbe. Das Kuriose aber ich rufe ja meine mails zu 95% mit Outlook ab direkt auf dem PC, im Onlineportal ist also nichts. Und wenn er das Passwort gekannt hätte, dann hätte Amazon ja nicht bemerkt das da jemand unbefugtes rein will.
Ich kann mir da nichts zusammenreimen. Vielleicht war beides auch unabhängig voneinander.

Auf jeden Fall, scheint ja bei mir nichts gefunden zu werden, sodass es doch nur rein onlinetechnisch abgelaufen ist oder ? Zumindest hoff ich es.

Danke Danke Danke nochmal für die tolle Hilfe. Nach den ganzen Scans fühl ich mich zumindest relativ sicher wieder ^^

Bitte Denke noch an meine pn an dich wegen der Namenslöschung.

Tuneuputilities hab ich gelöscht, war eh nur nen demo.

Hier die neuen Logs:

All processes killed
========== OTL ==========
ADS C:\ProgramData\TEMP:CB0FEE2B deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: xxx
->Temp folder emptied: 985311 bytes
->Temporary Internet Files folder emptied: 27310162 bytes
->Java cache emptied: 46998712 bytes
->FireFox cache emptied: 416188689 bytes
->Opera cache emptied: 3838 bytes
->Flash cache emptied: 113703 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 5276 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 469,00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 02252013_184418

Files\Folders moved on Reboot...
File move failed. C:\windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...



ESET hat nichts gefunden !



Results of screen317's Security Check version 0.99.59
Windows 7 x86 (UAC is enabled)
Out of date service pack!!
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
avast! Antivirus
Antivirus out of date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware Version 1.70.0.1100
TuneUp Utilities 2011
TuneUp Utilities Language Pack (de-DE)
JavaFX 2.1.1
Java(TM) 6 Update 29
Java 7 Update 15
Java version out of Date!
Adobe Flash Player 10 Flash Player out of Date!
Adobe Flash Player 10.3.183.20 Flash Player out of Date!
Adobe Reader XI
Mozilla Firefox (19.0)
Mozilla Thunderbird (17.0.3)
````````Process Check: objlist.exe by Laurent````````
Alwil Software Avast5 AvastSvc.exe
Alwil Software Avast5 AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````

aharonov 25.02.2013 21:44
Hallo,

Zitat:
sodass es doch nur rein onlinetechnisch abgelaufen ist oder ?
Die eine Möglichkeit ist, dass das Passwort bei dir oder sonstwo direkt geklaut wurde (z.B. durch entsprechende Malware). Schwache Passwörter werden aber auch oft durch sogenannte Bruteforce- oder Wörterbuchattacken schlicht "erraten", das ist die andere Möglichkeit.

Zitat:
Und wenn er das Passwort gekannt hätte, dann hätte Amazon ja nicht bemerkt das da jemand unbefugtes rein will.
Die Tatsache, dass Amazon etwas bemerkt hat, lässt wohl schon darauf schliessen, dass das nicht ein gezielter Angriff sondern ein automatisierter war. Vielleicht hat aber auch nur die Aktion mit dem Gutschein den Verdacht erregt. Ich weiss es nicht.

Zitat:
Auf jeden Fall, scheint ja bei mir nichts gefunden zu werden
Das ist korrekt, von den üblichen Verdächtigen fehlt bei dir jede Spur. Aber das bedeutet ausschliesslich, dass nichts gefunden wird, und nicht, dass da auch nichts ist. Das möchte ich der Vollständigkeit halber nochmals betont haben. :)

Zitat:
Nach den ganzen Scans fühl ich mich zumindest relativ sicher wieder ^^
Das ist gut. Ich würde auch darauf tippen, dass das schwache Passwort schuld war. Ändere einfach alle Zugangsdaten, wähle sichere (und überall andere) Passwörter und behalte das Ganze unter Beobachtung. Falls trotzdem wieder ein ähnlicher Fall auftritt, dann würd ich aber zur Sicherheit alles platt machen (Formatieren und Neuinstallieren).

Zitat:
Bitte Denke noch an meine pn an dich wegen der Namenslöschung.
Das ist eigentlich bereits länger gemeldet und erledigt (und ich seh auch, dass es geändert wurde). Man muss wohl noch warten, bis die alte Version aus dem Cache gespült wurde.


So, zum Schluss solltest du aber noch deine sicherheitsrelevante Software auf den neusten Stand bringen:


Schritt 1
  • Gehe bitte zu Start --> Alle Programme --> Windows Update.
  • Klicke dann links auf Nach Updates suchen und warte, bis die Suche beendet ist.
  • Drücke dann auf Updates installieren.
  • Starte nach Beendigung der Installation den Rechner neu auf.
  • Wiederhole diese Schritte, bis keine neuen Updates mehr verfügbar sind.



Schritt 2
  • Gehe zu Start --> Systemsteuerung und öffne Programme und Funktionen.
  • Suche und deinstalliere dort der Reihe nach folgende Einträge:
    • Adobe Flash Player 10 Plugin
    • Adobe Flash Player 10 ActiveX
    • Java(TM) 6 Update 29
  • Schliesse das Fenster wieder und führe einen Neustart durch, wenn das gefordert wurde.



Schritt 3

Dein Flashplayer ist veraltet. Installiere folgendermassen die aktuelle Version:
  • Besuche diese Seite von Adobe.
  • Entferne gegebenenfalls den Haken bei McAfee Security Scan bzw. Google Chrome.
  • Drücke auf Jetzt herunterladen und installiere die neuste Version.



Schritt 4
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Wenn der Scan beendet wurde, sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.



Bitte poste in deiner nächsten Antwort:
  • Log von SecurityCheck

-Mausi- 26.02.2013 18:14
Danke Dankeh für alles.


Results of screen317's Security Check version 0.99.59
Windows 7 Service Pack 1 x86 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware Version 1.70.0.1100
JavaFX 2.1.1
Java 7 Update 15
Java version out of Date!
Adobe Flash Player 11.6.602.171
Adobe Reader XI
Mozilla Firefox (19.0)
Mozilla Thunderbird (17.0.3)
````````Process Check: objlist.exe by Laurent````````
Alwil Software Avast5 AvastSvc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````

aharonov 26.02.2013 18:24
Hallo,

prima, das sieht alles gut aus. :daumenhoc
Wir räumen noch alles auf.


Schritt 1

Starte defogger und drücke den Button Re-enable.



Schritt 2

Bitte deaktiviere jetzt temporär das Antiviren-Programm, evtl. vorhandenes Skript-Blocking und Antimalware-Programme.

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste, kopiere folgenden Text in das Ausführen Fenster
Code:
Combofix /Uninstall
und drücke OK.
Du kannst die eben deaktivierten Programme nun wieder einschalten.



Schritt 3

Den ESET Online Scanner kannst du behalten, um ab und zu für eine Zweitmeinung dein System damit zu scannen.
Falls du ESET aber deinstallieren möchtest, dann:

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste, kopiere folgenden Text in das Ausführen Fenster
Code:
"%ProgramFiles%\Eset\Eset Online Scanner\OnlineScannerUninstaller.exe"
und drücke OK.



Schritt 4

Downloade dir bitte delfix auf deinen Desktop.
  • Schliesse alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Klicke auf Start.
  • DelFix entfernt alle von uns verwendeten Programme und löscht sich anschliessend selbst.
    Sollte denoch etwas übrig bleiben, kannst du es manuell löschen.




>> OK <<
Wir sind durch, deine Logs sehen für mich im Moment sauber aus. :daumenhoc

Ich habe dir nachfolgend ein paar Hinweise und Tipps zusammengestellt, die dazu beitragen sollen, dass du in Zukunft unsere Hilfe nicht mehr brauchen wirst.

Bitte gib mir danach noch eine kurze Rückmeldung, wenn auch von deiner Seite keine Probleme oder Fragen mehr offen sind, damit ich dieses Thema als erledigt betrachten kann.




Epilog: Tipps, Dos & Don'ts

Aktualität von System und Software

Das Betriebsystem Windows muss zwingend immer auf dem neusten Stand sein. Stelle sicher, dass die automatischen Updates aktiviert sind:
  • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
  • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren

Auch die installierte Software sollte immer in der aktuellsten Version vorliegen.
Speziell gilt das für den Browser, Java, Flash-Player und PDF-Reader, denn bekannte Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim blossen Besuch einer präparierten Website per Drive-by Download Malware zu installieren. Das kann sogar auf normalerweise legitimen Websites geschehen, wenn es einem Angreifer gelungen ist, seinen Code in die Seite einzuschleusen, und ist deshalb relativ unberechenbar.
  • Mit diesem kleinen Plugin-Check kannst du regelmässig diese Komponenten auf deren Aktualität überprüfen.
  • Achte auch darauf, dass alte, nicht mehr verwendete Versionen deinstalliert sind.
  • Optional: Das Programm Secunia Personal Software Inspector kann dich dabei unterstützen, stets die aktuellen Versionen sämtlicher installierter Software zu nutzen.

Sicherheits-Software

Eine Bemerkung vorneweg: Jede Softwarelösung hat ihre Schwächen. Die gesamte Verantwortung für die Sicherheit auf Software zu übertragen und einen Rundum-Schutz zu erwarten, wäre eine gefährliche Illusion. Bei unbedachtem oder bewusst risikoreichem Verhalten wird auch das beste Programm früher oder später seinen Dienst versagen (z.B. ein Virenscanner, der eine verseuchte Datei nicht erkennt).
Trotzdem ist entsprechende Software natürlich wichtig und hilft dir in Kombination mit einem gut gewarteten (up-to-date) System und durchdachtem Verhalten, deinen Rechner sauber zu halten.
  • Nutze einen Virenscanner mit Hintergrundwächter mit stets aktueller Datenbank. Welches Produkt gewählt wird, spielt keine so entscheidende Rolle. Es gibt kommerzielle Versionen, aber ein kostenloser Scanner mit den Grundfunktionen wie beispielsweise Avast! Free Antivirus sollte ausreichen. Betreibe aber keinesfalls zwei Wächter parallel, die würden sich gegenseitig behindern.
  • Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.
  • Zusätzlich zum Virenscanner kannst du dein System regelmässig mit einem On-Demand Antimalwareprogramm scannen. Empfehlenswert ist die Free-Version von Malwarebytes Anti-Malware. Vor jedem Scan die Datenbank updaten.
  • Optional: Das Programm Sandboxie führt Anwendungen in einer isolierten Umgebung ("Sandkasten") aus, so dass keine Änderungen am System vorgenommen werden können. Wenn du deinen Browser darin startest, vermindert sich die Chance, dass beim Surfen eingefangene Malware sich dauerhaft im System festsetzen kann.
  • Optional: Das Addon WOT (web of trust) warnt dich vor einer als schädlich gemeldeten Website, bevor sie geladen wird. Für verschiedene Browser erhältlich.

Es liegt in der Natur der Sache, dass die am weitesten verbreitete Anwendungs-Software auch am häufigsten von Malware-Autoren attackiert wird. Es kann daher bereits einen kleinen Sicherheitsgewinn darstellen, wenn man alternative Software (z.B. einen alternativen PDF Reader) benutzt.
Anstelle des Internet Explorers kann man beispielsweise den Mozilla Firefox einsetzen, für welchen es zwei nützliche Addons zur Empfehlung gibt:
  • NoScript verhindert standardmässig das Ausführen von aktiven Inhalten (Java, JavaScript, Flash, ..) für sämtliche Websites. Du kannst selber nach dem Prinzip einer Whitelist festlegen, welchen Seiten du vertrauen und Scripts erlauben willst, auch temporär.
  • Adblock Plus blockt die meisten Werbebanner weg. Solche Banner können nebst ihrer störenden Erscheinung auch als Infektionsherde fungieren.

(Un-)Sicheres Verhalten im Internet

Nebst unbemerkten Drive-by Installationen wird Malware aber auch oft mehr oder weniger aktiv vom Benutzer selbst installiert.

Der Besuch zwielichtiger Websites kann bereits Risiken bergen. Und Downloads aus dubiosen Quellen sind immer russisches Roulette. Auch wenn der Virenscanner im Moment darin keine Bedrohung erkennt, muss das nichts bedeuten.
  • Illegale Cracks, Keygens und Serials sind ein ausgesprochen einfacher (und ein beliebter) Weg, um Malware zu verbreiten.
  • Bei Dateien aus Peer-to-Peer- und Filesharingprogrammen oder von Filehostern kannst du dir nie sicher sein, ob auch wirklich drin ist, was drauf steht.

Oft wird auch versucht, den Benutzer mit mehr oder weniger trickreichen Methoden dazu zu bringen, eine für ihn verhängnisvolle Handlung selbst auszuführen (Überbegriff Social Engineering).
  • Surfe mit Vorsicht und lass dich nicht von irgendwie interessant erscheinenden Elementen zu einem vorschnellen Klick verleiten. Lass dich nicht von Popups täuschen, die aussehen wie System- oder Virenmeldungen.
  • Sei skeptisch bei unerwarteten E-Mails, insbesondere wenn sie Anhänge enthalten. Auch wenn sie auf den ersten Blick authentisch wirken, persönliche Daten von dir enthalten oder vermeintlich von einem bekannten Absender stammen: Lieber nochmals in Ruhe überdenken oder nachfragen, anstatt einfach mal Links oder ausführbare Anhänge öffnen oder irgendwo deine Daten eingeben.
  • Auch in sozialen Netzwerken oder über Instant Messaging Systeme können schädliche Links oder Dateien die Runde machen. Erhältst du von einem deiner Freunde eine Nachricht, die merkwürdig ist oder so sensationell interessant oder skandalös tönt, dass man einfach draufklicken muss, dann hat bei ihm/ihr wahrscheinlich Neugier über Verstand gesiegt und du solltest nicht denselben Fehler machen.
  • Lass die Dateiendungen anzeigen, so dass du dich nicht täuschen lässt, wenn eine ausführbare Datei über ein doppelte Dateiendung kaschiert wird, z.B. Nacktfoto.jpg.exe.

Nervige Adware (Werbung) und unnötige Toolbars werden auch meist durch den Benutzer selbst mitinstalliert.
  • Lade Software in erster Priorität immer direkt vom Hersteller herunter. Viele Softwareportale (z.B. Softonic) packen noch unnützes Zeug mit in die Installation. Alternativ dazu wähle ein sauberes Portal wie Filepony oder heise.
  • Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen fürs Programm irrelevanten Ergänzungen.

Allgemeine Hinweise

Abschliessend noch ein paar grundsätzliche Bemerkungen:
  • Dein Benutzerkonto für den alltäglichen Gebrauch sollte nicht über Administratorenrechte verfügen. Nutze ein Konto mit eingeschränkten Rechten (Windows XP) bzw. aktiviere die Benutzerkontensteuerung (UAC) auf der höchsten Stufe (Windows Vista / 7).
  • Erstelle regelmässig Backups deiner Daten und Dokumente auf externen Datenträgern, bei wichtigen Dateien mindestens zweifach. Nicht nur ein Malwarebefall kann schmerzhaften Datenverlust nach sich ziehen sondern auch ein gewöhnlicher Festplattendefekt.
  • Die Autorun/Autoplay-Funktion stellt ein Risiko dar, denn sie ermöglicht es, dass beispielsweise beim Einstecken eines entsprechend infizierten USB-Sticks der Befall auf den Rechner überspringt. Überlege dir, ob du diese Funktion nicht besser deaktivieren möchtest.
  • Wähle deine Passwörter gemäss den gängigen Regeln, um besser gegen Brute-Force- und Wörterbuchattacken gewappnet zu sein. Benutze jedes deiner Passwörter nur einmal und ändere sie regelmässig.
  • Der Nutzen von Registry-Cleanern zur Performancesteigerung ist umstritten. Auf jeden Fall lässt sich damit grosser Schaden anrichten, wenn man nicht weiss, was man tut. Wir empfehlen deshalb, die Finger von der Registry zu lassen. Um von Zeit zu Zeit die temporären Dateien zu löschen, genügt TFC.

Wenn du möchtest, kannst du das Forum mit einer kleinen Spende unterstützen.
Es bleibt mir nur noch, dir unbeschwertes und sicheres Surfen zu wünschen und dass wir uns hier so bald nicht wiedersehen. ;)

-Mausi- 26.02.2013 20:18
Vielen Vielen Dank. Ich habe alle Schritte ausgeführt. Ich hoffe das ich jetzt sicher bin. Und hab ja auch ein wenig draus gelernt.

Jetzt muss ich nur noch die 60€ mit Amazon klären :( und dann hoffen das ich endlich Ruhe habe.


Vielen Dank für alles. Ihr seit echt toll.

Danke
Mausi

aharonov 26.02.2013 20:43
Danke für die Rückmeldung.


Freut mich, dass wir helfen konnten. :abklatsch:

Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Ich bekomme somit keine Benachrichtigung mehr über neue Antworten.
Solltest du das Thema erneut brauchen, schicke mir bitte eine PM und wir machen hier weiter.

Jeder andere bitte diese Anleitung lesen und einen eigenen Thread erstellen.


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:03 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19