Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Virenbefall durch Delta Search und Konsorten (https://www.trojaner-board.de/135413-virenbefall-delta-search-konsorten.html)

painfiller 23.05.2013 11:11
Virenbefall durch Delta Search und Konsorten
 
Moin moin liebe Community,

ich schreibe heute für eine Freundin, die Probleme mit ihrem Rechner hat.
Wahrscheinlich handelt es sich für euch um ein altbekanntes Problem:
Man (also egtl Frau!) wollte ein Fußballspiel schauen, das die öffentlich rechtlichen nicht übertragen wollten/konnten und nun tummeln sich lauter Plagegeister auf dem Rechner.
Angefangen hat das ganze mit der 'Delta-Search', mittlerweile gibt es Eingriffe auf die DNS und regelmäßige Fehlermeldungen namens 'ATKOSD2' sowie Probleme mit diversen .DLL-Dateien.
Bevor das ganze Betriebssystem (Windows 7) neu aufgesetzt wird, seid ihr sozusagen die letzte Rettung.

Schn mal im voraus einen riesen Dank, Madame weiß eure Hilfe sehr zu schätzen!

Hier die üblichen Einstiegs-Logs:

Code:
OTL logfile created on: 23.05.2013 11:30:49 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Ann-Kristin.B\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,90 Gb Total Physical Memory | 1,37 Gb Available Physical Memory | 35,19% Memory free
7,81 Gb Paging File | 4,85 Gb Available in Paging File | 62,13% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 95,39 Gb Total Space | 4,59 Gb Free Space | 4,82% Space Free | Partition Type: NTFS
Drive D: | 135,08 Gb Total Space | 134,26 Gb Free Space | 99,39% Space Free | Partition Type: NTFS
 
Computer Name: ANN-KRISTINB-PC | User Name: Ann-Kristin.B | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.05.23 11:29:18 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Ann-Kristin.B\Downloads\OTL.exe
PRC - [2013.05.11 12:37:30 | 001,402,440 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
PRC - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.05.09 10:58:30 | 004,858,968 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2013.05.09 10:58:30 | 000,046,808 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2013.05.06 10:43:11 | 004,573,184 | ---- | M] (Spotify Ltd) -- C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\spotify.exe
PRC - [2013.05.06 10:43:10 | 001,105,408 | ---- | M] (Spotify Ltd) -- C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
PRC - [2013.04.28 22:28:29 | 003,360,256 | ---- | M] (Bandoo Media Inc.) -- C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe
PRC - [2013.04.28 22:28:24 | 003,019,264 | ---- | M] (Bandoo Media Inc.) -- C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe
PRC - [2013.04.09 10:57:09 | 001,312,720 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2013.04.02 20:37:59 | 000,569,120 | ---- | M] () -- C:\ProgramData\IBUpdaterService\ibsvc.exe
PRC - [2013.03.12 09:05:50 | 029,106,336 | ---- | M] (Dropbox, Inc.) -- C:\Users\Ann-Kristin.B\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2012.05.31 22:32:15 | 000,066,560 | ---- | M] (Nalpeiron Ltd.) -- C:\Windows\SysWOW64\nlssrv32.exe
PRC - [2012.03.20 11:16:08 | 000,247,872 | ---- | M] () -- C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE
PRC - [2012.02.16 18:04:20 | 000,289,408 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe
PRC - [2012.02.16 18:04:18 | 000,277,120 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe
PRC - [2011.10.04 22:14:10 | 000,082,944 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
PRC - [2011.10.04 22:14:06 | 000,155,648 | ---- | M] (ASUSTeK) -- C:\Windows\SysWOW64\ACEngSvr.exe
PRC - [2011.10.04 01:17:40 | 000,166,528 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
PRC - [2011.09.09 08:10:06 | 002,317,312 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
PRC - [2011.08.03 00:31:22 | 000,146,592 | ---- | M] (Atheros) -- C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
PRC - [2011.07.22 01:49:10 | 005,716,608 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
PRC - [2011.06.30 02:16:10 | 000,503,728 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
PRC - [2010.12.21 04:24:38 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2010.12.21 04:24:36 | 000,325,656 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2009.12.15 20:39:38 | 000,096,896 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
PRC - [2009.06.19 20:29:42 | 000,105,016 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
PRC - [2009.06.19 20:29:26 | 002,488,888 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
PRC - [2009.06.16 03:30:42 | 000,084,536 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
PRC - [2008.12.23 03:15:34 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
PRC - [2008.08.14 07:00:08 | 000,113,208 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.05.15 10:58:10 | 013,136,776 | ---- | M] () -- C:\Users\Ann-Kristin.B\AppData\Local\Google\Chrome\User Data\PepperFlash\11.7.700.202\pepflashplayer.dll
MOD - [2013.05.06 10:43:11 | 024,985,600 | ---- | M] () -- C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\libcef.dll
MOD - [2013.04.28 22:28:32 | 000,474,112 | ---- | M] () -- C:\Program Files (x86)\Search Results Toolbar\Datamngr\apcrtldr.dll
MOD - [2013.04.28 22:28:27 | 000,016,896 | ---- | M] () -- C:\Program Files (x86)\Search Results Toolbar\Datamngr\mgrldr.dll
MOD - [2013.04.23 16:14:38 | 003,599,872 | ---- | M] () -- C:\Program Files (x86)\Adobe\Reader 11.0\Reader\plug_ins\Citavi Picker\CitaviPicker.api
MOD - [2013.04.09 10:57:07 | 000,390,096 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
MOD - [2013.04.09 10:57:05 | 004,050,896 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\pdf.dll
MOD - [2013.04.09 10:56:15 | 000,598,480 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\libglesv2.dll
MOD - [2013.04.09 10:56:14 | 000,124,368 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\libegl.dll
MOD - [2013.04.09 10:56:13 | 001,606,096 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\ffmpegsumo.dll
MOD - [2013.01.28 14:08:56 | 000,087,952 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2013.01.28 14:08:28 | 001,242,512 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2012.12.18 21:08:32 | 014,588,632 | ---- | M] () -- C:\Program Files (x86)\Adobe\Reader 11.0\Reader\NPSWF32.dll
MOD - [2012.09.23 21:43:36 | 000,313,992 | ---- | M] () -- C:\Program Files (x86)\Adobe\Reader 11.0\Reader\sqlite.dll
MOD - [2011.10.04 22:14:06 | 000,009,216 | ---- | M] () -- C:\Program Files (x86)\ASUS\Splendid\GLCDdll.dll
MOD - [2011.09.09 08:10:06 | 001,163,264 | ---- | M] () -- C:\Program Files (x86)\ASUS\Wireless Console 3\acAuth.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - File not found [On_Demand | Stopped] -- C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe -- (Amsp)
SRV:64bit: - [2013.05.09 10:58:30 | 000,046,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV:64bit: - [2010.11.30 01:00:56 | 000,149,504 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)
SRV:64bit: - [2010.09.23 03:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2010.09.17 10:32:56 | 000,241,488 | ---- | M] (Trend Micro Inc.) [Auto | Running] -- C:\Program Files\Trend Micro\Titanium\TiMiniService.exe -- (TiMiniService)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2013.05.15 10:02:02 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.05.02 10:50:48 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.04.28 22:28:24 | 003,019,264 | ---- | M] (Bandoo Media Inc.) [Auto | Running] -- C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe -- (DatamngrCoordinator)
SRV - [2013.04.02 20:37:59 | 000,569,120 | ---- | M] () [Auto | Running] -- C:\ProgramData\IBUpdaterService\ibsvc.exe -- (IBUpdaterService)
SRV - [2013.02.05 17:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe -- (McComponentHostService)
SRV - [2013.01.14 21:34:36 | 001,024,384 | ---- | M] (Enigma Software Group USA, LLC.) [Auto | Running] -- C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE -- (SpyHunter 4 Service)
SRV - [2012.11.09 12:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.07.09 00:40:10 | 000,104,912 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2012.05.31 22:32:15 | 000,066,560 | ---- | M] (Nalpeiron Ltd.) [Auto | Running] -- C:\Windows\SysWOW64\nlssrv32.exe -- (nlsX86cc)
SRV - [2012.03.20 11:16:08 | 000,247,872 | ---- | M] () [Auto | Running] -- C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE -- (ICQ Service)
SRV - [2012.02.16 18:04:18 | 000,277,120 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe -- (ASUS InstantOn)
SRV - [2011.08.03 00:31:22 | 000,146,592 | ---- | M] (Atheros) [Auto | Running] -- C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe -- (Atheros Bt&Wlan Coex Agent)
SRV - [2011.08.03 00:13:24 | 000,103,584 | ---- | M] (Atheros Commnucations) [Auto | Running] -- C:\Program Files (x86)\Bluetooth Suite\adminservice.exe -- (AtherosSvc)
SRV - [2010.12.21 04:24:38 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2010.12.21 04:24:36 | 000,325,656 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2009.12.15 20:39:38 | 000,096,896 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)
SRV - [2009.06.16 03:30:42 | 000,084,536 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013.05.09 10:59:07 | 001,025,808 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2013.05.09 10:59:07 | 000,378,432 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:64bit: - [2013.05.09 10:59:07 | 000,189,936 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswVmm.sys -- (aswVmm)
DRV:64bit: - [2013.05.09 10:59:07 | 000,072,016 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2013.05.09 10:59:07 | 000,065,336 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswRvrt.sys -- (aswRvrt)
DRV:64bit: - [2013.05.09 10:59:07 | 000,064,288 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:64bit: - [2013.05.09 10:59:06 | 000,080,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2013.05.09 10:59:06 | 000,033,400 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:64bit: - [2013.03.26 17:18:20 | 000,112,080 | R--- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acsock64.sys -- (acsock)
DRV:64bit: - [2012.12.13 14:50:36 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.08.21 14:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012.06.22 11:01:32 | 000,022,704 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\EsgScanner.sys -- (EsgScanner)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.11.03 18:09:48 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2011.11.03 18:09:22 | 012,310,112 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2011.10.19 04:56:00 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.10.19 04:56:00 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.10.18 19:47:12 | 000,198,448 | ---- | M] (ELAN Microelectronics Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD)
DRV:64bit: - [2011.10.17 07:29:08 | 000,202,496 | ---- | M] (Fresco Logic) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\FLxHCIc.sys -- (FLxHCIc)
DRV:64bit: - [2011.10.17 07:29:08 | 000,069,888 | ---- | M] (Fresco Logic) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\FLxHCIh.sys -- (FLxHCIh)
DRV:64bit: - [2011.10.04 09:49:32 | 002,770,944 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2011.08.03 00:22:52 | 000,511,136 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btfilter.sys -- (BtFilter)
DRV:64bit: - [2011.08.03 00:22:06 | 000,280,992 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_rcp.sys -- (BTATH_RCP)
DRV:64bit: - [2011.08.03 00:21:50 | 000,068,256 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_lwflt.sys -- (BTATH_LWFLT)
DRV:64bit: - [2011.08.03 00:21:20 | 000,167,584 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_hcrp.sys -- (BTATH_HCRP)
DRV:64bit: - [2011.08.03 00:21:04 | 000,036,000 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_flt.sys -- (AthBTPort)
DRV:64bit: - [2011.08.03 00:20:50 | 000,030,368 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_bus.sys -- (BTATH_BUS)
DRV:64bit: - [2011.08.03 00:20:34 | 000,110,240 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_avdt.sys -- (btath_avdt)
DRV:64bit: - [2011.08.03 00:20:18 | 000,330,912 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_a2dp.sys -- (BTATH_A2DP)
DRV:64bit: - [2011.05.14 00:37:54 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2011.04.26 05:07:36 | 000,557,848 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2011.03.15 12:09:16 | 000,311,400 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtsuvstor.sys -- (RSUSBVSTOR)
DRV:64bit: - [2011.03.02 17:17:20 | 000,013,088 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
DRV:64bit: - [2011.02.26 03:42:18 | 000,016,768 | ---- | M] (ASUSTek Computer Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AiCharger.sys -- (AiCharger)
DRV:64bit: - [2010.11.30 01:00:04 | 000,016,120 | ---- | M] (Intel(R) Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB)
DRV:64bit: - [2010.11.20 15:33:36 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:06 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 13:07:06 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.10.20 02:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010.09.17 10:52:28 | 000,144,464 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\tmcomm.sys -- (tmcomm)
DRV:64bit: - [2010.09.17 10:52:28 | 000,105,552 | ---- | M] (Trend Micro Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\tmtdi.sys -- (tmtdi)
DRV:64bit: - [2010.09.17 10:52:28 | 000,090,704 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\tmactmon.sys -- (tmactmon)
DRV:64bit: - [2010.09.17 10:52:28 | 000,067,664 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\tmevtmgr.sys -- (tmevtmgr)
DRV:64bit: - [2010.04.28 19:59:16 | 000,027,264 | ---- | M] (ASUS Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\assd.sys -- (assd)
DRV:64bit: - [2009.07.20 11:29:40 | 000,015,416 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kbfiltr.sys -- (kbfiltr)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 01:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)
DRV:64bit: - [2009.06.10 22:35:57 | 000,056,832 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SiSG664.sys -- (SiSGbeLH)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:34:18 | 000,057,344 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2008.05.24 03:27:28 | 000,154,168 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV - [2011.09.07 19:55:04 | 000,017,536 | ---- | M] (ASUS) [Kernel | System | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys -- (ATKWMIACPIIO)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009.07.03 03:36:14 | 000,015,416 | ---- | M] (ASUS) [Kernel | Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys -- (ASMMAP64)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=NP06&src=IE-SearchBox
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=110&systemid=102&apn_uid=1556205021544236&apn_dtid=BND102&o=APN10646&apn_ptnrs=AG7&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=NP06&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=110&systemid=102&apn_uid=1556205021544236&apn_dtid=BND102&o=APN10646&apn_ptnrs=AG7&q={searchTerms}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://www.delta-search.com/?q={searchTerms}&affID=119677&tt=190313_wo3&babsrc=SP_ss&mntrId=1EF482B9A5D1BC8B
IE - HKCU\..\SearchScopes\{651C3DAB-BC92-4E1E-8A9D-75C0AEFB3A03}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYFR&apn_uid=C5DC74AB-5889-4C66-A571-D253D9D3D948&apn_sauid=FD110121-B4F5-4EF2-99CA-338B82612856
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=110&systemid=102&apn_uid=1556205021544236&apn_dtid=BND102&o=APN10646&apn_ptnrs=AG7&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..CT2625848.browser.search.defaultthis.engineName: true
FF - prefs.js..browser.search.defaultengine: "Google"
FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Search Results"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.searchnu.com/102?appid=110"
FF - prefs.js..extensions.enabledAddons: speedanalysis%40SpeedAnalysis.com:1.0.0.1
FF - prefs.js..extensions.enabledAddons: %7BC4A4F5A0-4B89-4392-AFAC-D58010E349AF%7D:5.0.0.7066
FF - prefs.js..extensions.enabledAddons: %7B0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff%7D:10.16.2.509
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&gct=ds&appid=110&systemid=102&apn_dtid=BND102&apn_ptnrs=AG7&apn_uid=1556205021544236&o=APN10646&q="
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\ZEON/PDF,version=2.0: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\firefoxextension\ [2011.10.19 06:36:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\speedanalysis@SpeedAnalysis.com: C:\Users\Ann-Kristin.B\AppData\Roaming\Mozilla\Extensions\speedanalysis@SpeedAnalysis.com [2013.04.02 20:38:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013.05.18 11:05:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}\\: C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2013.05.15 11:20:55 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.05.02 10:50:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\speedanalysis@SpeedAnalysis.com: C:\Users\Ann-Kristin.B\AppData\Roaming\Mozilla\Extensions\speedanalysis@SpeedAnalysis.com [2013.04.02 20:38:58 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.05.02 10:50:51 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2013.05.08 16:21:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ann-Kristin.B\AppData\Roaming\mozilla\Extensions
[2013.04.02 20:38:58 | 000,000,000 | ---D | M] (SpeedAnalysis.com) -- C:\Users\Ann-Kristin.B\AppData\Roaming\mozilla\Extensions\speedanalysis@SpeedAnalysis.com
[2013.05.17 22:36:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ann-Kristin.B\AppData\Roaming\mozilla\Firefox\Profiles\psibyyw1.default\extensions
[2013.05.17 22:36:29 | 000,000,000 | ---D | M] (DVDVideoSoftTB DE) -- C:\Users\Ann-Kristin.B\AppData\Roaming\mozilla\Firefox\Profiles\psibyyw1.default\extensions\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}
[2013.05.08 16:22:09 | 000,000,000 | ---D | M] (Search-Results Toolbar) -- C:\Users\Ann-Kristin.B\AppData\Roaming\mozilla\Firefox\Profiles\psibyyw1.default\extensions\{7abe12ca-e995-4ab4-9a4e-ef8820a20182}
[2013.05.08 16:21:51 | 000,000,000 | ---D | M] (New Tab) -- C:\Users\Ann-Kristin.B\AppData\Roaming\mozilla\Firefox\Profiles\psibyyw1.default\extensions\{C4A4F5A0-4B89-4392-AFAC-D58010E349AF}
[2012.11.08 12:41:00 | 000,002,308 | ---- | M] () -- C:\Users\Ann-Kristin.B\AppData\Roaming\mozilla\firefox\profiles\psibyyw1.default\searchplugins\askcom.xml
[2013.04.02 20:39:33 | 000,001,294 | ---- | M] () -- C:\Users\Ann-Kristin.B\AppData\Roaming\mozilla\firefox\profiles\psibyyw1.default\searchplugins\delta.xml
[2012.12.09 19:05:29 | 000,001,064 | ---- | M] () -- C:\Users\Ann-Kristin.B\AppData\Roaming\mozilla\firefox\profiles\psibyyw1.default\searchplugins\dvdvideosofttb-de-customized-web-search.xml
[2013.05.08 16:21:51 | 000,002,646 | ---- | M] () -- C:\Users\Ann-Kristin.B\AppData\Roaming\mozilla\firefox\profiles\psibyyw1.default\searchplugins\Search_Results.xml
[2013.05.08 16:21:51 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.05.02 10:50:50 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2013.05.02 10:50:38 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.04.02 20:39:13 | 000,006,508 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2013.05.02 10:50:38 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013.05.02 10:50:38 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2013.05.02 10:50:38 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.05.08 16:21:51 | 000,002,646 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml
[2013.05.02 10:50:38 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.05.02 10:50:38 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Search Results (Enabled)
CHR - default_search_provider: search_url = hxxp://dts.search-results.com/sr?src=crb&gct=ds&appid=110&systemid=102&apn_uid=1556205021544236&apn_dtid=BND102&o=APN10646&apn_ptnrs=AG7&q={searchTerms}
CHR - default_search_provider: suggest_url =
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U21 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: McAfee Security Scanner + (Enabled) = C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll
CHR - plugin: Zeon Plus (Enabled) = C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll
CHR - plugin: Java Deployment Toolkit 7.0.210.11 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - Extension: SpeedAnalysis.com = C:\Users\Ann-Kristin.B\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfcbmgbfdbijmjgjihagbomfbjfjmgon\1.0.0.1_0\
CHR - Extension: jZip New Tabs = C:\Users\Ann-Kristin.B\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbajpeofkjjeiamcglnmldoboonfkiol\5.0.0.7066_0\
CHR - Extension: Citavi Picker = C:\Users\Ann-Kristin.B\AppData\Local\Google\Chrome\User Data\Default\Extensions\piehhloihgjjiomhieeddiidpekaajio\2013.4.29_0\
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll (Trend Micro Inc.)
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe64.dll (Trend Micro Inc.)
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll (Trend Micro Inc.)
O2 - BHO: (SpeedAnalysis.com) - {45564571-A21B-48ED-B584-69752EEE9C3D} - C:\Program Files (x86)\SpeedAnalysis.com\ScriptHost.dll (SpeedAnalysis.com)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Search-Results Toolbar) - {7abe12ca-e995-4ab4-9a4e-ef8820a20182} - C:\PROGRA~2\SEARCH~1\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (Trend Micro Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Search-Results Toolbar) - {7abe12ca-e995-4ab4-9a4e-ef8820a20182} - C:\PROGRA~2\SEARCH~1\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [AtherosBtStack] C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Communications)
O4:64bit: - HKLM..\Run: [ETDCtrl] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Trend Micro Client Framework] C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe (Trend Micro Inc.)
O4:64bit: - HKLM..\Run: [VizorHtmlDialog.exe] C:\Program Files\Trend Micro\Titanium\UIFramework\VizorHtmlDialog.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [DATAMNGR] C:\PROGRA~2\SEARCH~1\Datamngr\DATAMN~2.EXE (Bandoo Media Inc.)
O4 - HKLM..\Run: [FLxHCIm64] C:\Program Files\Fresco Logic\Fresco Logic USB3.0 Host Controller\amd64_host\FLxHCIm.exe (Windows (R) Win 7 DDK provider)
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe (ASUS)
O4 - HKCU..\Run: [Spotify] C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\spotify.exe (Spotify Ltd)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - Startup: C:\Users\Ann-Kristin.B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Ann-Kristin.B\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Ann-Kristin.B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Persbackup.lnk =  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: &Citavi Picker... - C:\ProgramData\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: &Citavi Picker... - C:\ProgramData\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O9 - Extra Button: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files (x86)\ICQ7M\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - C:\Program Files (x86)\ICQ7M\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{00DB7D09-6DFF-40CD-B304-5D415F5092A2}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe64.dll (Trend Micro Inc.)
O18:64bit: - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg.dll (Trend Micro Inc.)
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll (Trend Micro Inc.)
O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1381\6.5.1234\TmIEPlg32.dll (Trend Micro Inc.)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~3\Wincert\WIN64C~1.DLL) - C:\ProgramData\Wincert\win64cert.dll ()
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\x64\mgrldr.dll) - C:\PROGRA~2\SEARCH~1\Datamngr\x64\mgrldr.dll ()
O20 - AppInit_DLLs: (C:\PROGRA~3\Wincert\WIN32C~1.DLL) - C:\ProgramData\Wincert\win32cert.dll ()
O20 - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\mgrldr.dll) - C:\PROGRA~2\SEARCH~1\Datamngr\mgrldr.dll ()
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013.04.30 22:03:18 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O36 - AppCertDlls: x64 - (C:\Program Files (x86)\Search Results Toolbar\Datamngr\x64\apcrtldr.dll) - C:\Program Files (x86)\Search Results Toolbar\Datamngr\x64\apcrtldr.dll ()
O36 - AppCertDlls: x86 - (C:\Program Files (x86)\Search Results Toolbar\Datamngr\apcrtldr.dll) - C:\Program Files (x86)\Search Results Toolbar\Datamngr\apcrtldr.dll ()
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.05.20 11:03:06 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\Documents\PersBackup
[2013.05.20 11:02:57 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\AppData\Roaming\PersBackup5
[2013.05.20 11:02:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Personal Backup
[2013.05.20 11:02:15 | 000,000,000 | ---D | C] -- C:\Program Files\Personal Backup 5
[2013.05.20 11:01:58 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\AppData\Local\Programs
[2013.05.19 20:34:25 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\Desktop\Lac de Madine nach Auchan Laxou - Google Maps_files
[2013.05.16 10:24:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Gibraltar
[2013.05.15 11:20:20 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Citavi 4
[2013.05.15 11:16:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Citavi 4
[2013.05.14 17:13:27 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\AppData\Roaming\Swiss Academic Software
[2013.05.14 16:54:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Swiss Academic Software
[2013.05.14 16:47:05 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\AppData\Local\Downloaded Installations
[2013.05.08 16:22:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Wincert
[2013.05.08 16:21:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Search Results Toolbar
[2013.05.08 16:21:37 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\AppData\Local\jZip
[2013.05.08 16:21:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Datamngr
[2013.05.08 16:21:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\jZip
[2013.04.30 22:02:22 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
[2013.04.30 22:02:18 | 000,000,000 | ---D | C] -- C:\sh4ldr
[2013.04.30 22:02:18 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2013.04.30 15:25:45 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\Desktop\Hochladen
[2013.04.30 11:35:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2013.04.30 10:59:11 | 000,378,432 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2013.04.30 10:59:11 | 000,033,400 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2013.04.30 10:59:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2013.04.30 10:59:10 | 000,072,016 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys
[2013.04.30 10:59:10 | 000,064,288 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2013.04.30 10:43:30 | 001,025,808 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2013.04.30 10:42:48 | 000,080,816 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2013.04.30 10:42:45 | 000,287,840 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2013.04.30 10:42:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2013.04.30 10:40:00 | 000,041,664 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2013.04.30 10:38:57 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2013.04.30 10:33:54 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2013.04.30 10:21:17 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\searchplugins
[2013.04.29 10:11:34 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\Desktop\Bewerbung
[2013.04.26 16:07:10 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\Desktop\BA-Arbeit
[2013.04.24 23:51:42 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\Desktop\Drucken
[2013.04.23 16:09:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cisco
[2013.04.23 14:45:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Cisco
[3 C:\Users\Ann-Kristin.B\Desktop\*.tmp files -> C:\Users\Ann-Kristin.B\Desktop\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.05.23 11:33:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.05.23 11:28:56 | 000,000,000 | ---- | M] () -- C:\Users\Ann-Kristin.B\defogger_reenable
[2013.05.23 11:26:29 | 000,050,477 | ---- | M] () -- C:\Users\Ann-Kristin.B\Desktop\Defogger.exe
[2013.05.23 11:13:52 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.05.23 11:13:45 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.05.22 17:33:00 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.05.22 14:10:10 | 009,356,676 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.05.22 14:10:10 | 000,749,256 | ---- | M] () -- C:\Windows\SysNative\perfh00C.dat
[2013.05.22 14:10:10 | 000,748,996 | ---- | M] () -- C:\Windows\SysNative\perfh00A.dat
[2013.05.22 14:10:10 | 000,747,038 | ---- | M] () -- C:\Windows\SysNative\perfh013.dat
[2013.05.22 14:10:10 | 000,743,586 | ---- | M] () -- C:\Windows\SysNative\perfh010.dat
[2013.05.22 14:10:10 | 000,732,558 | ---- | M] () -- C:\Windows\SysNative\prfh0816.dat
[2013.05.22 14:10:10 | 000,728,140 | ---- | M] () -- C:\Windows\SysNative\perfh019.dat
[2013.05.22 14:10:10 | 000,711,078 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.05.22 14:10:10 | 000,665,876 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.05.22 14:10:10 | 000,610,528 | ---- | M] () -- C:\Windows\SysNative\perfh008.dat
[2013.05.22 14:10:10 | 000,482,554 | ---- | M] () -- C:\Windows\SysNative\perfh001.dat
[2013.05.22 14:10:10 | 000,412,012 | ---- | M] () -- C:\Windows\SysNative\prfh0404.dat
[2013.05.22 14:10:10 | 000,395,884 | ---- | M] () -- C:\Windows\SysNative\perfh00D.dat
[2013.05.22 14:10:10 | 000,162,418 | ---- | M] () -- C:\Windows\SysNative\perfc00A.dat
[2013.05.22 14:10:10 | 000,157,046 | ---- | M] () -- C:\Windows\SysNative\perfc013.dat
[2013.05.22 14:10:10 | 000,156,850 | ---- | M] () -- C:\Windows\SysNative\prfc0816.dat
[2013.05.22 14:10:10 | 000,154,786 | ---- | M] () -- C:\Windows\SysNative\perfc019.dat
[2013.05.22 14:10:10 | 000,153,526 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.05.22 14:10:10 | 000,153,524 | ---- | M] () -- C:\Windows\SysNative\perfc00C.dat
[2013.05.22 14:10:10 | 000,150,790 | ---- | M] () -- C:\Windows\SysNative\perfc010.dat
[2013.05.22 14:10:10 | 000,126,088 | ---- | M] () -- C:\Windows\SysNative\prfc0404.dat
[2013.05.22 14:10:10 | 000,126,088 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.05.22 14:10:10 | 000,115,072 | ---- | M] () -- C:\Windows\SysNative\perfc008.dat
[2013.05.22 14:10:10 | 000,098,716 | ---- | M] () -- C:\Windows\SysNative\perfc001.dat
[2013.05.22 14:10:10 | 000,088,702 | ---- | M] () -- C:\Windows\SysNative\perfc00D.dat
[2013.05.22 14:10:08 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.05.22 14:10:08 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.05.22 14:02:24 | 3144,658,944 | -HS- | M] () -- C:\hiberfil.sys
[2013.05.20 18:04:29 | 000,076,827 | ---- | M] () -- C:\Users\Ann-Kristin.B\Desktop\ESTA-Antrag.pdf
[2013.05.20 14:09:01 | 000,002,028 | ---- | M] () -- C:\Users\Ann-Kristin.B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Persbackup.lnk
[2013.05.19 20:37:26 | 000,145,257 | ---- | M] () -- C:\Users\Ann-Kristin.B\Desktop\Lac de Madine nach Auchan Laxou - Google Maps.pdf
[2013.05.19 20:34:25 | 000,179,598 | ---- | M] () -- C:\Users\Ann-Kristin.B\Desktop\Lac de Madine nach Auchan Laxou - Google Maps.htm
[2013.05.18 20:26:09 | 009,159,930 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013.05.18 11:06:13 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2013.05.17 21:49:25 | 000,045,056 | ---- | M] () -- C:\Windows\SysWow64\acovcnt.exe
[2013.05.17 21:27:41 | 000,413,624 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.05.15 11:20:20 | 000,002,099 | ---- | M] () -- C:\Users\Ann-Kristin.B\Desktop\Citavi 4.lnk
[2013.05.09 10:59:07 | 001,025,808 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2013.05.09 10:59:07 | 000,378,432 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2013.05.09 10:59:07 | 000,189,936 | ---- | M] () -- C:\Windows\SysNative\drivers\aswVmm.sys
[2013.05.09 10:59:07 | 000,072,016 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys
[2013.05.09 10:59:07 | 000,065,336 | ---- | M] () -- C:\Windows\SysNative\drivers\aswRvrt.sys
[2013.05.09 10:59:07 | 000,064,288 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2013.05.09 10:59:06 | 000,080,816 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2013.05.09 10:59:06 | 000,033,400 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2013.05.09 10:58:37 | 000,041,664 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2013.05.09 10:58:11 | 000,287,840 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2013.05.08 16:21:53 | 000,000,985 | ---- | M] () -- C:\Users\Ann-Kristin.B\Desktop\jZip.lnk
[2013.05.01 03:09:54 | 000,025,185 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.05.01 03:09:50 | 000,025,185 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2013.04.30 22:03:18 | 000,000,000 | ---- | M] () -- C:\autoexec.bat
[2013.04.30 22:02:25 | 000,002,272 | ---- | M] () -- C:\Users\Ann-Kristin.B\Desktop\SpyHunter.lnk
[2013.04.30 18:02:18 | 000,001,068 | ---- | M] () -- C:\Users\Ann-Kristin.B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013.04.30 11:46:08 | 003,928,064 | ---- | M] () -- C:\Windows\SysNative\d2d1.dll
[2013.04.30 11:46:08 | 002,284,544 | ---- | M] () -- C:\Windows\SysWow64\msmpeg2vdec.dll
[2013.04.30 11:46:08 | 001,247,744 | ---- | M] () -- C:\Windows\SysWow64\DWrite.dll
[2013.04.30 11:46:08 | 001,230,336 | ---- | M] () -- C:\Windows\SysWow64\WindowsCodecs.dll
[2013.04.30 11:46:08 | 000,220,160 | ---- | M] () -- C:\Windows\SysWow64\d3d10core.dll
[2013.04.30 11:46:07 | 001,887,232 | ---- | M] () -- C:\Windows\SysNative\d3d11.dll
[2013.04.30 10:59:11 | 000,001,924 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[3 C:\Users\Ann-Kristin.B\Desktop\*.tmp files -> C:\Users\Ann-Kristin.B\Desktop\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.05.23 11:28:56 | 000,000,000 | ---- | C] () -- C:\Users\Ann-Kristin.B\defogger_reenable
[2013.05.23 11:27:05 | 000,050,477 | ---- | C] () -- C:\Users\Ann-Kristin.B\Desktop\Defogger.exe
[2013.05.20 18:04:29 | 000,076,827 | ---- | C] () -- C:\Users\Ann-Kristin.B\Desktop\ESTA-Antrag.pdf
[2013.05.20 14:09:01 | 000,002,028 | ---- | C] () -- C:\Users\Ann-Kristin.B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Persbackup.lnk
[2013.05.19 20:37:26 | 000,145,257 | ---- | C] () -- C:\Users\Ann-Kristin.B\Desktop\Lac de Madine nach Auchan Laxou - Google Maps.pdf
[2013.05.19 20:34:24 | 000,179,598 | ---- | C] () -- C:\Users\Ann-Kristin.B\Desktop\Lac de Madine nach Auchan Laxou - Google Maps.htm
[2013.05.15 11:20:20 | 000,002,099 | ---- | C] () -- C:\Users\Ann-Kristin.B\Desktop\Citavi 4.lnk
[2013.05.08 16:21:53 | 000,001,015 | ---- | C] () -- C:\Users\Ann-Kristin.B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\jZip.lnk
[2013.05.08 16:21:53 | 000,000,985 | ---- | C] () -- C:\Users\Ann-Kristin.B\Desktop\jZip.lnk
[2013.05.01 03:09:54 | 000,025,185 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.05.01 03:09:50 | 000,025,185 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2013.04.30 22:03:18 | 000,000,000 | ---- | C] () -- C:\autoexec.bat
[2013.04.30 22:02:34 | 000,022,704 | ---- | C] () -- C:\Windows\SysNative\drivers\EsgScanner.sys
[2013.04.30 22:02:25 | 000,002,272 | ---- | C] () -- C:\Users\Ann-Kristin.B\Desktop\SpyHunter.lnk
[2013.04.30 18:02:18 | 000,001,068 | ---- | C] () -- C:\Users\Ann-Kristin.B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013.04.30 11:46:08 | 003,928,064 | ---- | C] () -- C:\Windows\SysNative\d2d1.dll
[2013.04.30 11:46:08 | 002,284,544 | ---- | C] () -- C:\Windows\SysWow64\msmpeg2vdec.dll
[2013.04.30 11:46:08 | 001,247,744 | ---- | C] () -- C:\Windows\SysWow64\DWrite.dll
[2013.04.30 11:46:08 | 001,175,552 | ---- | C] () -- C:\Windows\SysNative\FntCache.dll
[2013.04.30 11:46:08 | 000,220,160 | ---- | C] () -- C:\Windows\SysWow64\d3d10core.dll
[2013.04.30 11:46:07 | 001,887,232 | ---- | C] () -- C:\Windows\SysNative\d3d11.dll
[2013.04.30 11:46:07 | 001,230,336 | ---- | C] () -- C:\Windows\SysWow64\WindowsCodecs.dll
[2013.04.30 10:59:11 | 000,001,924 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2013.04.30 10:43:25 | 000,189,936 | ---- | C] () -- C:\Windows\SysNative\drivers\aswVmm.sys
[2013.04.30 10:43:20 | 000,065,336 | ---- | C] () -- C:\Windows\SysNative\drivers\aswRvrt.sys
[2013.04.30 10:42:45 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\config.nt
[2012.12.11 16:35:35 | 000,000,355 | ---- | C] () -- C:\Users\Ann-Kristin.B\Computer - Verknüpfung.lnk
[2012.09.30 09:49:38 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\acovcnt.exe
[2011.11.03 18:09:24 | 000,217,536 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011.11.03 18:09:22 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2011.11.03 18:09:16 | 013,903,872 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll
[2011.10.20 08:47:09 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011.10.20 08:46:53 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2011.10.19 06:26:32 | 000,131,984 | ---- | C] () -- C:\ProgramData\FullRemove.exe
[2011.10.19 06:11:04 | 009,159,930 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.09.30 09:52:18 | 000,000,000 | ---D | M] -- C:\Users\Ann-Kristin.B\AppData\Roaming\ASUS WebStorage
[2013.04.02 20:38:32 | 000,000,000 | ---D | M] -- C:\Users\Ann-Kristin.B\AppData\Roaming\Babylon
[2013.05.23 11:14:15 | 000,000,000 | ---D | M] -- C:\Users\Ann-Kristin.B\AppData\Roaming\Dropbox
[2012.12.10 09:53:14 | 000,000,000 | ---D | M] -- C:\Users\Ann-Kristin.B\AppData\Roaming\DVDVideoSoft
[2013.04.02 20:38:31 | 000,000,000 | ---D | M] -- C:\Users\Ann-Kristin.B\AppData\Roaming\File Scout
[2013.01.04 21:30:41 | 000,000,000 | ---D | M] -- C:\Users\Ann-Kristin.B\AppData\Roaming\GMATPrep
[2013.05.01 20:09:57 | 000,000,000 | ---D | M] -- C:\Users\Ann-Kristin.B\AppData\Roaming\ICQ
[2012.09.30 21:43:29 | 000,000,000 | ---D | M] -- C:\Users\Ann-Kristin.B\AppData\Roaming\ICQ Search
[2012.09.30 17:07:24 | 000,000,000 | ---D | M] -- C:\Users\Ann-Kristin.B\AppData\Roaming\Nuance
[2012.09.30 13:21:49 | 000,000,000 | ---D | M] -- C:\Users\Ann-Kristin.B\AppData\Roaming\OpenOffice.org
[2013.04.30 11:39:47 | 000,000,000 | ---D | M] -- C:\Users\Ann-Kristin.B\AppData\Roaming\PerformerSoft
[2013.05.20 14:09:00 | 000,000,000 | ---D | M] -- C:\Users\Ann-Kristin.B\AppData\Roaming\PersBackup5
[2013.04.02 20:38:57 | 000,000,000 | ---D | M] -- C:\Users\Ann-Kristin.B\AppData\Roaming\SpeedanAlysis
[2013.05.23 11:52:43 | 000,000,000 | ---D | M] -- C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify
[2013.05.14 17:17:27 | 000,000,000 | ---D | M] -- C:\Users\Ann-Kristin.B\AppData\Roaming\Swiss Academic Software
[2012.09.30 17:07:23 | 000,000,000 | ---D | M] -- C:\Users\Ann-Kristin.B\AppData\Roaming\Zeon
 
========== Purity Check ==========
 
 

< End of report >
Code:
OTL Extras logfile created on: 23.05.2013 11:30:49 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Ann-Kristin.B\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,90 Gb Total Physical Memory | 1,37 Gb Available Physical Memory | 35,19% Memory free
7,81 Gb Paging File | 4,85 Gb Available in Paging File | 62,13% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 95,39 Gb Total Space | 4,59 Gb Free Space | 4,82% Space Free | Partition Type: NTFS
Drive D: | 135,08 Gb Total Space | 134,26 Gb Free Space | 99,39% Space Free | Partition Type: NTFS
 
Computer Name: ANN-KRISTINB-PC | User Name: Ann-Kristin.B | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- "C:\Users\Ann-Kristin.B\AppData\Roaming\File Scout\filescout.exe" /open "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- "C:\Users\Ann-Kristin.B\AppData\Roaming\File Scout\filescout.exe" /open "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{11AB1217-C14A-434C-A214-CA789E4E6665}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2486CC2E-1ED4-4EC9-9DC2-3D94C0FDF57D}" = rport=137 | protocol=17 | dir=out | app=system |
"{25DBE947-1D8A-429A-BBEF-9F39F4DD18C1}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{304F06C8-44C4-4508-99F6-7F41FDC98E1A}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{35138EFB-A5CD-4F9C-B0CA-22955FD728C8}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe |
"{3AB3FE31-A7E2-47C5-A3B7-D9B89F783636}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{3D8F0BCE-0B78-4F48-90C4-FF8D8BB72E23}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{45965A9E-CB6E-4F80-8CB6-2479306B6448}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{489C0B04-3012-4790-AD7B-600C87045BA3}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{5148AB41-415B-4761-BC08-320445C478AB}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{52CFE999-B874-4610-B4C0-89F64D9DF3E5}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{5313633B-0C5E-4733-B274-FAA7C016D82D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{5E36473F-385E-4418-AFF4-A3CDBB1A8FE3}" = rport=2869 | protocol=6 | dir=out | app=system |
"{66BA708F-8FBD-4858-8D6A-3B080147F7BB}" = rport=139 | protocol=6 | dir=out | app=system |
"{706E474C-B565-463C-BE7C-416FD89AD845}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{70D5E0F2-FAD1-411A-A9B0-8C232FA11204}" = lport=2869 | protocol=6 | dir=in | app=system |
"{728C3760-A594-4DED-8B6E-8DD1C4E77369}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{78453381-8146-489E-8C70-43E70788B6B2}" = lport=137 | protocol=17 | dir=in | app=system |
"{7AC46C47-1AD2-49D4-AF80-154F16D3E0AC}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{85DCF5FF-D80A-4600-8D00-468537DCEE90}" = rport=445 | protocol=6 | dir=out | app=system |
"{8A6B58BD-6BAA-43E7-88BB-71717E5386C4}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{8AEB04BB-59D3-4048-B4BB-9091F619D2E6}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8DD9D8F6-F5E3-484D-BE94-59452D142224}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{91F3C7C3-E2BA-457B-9815-878F7C441EB6}" = rport=138 | protocol=17 | dir=out | app=system |
"{99A1359C-B3F6-4D01-8FE9-837A812C0997}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{9E60ED47-D869-4D86-B4B5-78E813852362}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{AC882C1F-EBF3-48BF-83D5-5954B640008A}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{B0862B5F-83C4-4410-95B1-A01F57B25ADF}" = lport=2869 | protocol=6 | dir=in | app=system |
"{B2F5C2D9-2E2B-43FD-8368-3A0D08433B69}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BA6CA42A-B1B7-431E-9B98-54A4CFD84562}" = lport=138 | protocol=17 | dir=in | app=system |
"{BCD4C04D-69E6-4DFF-AE9A-B7344B6A8234}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{BDC53C73-0E33-4C4F-B4A8-D0B01E2AB520}" = lport=445 | protocol=6 | dir=in | app=system |
"{C56FB0F5-31E6-40EC-8017-5E902BE61C17}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{CABD667A-D7FF-445A-A641-EB406C641FC0}" = rport=10243 | protocol=6 | dir=out | app=system |
"{CE845B0A-8C47-45E5-B64A-30565AD8140A}" = lport=139 | protocol=6 | dir=in | app=system |
"{D1265378-4793-42FC-A6D1-78AE9466C623}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{D3DA41FE-69C5-4E3E-992A-DB7BC87D66A4}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{DFFB1129-CDFD-488F-9636-333D51D3A37B}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EBBC876C-FCF8-4B4F-A9E6-D3F168DD81C0}" = lport=10243 | protocol=6 | dir=in | app=system |
"{F6125247-F86F-4AC2-B4CA-E6CD2F0F2E7D}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{F80E1847-BE3D-43CD-BC94-B2D77DD84196}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F845247F-1E63-4FE3-965D-FB92243F35F8}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{057587D7-F584-4B7E-B560-7795152A3390}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7m\icq.exe |
"{1123624D-F4CA-40D0-9E83-EA8212EA0C07}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{1772B24C-4253-4517-864D-DFF680280AA6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{200E67EE-4780-4CB7-9989-D72723446988}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{209F67F8-9274-4899-AF62-8973792805E9}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{22D3B5E2-94C6-4EA3-A595-6B098036A06F}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7m\icq.exe |
"{26AC851B-32DA-4FDD-88B1-1FB3A5BD0938}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{293C2774-1FFB-4A93-B83E-406F22ABD302}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 |
"{2E3346A1-B250-409D-9246-7EF7F768BAD6}" = protocol=6 | dir=in | app=c:\program files (x86)\search results toolbar\datamngr\srtool~1\dtuser.exe |
"{37ADF6F8-ED6A-4D37-B984-753C8260F961}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{405C0A6A-178A-4CA4-B81F-19A3BBCE444D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{438FF002-C9D9-4138-8D89-29742F2A3DFF}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{4CC1A29E-4EB8-4374-8995-AA3CB6CCD94C}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{57DA4DAA-D0AE-432E-B6FF-BF6FA88FE834}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{58629E3E-7D21-4FC5-8B74-2BCCDB9ECEDF}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{591D37B9-FBC0-4341-B868-ECF7F29B626D}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{5E2E44C9-295F-4E2E-AE58-AE4E342DAC43}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{681CFC57-F415-44D3-B15B-21BAA8AD190F}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{6D1D3A4C-A07A-4829-9741-507E617A36C9}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{73C9730C-C958-46A0-9CE7-6BC257BAF59C}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7m\icq.exe |
"{75F3B432-54D1-49F8-937A-ABF57110E1C5}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{798D0F6C-3ADD-445A-87C3-704DF4308C2D}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{800A286C-6428-48F2-A50E-102826E6E861}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8BCD0107-EA58-41CD-9836-73618D67CC75}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{96A03537-287E-48FA-800B-DFF724D8D3B7}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{97A7C9EF-CB4E-4921-95D9-FED64770B231}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{9C7C9A34-7C60-44CF-A908-7A33198AD324}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{9F6A35B9-61F0-457A-BB7D-A1B622F71F77}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{A9CE206F-A4C3-4AA2-8379-C4AC27D67B5F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A9D89E4C-9ACF-460C-B3BB-82640289AFB4}" = protocol=6 | dir=out | app=system |
"{AB857E93-B320-43B3-9C30-B8F959487842}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{B1FBA132-9554-464A-90A0-4EDF7B6862BC}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{B3ADBCAB-D3AB-4A92-8AC7-DDBDAF57EF58}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{B6B8422D-2270-4BBB-BE55-87F0E0BC8012}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{B825761A-0490-4CE2-B4F1-3B67B70D0757}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7m\icq.exe |
"{BFC62DE7-34D2-4533-B7A4-E9CBCDCDC2DC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{CA507FC3-0647-49EC-8727-CF326E337140}" = protocol=17 | dir=in | app=c:\program files (x86)\search results toolbar\datamngr\srtool~1\dtuser.exe |
"{CDF2B718-9927-457E-83CF-82155C9761CE}" = protocol=17 | dir=in | app=c:\users\ann-kristin.b\appdata\roaming\dropbox\bin\dropbox.exe |
"{D129C0AA-43B7-47B2-8F51-C90B88398569}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{DBC075B4-AC56-4C61-95AE-6577F85A0D7E}" = protocol=6 | dir=in | app=c:\users\ann-kristin.b\appdata\roaming\dropbox\bin\dropbox.exe |
"{E119CC67-6F4B-4A66-8245-E80860F9E499}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{F58E3A90-C478-4F80-8BCA-B04C1E114591}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{F991A32A-075F-4B7E-A7CD-1EE5E229829D}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{FC96263D-6D88-4B8C-BFAF-26CEA6AF87D8}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{FDD96A5B-D830-49E1-B8D6-3C634B41B339}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"TCP Query User{1B4B9571-D86D-4A9F-BDB7-011955A50BDF}C:\users\ann-kristin.b\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\ann-kristin.b\appdata\roaming\spotify\spotify.exe |
"TCP Query User{45F83161-AAF1-47F3-B7BF-88DF892A44E1}C:\program files (x86)\icq7m\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icq7m\icq.exe |
"TCP Query User{52842473-25C5-4527-A9BE-EB64A2E3A8AE}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"TCP Query User{57A56DE4-DB8C-4167-A168-B60CD04F487D}C:\users\ann-kristin.b\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\ann-kristin.b\appdata\roaming\spotify\spotify.exe |
"TCP Query User{E91A5721-FE31-4D79-A232-964E7A6383A5}C:\users\ann-kristin.b\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\ann-kristin.b\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{06F16684-0F3E-49EE-9F52-CE3B78AB936E}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"UDP Query User{3F1CF8FC-E4CE-4E03-B455-B360D4E70AEC}C:\program files (x86)\icq7m\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icq7m\icq.exe |
"UDP Query User{6EEEAD1F-BDD5-461F-895F-9128E04A8D58}C:\users\ann-kristin.b\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\ann-kristin.b\appdata\roaming\spotify\spotify.exe |
"UDP Query User{777D5FA4-504B-4195-82C8-47F297F896DC}C:\users\ann-kristin.b\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\ann-kristin.b\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{9AC40C84-A7E6-4F85-A487-D00EDE9C0253}C:\users\ann-kristin.b\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\ann-kristin.b\appdata\roaming\spotify\spotify.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01E66AC4-B28B-494C-993D-3CD17020BEBC}" = Fresco Logic USB3.0 Host Controller
"{0225AD21-F3E2-4916-BFF3-65D3F9052582}" = iTunes
"{0919C44F-F18A-4E3B-A737-03685272CE72}" = Windows Live Remote Service Resources
"{11BA2B00-1495-47B8-BFA8-D08C605AB2CC}" = Windows Live Family Safety
"{17A4FD95-A507-43F1-BC92-D8572AF8340A}" = Windows Live Remote Service Resources
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{19F09425-3C20-4730-9E2A-FC2E17C9F362}" = Windows Live Remote Service Resources
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}" = Microsoft .NET Framework 4.5
"{1EB2CFC3-E1C5-4FC4-B1F8-549DD6242C67}" = Windows Live Remote Service Resources
"{1FB31F44-D4D0-4D76-944A-A1A5D79FD321}" = Windows Live Family Safety
"{230D1595-57DA-4933-8C4E-375797EBB7E1}" = Bluetooth Win7 Suite (64)
"{2F72F540-1F60-4266-9506-952B21D6640D}" = Apple Mobile Device Support
"{3CE222BA-66A6-4D18-BEE9-5D21C5798C3E}" = Windows Live Family Safety
"{3D7F836A-AE1F-4FA6-8DB9-4FE06697AB0A}" = Windows Live Family Safety
"{3E776E7A-F4C3-4A89-8EAD-535E722C8397}" = Windows Live Family Safety
"{53375A2B-FE08-42B6-8EB8-16818CD27B2C}" = Windows Live Family Safety
"{5E2CD4FB-4538-4831-8176-05D653C3E6D4}" = Windows Live Remote Service Resources
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{5FEAD3E5-A158-4B66-B92B-0C959D7CF838}" = Windows Live Remote Service Resources
"{63919769-655A-48A8-AD6C-39B471F683ED}" = Windows Live Family Safety
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{692CCE55-9EAE-4F57-A834-092882E7FE0B}" = Windows Live Remote Client Resources
"{6B6C4C46-1B7E-4A41-9E70-ACFBB22B1D81}" = SpyHunter
"{6CBFDC3C-CF21-4C02-A6DC-A5A2707FAF55}" = Windows Live Remote Service Resources
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6DDCFF78-6F91-438C-9567-C5CAA9D7F56C}" = Windows Live Family Safety
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{761C6783-D3BC-48AB-8E7C-61CE918A8436}" = ASUS Secure Delete
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{825C7D3F-D0B3-49D5-A42B-CBB0FBE85E99}" = Windows Live Remote Client Resources
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{8970AE69-40BE-4058-9916-0ACB1B974A3D}" = Windows Live Remote Client Resources
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8EB588BD-D398-40D0-ADF7-BE1CEEF7C116}" = Windows Live Remote Client Resources
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}" = ASUS Power4Gear Hybrid
"{A679FBE4-BA2D-4514-8834-030982C8B31A}" = Windows Live Remote Service Resources
"{ABBD4BA8-6703-40D2-AB1E-5BB1F7DB49A4}" = Trend Micro Titanium Internet Security
"{ABBD4BA9-6703-40D2-AB1E-5BB1F7DB49A4}" = Trend Micro Titanium Internet Security
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B0BF8602-EA52-4B0A-A2BD-EDABB0977030}" = Windows Live Remote Client Resources
"{B36055BF-5F0E-4EAB-804D-9203DFB34ADC}" = Windows Live Family Safety
"{B750FA38-7AB0-42CB-ACBB-E7DBE9FF603F}" = Windows Live Remote Client Resources
"{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}" = Intel(R) Turbo Boost Technology Monitor 2.0
"{C504EC13-E122-4939-BD6E-EE5A3BAA5FEC}" = Windows Live Remote Client Resources
"{C9F05151-95A9-4B9B-B534-1760E2D014A5}" = Windows Live Remote Client Resources
"{CEA21F20-DBF4-464C-8B81-28B8508AFDDD}" = Windows Live Family Safety
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DBEDAF67-C5A3-4C91-951D-31F3FE63AF3F}" = Windows Live Remote Client Resources
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E01819BD-709F-43A1-9600-6F5E4C584C37}" = Windows Live Family Safety
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{E60F14FA-E114-4F25-AEE0-33FE9EC9B1C3}" = Windows Live Family Safety
"{EFB20CF5-1A6D-41F3-8895-223346CE6291}" = Windows Live Remote Service Resources
"{F11009B0-F4DB-463B-B717-5266E47498AA}" = Windows Live Family Safety
"{FAA3933C-6F0D-4350-B66B-9D7F7031343E}" = Windows Live Remote Service Resources
"{FAD0EC0B-753B-4A97-AD34-32AC1EC8DB69}" = Windows Live Remote Client Resources
"Elantech" = ETDWare PS/2-X64 10.0.5.2_WHQL
"Personal Backup 5_is1" = Personal Backup 5.4
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{039480EE-6933-4845-88B8-77FD0C3D059D}" = Windows Live Mesh
"{04668DF2-D32F-4555-9C7E-35523DCD6544}" = Control ActiveX de Windows Live Mesh para conexiones remotas
"{05E379CC-F626-4E7D-8354-463865B303BF}" = Windows Live UX Platform Language Pack
"{062E4D94-8306-46D5-81B6-45E6AD09C799}" = Windows Live Messenger
"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology
"{0A4C4B29-5A9D-4910-A13C-B920D5758744}" = بريد Windows Live
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D261C88-454B-46FE-B43B-640E621BDA11}" = Windows Live Mail
"{0EC0B576-90F9-43C3-8FAD-A4902DF4B8F4}" = Galeria de Fotografias do Windows Live
"{128133D3-037A-4C62-B1B7-55666A10587A}" = Windows Live UX Platform Language Pack
"{14B441B7-774D-4170-98EA-A13667AE6218}" = Windows Live Writer Resources
"{168E7302-890A-4138-9109-A225ACAF7AD1}" = Windows Live Photo Common
"{17F99FCE-8F03-4439-860A-25C5A5434E18}" = Windows Live Essentials
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{198EA334-8A3F-4CB2-9D61-6C10B8168A6F}" = Windows Live Writer
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1A82AE99-84D3-486D-BAD6-675982603E14}" = Windows Live Writer
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2511AAD7-82DF-4B97-B0B3-E1B933317010}" = Windows Live Writer Resources
"{25A381E1-0AB9-4E7A-ACCE-BA49D519CF4E}" = Windows Live Mail
"{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{29373E24-AC72-424E-8F2A-FB0F9436F21F}" = Windows Live Photo Common
"{2A07C35B-8384-4DA4-9A95-442B6C89A073}" = Windows Live Essentials
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2C4E06CC-1F04-4C25-8B3C-93A9049EC42C}" = Windows Live UX Platform Language Pack
"{2C865FB0-051E-4D22-AC62-428E035AEAF0}" = Windows Live Mesh
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{370F888E-42A7-4911-9E34-7D74632E17EB}" = Windows Live Photo Common
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3B9A92DA-6374-4872-B646-253F18624D5F}" = Windows Live Writer
"{3F4143A1-9C21-4011-8679-3BC1014C6886}" = Windows Live Mesh
"{40BFD84C-64CD-42CC-9909-8734C50429C6}" = Windows Live UX Platform Language Pack
"{45C56AA7-ED1B-4800-A97F-EDDF3F3520B1}" = Apple Application Support
"{46872828-6453-4138-BE1C-CE35FBF67978}" = Windows Live Mesh
"{48294D95-EE9A-4377-8213-44FC4265FB27}" = Windows Live Messenger
"{488F0347-C4A7-4374-91A7-30818BEDA710}" = Galerie de photos Windows Live
"{48C0DC5E-820A-44F2-890E-29B68EDD3C78}" = Windows Live Writer
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B28D47A-5FF0-45F8-8745-11DC2A1C9D0F}" = Windows Live Writer
"{4D83F339-5A5C-4B21-8FD3-5D407B981E72}" = Windows Live Photo Common
"{506FC723-8E6C-4417-9CFF-351F99130425}" = Windows Live UX Platform Language Pack
"{54A168C9-2250-4058-80EB-1F4A4192548A}" = AX88772B Windows 7 Drivers
"{55D003F4-9599-44BF-BA9E-95D060730DD3}" = Contrôle ActiveX Windows Live Mesh pour connexions à distance
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{58172D66-2F69-4215-9AEC-ED8196023736}" = ASUS Tutor
"{5AF4B3C4-C393-48D7-AC7E-8E7615579548}" = Adobe AIR
"{5D273F60-0525-48BA-A5FB-D0CAA4A952AE}" = Windows Live Movie Maker
"{622DE1BE-9EDE-49D3-B349-29D64760342A}" = 適用遠端連線的 Windows Live Mesh ActiveX 控制項
"{62687B11-58B5-4A18-9BC3-9DF4CE03F194}" = Windows Live Writer Resources
"{62BBB2F0-E220-4821-A564-730807D2C34D}" = Realtek USB 2.0 Reader Driver
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{677AAD91-1790-4FC5-B285-0E6A9D65F7DC}" = Windows Live Mail
"{6807427D-8D68-4D30-AF5B-0B38F8F948C8}" = Windows Live Writer Resources
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A4ABCDC-0A49-4132-944E-01FBCCB3465C}" = Windows Live UX Platform Language Pack
"{6CB36609-E3A6-446C-A3C1-C71E311D2B9C}" = Windows Live Movie Maker
"{6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}" = Windows Live Movie Maker
"{6E8AFC13-F7B8-41D8-88AB-F1D0CFC56305}" = Windows Live Messenger
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73FC3510-6421-40F7-9503-EDAE4D0CF70D}" = Windows Live Photo Common
"{7465A996-0FCA-4D2D-A52C-F833B0829B5B}" = Windows Live Movie Maker
"{7496FD31-E5CB-4AE4-82D3-31099558BF6A}" = Windows Live Mesh
"{749F674B-2674-47E8-879C-5626A06B2A91}" = InstantOn for NB
"{74E8A7F6-575D-42C7-9178-E87D1B3BEFE8}" = Windows Live UX Platform Language Pack
"{77477AEA-5757-47D8-8B33-939F43D82218}" = Windows Live UX Platform Language Pack
"{77F69CA1-E53D-4D77-8BA3-FA07606CC851}" = Фотоальбом Windows Live
"{781B39EC-2E18-41FC-9B00-B84E4FFCA85F}" = ICQ7M
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78DAE910-CA72-450E-AD22-772CB1A00678}" = Windows Live Mesh
"{78DBE8CE-61F6-4D6C-806C-A0FFF65F5E1D}" = Windows Live Messenger
"{7D1C7B9F-2744-4388-B128-5C75B8BCCC84}" = Windows Live Essentials
"{7D916FA5-DAE9-4A25-B089-655C70EAF607}" = Qualcomm Atheros WiFi Driver Installation
"{7E017923-16F8-4E32-94EF-0A150BD196FE}" = Windows Live Writer
"{7FF11E53-C002-4F40-8D68-6BE751E5DD62}" = Windows Live Writer Resources
"{804DE397-F82C-4867-9085-E0AA539A3294}" = Windows Live Writer
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111249233}" = Dream Vacation Solitaire
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}" = Galapago
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}" = Dream Day First Home
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115290153}" = Go Go Gourmet Chef of the Year
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115320460}" = Turbo Fiesta
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-116672750}" = World of Goo
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117080787}" = Plants vs Zombies
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117948443}" = Mahjong Memoirs
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-118716773}" = Deadtime Stories
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-119205603}" = Farm Frenzy 3 - Madagascar
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{841F1FB4-FDF8-461C-A496-3E1CFD84C0B5}" = Windows Live Mesh
"{84A411F9-40A5-4CDA-BF46-E09FBB2BC313}" = Windows Live Essentials
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8F21291E-0444-4B1D-B9F9-4370A73E346D}" = WinFlash
"{8FF3891F-01B5-4A71-BFCD-20761890471C}" = Windows Live Messenger
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{93E464B3-D075-4989-87FD-A828B5C308B1}" = Windows Live Writer Resources
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BD262D0-B788-4546-A0A5-F4F56EC3834B}" = Windows Live Photo Common
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D4C7DFA-CBBB-4F06-BDAC-94D831406DF0}" = פקד ActiveX של Windows Live Mesh עבור חיבורים מרוחקים
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9DB90178-B5B0-45BD-B0A7-D40A6A1DF1CA}" = Windows Live Movie Maker
"{9FAE6E8D-E686-49F5-A574-0A58DFD9580C}" = Windows Live Mail
"{A0B91308-6666-4249-8FF6-1E11AFD75FE1}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A41A708E-3BE6-4561-855D-44027C1CF0F8}" = Windows Live Photo Common
"{A60B3BF0-954B-42AF-B8D8-2C1D34B613AA}" = Windows Live Photo Gallery
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}" = ATK Package
"{AB61A2E9-37D3-485D-9085-19FBDF8CEF4A}" = Windows Live Messenger
"{ABD534B7-E951-470E-92C2-CD5AF1735726}" = Windows Live Essentials
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.03) - Deutsch
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{ADE85655-8D1E-4E4B-BF88-5E312FB2C74F}" = Windows Live Mail
"{ADFE4AED-7F8E-4658-8D6E-742B15B9F120}" = Windows Live Photo Common
"{AECA3622-E634-4A55-A696-70A511CBE06E}" = ASUS USB Charger Plus
"{AF01B90A-D25C-4F60-AECD-6EEDF509DC11}" = Windows Live Mesh
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B2BCA478-EC0F-45EE-A9E9-5EABE87EA72D}" = Windows Live Photo Common
"{B2E90616-C50D-4B89-A40D-92377AC669E5}" = Windows Live Messenger
"{B480904D-F73F-4673-B034-8A5F492C9184}" = Nuance PDF Reader
"{B618C3BF-5142-4630-81DD-F96864F97C7E}" = Windows Live Essentials
"{B63F0CE3-CCD0-490A-9A9C-E1A3B3A17137}" = Почта Windows Live
"{B7B60C4F-0DB8-42EF-8EDC-5F21D4C2D73F}" = PWR Option
"{BAEE89D5-6E87-4F89-9603-A1C100479181}" = Windows Live Messenger
"{BCB0D6F7-7EAB-4009-A6F2-8E0E7F317773}" = Элемент управления Windows Live Mesh ActiveX для удаленных подключений
"{BF022D76-9F72-4203-B8FA-6522DC66DFDA}" = Windows Live Movie Maker
"{C00C2A91-6CB3-483F-80B3-2958E29468F1}" = Συλλογή φωτογραφιών του Windows Live
"{C29FC15D-E84B-4EEC-8505-4DED94414C59}" = Windows Live Writer Resources
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C32CE55C-12BA-4951-8797-0967FDEF556F}" = Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen
"{C4BC5A5F-4A97-47CC-99C3-AB8E10572AFE}" = Wireless Console 3
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}" = Windows Live Mesh ActiveX Control for Remote Connections
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common
"{C95A5A77-622F-45CA-9540-84468FCB18B1}" = Windows Live Messenger
"{CB7224D9-6DCA-43F1-8F83-6B1E39A00F92}" = Windows Live Movie Maker
"{CBFD061C-4B27-4A89-ADD8-210316EEFA11}" = Windows Live Messenger
"{CC0A85B2-734A-45B3-B678-05F6A6499AC7}" = Citavi 4
"{CDC39BF2-9697-4959-B893-A2EE05EF6ACB}" = Windows Live Writer
"{CE929F09-3853-4180-BD90-30764BFF7136}" = גלריית התמונות של Windows Live
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D299197D-CDEA-41A6-A363-F532DE4114FD}" = Windows Live UX Platform Language Pack
"{D39F0676-163E-4595-A917-E28F99BBD4D2}" = ASUS AI Recovery
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D588365A-AE39-4F27-BDAE-B4E72C8E900C}" = Windows Live Mail
"{D6F25CF9-4E87-43EB-B324-C12BE9CDD668}" = Windows Live UX Platform Language Pack
"{DAEF48AD-89C8-4A93-B1DD-45B7E4FB6071}" = Windows Live Movie Maker
"{DBAA2B17-D596-4195-A169-BA2166B0D69B}" = Windows Live Mail
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DE7C13A6-E4EA-4296-B0D5-5D7E8AD69501}" = Windows Live Writer
"{DE8F99FD-2FC7-4C98-AA67-2729FDE1F040}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DEF91E0F-D266-453D-B6F2-1BA002B40CB6}" = Windows Live Essentials
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E18B30AA-6E2D-480C-B918-AF61009F4010}" = عنصر تحكم ActiveX الخاص بـ Windows Live Mesh للاتصالات البعيدة
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E54EEB5D-41ED-40FE-B4A8-8565DB81469B}" = Controlo ActiveX do Windows Live Mesh para Ligações Remotas
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E62E0550-C098-43A2-B54B-03FB1E634483}" = Windows Live Writer
"{E727A662-AF9F-4DEE-81C5-F4A1686F3DFC}" = Windows Live Writer Resources
"{E83DC314-C926-4214-AD58-147691D6FE9F}" = Основные компоненты Windows Live
"{E85A4EFC-82F2-4CEE-8A8E-62FDAD353A66}" = Galería fotográfica de Windows Live
"{EA17F4FC-FDBF-4CF8-A529-2D983132D053}" = Skype™ 6.0
"{ED16B700-D91F-44B0-867C-7EB5253CA38D}" = Raccolta foto di Windows Live
"{EEF99142-3357-402C-B298-DEC303E12D92}" = Windows Live 影像中心
"{EF7EAB13-46FC-49DD-8E3C-AAF8A286C5BB}" = Windows Live 程式集
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F52C5BE7-3F57-464E-8A54-908402E43CE8}" = Windows Live Writer Resources
"{F665F3B8-01B4-46A9-8E47-FF8DC2208C9F}" = Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις
"{F7E80BA7-A09D-4DD1-828B-C4A0274D4720}" = Windows Live Mesh
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}" = ASUS Live Update
"{FBCA06D2-4642-4F33-B20A-A7AB3F0D2E69}" = معرض صور Windows Live
"{FCDE76CB-989D-4E32-9739-6A272D2B0ED7}" = Windows Live Mesh
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF105207-8423-4E13-B0B1-50753170B245}" = Windows Live Movie Maker
"{FF3DFA01-1E98-46B4-A065-DA8AD47C9598}" = Windows Live Movie Maker
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"ALDI Bestellsoftware" = ALDI Bestellsoftware 4.12.2
"Asus Vibe2.0" = AsusVibe2.0
"ASUS WebStorage" = ASUS WebStorage
"avast" = avast! Free Antivirus
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Game Park Console" = Game Park Console
"GMATPrep 2.1.279" = GMATPrep
"Google Chrome" = Google Chrome
"ICQToolbar" = ICQ Toolbar
"InstallShield_{54A168C9-2250-4058-80EB-1F4A4192548A}" = AX88772B Windows 7 Drivers
"jziptoolbargaw" = Search-Results Toolbar
"McAfee Security Scan" = McAfee Security Scan Plus
"Mozilla Firefox 20.0.1 (x86 de)" = Mozilla Firefox 20.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"SpeedAnalysis.com" = SpeedAnalysis.com
"Updater Service" = Updater Service
"WinLiveSuite" = Windows Live Essentials
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"jZip" = jZip
"Spotify" = Spotify
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 02.05.2013 05:48:03 | Computer Name = Ann-KristinB-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1232
 
Error - 02.05.2013 08:19:59 | Computer Name = Ann-KristinB-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Dwm.exe, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5bc541  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0000000000000000
ID
 des fehlerhaften Prozesses: 0x9c0  Startzeit der fehlerhaften Anwendung: 0x01ce472f59104dec
Pfad
 der fehlerhaften Anwendung: C:\Windows\system32\Dwm.exe  Pfad des fehlerhaften Moduls:
 unknown  Berichtskennung: 9b463323-b322-11e2-acf5-e0b9a5d3b907
 
Error - 02.05.2013 08:20:53 | Computer Name = Ann-KristinB-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: ICQ.exe, Version: 7.8.0.6800, Zeitstempel:
 0x4f9e81cc  Name des fehlerhaften Moduls: mshtml.dll, Version: 10.0.9200.16540, Zeitstempel:
 0x5125ef5c  Ausnahmecode: 0xc00000fd  Fehleroffset: 0x0003cdcd  ID des fehlerhaften Prozesses:
 0x11c0  Startzeit der fehlerhaften Anwendung: 0x01ce472f60894e86  Pfad der fehlerhaften
 Anwendung: C:\Program Files (x86)\ICQ7M\ICQ.exe  Pfad des fehlerhaften Moduls: C:\Windows\system32\mshtml.dll
Berichtskennung:
 bb6c4296-b322-11e2-acf5-e0b9a5d3b907
 
Error - 02.05.2013 09:26:19 | Computer Name = Ann-KristinB-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 02.05.2013 09:26:19 | Computer Name = Ann-KristinB-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1279
 
Error - 02.05.2013 09:26:19 | Computer Name = Ann-KristinB-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1279
 
Error - 02.05.2013 11:06:06 | Computer Name = Ann-KristinB-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 02.05.2013 11:06:06 | Computer Name = Ann-KristinB-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 5988207
 
Error - 02.05.2013 11:06:06 | Computer Name = Ann-KristinB-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 5988207
 
Error - 02.05.2013 11:12:01 | Computer Name = Ann-KristinB-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Dwm.exe, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5bc541  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0000000000000000
ID
 des fehlerhaften Prozesses: 0x8f8  Startzeit der fehlerhaften Anwendung: 0x01ce474760cfeda8
Pfad
 der fehlerhaften Anwendung: C:\Windows\system32\Dwm.exe  Pfad des fehlerhaften Moduls:
 unknown  Berichtskennung: a38d89c3-b33a-11e2-acd9-e0b9a5d3b907
 
Error - 03.05.2013 07:01:29 | Computer Name = Ann-KristinB-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Dwm.exe, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5bc541  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0000000000000000
ID
 des fehlerhaften Prozesses: 0xa54  Startzeit der fehlerhaften Anwendung: 0x01ce47ed8b3ca900
Pfad
 der fehlerhaften Anwendung: C:\Windows\system32\Dwm.exe  Pfad des fehlerhaften Moduls:
 unknown  Berichtskennung: ce22eab2-b3e0-11e2-b6ef-e0b9a5d3b907
 
[ OSession Events ]
Error - 11.12.2012 12:25:29 | Computer Name = Ann-KristinB-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6662.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 2670
 seconds with 120 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 09.05.2013 16:50:27 | Computer Name = Ann-KristinB-PC | Source = ipnathlp | ID = 31004
Description =
 
Error - 09.05.2013 16:50:27 | Computer Name = Ann-KristinB-PC | Source = ipnathlp | ID = 31004
Description =
 
Error - 09.05.2013 16:51:05 | Computer Name = Ann-KristinB-PC | Source = ipnathlp | ID = 31004
Description =
 
Error - 09.05.2013 16:52:06 | Computer Name = Ann-KristinB-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "FontCache" wurde mit folgendem Fehler beendet:  %%193
 
Error - 09.05.2013 16:52:33 | Computer Name = Ann-KristinB-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  cdrom
 
Error - 10.05.2013 02:32:23 | Computer Name = Ann-KristinB-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "FontCache" wurde mit folgendem Fehler beendet:  %%193
 
Error - 10.05.2013 02:32:50 | Computer Name = Ann-KristinB-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  cdrom
 
Error - 10.05.2013 02:41:12 | Computer Name = Ann-KristinB-PC | Source = DCOM | ID = 10010
Description =
 
Error - 12.05.2013 13:09:42 | Computer Name = Ann-KristinB-PC | Source = ipnathlp | ID = 31004
Description =
 
Error - 12.05.2013 13:09:42 | Computer Name = Ann-KristinB-PC | Source = ipnathlp | ID = 31004
Description =
 
 
< End of report >
Die GMER-Logfile folgt in Kürze.

M-K-D-B 23.05.2013 11:32
:hallo:


Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.


Bitte beachte folgende Hinweise:
  • Eine Bereinigung ist mitunter mit viel Arbeit für dich verbunden. Es können mehrere Analyse- und Bereinigungsschritte erforderlich sein.
    Abschließend entfernen wir wieder alle verwendeten Programme und ich gebe dir ein paar Tipps für die Zukunft mit auf den Weg.
  • Bei Anzeichen von illegaler Software wird der Support ohne Diskussion eingestellt.
  • Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab.
  • Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
  • Führe nur Scans durch, zu denen du von mir oder einem anderen Helfer aufgefordert wirst.
  • Bitte kein Crossposting (posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software außer du wirst dazu aufgefordert.
  • Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo.
    Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
  • Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort zu starten!
    Ich kann Dir niemals eine Garantie geben, dass auch ich alles finde. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.
    Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.







Schritt 1
Downloade Dir bitte defogger von jpshortstuff auf Deinem Desktop.
  • Starte das Tool mit Doppelklick.
  • Klicke nun auf den Disable Button, um die Treiber gewisser Emulatoren zu deaktivieren.
  • Defogger wird dich fragen "Defogger will forcefully terminate and disable all CD Emulator related drivers and processes... Continue?" bestätige diese Sicherheitsabfrage mit Ja.
  • Wenn der Scan beendet wurde (Finished), klicke auf OK.
  • Defogger fordert gegebenfalls zum Neustart auf. Bestätige dies mit OK.
  • Defogger erstellt auf dem Desktop eine Logdatei mit dem Namen defogger_disable.log. Poste deren Inhalt mit deiner nächsten Antwort.
Klicke den Re-enable Button nicht ohne Anweisung!





Schritt 2
Bitte lade dir GMER Rootkit Scanner GMER herunter: (Dateiname zufällig)
  • Schließe alle anderen Programme, deaktiviere deinen Virenscanner und trenne den Rechner vom Internet bevor du GMER startest.
  • Sollte sich nach dem Start ein Fenster mit folgender Warnung öffnen:
    WARNING !!!
    GMER has found system modification, which might have been caused by ROOTKIT activity.
    Do you want to fully scan your system ?
    Unbedingt auf "No" klicken.
  • Entferne rechts den Haken bei: IAT/EAT und Show All
  • Setze den Haken bei Quickscan und entferne ihn bei allen anderen Laufwerken.
  • Starte den Scan mit "Scan".
  • Mache nichts am Computer während der Scan läuft.
  • Wenn der Scan fertig ist klicke auf Save und speichere die Logfile unter Gmer.txt auf deinem Desktop. Mit "Ok" wird GMER beendet.
Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!


Tauchen Probleme auf?
  • Probiere alternativ den abgesicherten Modus.
  • Erhältst du einen Bluescreen, dann entferne den Haken vor Devices.






Bitte poste mit deiner nächsten Antwort
  • die Logdatei von DeFogger,
  • die Logdatei von GMER.

painfiller 23.05.2013 15:01
Hallo Matthias,

mit der Kürze hat das nicht ganz geklappt, GMER hat recht lange gedauert ;)
Hier die Ergebnisse:

Code:
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-05-23 15:52:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 SanDisk_ rev.10.0 238,47GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\ANN-KR~1.B\AppData\Local\Temp\axkdqpod.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 560                                                                                        fffff800031eb000 45 bytes [B0, CA, EB, 0A, 80, FA, FF, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 607                                                                                        fffff800031eb02f 90 bytes [00, 00, 00, 00, 00, 00, 00, ...]

---- User code sections - GMER 2.1 ----

.text    C:\Windows\system32\wininit.exe[660] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                0000000077a7eecd 1 byte [62]
.text    C:\Windows\system32\services.exe[724] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                              0000000077a7eecd 1 byte [62]
.text    C:\Windows\system32\lsass.exe[760] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                  0000000077a7eecd 1 byte [62]
.text    C:\Windows\system32\svchost.exe[880] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                0000000077a7eecd 1 byte [62]
.text    C:\Windows\system32\winlogon.exe[956] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                              0000000077a7eecd 1 byte [62]
.text    C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE[1020] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                    0000000077a7eecd 1 byte [62]
.text    C:\Windows\system32\svchost.exe[316] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                0000000077a7eecd 1 byte [62]
.text    C:\Windows\System32\svchost.exe[620] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                0000000077a7eecd 1 byte [62]
.text    C:\Windows\System32\svchost.exe[428] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                0000000077a7eecd 1 byte [62]
.text    C:\Windows\system32\svchost.exe[116] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                0000000077a7eecd 1 byte [62]
.text    C:\Windows\system32\svchost.exe[904] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                0000000077a7eecd 1 byte [62]
.text    C:\Windows\system32\svchost.exe[1188] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                              0000000077a7eecd 1 byte [62]
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe[1372] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                              000000007638a30a 1 byte [62]
.text    C:\Windows\system32\WLANExt.exe[1388] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                              0000000077a7eecd 1 byte [62]
.text    C:\Windows\system32\conhost.exe[1396] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                              0000000077a7eecd 1 byte [62]
.text    C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe[1472] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                000000007638a30a 1 byte [62]
.text    C:\Windows\System32\spoolsv.exe[1696] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                              0000000077a7eecd 1 byte [62]
.text    C:\Windows\system32\svchost.exe[1732] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                              0000000077a7eecd 1 byte [62]
.text    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1912] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                  000000007638a30a 1 byte [62]
.text    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1944] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112  000000007638a30a 1 byte [62]
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe[1204] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                    0000000077d3faa0 5 bytes JMP 0000000100030600
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe[1204] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                        0000000077d3fb38 5 bytes JMP 0000000100030804
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe[1204] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                          0000000077d3fc90 5 bytes JMP 0000000100030c0c
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe[1204] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                      0000000077d40018 5 bytes JMP 0000000100030a08
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe[1204] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                          0000000077d41900 5 bytes JMP 0000000100030e10
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe[1204] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                  0000000077d5c45a 5 bytes JMP 00000001000301f8
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe[1204] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                                0000000077d61217 5 bytes JMP 00000001000303fc
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe[1204] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                    000000007638a30a 1 byte [62]
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe[1204] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                            000000007593ee09 5 bytes JMP 00000001002401f8
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe[1204] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                            0000000075943982 5 bytes JMP 00000001002403fc
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe[1204] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                          0000000075947603 5 bytes JMP 0000000100240804
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe[1204] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                          000000007594835c 5 bytes JMP 0000000100240600
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe[1204] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                        000000007595f52b 5 bytes JMP 0000000100240a08
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe[1204] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                  00000000776a5181 5 bytes JMP 0000000100251014
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe[1204] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                      00000000776a5254 5 bytes JMP 0000000100250804
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe[1204] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                      00000000776a53d5 5 bytes JMP 0000000100250a08
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe[1204] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                    00000000776a54c2 5 bytes JMP 0000000100250c0c
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe[1204] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                    00000000776a55e2 5 bytes JMP 0000000100250e10
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe[1204] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                            00000000776a567c 5 bytes JMP 00000001002501f8
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe[1204] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                            00000000776a589f 5 bytes JMP 00000001002503fc
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe[1204] C:\Windows\SysWOW64\sechost.dll!DeleteService                                            00000000776a5a22 5 bytes JMP 0000000100250600
.text    C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe[1556] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                      0000000077d3faa0 5 bytes JMP 0000000100030600
.text    C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe[1556] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                          0000000077d3fb38 5 bytes JMP 0000000100030804
.text    C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe[1556] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                          0000000077d3fc90 5 bytes JMP 0000000100030c0c
.text    C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe[1556] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                      0000000077d40018 5 bytes JMP 0000000100030a08
.text    C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe[1556] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                          0000000077d41900 5 bytes JMP 0000000100030e10
.text    C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe[1556] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                  0000000077d5c45a 5 bytes JMP 00000001000301f8
.text    C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe[1556] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                                0000000077d61217 5 bytes JMP 00000001000303fc
.text    C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe[1556] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                      000000007638a30a 1 byte [62]
.text    C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe[1556] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                            000000007593ee09 5 bytes JMP 00000001002401f8
.text    C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe[1556] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                              0000000075943982 5 bytes JMP 00000001002403fc
.text    C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe[1556] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                          0000000075947603 5 bytes JMP 0000000100240804
.text    C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe[1556] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                          000000007594835c 5 bytes JMP 0000000100240600
.text    C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe[1556] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                        000000007595f52b 5 bytes JMP 0000000100240a08
.text    C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe[1556] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                  00000000776a5181 5 bytes JMP 0000000100251014
.text    C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe[1556] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                      00000000776a5254 5 bytes JMP 0000000100250804
.text    C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe[1556] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                      00000000776a53d5 5 bytes JMP 0000000100250a08
.text    C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe[1556] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                      00000000776a54c2 5 bytes JMP 0000000100250c0c
.text    C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe[1556] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                      00000000776a55e2 5 bytes JMP 0000000100250e10
.text    C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe[1556] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                            00000000776a567c 5 bytes JMP 00000001002501f8
.text    C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe[1556] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                            00000000776a589f 5 bytes JMP 00000001002503fc
.text    C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe[1556] C:\Windows\SysWOW64\sechost.dll!DeleteService                                              00000000776a5a22 5 bytes JMP 0000000100250600
.text    C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                  0000000077b63ae0 5 bytes JMP 000000010048075c
.text    C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                    0000000077b67a90 5 bytes JMP 00000001004803a4
.text    C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                      0000000077b91490 5 bytes JMP 0000000100480b14
.text    C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                          0000000077b914f0 5 bytes JMP 0000000100480ecc
.text    C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                            0000000077b915d0 5 bytes JMP 000000010048163c
.text    C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                        0000000077b91810 5 bytes JMP 0000000100481284
.text    C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1776] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                            0000000077b92840 5 bytes JMP 00000001004819f4
.text    C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1776] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                      0000000077a7eecd 1 byte [62]
.text    C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1776] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                    000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1776] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                        000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1776] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                        000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1776] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                      000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1776] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                      000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1776] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                              000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1776] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                              000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1776] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                              000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Program Files\Bonjour\mDNSResponder.exe[2284] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                              0000000077b63ae0 5 bytes JMP 00000001001c075c
.text    C:\Program Files\Bonjour\mDNSResponder.exe[2284] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                0000000077b67a90 5 bytes JMP 00000001001c03a4
.text    C:\Program Files\Bonjour\mDNSResponder.exe[2284] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                    0000000077b91490 5 bytes JMP 00000001001c0b14
.text    C:\Program Files\Bonjour\mDNSResponder.exe[2284] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                        0000000077b914f0 5 bytes JMP 00000001001c0ecc
.text    C:\Program Files\Bonjour\mDNSResponder.exe[2284] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                        0000000077b915d0 5 bytes JMP 00000001001c163c
.text    C:\Program Files\Bonjour\mDNSResponder.exe[2284] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                    0000000077b91810 5 bytes JMP 00000001001c1284
.text    C:\Program Files\Bonjour\mDNSResponder.exe[2284] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                        0000000077b92840 5 bytes JMP 00000001001c19f4
.text    C:\Program Files\Bonjour\mDNSResponder.exe[2284] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                    0000000077a7eecd 1 byte [62]
.text    C:\Program Files\Bonjour\mDNSResponder.exe[2284] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Program Files\Bonjour\mDNSResponder.exe[2284] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                    000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Program Files\Bonjour\mDNSResponder.exe[2284] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                    000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Program Files\Bonjour\mDNSResponder.exe[2284] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                    000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Program Files\Bonjour\mDNSResponder.exe[2284] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                    000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Program Files\Bonjour\mDNSResponder.exe[2284] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                          000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Program Files\Bonjour\mDNSResponder.exe[2284] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                          000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Program Files\Bonjour\mDNSResponder.exe[2284] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                            000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                0000000077d3faa0 5 bytes JMP 0000000100030600
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                    0000000077d3fb38 5 bytes JMP 0000000100030804
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                    0000000077d3fc90 5 bytes JMP 0000000100030c0c
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                0000000077d40018 5 bytes JMP 0000000100030a08
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                    0000000077d41900 5 bytes JMP 0000000100030e10
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                            0000000077d5c45a 5 bytes JMP 00000001000301f8
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                          0000000077d61217 5 bytes JMP 00000001000303fc
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                000000007638a30a 1 byte [62]
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\syswow64\USER32.dll!SetWinEventHook                      000000007593ee09 5 bytes JMP 00000001001001f8
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                        0000000075943982 5 bytes JMP 00000001001003fc
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                    0000000075947603 5 bytes JMP 0000000100100804
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                    000000007594835c 5 bytes JMP 0000000100100600
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                  000000007595f52b 5 bytes JMP 0000000100100a08
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity            00000000776a5181 5 bytes JMP 0000000100111014
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                00000000776a5254 5 bytes JMP 0000000100110804
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                00000000776a53d5 5 bytes JMP 0000000100110a08
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                00000000776a54c2 5 bytes JMP 0000000100110c0c
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                00000000776a55e2 5 bytes JMP 0000000100110e10
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                      00000000776a567c 5 bytes JMP 00000001001101f8
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                      00000000776a589f 5 bytes JMP 00000001001103fc
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\SysWOW64\sechost.dll!DeleteService                        00000000776a5a22 5 bytes JMP 0000000100110600
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69              0000000075f11465 2 bytes [F1, 75]
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155            0000000075f114bb 2 bytes [F1, 75]
.text    ...                                                                                                                                                      * 2
.text    C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                          0000000077b63ae0 5 bytes JMP 000000010026075c
.text    C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                            0000000077b67a90 5 bytes JMP 00000001002603a4
.text    C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              0000000077b91490 5 bytes JMP 0000000100260b14
.text    C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  0000000077b914f0 5 bytes JMP 0000000100260ecc
.text    C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                    0000000077b915d0 5 bytes JMP 000000010026163c
.text    C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                0000000077b91810 5 bytes JMP 0000000100261284
.text    C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                    0000000077b92840 5 bytes JMP 00000001002619f4
.text    C:\Windows\system32\svchost.exe[2400] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                              0000000077a7eecd 1 byte [62]
.text    C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                            000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                              000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                              000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                      000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                      000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Windows\system32\svchost.exe[2400] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                      000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                    0000000077d3faa0 5 bytes JMP 0000000100030600
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                        0000000077d3fb38 5 bytes JMP 0000000100030804
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                        0000000077d3fc18 5 bytes JMP 0000000170961780
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                          0000000077d3fc90 5 bytes JMP 0000000170962ad0
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                                  0000000077d3fd44 5 bytes JMP 00000001709616b0
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                      0000000077d40018 5 bytes JMP 0000000100030a08
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                                0000000077d40094 5 bytes JMP 0000000170961600
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\SysWOW64\ntdll.dll!NtOpenDirectoryObject                                                      0000000077d400dc 5 bytes JMP 0000000170961740
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\SysWOW64\ntdll.dll!NtCreateDirectoryObject                                                    0000000077d406a4 5 bytes JMP 0000000170961700
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\SysWOW64\ntdll.dll!NtDeleteFile                                                                0000000077d409c4 5 bytes JMP 0000000170961680
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                          0000000077d41900 5 bytes JMP 0000000100030e10
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                                  0000000077d5c45a 5 bytes JMP 0000000170962370
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                                                0000000077d61217 5 bytes JMP 00000001000303fc
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                                    000000007638a30a 1 byte [62]
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                                            000000007593ee09 5 bytes JMP 00000001001101f8
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                                            0000000075943982 5 bytes JMP 00000001001103fc
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                                          0000000075947603 5 bytes JMP 0000000100110804
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                                          000000007594835c 5 bytes JMP 0000000100110600
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                                        000000007595f52b 5 bytes JMP 0000000100110a08
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\ADVAPI32.dll!RegDeleteKeyTransactedW                                                  00000000766fa8ea 5 bytes JMP 0000000170963af0
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\ADVAPI32.dll!RegDeleteKeyExW                                                          00000000766fa9c5 5 bytes JMP 0000000170963ab0
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\ADVAPI32.dll!RegDeleteValueW                                                          00000000766fcf31 5 bytes JMP 0000000170963a10
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\ADVAPI32.dll!RegDeleteKeyW                                                            0000000076701272 7 bytes JMP 0000000170963a70
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\ADVAPI32.dll!RegSetValueExW                                                          00000000767014d6 5 bytes JMP 00000001709634b0
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\ADVAPI32.dll!RegSetKeyValueW                                                          0000000076717180 5 bytes JMP 00000001709637f0
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\ADVAPI32.dll!RegSetValueW                                                            000000007671a68a 5 bytes JMP 0000000170963660
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\ADVAPI32.dll!RegDeleteTreeW                                                          00000000767334a3 5 bytes JMP 0000000170963b40
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\ADVAPI32.dll!RegDeleteKeyValueW                                                      000000007674f84b 5 bytes JMP 00000001709639a0
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                                  00000000776a5181 5 bytes JMP 0000000100121014
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                                      00000000776a5254 5 bytes JMP 0000000100120804
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                                      00000000776a53d5 5 bytes JMP 0000000100120a08
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                                    00000000776a54c2 5 bytes JMP 0000000100120c0c
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                                    00000000776a55e2 5 bytes JMP 0000000100120e10
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                                            00000000776a567c 5 bytes JMP 00000001001201f8
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                                            00000000776a589f 5 bytes JMP 00000001001203fc
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\SysWOW64\sechost.dll!DeleteService                                                            00000000776a5a22 5 bytes JMP 0000000100120600
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\WININET.dll!InternetOpenW                                                            00000000765ae9b4 5 bytes JMP 0000000170962010
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\WININET.dll!InternetAttemptConnect                                                    00000000765df0ca 5 bytes JMP 0000000170962030
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\WININET.dll!InternetCheckConnectionW                                                  00000000765dffcf 5 bytes JMP 0000000170962020
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\WININET.dll!InternetGoOnlineW                                                        00000000765e30c0 5 bytes JMP 0000000170962020
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\WS2_32.dll!WSAStartup                                                                00000000764d3ab2 7 bytes JMP 00000001709620b0
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\WS2_32.dll!WSASocketW                                                                00000000764d3cd3 7 bytes JMP 00000001709620a0
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\WS2_32.dll!socket                                                                    00000000764d3eb8 5 bytes JMP 0000000170962040
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\WS2_32.dll!bind                                                                      00000000764d4582 5 bytes JMP 0000000170962040
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\WS2_32.dll!connect                                                                    00000000764d6bdd 5 bytes JMP 0000000170962040
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\WS2_32.dll!listen                                                                    00000000764db001 5 bytes JMP 0000000170962060
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\WS2_32.dll!WSAConnect                                                                00000000764dcc3f 5 bytes JMP 0000000170962070
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\WS2_32.dll!WSAConnectByList                                                          00000000764ebfdd 5 bytes JMP 0000000170962080
.text    C:\ProgramData\IBUpdaterService\ibsvc.exe[2488] C:\Windows\syswow64\WS2_32.dll!WSAConnectByNameW                                                          00000000764ec52f 5 bytes JMP 0000000170962090
.text    C:\Windows\system32\taskhost.exe[2604] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                        0000000077b63ae0 5 bytes JMP 000000010012075c
.text    C:\Windows\system32\taskhost.exe[2604] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                          0000000077b67a90 5 bytes JMP 00000001001203a4
.text    C:\Windows\system32\taskhost.exe[2604] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              0000000077b91490 5 bytes JMP 0000000100120b14
.text    C:\Windows\system32\taskhost.exe[2604] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  0000000077b914f0 5 bytes JMP 0000000100120ecc
.text    C:\Windows\system32\taskhost.exe[2604] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                  0000000077b915d0 5 bytes JMP 000000010012163c
.text    C:\Windows\system32\taskhost.exe[2604] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                              0000000077b91810 5 bytes JMP 0000000100121284
.text    C:\Windows\system32\taskhost.exe[2604] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                  0000000077b92840 5 bytes JMP 00000001001219f4
.text    C:\Windows\system32\taskhost.exe[2604] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                              0000000077a7eecd 1 byte [62]
.text    C:\Windows\system32\taskhost.exe[2604] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                          000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Windows\system32\taskhost.exe[2604] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                              000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Windows\system32\taskhost.exe[2604] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                              000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Windows\system32\taskhost.exe[2604] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                              000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Windows\system32\taskhost.exe[2604] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                              000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Windows\system32\taskhost.exe[2604] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                    000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Windows\system32\taskhost.exe[2604] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                    000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Windows\system32\taskhost.exe[2604] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                      000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe[2648] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                    0000000077d3faa0 5 bytes JMP 0000000100030600
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe[2648] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                        0000000077d3fb38 5 bytes JMP 0000000100030804
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe[2648] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                          0000000077d3fc90 5 bytes JMP 0000000100030c0c
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe[2648] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                      0000000077d40018 5 bytes JMP 0000000100030a08
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe[2648] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                          0000000077d41900 5 bytes JMP 0000000100030e10
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe[2648] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                  0000000077d5c45a 5 bytes JMP 00000001000301f8
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe[2648] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                                0000000077d61217 5 bytes JMP 00000001000303fc
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe[2648] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                    000000007638a30a 1 byte [62]
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe[2648] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                            000000007593ee09 5 bytes JMP 00000001002401f8
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe[2648] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                            0000000075943982 5 bytes JMP 00000001002403fc
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe[2648] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                          0000000075947603 5 bytes JMP 0000000100240804
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe[2648] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                          000000007594835c 5 bytes JMP 0000000100240600
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe[2648] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                        000000007595f52b 5 bytes JMP 0000000100240a08
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe[2648] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                  00000000776a5181 5 bytes JMP 0000000100251014
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe[2648] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                      00000000776a5254 5 bytes JMP 0000000100250804
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe[2648] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                      00000000776a53d5 5 bytes JMP 0000000100250a08
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe[2648] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                    00000000776a54c2 5 bytes JMP 0000000100250c0c
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe[2648] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                    00000000776a55e2 5 bytes JMP 0000000100250e10
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe[2648] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                            00000000776a567c 5 bytes JMP 00000001002501f8
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe[2648] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                            00000000776a589f 5 bytes JMP 00000001002503fc
.text    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe[2648] C:\Windows\SysWOW64\sechost.dll!DeleteService                                            00000000776a5a22 5 bytes JMP 0000000100250600
.text    C:\Windows\system32\taskeng.exe[2760] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                          0000000077b63ae0 5 bytes JMP 00000001003c075c
.text    C:\Windows\system32\taskeng.exe[2760] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                            0000000077b67a90 5 bytes JMP 00000001003c03a4
.text    C:\Windows\system32\taskeng.exe[2760] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              0000000077b91490 5 bytes JMP 00000001003c0b14
.text    C:\Windows\system32\taskeng.exe[2760] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  0000000077b914f0 5 bytes JMP 00000001003c0ecc
.text    C:\Windows\system32\taskeng.exe[2760] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                    0000000077b915d0 5 bytes JMP 00000001003c163c
.text    C:\Windows\system32\taskeng.exe[2760] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                0000000077b91810 5 bytes JMP 00000001003c1284
.text    C:\Windows\system32\taskeng.exe[2760] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                    0000000077b92840 5 bytes JMP 00000001003c19f4
.text    C:\Windows\system32\taskeng.exe[2760] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                              0000000077a7eecd 1 byte [62]
.text    C:\Windows\system32\taskeng.exe[2760] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                            000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Windows\system32\taskeng.exe[2760] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Windows\system32\taskeng.exe[2760] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Windows\system32\taskeng.exe[2760] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                              000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Windows\system32\taskeng.exe[2760] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                              000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Windows\system32\taskeng.exe[2760] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                      000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Windows\system32\taskeng.exe[2760] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                      000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Windows\system32\taskeng.exe[2760] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                      000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE[2876] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                            0000000077d3faa0 5 bytes JMP 0000000100030600
.text    C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE[2876] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                0000000077d3fb38 5 bytes JMP 0000000100030804
.text    C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE[2876] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                                  0000000077d3fc90 5 bytes JMP 0000000100030c0c
.text    C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE[2876] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                              0000000077d40018 5 bytes JMP 0000000100030a08
.text    C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE[2876] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                  0000000077d41900 5 bytes JMP 0000000100030e10
.text    C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE[2876] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                                          0000000077d5c45a 5 bytes JMP 00000001000301f8
.text    C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE[2876] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                                                        0000000077d61217 5 bytes JMP 00000001000303fc
.text    C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE[2876] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                                            000000007638a30a 1 byte [62]
.text    C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE[2876] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                                                    000000007593ee09 5 bytes JMP 00000001002501f8
.text    C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE[2876] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                                                    0000000075943982 5 bytes JMP 00000001002503fc
.text    C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE[2876] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                                                  0000000075947603 5 bytes JMP 0000000100250804
.text    C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE[2876] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                                                  000000007594835c 5 bytes JMP 0000000100250600
.text    C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE[2876] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                                                000000007595f52b 5 bytes JMP 0000000100250a08
.text    C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE[2876] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                                          00000000776a5181 5 bytes JMP 0000000100261014
.text    C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE[2876] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                                              00000000776a5254 5 bytes JMP 0000000100260804
.text    C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE[2876] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                                              00000000776a53d5 5 bytes JMP 0000000100260a08
.text    C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE[2876] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                                            00000000776a54c2 5 bytes JMP 0000000100260c0c
.text    C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE[2876] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                                            00000000776a55e2 5 bytes JMP 0000000100260e10
.text    C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE[2876] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                                                    00000000776a567c 5 bytes JMP 00000001002601f8
.text    C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE[2876] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                                                    00000000776a589f 5 bytes JMP 00000001002603fc
.text    C:\PROGRA~2\ICQ6TO~1\ICQSER~1.EXE[2876] C:\Windows\SysWOW64\sechost.dll!DeleteService                                                                    00000000776a5a22 5 bytes JMP 0000000100260600
.text    C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                                  0000000077b63ae0 5 bytes JMP 000000010020075c
.text    C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                                    0000000077b67a90 5 bytes JMP 00000001002003a4
.text    C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                      0000000077b91490 5 bytes JMP 0000000100200b14
.text    C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                          0000000077b914f0 5 bytes JMP 0000000100200ecc
.text    C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                            0000000077b915d0 5 bytes JMP 000000010020163c
.text    C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                        0000000077b91810 5 bytes JMP 0000000100201284
.text    C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                            0000000077b92840 5 bytes JMP 00000001002019f4
.text    C:\Windows\Explorer.EXE[2980] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                                      0000000077a7eecd 1 byte [62]
.text    C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                                    000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                        000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                        000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                                      000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                                      000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                              000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                              000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Windows\Explorer.EXE[2980] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                              000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                              0000000077d3faa0 5 bytes JMP 0000000100030600
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                  0000000077d3fb38 5 bytes JMP 0000000100030804
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                                  0000000077d3fc90 5 bytes JMP 0000000100030c0c
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                              0000000077d40018 5 bytes JMP 0000000100030a08
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                  0000000077d41900 5 bytes JMP 0000000100030e10
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                                          0000000077d5c45a 5 bytes JMP 00000001000301f8
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                                                        0000000077d61217 5 bytes JMP 00000001000303fc
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                                              000000007638a30a 1 byte [62]
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                                          00000000776a5181 5 bytes JMP 00000001001e1014
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                                              00000000776a5254 5 bytes JMP 00000001001e0804
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                                              00000000776a53d5 5 bytes JMP 00000001001e0a08
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                                              00000000776a54c2 5 bytes JMP 00000001001e0c0c
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                                              00000000776a55e2 5 bytes JMP 00000001001e0e10
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                                                    00000000776a567c 5 bytes JMP 00000001001e01f8
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                                                    00000000776a589f 5 bytes JMP 00000001001e03fc
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\SysWOW64\sechost.dll!DeleteService                                                                      00000000776a5a22 5 bytes JMP 00000001001e0600
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                                                    000000007593ee09 3 bytes JMP 00000001001f01f8
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\syswow64\USER32.dll!SetWinEventHook + 4                                                                000000007593ee0d 1 byte [8A]
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                                                      0000000075943982 5 bytes JMP 00000001001f03fc
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                                                  0000000075947603 5 bytes JMP 00000001001f0804
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                                                  000000007594835c 5 bytes JMP 00000001001f0600
.text    C:\Windows\SysWOW64\nlssrv32.exe[3052] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                                                000000007595f52b 5 bytes JMP 00000001001f0a08
.text    C:\Windows\system32\taskeng.exe[2292] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                          0000000077b63ae0 5 bytes JMP 00000001001f075c
.text    C:\Windows\system32\taskeng.exe[2292] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                            0000000077b67a90 5 bytes JMP 00000001001f03a4
.text    C:\Windows\system32\taskeng.exe[2292] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              0000000077b91490 5 bytes JMP 00000001001f0b14
.text    C:\Windows\system32\taskeng.exe[2292] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  0000000077b914f0 5 bytes JMP 00000001001f0ecc
.text    C:\Windows\system32\taskeng.exe[2292] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                    0000000077b915d0 5 bytes JMP 00000001001f163c
.text    C:\Windows\system32\taskeng.exe[2292] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                0000000077b91810 5 bytes JMP 00000001001f1284
.text    C:\Windows\system32\taskeng.exe[2292] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                    0000000077b92840 5 bytes JMP 00000001001f19f4
.text    C:\Windows\system32\taskeng.exe[2292] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                              0000000077a7eecd 1 byte [62]
.text    C:\Windows\system32\taskeng.exe[2292] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                            000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Windows\system32\taskeng.exe[2292] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Windows\system32\taskeng.exe[2292] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Windows\system32\taskeng.exe[2292] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                              000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Windows\system32\taskeng.exe[2292] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                              000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Windows\system32\taskeng.exe[2292] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                      000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Windows\system32\taskeng.exe[2292] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                      000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Windows\system32\taskeng.exe[2292] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                      000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Windows\system32\svchost.exe[2728] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                          0000000077b63ae0 5 bytes JMP 00000001000a075c
.text    C:\Windows\system32\svchost.exe[2728] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                            0000000077b67a90 5 bytes JMP 00000001000a03a4
.text    C:\Windows\system32\svchost.exe[2728] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              0000000077b91490 5 bytes JMP 00000001000a0b14
.text    C:\Windows\system32\svchost.exe[2728] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  0000000077b914f0 5 bytes JMP 00000001000a0ecc
.text    C:\Windows\system32\svchost.exe[2728] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                    0000000077b915d0 5 bytes JMP 00000001000a163c
.text    C:\Windows\system32\svchost.exe[2728] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                0000000077b91810 5 bytes JMP 00000001000a1284
.text    C:\Windows\system32\svchost.exe[2728] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                    0000000077b92840 5 bytes JMP 00000001000a19f4
.text    C:\Windows\system32\svchost.exe[2728] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                              0000000077a7eecd 1 byte [62]
.text    C:\Windows\system32\svchost.exe[2728] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                            000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Windows\system32\svchost.exe[2728] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Windows\system32\svchost.exe[2728] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Windows\system32\svchost.exe[2728] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                              000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Windows\system32\svchost.exe[2728] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                              000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Windows\system32\svchost.exe[2728] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                      000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Windows\system32\svchost.exe[2728] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                      000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Windows\system32\svchost.exe[2728] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                      000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Program Files\Trend Micro\Titanium\TiMiniService.exe[3064] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                  0000000077b63ae0 5 bytes JMP 00000001002d075c
.text    C:\Program Files\Trend Micro\Titanium\TiMiniService.exe[3064] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                    0000000077b67a90 5 bytes JMP 00000001002d03a4
.text    C:\Program Files\Trend Micro\Titanium\TiMiniService.exe[3064] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                      0000000077b91490 5 bytes JMP 00000001002d0b14
.text    C:\Program Files\Trend Micro\Titanium\TiMiniService.exe[3064] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                          0000000077b914f0 5 bytes JMP 00000001002d0ecc
.text    C:\Program Files\Trend Micro\Titanium\TiMiniService.exe[3064] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                            0000000077b915d0 5 bytes JMP 00000001002d163c
.text    C:\Program Files\Trend Micro\Titanium\TiMiniService.exe[3064] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                        0000000077b91810 5 bytes JMP 00000001002d1284
.text    C:\Program Files\Trend Micro\Titanium\TiMiniService.exe[3064] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                            0000000077b92840 5 bytes JMP 00000001002d19f4
.text    C:\Program Files\Trend Micro\Titanium\TiMiniService.exe[3064] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                      0000000077a7eecd 1 byte [62]
.text    C:\Program Files\Trend Micro\Titanium\TiMiniService.exe[3064] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                    000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Program Files\Trend Micro\Titanium\TiMiniService.exe[3064] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                        000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Program Files\Trend Micro\Titanium\TiMiniService.exe[3064] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                        000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Program Files\Trend Micro\Titanium\TiMiniService.exe[3064] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                      000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Program Files\Trend Micro\Titanium\TiMiniService.exe[3064] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                      000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Program Files\Trend Micro\Titanium\TiMiniService.exe[3064] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                              000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Program Files\Trend Micro\Titanium\TiMiniService.exe[3064] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                              000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Program Files\Trend Micro\Titanium\TiMiniService.exe[3064] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                              000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Program Files\Trend Micro\Titanium\TiResumeSrv.exe[3112] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                    0000000077b63ae0 5 bytes JMP 000000010046075c
.text    C:\Program Files\Trend Micro\Titanium\TiResumeSrv.exe[3112] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                      0000000077b67a90 5 bytes JMP 00000001004603a4
.text    C:\Program Files\Trend Micro\Titanium\TiResumeSrv.exe[3112] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                        0000000077b91490 5 bytes JMP 0000000100460b14
.text    C:\Program Files\Trend Micro\Titanium\TiResumeSrv.exe[3112] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                            0000000077b914f0 5 bytes JMP 0000000100460ecc
.text    C:\Program Files\Trend Micro\Titanium\TiResumeSrv.exe[3112] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                              0000000077b915d0 5 bytes JMP 000000010046163c
.text    C:\Program Files\Trend Micro\Titanium\TiResumeSrv.exe[3112] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                          0000000077b91810 5 bytes JMP 0000000100461284
.text    C:\Program Files\Trend Micro\Titanium\TiResumeSrv.exe[3112] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                              0000000077b92840 5 bytes JMP 00000001004619f4
.text    C:\Program Files\Trend Micro\Titanium\TiResumeSrv.exe[3112] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                        0000000077a7eecd 1 byte [62]
.text    C:\Program Files\Trend Micro\Titanium\TiResumeSrv.exe[3112] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                      000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Program Files\Trend Micro\Titanium\TiResumeSrv.exe[3112] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                          000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Program Files\Trend Micro\Titanium\TiResumeSrv.exe[3112] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                          000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Program Files\Trend Micro\Titanium\TiResumeSrv.exe[3112] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                        000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Program Files\Trend Micro\Titanium\TiResumeSrv.exe[3112] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                        000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Program Files\Trend Micro\Titanium\TiResumeSrv.exe[3112] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Program Files\Trend Micro\Titanium\TiResumeSrv.exe[3112] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Program Files\Trend Micro\Titanium\TiResumeSrv.exe[3112] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3120] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                  0000000077b63ae0 5 bytes JMP 00000001001e075c
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3120] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                    0000000077b67a90 5 bytes JMP 00000001001e03a4
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3120] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                      0000000077b91490 5 bytes JMP 00000001001e0b14
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3120] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                          0000000077b914f0 5 bytes JMP 00000001001e0ecc
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3120] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                            0000000077b915d0 5 bytes JMP 00000001001e163c
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3120] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                        0000000077b91810 5 bytes JMP 00000001001e1284
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3120] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                            0000000077b92840 5 bytes JMP 00000001001e19f4
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3120] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                      0000000077a7eecd 1 byte [62]
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3120] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                    000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3120] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                        000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3120] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                        000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3120] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                      000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3120] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                      000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3120] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                              000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3120] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                              000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3120] C:\Windows\SYSTEM32\sechost.dll!DeleteService                              000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Windows\system32\conhost.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                          0000000077b63ae0 5 bytes JMP 00000001001b075c
.text    C:\Windows\system32\conhost.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                            0000000077b67a90 5 bytes JMP 00000001001b03a4
.text    C:\Windows\system32\conhost.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              0000000077b91490 5 bytes JMP 00000001001b0b14
.text    C:\Windows\system32\conhost.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  0000000077b914f0 5 bytes JMP 00000001001b0ecc
.text    C:\Windows\system32\conhost.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                    0000000077b915d0 5 bytes JMP 00000001001b163c
.text    C:\Windows\system32\conhost.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                0000000077b91810 5 bytes JMP 00000001001b1284
.text    C:\Windows\system32\conhost.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                    0000000077b92840 5 bytes JMP 00000001001b19f4
.text    C:\Windows\system32\conhost.exe[3132] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                              0000000077a7eecd 1 byte [62]
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[3560] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                              0000000077d3faa0 5 bytes JMP 0000000100240600
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[3560] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                  0000000077d3fb38 5 bytes JMP 0000000100240804
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[3560] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                    0000000077d3fc90 5 bytes JMP 0000000100240c0c
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[3560] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                0000000077d40018 5 bytes JMP 0000000100240a08
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[3560] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                    0000000077d41900 5 bytes JMP 0000000100240e10
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[3560] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                            0000000077d5c45a 5 bytes JMP 00000001002401f8
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[3560] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                          0000000077d61217 5 bytes JMP 00000001002403fc
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[3560] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                              000000007638a30a 1 byte [62]
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[3560] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                      000000007593ee09 5 bytes JMP 00000001002501f8
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[3560] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                      0000000075943982 5 bytes JMP 00000001002503fc
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[3560] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                    0000000075947603 5 bytes JMP 0000000100250804
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[3560] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                    000000007594835c 5 bytes JMP 0000000100250600
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[3560] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                  000000007595f52b 5 bytes JMP 0000000100250a08
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[3560] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                            00000000776a5181 5 bytes JMP 0000000100261014
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[3560] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                00000000776a5254 5 bytes JMP 0000000100260804
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[3560] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                00000000776a53d5 5 bytes JMP 0000000100260a08
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[3560] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                              00000000776a54c2 5 bytes JMP 0000000100260c0c
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[3560] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                              00000000776a55e2 5 bytes JMP 0000000100260e10
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[3560] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                      00000000776a567c 5 bytes JMP 00000001002601f8
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[3560] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                      00000000776a589f 5 bytes JMP 00000001002603fc
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe[3560] C:\Windows\SysWOW64\sechost.dll!DeleteService                                      00000000776a5a22 5 bytes JMP 0000000100260600
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3600] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                0000000077b63ae0 5 bytes JMP 000000010044075c
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3600] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                  0000000077b67a90 5 bytes JMP 00000001004403a4
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3600] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                      0000000077b91490 5 bytes JMP 0000000100440b14
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3600] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                          0000000077b914f0 5 bytes JMP 0000000100440ecc
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3600] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                          0000000077b915d0 5 bytes JMP 000000010044163c
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3600] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                      0000000077b91810 5 bytes JMP 0000000100441284
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3600] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                          0000000077b92840 5 bytes JMP 00000001004419f4
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3600] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                      0000000077a7eecd 1 byte [62]
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3600] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                  000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3600] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                      000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3600] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                      000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3600] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                      000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3600] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                      000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3600] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                            000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3600] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                            000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3600] C:\Windows\SYSTEM32\sechost.dll!DeleteService                              000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Program Files\Elantech\ETDCtrl.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                    0000000077b63ae0 5 bytes JMP 000000010039075c
.text    C:\Program Files\Elantech\ETDCtrl.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                      0000000077b67a90 5 bytes JMP 00000001003903a4
.text    C:\Program Files\Elantech\ETDCtrl.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                        0000000077b91490 5 bytes JMP 0000000100390b14
.text    C:\Program Files\Elantech\ETDCtrl.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                            0000000077b914f0 5 bytes JMP 0000000100390ecc
.text    C:\Program Files\Elantech\ETDCtrl.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                              0000000077b915d0 5 bytes JMP 000000010039163c
.text    C:\Program Files\Elantech\ETDCtrl.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                          0000000077b91810 5 bytes JMP 0000000100391284
.text    C:\Program Files\Elantech\ETDCtrl.exe[3720] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                              0000000077b92840 5 bytes JMP 00000001003919f4
.text    C:\Program Files\Elantech\ETDCtrl.exe[3720] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                        0000000077a7eecd 1 byte [62]
.text    C:\Program Files\Elantech\ETDCtrl.exe[3720] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                      000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Program Files\Elantech\ETDCtrl.exe[3720] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                          000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Program Files\Elantech\ETDCtrl.exe[3720] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                          000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Program Files\Elantech\ETDCtrl.exe[3720] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                        000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Program Files\Elantech\ETDCtrl.exe[3720] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                        000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Program Files\Elantech\ETDCtrl.exe[3720] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Program Files\Elantech\ETDCtrl.exe[3720] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Program Files\Elantech\ETDCtrl.exe[3720] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                          0000000077b63ae0 5 bytes JMP 00000001003f075c
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                            0000000077b67a90 5 bytes JMP 00000001003f03a4
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                              0000000077b91490 5 bytes JMP 00000001003f0b14
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                  0000000077b914f0 5 bytes JMP 00000001003f0ecc
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                    0000000077b915d0 5 bytes JMP 00000001003f163c
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                0000000077b91810 5 bytes JMP 00000001003f1284
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3836] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                    0000000077b92840 5 bytes JMP 00000001003f19f4
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3836] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                              0000000077a7eecd 1 byte [62]
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3836] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                            000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3836] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3836] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3836] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                              000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3836] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                              000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3836] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                      000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3836] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                      000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3836] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                      000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Windows\system32\wbem\wmiprvse.exe[4008] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                    0000000077b63ae0 5 bytes JMP 000000010017075c
.text    C:\Windows\system32\wbem\wmiprvse.exe[4008] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                      0000000077b67a90 5 bytes JMP 00000001001703a4
.text    C:\Windows\system32\wbem\wmiprvse.exe[4008] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                        0000000077b91490 5 bytes JMP 0000000100170b14
.text    C:\Windows\system32\wbem\wmiprvse.exe[4008] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                            0000000077b914f0 5 bytes JMP 0000000100170ecc
.text    C:\Windows\system32\wbem\wmiprvse.exe[4008] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                              0000000077b915d0 5 bytes JMP 000000010017163c
.text    C:\Windows\system32\wbem\wmiprvse.exe[4008] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                          0000000077b91810 5 bytes JMP 0000000100171284
.text    C:\Windows\system32\wbem\wmiprvse.exe[4008] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                              0000000077b92840 5 bytes JMP 00000001001719f4
.text    C:\Windows\system32\wbem\wmiprvse.exe[4008] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                        0000000077a7eecd 1 byte [62]
.text    C:\Windows\system32\wbem\wmiprvse.exe[4008] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                      000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Windows\system32\wbem\wmiprvse.exe[4008] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                          000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Windows\system32\wbem\wmiprvse.exe[4008] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                          000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Windows\system32\wbem\wmiprvse.exe[4008] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                        000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Windows\system32\wbem\wmiprvse.exe[4008] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                        000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Windows\system32\wbem\wmiprvse.exe[4008] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Windows\system32\wbem\wmiprvse.exe[4008] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Windows\system32\wbem\wmiprvse.exe[4008] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Windows\System32\alg.exe[4028] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                              0000000077b63ae0 5 bytes JMP 00000001003c075c
.text    C:\Windows\System32\alg.exe[4028] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                                0000000077b67a90 5 bytes JMP 00000001003c03a4
.text    C:\Windows\System32\alg.exe[4028] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                  0000000077b91490 5 bytes JMP 00000001003c0b14
.text    C:\Windows\System32\alg.exe[4028] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                      0000000077b914f0 5 bytes JMP 00000001003c0ecc
.text    C:\Windows\System32\alg.exe[4028] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                        0000000077b915d0 5 bytes JMP 00000001003c163c
.text    C:\Windows\System32\alg.exe[4028] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                    0000000077b91810 5 bytes JMP 00000001003c1284
.text    C:\Windows\System32\alg.exe[4028] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                        0000000077b92840 5 bytes JMP 00000001003c19f4
.text    C:\Windows\System32\alg.exe[4028] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                                  0000000077a7eecd 1 byte [62]
.text    C:\Windows\System32\alg.exe[4028] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                                000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Windows\System32\alg.exe[4028] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                    000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Windows\System32\alg.exe[4028] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                    000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Windows\System32\alg.exe[4028] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                                  000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Windows\System32\alg.exe[4028] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                                  000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Windows\System32\alg.exe[4028] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                          000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Windows\System32\alg.exe[4028] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                          000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Windows\System32\alg.exe[4028] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                          000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Windows\system32\svchost.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                          0000000077b63ae0 5 bytes JMP 000000010039075c
.text    C:\Windows\system32\svchost.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                            0000000077b67a90 5 bytes JMP 00000001003903a4
.text    C:\Windows\system32\svchost.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              0000000077b91490 5 bytes JMP 0000000100390b14
.text    C:\Windows\system32\svchost.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  0000000077b914f0 5 bytes JMP 0000000100390ecc
.text    C:\Windows\system32\svchost.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                    0000000077b915d0 5 bytes JMP 000000010039163c
.text    C:\Windows\system32\svchost.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                0000000077b91810 5 bytes JMP 0000000100391284
.text    C:\Windows\system32\svchost.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                    0000000077b92840 5 bytes JMP 00000001003919f4
.text    C:\Windows\system32\svchost.exe[3548] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                              0000000077a7eecd 1 byte [62]
.text    C:\Windows\system32\svchost.exe[3548] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                            000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Windows\system32\svchost.exe[3548] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Windows\system32\svchost.exe[3548] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Windows\system32\svchost.exe[3548] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                              000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Windows\system32\svchost.exe[3548] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                              000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Windows\system32\svchost.exe[3548] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                      000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Windows\system32\svchost.exe[3548] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                      000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Windows\system32\svchost.exe[3548] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                      000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Windows\System32\igfxtray.exe[4060] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                        0000000077b63ae0 5 bytes JMP 000000010048075c
.text    C:\Windows\System32\igfxtray.exe[4060] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                          0000000077b67a90 5 bytes JMP 00000001004803a4
.text    C:\Windows\System32\igfxtray.exe[4060] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              0000000077b91490 5 bytes JMP 0000000100480b14
.text    C:\Windows\System32\igfxtray.exe[4060] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  0000000077b914f0 5 bytes JMP 0000000100480ecc
.text    C:\Windows\System32\igfxtray.exe[4060] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                  0000000077b915d0 5 bytes JMP 000000010048163c
.text    C:\Windows\System32\igfxtray.exe[4060] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                              0000000077b91810 5 bytes JMP 0000000100481284
.text    C:\Windows\System32\igfxtray.exe[4060] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                  0000000077b92840 5 bytes JMP 00000001004819f4
.text    C:\Windows\System32\igfxtray.exe[4060] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                              0000000077a7eecd 1 byte [62]
.text    C:\Windows\System32\igfxtray.exe[4060] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                          000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Windows\System32\igfxtray.exe[4060] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                              000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Windows\System32\igfxtray.exe[4060] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                              000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Windows\System32\igfxtray.exe[4060] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                              000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Windows\System32\igfxtray.exe[4060] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                              000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Windows\System32\igfxtray.exe[4060] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                    000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Windows\System32\igfxtray.exe[4060] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                    000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Windows\System32\igfxtray.exe[4060] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                      000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Windows\System32\hkcmd.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                            0000000077b63ae0 5 bytes JMP 000000010045075c
.text    C:\Windows\System32\hkcmd.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                              0000000077b67a90 5 bytes JMP 00000001004503a4
.text    C:\Windows\System32\hkcmd.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                0000000077b91490 5 bytes JMP 0000000100450b14
.text    C:\Windows\System32\hkcmd.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                    0000000077b914f0 5 bytes JMP 0000000100450ecc
.text    C:\Windows\System32\hkcmd.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                      0000000077b915d0 5 bytes JMP 000000010045163c
.text    C:\Windows\System32\hkcmd.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                  0000000077b91810 5 bytes JMP 0000000100451284
.text    C:\Windows\System32\hkcmd.exe[1340] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                      0000000077b92840 5 bytes JMP 00000001004519f4
.text    C:\Windows\System32\hkcmd.exe[1340] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                                0000000077a7eecd 1 byte [62]
.text    C:\Windows\System32\hkcmd.exe[1340] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                              000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Windows\System32\hkcmd.exe[1340] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                  000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Windows\System32\hkcmd.exe[1340] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                  000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Windows\System32\hkcmd.exe[1340] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                                000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Windows\System32\hkcmd.exe[1340] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                                000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Windows\System32\hkcmd.exe[1340] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                        000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Windows\System32\hkcmd.exe[1340] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                        000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Windows\System32\hkcmd.exe[1340] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                        000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                          0000000077b63ae0 5 bytes JMP 000000010039075c
.text    C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                            0000000077b67a90 5 bytes JMP 00000001003903a4
.text    C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              0000000077b91490 5 bytes JMP 0000000100390b14
.text    C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  0000000077b914f0 5 bytes JMP 0000000100390ecc
.text    C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                    0000000077b915d0 5 bytes JMP 000000010039163c
.text    C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                0000000077b91810 5 bytes JMP 0000000100391284
.text    C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                    0000000077b92840 5 bytes JMP 00000001003919f4
.text    C:\Windows\system32\svchost.exe[2864] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                              0000000077a7eecd 1 byte [62]
.text    C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                            000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                              000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                              000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                      000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                      000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Windows\system32\svchost.exe[2864] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                      000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Windows\System32\igfxpers.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                        0000000077b63ae0 5 bytes JMP 00000001002e075c
.text    C:\Windows\System32\igfxpers.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                          0000000077b67a90 5 bytes JMP 00000001002e03a4
.text    C:\Windows\System32\igfxpers.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              0000000077b91490 5 bytes JMP 00000001002e0b14
.text    C:\Windows\System32\igfxpers.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  0000000077b914f0 5 bytes JMP 00000001002e0ecc
.text    C:\Windows\System32\igfxpers.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                  0000000077b915d0 5 bytes JMP 00000001002e163c
.text    C:\Windows\System32\igfxpers.exe[4324]
Das ist der erste Teil

painfiller 23.05.2013 15:02
Hier der zweite:

Vom Defogger gab es keine Logfile

Code:
C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                              0000000077b91810 5 bytes JMP 00000001002e1284
.text    C:\Windows\System32\igfxpers.exe[4324] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                  0000000077b92840 5 bytes JMP 00000001002e19f4
.text    C:\Windows\System32\igfxpers.exe[4324] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                              0000000077a7eecd 1 byte [62]
.text    C:\Windows\System32\igfxpers.exe[4324] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                          000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Windows\System32\igfxpers.exe[4324] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                              000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Windows\System32\igfxpers.exe[4324] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                              000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Windows\System32\igfxpers.exe[4324] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                              000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Windows\System32\igfxpers.exe[4324] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                              000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Windows\System32\igfxpers.exe[4324] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                    000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Windows\System32\igfxpers.exe[4324] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                    000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Windows\System32\igfxpers.exe[4324] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                      000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[4472] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                      0000000077d3faa0 5 bytes JMP 0000000100030600
.text    C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[4472] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                          0000000077d3fb38 5 bytes JMP 0000000100030804
.text    C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[4472] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                          0000000077d3fc90 5 bytes JMP 0000000100030c0c
.text    C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[4472] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                      0000000077d40018 5 bytes JMP 0000000100030a08
.text    C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[4472] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                          0000000077d41900 5 bytes JMP 0000000100030e10
.text    C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[4472] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                  0000000077d5c45a 5 bytes JMP 00000001000301f8
.text    C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[4472] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                0000000077d61217 5 bytes JMP 00000001000303fc
.text    C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[4472] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                      000000007638a30a 1 byte [62]
.text    C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[4472] C:\Windows\syswow64\USER32.dll!SetWinEventHook                            000000007593ee09 5 bytes JMP 00000001001401f8
.text    C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[4472] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                              0000000075943982 5 bytes JMP 00000001001403fc
.text    C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[4472] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                          0000000075947603 5 bytes JMP 0000000100140804
.text    C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[4472] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                          000000007594835c 5 bytes JMP 0000000100140600
.text    C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[4472] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                        000000007595f52b 5 bytes JMP 0000000100140a08
.text    C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[4472] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                  00000000776a5181 5 bytes JMP 0000000100151014
.text    C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[4472] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                      00000000776a5254 5 bytes JMP 0000000100150804
.text    C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[4472] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                      00000000776a53d5 5 bytes JMP 0000000100150a08
.text    C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[4472] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                      00000000776a54c2 5 bytes JMP 0000000100150c0c
.text    C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[4472] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                      00000000776a55e2 5 bytes JMP 0000000100150e10
.text    C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[4472] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                            00000000776a567c 5 bytes JMP 00000001001501f8
.text    C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[4472] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                            00000000776a589f 5 bytes JMP 00000001001503fc
.text    C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe[4472] C:\Windows\SysWOW64\sechost.dll!DeleteService                              00000000776a5a22 5 bytes JMP 0000000100150600
.text    C:\Windows\system32\SearchIndexer.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                    0000000077b63ae0 5 bytes JMP 00000001002b075c
.text    C:\Windows\system32\SearchIndexer.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                      0000000077b67a90 5 bytes JMP 00000001002b03a4
.text    C:\Windows\system32\SearchIndexer.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                        0000000077b91490 5 bytes JMP 00000001002b0b14
.text    C:\Windows\system32\SearchIndexer.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                            0000000077b914f0 5 bytes JMP 00000001002b0ecc
.text    C:\Windows\system32\SearchIndexer.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                              0000000077b915d0 5 bytes JMP 00000001002b163c
.text    C:\Windows\system32\SearchIndexer.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                          0000000077b91810 5 bytes JMP 00000001002b1284
.text    C:\Windows\system32\SearchIndexer.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                              0000000077b92840 5 bytes JMP 00000001002b19f4
.text    C:\Windows\system32\SearchIndexer.exe[4780] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                        0000000077a7eecd 1 byte [62]
.text    C:\Windows\system32\SearchIndexer.exe[4780] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                      000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Windows\system32\SearchIndexer.exe[4780] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                          000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Windows\system32\SearchIndexer.exe[4780] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                          000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Windows\system32\SearchIndexer.exe[4780] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                        000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Windows\system32\SearchIndexer.exe[4780] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                        000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Windows\system32\SearchIndexer.exe[4780] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Windows\system32\SearchIndexer.exe[4780] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Windows\system32\SearchIndexer.exe[4780] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4364] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                              0000000077b63ae0 5 bytes JMP 000000010031075c
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4364] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                0000000077b67a90 5 bytes JMP 00000001003103a4
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4364] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                  0000000077b91490 5 bytes JMP 0000000100310b14
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4364] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                      0000000077b914f0 5 bytes JMP 0000000100310ecc
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4364] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                        0000000077b915d0 5 bytes JMP 000000010031163c
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4364] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                    0000000077b91810 5 bytes JMP 0000000100311284
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4364] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                        0000000077b92840 5 bytes JMP 00000001003119f4
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4364] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                  0000000077a7eecd 1 byte [62]
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4364] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4364] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                    000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4364] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                    000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4364] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                  000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4364] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                  000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4364] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                          000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4364] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                          000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Program Files\Elantech\ETDCtrlHelper.exe[4364] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                          000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Program Files\Fresco Logic\Fresco Logic USB3.0 Host Controller\amd64_host\FLxHCIm.exe[4152] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                0000000077b63ae0 5 bytes JMP 000000010041075c
.text    C:\Program Files\Fresco Logic\Fresco Logic USB3.0 Host Controller\amd64_host\FLxHCIm.exe[4152] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                  0000000077b67a90 5 bytes JMP 00000001004103a4
.text    C:\Program Files\Fresco Logic\Fresco Logic USB3.0 Host Controller\amd64_host\FLxHCIm.exe[4152] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory      0000000077b91490 5 bytes JMP 0000000100410b14
.text    C:\Program Files\Fresco Logic\Fresco Logic USB3.0 Host Controller\amd64_host\FLxHCIm.exe[4152] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory          0000000077b914f0 5 bytes JMP 0000000100410ecc
.text    C:\Program Files\Fresco Logic\Fresco Logic USB3.0 Host Controller\amd64_host\FLxHCIm.exe[4152] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess          0000000077b915d0 5 bytes JMP 000000010041163c
.text    C:\Program Files\Fresco Logic\Fresco Logic USB3.0 Host Controller\amd64_host\FLxHCIm.exe[4152] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory      0000000077b91810 5 bytes JMP 0000000100411284
.text    C:\Program Files\Fresco Logic\Fresco Logic USB3.0 Host Controller\amd64_host\FLxHCIm.exe[4152] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread          0000000077b92840 5 bytes JMP 00000001004119f4
.text    C:\Program Files\Fresco Logic\Fresco Logic USB3.0 Host Controller\amd64_host\FLxHCIm.exe[4152] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189      0000000077a7eecd 1 byte [62]
.text    C:\Program Files\Fresco Logic\Fresco Logic USB3.0 Host Controller\amd64_host\FLxHCIm.exe[4152] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity  000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Program Files\Fresco Logic\Fresco Logic USB3.0 Host Controller\amd64_host\FLxHCIm.exe[4152] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA      000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Program Files\Fresco Logic\Fresco Logic USB3.0 Host Controller\amd64_host\FLxHCIm.exe[4152] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW      000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Program Files\Fresco Logic\Fresco Logic USB3.0 Host Controller\amd64_host\FLxHCIm.exe[4152] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A      000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Program Files\Fresco Logic\Fresco Logic USB3.0 Host Controller\amd64_host\FLxHCIm.exe[4152] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W      000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Program Files\Fresco Logic\Fresco Logic USB3.0 Host Controller\amd64_host\FLxHCIm.exe[4152] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA            000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Program Files\Fresco Logic\Fresco Logic USB3.0 Host Controller\amd64_host\FLxHCIm.exe[4152] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW            000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Program Files\Fresco Logic\Fresco Logic USB3.0 Host Controller\amd64_host\FLxHCIm.exe[4152] C:\Windows\SYSTEM32\sechost.dll!DeleteService              000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[3928] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                          0000000077d3faa0 5 bytes JMP 0000000100030600
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[3928] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                              0000000077d3fb38 5 bytes JMP 0000000100030804
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[3928] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                0000000077d3fc90 5 bytes JMP 0000000100030c0c
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[3928] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                            0000000077d40018 5 bytes JMP 0000000100030a08
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[3928] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                0000000077d41900 5 bytes JMP 0000000100030e10
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[3928] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                        0000000077d5c45a 5 bytes JMP 00000001000301f8
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[3928] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                      0000000077d61217 5 bytes JMP 00000001000303fc
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[3928] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                          000000007638a30a 1 byte [62]
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[3928] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                  000000007593ee09 5 bytes JMP 00000001002401f8
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[3928] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                  0000000075943982 5 bytes JMP 00000001002403fc
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[3928] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                0000000075947603 5 bytes JMP 0000000100240804
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[3928] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                000000007594835c 5 bytes JMP 0000000100240600
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[3928] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                              000000007595f52b 5 bytes JMP 0000000100240a08
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[3928] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                        00000000776a5181 5 bytes JMP 00000001002d1014
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[3928] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                            00000000776a5254 5 bytes JMP 00000001002d0804
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[3928] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                            00000000776a53d5 5 bytes JMP 00000001002d0a08
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[3928] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                          00000000776a54c2 5 bytes JMP 00000001002d0c0c
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[3928] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                          00000000776a55e2 5 bytes JMP 00000001002d0e10
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[3928] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                  00000000776a567c 5 bytes JMP 00000001002d01f8
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[3928] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                  00000000776a589f 5 bytes JMP 00000001002d03fc
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[3928] C:\Windows\SysWOW64\sechost.dll!DeleteService                                  00000000776a5a22 5 bytes JMP 00000001002d0600
.text    C:\Program Files\AVAST Software\Avast\AvastUI.exe[2780] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                            000000007638a30a 1 byte [62]
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe[4144] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                0000000077d3faa0 5 bytes JMP 0000000100030600
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe[4144] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                    0000000077d3fb38 5 bytes JMP 0000000100030804
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe[4144] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                      0000000077d3fc90 5 bytes JMP 0000000100030c0c
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe[4144] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                  0000000077d40018 5 bytes JMP 0000000100030a08
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe[4144] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                      0000000077d41900 5 bytes JMP 0000000100030e10
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe[4144] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                              0000000077d5c45a 5 bytes JMP 00000001000301f8
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe[4144] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                            0000000077d61217 5 bytes JMP 00000001000303fc
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe[4144] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                000000007638a30a 1 byte [62]
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe[4144] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                        000000007593ee09 5 bytes JMP 00000001002401f8
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe[4144] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                        0000000075943982 5 bytes JMP 00000001002403fc
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe[4144] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                      0000000075947603 5 bytes JMP 0000000100240804
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe[4144] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                      000000007594835c 5 bytes JMP 0000000100240600
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe[4144] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                    000000007595f52b 5 bytes JMP 0000000100240a08
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe[4144] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                              00000000776a5181 5 bytes JMP 0000000100251014
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe[4144] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                  00000000776a5254 5 bytes JMP 0000000100250804
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe[4144] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                  00000000776a53d5 5 bytes JMP 0000000100250a08
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe[4144] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                00000000776a54c2 5 bytes JMP 0000000100250c0c
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe[4144] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                00000000776a55e2 5 bytes JMP 0000000100250e10
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe[4144] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                        00000000776a567c 5 bytes JMP 00000001002501f8
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe[4144] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                        00000000776a589f 5 bytes JMP 00000001002503fc
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe[4144] C:\Windows\SysWOW64\sechost.dll!DeleteService                                        00000000776a5a22 5 bytes JMP 0000000100250600
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe[4224] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                        0000000077d3faa0 5 bytes JMP 0000000100030600
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe[4224] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                            0000000077d3fb38 5 bytes JMP 0000000100030804
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe[4224] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                              0000000077d3fc90 5 bytes JMP 0000000100030c0c
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe[4224] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                          0000000077d40018 5 bytes JMP 0000000100030a08
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe[4224] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                              0000000077d41900 5 bytes JMP 0000000100030e10
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe[4224] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                      0000000077d5c45a 5 bytes JMP 00000001000301f8
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe[4224] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                    0000000077d61217 5 bytes JMP 00000001000303fc
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe[4224] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                        000000007638a30a 1 byte [62]
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe[4224] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                000000007593ee09 5 bytes JMP 00000001000d01f8
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe[4224] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                0000000075943982 5 bytes JMP 00000001000d03fc
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe[4224] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                              0000000075947603 5 bytes JMP 00000001000d0804
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe[4224] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                              000000007594835c 5 bytes JMP 00000001000d0600
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe[4224] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                            000000007595f52b 5 bytes JMP 00000001000d0a08
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe[4224] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                      00000000776a5181 5 bytes JMP 00000001000e1014
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe[4224] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                          00000000776a5254 5 bytes JMP 00000001000e0804
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe[4224] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                          00000000776a53d5 5 bytes JMP 00000001000e0a08
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe[4224] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                        00000000776a54c2 5 bytes JMP 00000001000e0c0c
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe[4224] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                        00000000776a55e2 5 bytes JMP 00000001000e0e10
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe[4224] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                00000000776a567c 5 bytes JMP 00000001000e01f8
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe[4224] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                00000000776a589f 5 bytes JMP 00000001000e03fc
.text    C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe[4224] C:\Windows\SysWOW64\sechost.dll!DeleteService                                00000000776a5a22 5 bytes JMP 00000001000e0600
.text    C:\Windows\SysWOW64\ACEngSvr.exe[4844] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                              0000000077d3faa0 5 bytes JMP 0000000100030600
.text    C:\Windows\SysWOW64\ACEngSvr.exe[4844] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                  0000000077d3fb38 5 bytes JMP 0000000100030804
.text    C:\Windows\SysWOW64\ACEngSvr.exe[4844] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                                  0000000077d3fc90 5 bytes JMP 0000000100030c0c
.text    C:\Windows\SysWOW64\ACEngSvr.exe[4844] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                              0000000077d40018 5 bytes JMP 0000000100030a08
.text    C:\Windows\SysWOW64\ACEngSvr.exe[4844] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                                  0000000077d41900 5 bytes JMP 0000000100030e10
.text    C:\Windows\SysWOW64\ACEngSvr.exe[4844] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                                          0000000077d5c45a 5 bytes JMP 00000001000301f8
.text    C:\Windows\SysWOW64\ACEngSvr.exe[4844] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                                                        0000000077d61217 5 bytes JMP 00000001000303fc
.text    C:\Windows\SysWOW64\ACEngSvr.exe[4844] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                                              000000007638a30a 1 byte [62]
.text    C:\Windows\SysWOW64\ACEngSvr.exe[4844] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                                          00000000776a5181 5 bytes JMP 0000000100231014
.text    C:\Windows\SysWOW64\ACEngSvr.exe[4844] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                                              00000000776a5254 5 bytes JMP 0000000100230804
.text    C:\Windows\SysWOW64\ACEngSvr.exe[4844] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                                              00000000776a53d5 5 bytes JMP 0000000100230a08
.text    C:\Windows\SysWOW64\ACEngSvr.exe[4844] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                                              00000000776a54c2 5 bytes JMP 0000000100230c0c
.text    C:\Windows\SysWOW64\ACEngSvr.exe[4844] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                                              00000000776a55e2 5 bytes JMP 0000000100230e10
.text    C:\Windows\SysWOW64\ACEngSvr.exe[4844] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                                                    00000000776a567c 5 bytes JMP 00000001002301f8
.text    C:\Windows\SysWOW64\ACEngSvr.exe[4844] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                                                    00000000776a589f 5 bytes JMP 00000001002303fc
.text    C:\Windows\SysWOW64\ACEngSvr.exe[4844] C:\Windows\SysWOW64\sechost.dll!DeleteService                                                                      00000000776a5a22 5 bytes JMP 0000000100230600
.text    C:\Windows\SysWOW64\ACEngSvr.exe[4844] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                                                    000000007593ee09 5 bytes JMP 00000001002c01f8
.text    C:\Windows\SysWOW64\ACEngSvr.exe[4844] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                                                      0000000075943982 5 bytes JMP 00000001002c03fc
.text    C:\Windows\SysWOW64\ACEngSvr.exe[4844] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                                                  0000000075947603 5 bytes JMP 00000001002c0804
.text    C:\Windows\SysWOW64\ACEngSvr.exe[4844] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                                                  000000007594835c 5 bytes JMP 00000001002c0600
.text    C:\Windows\SysWOW64\ACEngSvr.exe[4844] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                                                000000007595f52b 5 bytes JMP 00000001002c0a08
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[3384] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                0000000077d3faa0 5 bytes JMP 0000000100030600
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[3384] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                    0000000077d3fb38 5 bytes JMP 0000000100030804
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[3384] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                    0000000077d3fc90 5 bytes JMP 0000000100030c0c
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[3384] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                0000000077d40018 5 bytes JMP 0000000100030a08
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[3384] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                    0000000077d41900 5 bytes JMP 0000000100030e10
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[3384] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                            0000000077d5c45a 5 bytes JMP 00000001000301f8
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[3384] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                          0000000077d61217 5 bytes JMP 00000001000303fc
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[3384] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                000000007638a30a 1 byte [62]
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[3384] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                      000000007593ee09 5 bytes JMP 00000001002401f8
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[3384] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                        0000000075943982 5 bytes JMP 00000001002403fc
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[3384] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                    0000000075947603 5 bytes JMP 0000000100240804
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[3384] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                    000000007594835c 5 bytes JMP 0000000100240600
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[3384] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                  000000007595f52b 5 bytes JMP 0000000100240a08
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[3384] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                            00000000776a5181 5 bytes JMP 0000000100251014
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[3384] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                00000000776a5254 5 bytes JMP 0000000100250804
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[3384] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                00000000776a53d5 5 bytes JMP 0000000100250a08
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[3384] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                00000000776a54c2 5 bytes JMP 0000000100250c0c
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[3384] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                00000000776a55e2 5 bytes JMP 0000000100250e10
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[3384] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                      00000000776a567c 5 bytes JMP 00000001002501f8
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[3384] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                      00000000776a589f 5 bytes JMP 00000001002503fc
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe[3384] C:\Windows\SysWOW64\sechost.dll!DeleteService                                        00000000776a5a22 5 bytes JMP 0000000100250600
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe[5160] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                    0000000077d3faa0 5 bytes JMP 0000000100030600
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe[5160] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                        0000000077d3fb38 5 bytes JMP 0000000100030804
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe[5160] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                        0000000077d3fc90 5 bytes JMP 0000000100030c0c
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe[5160] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                    0000000077d40018 5 bytes JMP 0000000100030a08
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe[5160] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                        0000000077d41900 5 bytes JMP 0000000100030e10
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe[5160] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                0000000077d5c45a 5 bytes JMP 00000001000301f8
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe[5160] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                              0000000077d61217 5 bytes JMP 00000001000303fc
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe[5160] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                    000000007638a30a 1 byte [62]
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe[5160] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                          000000007593ee09 5 bytes JMP 00000001002401f8
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe[5160] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                            0000000075943982 5 bytes JMP 00000001002403fc
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe[5160] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                        0000000075947603 5 bytes JMP 0000000100240804
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe[5160] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                        000000007594835c 5 bytes JMP 0000000100240600
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe[5160] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                      000000007595f52b 5 bytes JMP 0000000100240a08
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe[5160] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                00000000776a5181 5 bytes JMP 0000000100251014
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe[5160] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                    00000000776a5254 5 bytes JMP 0000000100250804
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe[5160] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                    00000000776a53d5 5 bytes JMP 0000000100250a08
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe[5160] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                    00000000776a54c2 5 bytes JMP 0000000100250c0c
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe[5160] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                    00000000776a55e2 5 bytes JMP 0000000100250e10
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe[5160] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                          00000000776a567c 5 bytes JMP 00000001002501f8
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe[5160] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                          00000000776a589f 5 bytes JMP 00000001002503fc
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe[5160] C:\Windows\SysWOW64\sechost.dll!DeleteService                                            00000000776a5a22 5 bytes JMP 0000000100250600
.text    C:\Program Files\Windows Media Player\wmpnetwk.exe[5568] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                            0000000077a7eecd 1 byte [62]
.text    C:\Windows\System32\svchost.exe[5744] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                          0000000077b63ae0 5 bytes JMP 000000010038075c
.text    C:\Windows\System32\svchost.exe[5744] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                            0000000077b67a90 5 bytes JMP 00000001003803a4
.text    C:\Windows\System32\svchost.exe[5744] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              0000000077b91490 5 bytes JMP 0000000100380b14
.text    C:\Windows\System32\svchost.exe[5744] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  0000000077b914f0 5 bytes JMP 0000000100380ecc
.text    C:\Windows\System32\svchost.exe[5744] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                    0000000077b915d0 5 bytes JMP 000000010038163c
.text    C:\Windows\System32\svchost.exe[5744] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                0000000077b91810 5 bytes JMP 0000000100381284
.text    C:\Windows\System32\svchost.exe[5744] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                    0000000077b92840 5 bytes JMP 00000001003819f4
.text    C:\Windows\System32\svchost.exe[5744] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                              0000000077a7eecd 1 byte [62]
.text    C:\Windows\System32\svchost.exe[5744] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                            000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Windows\System32\svchost.exe[5744] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Windows\System32\svchost.exe[5744] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Windows\System32\svchost.exe[5744] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                              000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Windows\System32\svchost.exe[5744] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                              000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Windows\System32\svchost.exe[5744] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                      000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Windows\System32\svchost.exe[5744] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                      000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Windows\System32\svchost.exe[5744] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                      000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Program Files\iPod\bin\iPodService.exe[6032] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                0000000077b63ae0 5 bytes JMP 000000010031075c
.text    C:\Program Files\iPod\bin\iPodService.exe[6032] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                  0000000077b67a90 5 bytes JMP 00000001003103a4
.text    C:\Program Files\iPod\bin\iPodService.exe[6032] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                    0000000077b91490 5 bytes JMP 0000000100310b14
.text    C:\Program Files\iPod\bin\iPodService.exe[6032] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                        0000000077b914f0 5 bytes JMP 0000000100310ecc
.text    C:\Program Files\iPod\bin\iPodService.exe[6032] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                          0000000077b915d0 5 bytes JMP 000000010031163c
.text    C:\Program Files\iPod\bin\iPodService.exe[6032] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                      0000000077b91810 5 bytes JMP 0000000100311284
.text    C:\Program Files\iPod\bin\iPodService.exe[6032] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                          0000000077b92840 5 bytes JMP 00000001003119f4
.text    C:\Program Files\iPod\bin\iPodService.exe[6032] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                    0000000077a7eecd 1 byte [62]
.text    C:\Program Files\iPod\bin\iPodService.exe[6032] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                  000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Program Files\iPod\bin\iPodService.exe[6032] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                      000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Program Files\iPod\bin\iPodService.exe[6032] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                      000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Program Files\iPod\bin\iPodService.exe[6032] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                    000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Program Files\iPod\bin\iPodService.exe[6032] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                    000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Program Files\iPod\bin\iPodService.exe[6032] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                            000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Program Files\iPod\bin\iPodService.exe[6032] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                            000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Program Files\iPod\bin\iPodService.exe[6032] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                            000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Windows\system32\DllHost.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                          0000000077b63ae0 5 bytes JMP 000000010024075c
.text    C:\Windows\system32\DllHost.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                            0000000077b67a90 5 bytes JMP 00000001002403a4
.text    C:\Windows\system32\DllHost.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              0000000077b91490 5 bytes JMP 0000000100240b14
.text    C:\Windows\system32\DllHost.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  0000000077b914f0 5 bytes JMP 0000000100240ecc
.text    C:\Windows\system32\DllHost.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                    0000000077b915d0 5 bytes JMP 000000010024163c
.text    C:\Windows\system32\DllHost.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                0000000077b91810 5 bytes JMP 0000000100241284
.text    C:\Windows\system32\DllHost.exe[6648] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                    0000000077b92840 5 bytes JMP 00000001002419f4
.text    C:\Windows\system32\DllHost.exe[6648] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                              0000000077a7eecd 1 byte [62]
.text    C:\Windows\system32\DllHost.exe[6648] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                            000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Windows\system32\DllHost.exe[6648] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Windows\system32\DllHost.exe[6648] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Windows\system32\DllHost.exe[6648] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                              000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Windows\system32\DllHost.exe[6648] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                              000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Windows\system32\DllHost.exe[6648] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                      000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Windows\system32\DllHost.exe[6648] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                      000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Windows\system32\DllHost.exe[6648] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                      000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[6352] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                  0000000077b63ae0 5 bytes JMP 000000010010075c
.text    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[6352] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                    0000000077b67a90 5 bytes JMP 00000001001003a4
.text    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[6352] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                      0000000077b91490 5 bytes JMP 0000000100100b14
.text    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[6352] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                          0000000077b914f0 5 bytes JMP 0000000100100ecc
.text    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[6352] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                            0000000077b915d0 5 bytes JMP 000000010010163c
.text    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[6352] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                        0000000077b91810 5 bytes JMP 0000000100101284
.text    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[6352] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                            0000000077b92840 5 bytes JMP 00000001001019f4
.text    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[6352] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                      0000000077a7eecd 1 byte [62]
.text    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[6352] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                    000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[6352] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                        000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[6352] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                        000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[6352] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                      000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[6352] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                      000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[6352] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                              000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[6352] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                              000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[6352] C:\Windows\SYSTEM32\sechost.dll!DeleteService                              000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6640] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                0000000077d3faa0 5 bytes JMP 0000000100030600
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6640] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                    0000000077d3fb38 5 bytes JMP 0000000100030804
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6640] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                    0000000077d3fc90 5 bytes JMP 0000000100030c0c
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6640] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                0000000077d40018 5 bytes JMP 0000000100030a08
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6640] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                    0000000077d41900 5 bytes JMP 0000000100030e10
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6640] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                            0000000077d5c45a 5 bytes JMP 00000001000301f8
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6640] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                          0000000077d61217 5 bytes JMP 00000001000303fc
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6640] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                000000007638a30a 1 byte [62]
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6640] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity            00000000776a5181 5 bytes JMP 0000000100241014
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6640] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                00000000776a5254 5 bytes JMP 0000000100240804
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6640] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                00000000776a53d5 5 bytes JMP 0000000100240a08
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6640] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                00000000776a54c2 5 bytes JMP 0000000100240c0c
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6640] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                00000000776a55e2 5 bytes JMP 0000000100240e10
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6640] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                      00000000776a567c 5 bytes JMP 00000001002401f8
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6640] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                      00000000776a589f 5 bytes JMP 00000001002403fc
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6640] C:\Windows\SysWOW64\sechost.dll!DeleteService                        00000000776a5a22 5 bytes JMP 0000000100240600
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6640] C:\Windows\syswow64\USER32.dll!SetWinEventHook                      000000007593ee09 5 bytes JMP 00000001002501f8
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6640] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                        0000000075943982 5 bytes JMP 00000001002503fc
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6640] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                    0000000075947603 5 bytes JMP 0000000100250804
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6640] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                    000000007594835c 5 bytes JMP 0000000100250600
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6640] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                  000000007595f52b 5 bytes JMP 0000000100250a08
.text    C:\Windows\System32\svchost.exe[6736] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                            000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Windows\System32\svchost.exe[6736] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Windows\System32\svchost.exe[6736] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Windows\System32\svchost.exe[6736] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                              000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Windows\System32\svchost.exe[6736] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                              000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Windows\System32\svchost.exe[6736] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                      000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Windows\System32\svchost.exe[6736] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                      000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Windows\System32\svchost.exe[6736] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                      000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Windows\System32\svchost.exe[6736] C:\Windows\system32\USER32.dll!UnhookWinEvent                                                                      0000000077928550 5 bytes JMP 000000010046075c
.text    C:\Windows\System32\svchost.exe[6736] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx                                                                  000000007792d440 5 bytes JMP 0000000100461284
.text    C:\Windows\System32\svchost.exe[6736] C:\Windows\system32\USER32.dll!SetWindowsHookExW                                                                    000000007792f874 5 bytes JMP 0000000100460ecc
.text    C:\Windows\System32\svchost.exe[6736] C:\Windows\system32\USER32.dll!SetWinEventHook                                                                      0000000077934d4c 5 bytes JMP 00000001004603a4
.text    C:\Windows\System32\svchost.exe[6736] C:\Windows\system32\USER32.dll!SetWindowsHookExA                                                                    0000000077948c20 5 bytes JMP 0000000100460b14
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1384] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                0000000077d3faa0 5 bytes JMP 0000000100030600
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1384] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                    0000000077d3fb38 5 bytes JMP 0000000100030804
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1384] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                    0000000077d3fc90 5 bytes JMP 0000000100030c0c
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1384] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                0000000077d40018 5 bytes JMP 0000000100030a08
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1384] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                    0000000077d41900 5 bytes JMP 0000000100030e10
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1384] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                            0000000077d5c45a 5 bytes JMP 00000001000301f8
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1384] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                          0000000077d61217 5 bytes JMP 00000001000303fc
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1384] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                000000007638a30a 1 byte [62]
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1384] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity            00000000776a5181 5 bytes JMP 0000000100241014
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1384] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                00000000776a5254 5 bytes JMP 0000000100240804
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1384] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                00000000776a53d5 5 bytes JMP 0000000100240a08
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1384] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                00000000776a54c2 5 bytes JMP 0000000100240c0c
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1384] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                00000000776a55e2 5 bytes JMP 0000000100240e10
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1384] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                      00000000776a567c 5 bytes JMP 00000001002401f8
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1384] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                      00000000776a589f 5 bytes JMP 00000001002403fc
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1384] C:\Windows\SysWOW64\sechost.dll!DeleteService                        00000000776a5a22 5 bytes JMP 0000000100240600
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1384] C:\Windows\syswow64\USER32.dll!SetWinEventHook                      000000007593ee09 5 bytes JMP 00000001002d01f8
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1384] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                        0000000075943982 5 bytes JMP 00000001002d03fc
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1384] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                    0000000075947603 5 bytes JMP 00000001002d0804
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1384] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                    000000007594835c 5 bytes JMP 00000001002d0600
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1384] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                  000000007595f52b 5 bytes JMP 00000001002d0a08
.text    C:\Windows\system32\wuauclt.exe[6056] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                          0000000077b63ae0 5 bytes JMP 000000010029075c
.text    C:\Windows\system32\wuauclt.exe[6056] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                            0000000077b67a90 5 bytes JMP 00000001002903a4
.text    C:\Windows\system32\wuauclt.exe[6056] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              0000000077b91490 5 bytes JMP 0000000100290b14
.text    C:\Windows\system32\wuauclt.exe[6056] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  0000000077b914f0 5 bytes JMP 0000000100290ecc
.text    C:\Windows\system32\wuauclt.exe[6056] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                    0000000077b915d0 5 bytes JMP 000000010029163c
.text    C:\Windows\system32\wuauclt.exe[6056] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                0000000077b91810 5 bytes JMP 0000000100291284
.text    C:\Windows\system32\wuauclt.exe[6056] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                    0000000077b92840 5 bytes JMP 00000001002919f4
.text    C:\Windows\system32\wuauclt.exe[6056] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                              0000000077a7eecd 1 byte [62]
.text    C:\Windows\system32\wuauclt.exe[6056] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                            000007fefe4a6e00 5 bytes JMP 000007ff7e4c1dac
.text    C:\Windows\system32\wuauclt.exe[6056] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                000007fefe4a6f2c 5 bytes JMP 000007ff7e4c0ecc
.text    C:\Windows\system32\wuauclt.exe[6056] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                000007fefe4a7220 5 bytes JMP 000007ff7e4c1284
.text    C:\Windows\system32\wuauclt.exe[6056] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                              000007fefe4a739c 5 bytes JMP 000007ff7e4c163c
.text    C:\Windows\system32\wuauclt.exe[6056] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                              000007fefe4a7538 5 bytes JMP 000007ff7e4c19f4
.text    C:\Windows\system32\wuauclt.exe[6056] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                      000007fefe4a75e8 5 bytes JMP 000007ff7e4c03a4
.text    C:\Windows\system32\wuauclt.exe[6056] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                      000007fefe4a790c 5 bytes JMP 000007ff7e4c075c
.text    C:\Windows\system32\wuauclt.exe[6056] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                      000007fefe4a7ab4 5 bytes JMP 000007ff7e4c0b14
.text    C:\Windows\system32\AUDIODG.EXE[7448] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189                                                              0000000077a7eecd 1 byte [62]
.text    C:\Users\Ann-Kristin.B\Downloads\gmer_2.1.19163.exe[3628] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                          0000000077d3faa0 5 bytes JMP 0000000100030600
.text    C:\Users\Ann-Kristin.B\Downloads\gmer_2.1.19163.exe[3628] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                              0000000077d3fb38 5 bytes JMP 0000000100030804
.text    C:\Users\Ann-Kristin.B\Downloads\gmer_2.1.19163.exe[3628] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                0000000077d3fc90 5 bytes JMP 0000000100030c0c
.text    C:\Users\Ann-Kristin.B\Downloads\gmer_2.1.19163.exe[3628] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                            0000000077d40018 5 bytes JMP 0000000100030a08
.text    C:\Users\Ann-Kristin.B\Downloads\gmer_2.1.19163.exe[3628] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                0000000077d41900 5 bytes JMP 0000000100030e10
.text    C:\Users\Ann-Kristin.B\Downloads\gmer_2.1.19163.exe[3628] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                        0000000077d5c45a 5 bytes JMP 00000001000301f8
.text    C:\Users\Ann-Kristin.B\Downloads\gmer_2.1.19163.exe[3628] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                                      0000000077d61217 5 bytes JMP 00000001000303fc
.text    C:\Users\Ann-Kristin.B\Downloads\gmer_2.1.19163.exe[3628] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                          000000007638a30a 1 byte [62]
.text    C:\Users\Ann-Kristin.B\Downloads\gmer_2.1.19163.exe[3628] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                        00000000776a5181 5 bytes JMP 0000000100241014
.text    C:\Users\Ann-Kristin.B\Downloads\gmer_2.1.19163.exe[3628] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                            00000000776a5254 5 bytes JMP 0000000100240804
.text    C:\Users\Ann-Kristin.B\Downloads\gmer_2.1.19163.exe[3628] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                            00000000776a53d5 5 bytes JMP 0000000100240a08
.text    C:\Users\Ann-Kristin.B\Downloads\gmer_2.1.19163.exe[3628] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                          00000000776a54c2 5 bytes JMP 0000000100240c0c
.text    C:\Users\Ann-Kristin.B\Downloads\gmer_2.1.19163.exe[3628] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                          00000000776a55e2 5 bytes JMP 0000000100240e10
.text    C:\Users\Ann-Kristin.B\Downloads\gmer_2.1.19163.exe[3628] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                                  00000000776a567c 5 bytes JMP 00000001002401f8
.text    C:\Users\Ann-Kristin.B\Downloads\gmer_2.1.19163.exe[3628] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                                  00000000776a589f 5 bytes JMP 00000001002403fc
.text    C:\Users\Ann-Kristin.B\Downloads\gmer_2.1.19163.exe[3628] C:\Windows\SysWOW64\sechost.dll!DeleteService                                                  00000000776a5a22 5 bytes JMP 0000000100240600
.text    C:\Users\Ann-Kristin.B\Downloads\gmer_2.1.19163.exe[3628] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                                  000000007593ee09 5 bytes JMP 00000001002501f8
.text    C:\Users\Ann-Kristin.B\Downloads\gmer_2.1.19163.exe[3628] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                                  0000000075943982 5 bytes JMP 00000001002503fc
.text    C:\Users\Ann-Kristin.B\Downloads\gmer_2.1.19163.exe[3628] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                                0000000075947603 5 bytes JMP 0000000100250804
.text    C:\Users\Ann-Kristin.B\Downloads\gmer_2.1.19163.exe[3628] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                                000000007594835c 5 bytes JMP 0000000100250600
.text    C:\Users\Ann-Kristin.B\Downloads\gmer_2.1.19163.exe[3628] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                              000000007595f52b 5 bytes JMP 0000000100250a08

---- Threads - GMER 2.1 ----

Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [5568:3172]                                                                                            000007fefe860168
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [5568:5148]                                                                                            000007fefbe22a7c
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [5568:4280]                                                                                            000007fef1f1d618
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [5568:6192]                                                                                            000007fef9135124
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [5568:6320]                                                                                            000007fef1eb9730
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [5568:6328]                                                                                            000007fef1f1d618
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [5568:3668]                                                                                            000007fefe860168
Thread    C:\Windows\System32\svchost.exe [6736:1168]                                                                                                              000007fef5309688

---- Registry - GMER 2.1 ----

Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Type                                                                                                      2
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Start                                                                                                    2
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@ErrorControl                                                                                              1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DisplayName                                                                                              aswFsBlk
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Group                                                                                                    FSFilter Activity Monitor
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DependOnService                                                                                          FltMgr?
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Description                                                                                              avast! mini-filter driver (aswFsBlk)
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Tag                                                                                                      2
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances                                                                                               
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances@DefaultInstance                                                                                aswFsBlk Instance
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance                                                                             
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude                                                                      388400
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Flags                                                                        0
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk                                                                                                         
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Type                                                                                                    2
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Start                                                                                                    2
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ErrorControl                                                                                            1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ImagePath                                                                                                \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DisplayName                                                                                              aswMonFlt
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Group                                                                                                    FSFilter Anti-Virus
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DependOnService                                                                                          FltMgr?
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Description                                                                                              avast! mini-filter driver (aswMonFlt)
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances                                                                                               
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances@DefaultInstance                                                                                aswMonFlt Instance
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance                                                                           
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude                                                                    320700
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Flags                                                                      0
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt                                                                                                         
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ImagePath                                                                                                  \SystemRoot\System32\Drivers\aswrdr2.sys
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Type                                                                                                        1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Start                                                                                                      1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ErrorControl                                                                                                1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DisplayName                                                                                                aswRdr
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Group                                                                                                      PNP_TDI
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DependOnService                                                                                            tcpip?
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Description                                                                                                avast! WFP Redirect driver
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters                                                                                                 
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@MSIgnoreLSPDefault                                                                             
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@WSIgnoreLSPDefault                                                                              nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr                                                                                                           
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Type                                                                                                      1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Start                                                                                                      0
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@ErrorControl                                                                                              1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@DisplayName                                                                                                aswRvrt
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Description                                                                                                avast! Revert
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters                                                                                               
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@BootCounter                                                                                    7
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@TickCounter                                                                                    352673
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@SystemRoot                                                                                      \Device\Harddisk0\Partition1\Windows
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@ImproperShutdown                                                                                1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt                                                                                                           
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Type                                                                                                        2
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Start                                                                                                      1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx@ErrorControl                                                                                                1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DisplayName                                                                                                aswSnx
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Group                                                                                                      FSFilter Virtualization
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DependOnService                                                                                            FltMgr?
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Description                                                                                                avast! virtualization driver (aswSnx)
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Tag                                                                                                        2
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances                                                                                                 
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances@DefaultInstance                                                                                  aswSnx Instance
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance                                                                                 
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Altitude                                                                          137600
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Flags                                                                            0
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters                                                                                                 
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@ProgramFolder                                                                                    \DosDevices\C:\Program Files\AVAST Software\Avast
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@DataFolder                                                                                      \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx                                                                                                           
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP@Type                                                                                                        1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP@Start                                                                                                        1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP@ErrorControl                                                                                                1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP@DisplayName                                                                                                  aswSP
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP@Description                                                                                                  avast! Self Protection
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters                                                                                                 
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@BehavShield                                                                                      1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFolder                                                                                    \DosDevices\C:\Program Files\AVAST Software\Avast
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@DataFolder                                                                                        \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFilesFolder                                                                                \DosDevices\C:\Program Files
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@GadgetFolder                                                                                      \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP                                                                                                             
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Type                                                                                                        1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Start                                                                                                      1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswTdi@ErrorControl                                                                                                1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DisplayName                                                                                                avast! Network Shield Support
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Group                                                                                                      PNP_TDI
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DependOnService                                                                                            tcpip?
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Description                                                                                                avast! Network Shield TDI driver
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Tag                                                                                                        10
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswTdi                                                                                                           
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Type                                                                                                        1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Start                                                                                                      0
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswVmm@ErrorControl                                                                                                1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswVmm@DisplayName                                                                                                aswVmm
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Description                                                                                                avast! VM Monitor
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswVmm\Parameters                                                                                                 
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswVmm                                                                                                           
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Type                                                                                              32
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Start                                                                                            2
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ErrorControl                                                                                      1
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ImagePath                                                                                        "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DisplayName                                                                                      avast! Antivirus
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Group                                                                                            ShellSvcGroup
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DependOnService                                                                                  aswMonFlt?RpcSS?
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@WOW64                                                                                            1
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ObjectName                                                                                        LocalSystem
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ServiceSidType                                                                                    1
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Description                                                                                      Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus                                                                                                 
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Type                                                                                                          2
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Start                                                                                                        2
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk@ErrorControl                                                                                                  1
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DisplayName                                                                                                  aswFsBlk
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Group                                                                                                        FSFilter Activity Monitor
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DependOnService                                                                                              FltMgr?
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Description                                                                                                  avast! mini-filter driver (aswFsBlk)
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Tag                                                                                                          2
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances (not active ControlSet)                                                                           
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances@DefaultInstance                                                                                    aswFsBlk Instance
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance (not active ControlSet)                                                         
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude                                                                          388400
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Flags                                                                            0
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Type                                                                                                        2
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Start                                                                                                        2
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ErrorControl                                                                                                1
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ImagePath                                                                                                    \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DisplayName                                                                                                  aswMonFlt
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Group                                                                                                        FSFilter Anti-Virus
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DependOnService                                                                                              FltMgr?
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Description                                                                                                  avast! mini-filter driver (aswMonFlt)
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances (not active ControlSet)                                                                           
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances@DefaultInstance                                                                                    aswMonFlt Instance
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance (not active ControlSet)                                                       
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude                                                                        320700
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Flags                                                                          0
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr@ImagePath                                                                                                      \SystemRoot\System32\Drivers\aswrdr2.sys
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr@Type                                                                                                            1
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr@Start                                                                                                          1
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr@ErrorControl                                                                                                    1
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr@DisplayName                                                                                                    aswRdr
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr@Group                                                                                                          PNP_TDI
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr@DependOnService                                                                                                tcpip?
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr@Description                                                                                                    avast! WFP Redirect driver
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters (not active ControlSet)                                                                             
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@MSIgnoreLSPDefault                                                                                 
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@WSIgnoreLSPDefault                                                                                  nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt@Type                                                                                                          1
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt@Start                                                                                                          0
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt@ErrorControl                                                                                                  1
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt@DisplayName                                                                                                    aswRvrt
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt@Description                                                                                                    avast! Revert
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters (not active ControlSet)                                                                           
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@BootCounter                                                                                        7
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@TickCounter                                                                                        352673
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@SystemRoot                                                                                          \Device\Harddisk0\Partition1\Windows
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@ImproperShutdown                                                                                    1
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx@Type                                                                                                            2
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx@Start                                                                                                          1
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx@ErrorControl                                                                                                    1
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx@DisplayName                                                                                                    aswSnx
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx@Group                                                                                                          FSFilter Virtualization
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx@DependOnService                                                                                                FltMgr?
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx@Description                                                                                                    avast! virtualization driver (aswSnx)
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx@Tag                                                                                                            2
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances (not active ControlSet)                                                                             
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances@DefaultInstance                                                                                      aswSnx Instance
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance (not active ControlSet)                                                             
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Altitude                                                                              137600
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Flags                                                                                0
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters (not active ControlSet)                                                                             
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@ProgramFolder                                                                                        \DosDevices\C:\Program Files\AVAST Software\Avast
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@DataFolder                                                                                          \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP@Type                                                                                                            1
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP@Start                                                                                                            1
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP@ErrorControl                                                                                                    1
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP@DisplayName                                                                                                      aswSP
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP@Description                                                                                                      avast! Self Protection
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters (not active ControlSet)                                                                             
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@BehavShield                                                                                          1
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFolder                                                                                        \DosDevices\C:\Program Files\AVAST Software\Avast
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@DataFolder                                                                                            \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFilesFolder                                                                                    \DosDevices\C:\Program Files
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@GadgetFolder                                                                                          \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg      HKLM\SYSTEM\ControlSet002\services\aswTdi@Type                                                                                                            1
Reg      HKLM\SYSTEM\ControlSet002\services\aswTdi@Start                                                                                                          1
Reg      HKLM\SYSTEM\ControlSet002\services\aswTdi@ErrorControl                                                                                                    1
Reg      HKLM\SYSTEM\ControlSet002\services\aswTdi@DisplayName                                                                                                    avast! Network Shield Support
Reg      HKLM\SYSTEM\ControlSet002\services\aswTdi@Group                                                                                                          PNP_TDI
Reg      HKLM\SYSTEM\ControlSet002\services\aswTdi@DependOnService                                                                                                tcpip?
Reg      HKLM\SYSTEM\ControlSet002\services\aswTdi@Description                                                                                                    avast! Network Shield TDI driver
Reg      HKLM\SYSTEM\ControlSet002\services\aswTdi@Tag                                                                                                            10
Reg      HKLM\SYSTEM\ControlSet002\services\aswVmm@Type                                                                                                            1
Reg      HKLM\SYSTEM\ControlSet002\services\aswVmm@Start                                                                                                          0
Reg      HKLM\SYSTEM\ControlSet002\services\aswVmm@ErrorControl                                                                                                    1
Reg      HKLM\SYSTEM\ControlSet002\services\aswVmm@DisplayName                                                                                                    aswVmm
Reg      HKLM\SYSTEM\ControlSet002\services\aswVmm@Description                                                                                                    avast! VM Monitor
Reg      HKLM\SYSTEM\ControlSet002\services\aswVmm\Parameters (not active ControlSet)                                                                             
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Type                                                                                                  32
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Start                                                                                                2
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ErrorControl                                                                                          1
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ImagePath                                                                                            "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DisplayName                                                                                          avast! Antivirus
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Group                                                                                                ShellSvcGroup
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DependOnService                                                                                      aswMonFlt?RpcSS?
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@WOW64                                                                                                1
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ObjectName                                                                                            LocalSystem
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ServiceSidType                                                                                        1
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Description                                                                                          Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.

---- EOF - GMER 2.1 ----
Ich muss mich korrigieren.
Habe die Logfile vom Defoger übersehen, hier ist sie.

Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:58 on 23/05/2013 (Ann-Kristin.B)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
Sorry und danke!

M-K-D-B 23.05.2013 16:07
Servus,





Schritt 1
Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.






AdwCleaner bitte zweimal hintereinander ausführen und beide Logdateien davon posten!

Schritt 2
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).





Schritt 3

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.






Bitte poste mit deiner nächsten Antwort
  • die Logdatei von ComboFix,
  • die beiden Logdateien von AdwCleaner,
  • die Logdatei von JRT.

painfiller 23.05.2013 21:41
So, das war eine Prozedur, aber ich denke es hat geholfen.
Hier die Logs:

Combofix:
Code:
ComboFix 13-05-23.02 - Ann-Kristin.B 23.05.2013  19:40:51.1.4 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.3999.2241 [GMT 2:00]
ausgeführt von:: c:\users\Ann-Kristin.B\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AV: Trend Micro Titanium Internet Security *Disabled/Updated* {68F968AC-2AA0-091D-848C-803E83E35902}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Trend Micro Titanium Internet Security *Disabled/Updated* {D3988948-0C9A-0693-BE3C-BB4CF86413BF}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
ADS - Windows: deleted 0 bytes in 1 streams.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\SpeedAnalysis.com\ScRIpthost.dll
c:\programdata\FullRemove.exe
c:\windows\SysWow64\pt
c:\windows\SysWow64\pt\AuthFWSnapIn.Resources.dll
c:\windows\SysWow64\pt\AuthFWWizFwk.Resources.dll
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-04-23 bis 2013-05-23  ))))))))))))))))))))))))))))))
.
.
2013-05-23 18:27 . 2013-05-23 18:27        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-05-23 17:33 . 2013-05-23 17:33        76232        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{75B4D103-4844-49D0-BB38-53C5FCD1B533}\offreg.dll
2013-05-23 16:57 . 2013-05-23 16:57        --------        d-----w-        c:\program files (x86)\TeamViewer
2013-05-21 08:14 . 2013-05-13 06:37        9460464        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{75B4D103-4844-49D0-BB38-53C5FCD1B533}\mpengine.dll
2013-05-20 09:02 . 2013-05-20 12:09        --------        d-----w-        c:\users\Ann-Kristin.B\AppData\Roaming\PersBackup5
2013-05-20 09:02 . 2013-05-20 09:02        --------        d-----w-        c:\program files\Personal Backup 5
2013-05-20 09:01 . 2013-05-20 09:01        --------        d-----w-        c:\users\Ann-Kristin.B\AppData\Local\Programs
2013-05-17 18:54 . 2013-04-05 06:50        3958784        ----a-w-        c:\windows\system32\jscript9.dll
2013-05-17 18:54 . 2013-04-05 05:26        2877440        ----a-w-        c:\windows\SysWow64\jscript9.dll
2013-05-17 18:54 . 2013-04-05 06:52        1084928        ----a-w-        c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2013-05-17 18:54 . 2013-04-05 05:28        817664        ----a-w-        c:\program files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
2013-05-17 18:54 . 2013-04-05 06:50        53248        ----a-w-        c:\windows\system32\jsproxy.dll
2013-05-17 18:54 . 2013-04-05 05:28        1767424        ----a-w-        c:\windows\SysWow64\wininet.dll
2013-05-17 18:54 . 2013-04-05 06:52        2242048        ----a-w-        c:\windows\system32\wininet.dll
2013-05-17 18:54 . 2013-04-05 06:50        19231232        ----a-w-        c:\windows\system32\mshtml.dll
2013-05-17 18:54 . 2013-04-05 06:50        15404032        ----a-w-        c:\windows\system32\ieframe.dll
2013-05-16 08:24 . 2013-05-16 08:24        --------        d-----w-        c:\programdata\Gibraltar
2013-05-15 09:20 . 2013-05-15 09:20        434176        ----a-r-        c:\users\Ann-Kristin.B\AppData\Roaming\Microsoft\Installer\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}\NewShortcut21_BB44E8EFCE184CC8BAF21F23666E91E7.exe
2013-05-15 09:20 . 2013-05-15 09:20        434176        ----a-r-        c:\users\Ann-Kristin.B\AppData\Roaming\Microsoft\Installer\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}\NewShortcut2_A231A4E65E1B4B0D9C1B4A4301BC15D3.exe
2013-05-15 09:20 . 2013-05-15 09:20        434176        ----a-r-        c:\users\Ann-Kristin.B\AppData\Roaming\Microsoft\Installer\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}\ARPPRODUCTICON.exe
2013-05-15 09:16 . 2013-05-15 09:20        --------        d-----w-        c:\program files (x86)\Citavi 4
2013-05-15 09:11 . 2013-04-10 06:01        265064        ----a-w-        c:\windows\system32\drivers\dxgmms1.sys
2013-05-15 09:11 . 2013-04-10 06:01        983400        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys
2013-05-15 09:11 . 2011-02-03 11:25        144384        ----a-w-        c:\windows\system32\cdd.dll
2013-05-15 09:10 . 2013-02-27 05:52        14172672        ----a-w-        c:\windows\system32\shell32.dll
2013-05-15 09:10 . 2013-02-27 05:52        197120        ----a-w-        c:\windows\system32\shdocvw.dll
2013-05-15 09:10 . 2013-02-27 05:48        1930752        ----a-w-        c:\windows\system32\authui.dll
2013-05-15 09:10 . 2013-02-27 06:02        111448        ----a-w-        c:\windows\system32\consent.exe
2013-05-15 09:10 . 2013-02-27 05:47        70144        ----a-w-        c:\windows\system32\appinfo.dll
2013-05-15 09:10 . 2013-02-27 04:49        1796096        ----a-w-        c:\windows\SysWow64\authui.dll
2013-05-15 09:09 . 2013-03-19 05:53        48640        ----a-w-        c:\windows\system32\wwanprotdim.dll
2013-05-15 09:09 . 2013-03-19 05:53        230400        ----a-w-        c:\windows\system32\wwansvc.dll
2013-05-15 09:09 . 2013-04-10 03:30        3153920        ----a-w-        c:\windows\system32\win32k.sys
2013-05-14 15:13 . 2013-05-14 15:17        --------        d-----w-        c:\users\Ann-Kristin.B\AppData\Roaming\Swiss Academic Software
2013-05-14 14:54 . 2013-05-14 14:55        --------        d-----w-        c:\programdata\Swiss Academic Software
2013-05-14 14:47 . 2013-05-14 14:47        --------        d-----w-        c:\users\Ann-Kristin.B\AppData\Local\Downloaded Installations
2013-05-08 14:22 . 2013-05-08 14:22        --------        d-----w-        c:\programdata\Wincert
2013-05-08 14:21 . 2013-05-08 14:22        --------        d-----w-        c:\program files (x86)\Search Results Toolbar
2013-05-08 14:21 . 2013-05-08 14:21        --------        d-----w-        c:\users\Ann-Kristin.B\AppData\Local\jZip
2013-05-08 14:21 . 2013-05-23 18:29        --------        d-----w-        c:\programdata\Datamngr
2013-05-08 14:21 . 2013-05-08 14:21        --------        d-----w-        c:\program files (x86)\jZip
2013-05-01 01:09 . 2013-05-01 01:09        1054720        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe
2013-04-30 20:02 . 2012-06-22 09:01        22704        ----a-w-        c:\windows\system32\drivers\EsgScanner.sys
2013-04-30 20:02 . 2013-04-30 20:02        110080        ----a-r-        c:\users\Ann-Kristin.B\AppData\Roaming\Microsoft\Installer\{6B6C4C46-1B7E-4A41-9E70-ACFBB22B1D81}\IconF7A21AF7.exe
2013-04-30 20:02 . 2013-04-30 20:02        110080        ----a-r-        c:\users\Ann-Kristin.B\AppData\Roaming\Microsoft\Installer\{6B6C4C46-1B7E-4A41-9E70-ACFBB22B1D81}\IconD7F16134.exe
2013-04-30 20:02 . 2013-04-30 20:02        110080        ----a-r-        c:\users\Ann-Kristin.B\AppData\Roaming\Microsoft\Installer\{6B6C4C46-1B7E-4A41-9E70-ACFBB22B1D81}\Icon1226A4C5.exe
2013-04-30 20:02 . 2013-04-30 20:02        --------        d-----w-        C:\sh4ldr
2013-04-30 20:02 . 2013-04-30 20:02        --------        d-----w-        c:\program files\Enigma Software Group
2013-04-30 19:59 . 2013-04-30 20:02        --------        d-----w-        c:\windows\6B6C4C461B7E4A419E70ACFBB22B1D81.TMP
2013-04-30 09:37 . 2013-04-30 09:36        95648        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-04-30 09:35 . 2013-04-30 09:35        --------        d-----w-        c:\program files (x86)\Java
2013-04-30 08:59 . 2013-05-09 08:59        378432        ----a-w-        c:\windows\system32\drivers\aswSP.sys
2013-04-30 08:59 . 2013-05-09 08:59        33400        ----a-w-        c:\windows\system32\drivers\aswFsBlk.sys
2013-04-30 08:59 . 2013-05-09 08:59        72016        ----a-w-        c:\windows\system32\drivers\aswRdr2.sys
2013-04-30 08:59 . 2013-05-09 08:59        64288        ----a-w-        c:\windows\system32\drivers\aswTdi.sys
2013-04-30 08:43 . 2013-05-09 08:59        1025808        ----a-w-        c:\windows\system32\drivers\aswSnx.sys
2013-04-30 08:43 . 2013-05-09 08:59        189936        ----a-w-        c:\windows\system32\drivers\aswVmm.sys
2013-04-30 08:43 . 2013-05-09 08:59        65336        ----a-w-        c:\windows\system32\drivers\aswRvrt.sys
2013-04-30 08:42 . 2013-05-09 08:59        80816        ----a-w-        c:\windows\system32\drivers\aswMonFlt.sys
2013-04-30 08:42 . 2013-05-09 08:58        287840        ----a-w-        c:\windows\system32\aswBoot.exe
2013-04-30 08:42 . 2013-04-30 08:42        --------        d-----w-        c:\program files (x86)\Common Files\Wise Installation Wizard
2013-04-30 08:40 . 2013-05-09 08:58        41664        ----a-w-        c:\windows\avastSS.scr
2013-04-30 08:38 . 2013-04-30 08:38        --------        d-----w-        c:\program files\AVAST Software
2013-04-30 08:33 . 2013-04-30 08:38        --------        d-----w-        c:\programdata\AVAST Software
2013-04-30 08:21 . 2013-04-30 08:21        --------        d-----w-        c:\windows\SysWow64\searchplugins
2013-04-24 14:24 . 2013-04-12 14:45        1656680        ----a-w-        c:\windows\system32\drivers\ntfs.sys
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-17 19:49 . 2012-09-30 07:49        45056        ----a-w-        c:\windows\SysWow64\acovcnt.exe
2013-05-17 19:04 . 2012-10-20 12:52        75016696        ----a-w-        c:\windows\system32\MRT.exe
2013-05-15 08:02 . 2012-10-05 19:13        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-05-15 08:02 . 2012-10-05 19:13        692104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2013-05-14 11:15 . 2011-03-29 01:36        22240        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-02 00:06 . 2012-12-10 07:50        278800        ------w-        c:\windows\system32\MpSigStub.exe
2013-04-30 09:35 . 2012-11-08 10:29        866720        ----a-w-        c:\windows\SysWow64\npDeployJava1.dll
2013-04-30 09:35 . 2012-11-08 10:29        788896        ----a-w-        c:\windows\SysWow64\deployJava1.dll
2013-04-13 05:49 . 2013-05-15 09:11        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-15 09:11        308736        ----a-w-        c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-15 09:11        350208        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-15 09:11        111104        ----a-w-        c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-15 09:11        474624        ----a-w-        c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-15 09:11        2176512        ----a-w-        c:\windows\apppatch\AcGenral.dll
2013-03-26 15:18 . 2013-04-23 14:12        112080        ----a-r-        c:\windows\system32\drivers\acsock64.sys
2013-03-19 06:04 . 2013-04-10 10:48        5550424        ----a-w-        c:\windows\system32\ntoskrnl.exe
2013-03-19 05:46 . 2013-04-10 10:48        43520        ----a-w-        c:\windows\system32\csrsrv.dll
2013-03-19 05:04 . 2013-04-10 10:48        3968856        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-10 10:48        3913560        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47 . 2013-04-10 10:48        6656        ----a-w-        c:\windows\SysWow64\apisetschema.dll
2013-03-19 03:06 . 2013-04-10 10:48        112640        ----a-w-        c:\windows\system32\smss.exe
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{7abe12ca-e995-4ab4-9a4e-ef8820a20182}]
2012-12-05 22:54        89288        ----a-w-        c:\progra~2\SEARCH~1\Datamngr\SRTOOL~1\searchresultsDx.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{7abe12ca-e995-4ab4-9a4e-ef8820a20182}"= "c:\progra~2\SEARCH~1\Datamngr\SRTOOL~1\searchresultsDx.dll" [2012-12-05 89288]
.
[HKEY_CLASSES_ROOT\clsid\{7abe12ca-e995-4ab4-9a4e-ef8820a20182}]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        129272        ----a-w-        c:\users\Ann-Kristin.B\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        129272        ----a-w-        c:\users\Ann-Kristin.B\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        129272        ----a-w-        c:\users\Ann-Kristin.B\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spotify Web Helper"="c:\users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-05-06 1105408]
"Spotify"="c:\users\Ann-Kristin.B\AppData\Roaming\Spotify\spotify.exe" [2013-05-06 4573184]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"FLxHCIm64"="c:\program files\Fresco Logic\Fresco Logic USB3.0 Host Controller\amd64_host\FLxHCIm.exe" [2011-10-17 47616]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2011-09-09 2317312]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
.
c:\users\Ann-Kristin.B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Ann-Kristin.B\AppData\Roaming\Dropbox\bin\Dropbox.exe [2013-3-12 29106336]
Persbackup.lnk - c:\program files\Personal Backup 5\Persbackup.exe [2013-5-20 8426496]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2012-07-08 123856]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-11-09 160944]
R3 acsock;acsock;c:\windows\system32\DRIVERS\acsock64.sys [2013-03-26 112080]
R3 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe [x]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [2011-03-02 13088]
R3 EsgScanner;EsgScanner;c:\windows\system32\DRIVERS\EsgScanner.sys [2012-06-22 22704]
R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys [2009-06-10 57344]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [2013-02-05 235216]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [2009-06-10 56832]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 31232]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe [2010-11-29 149504]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2012-10-06 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 assd;assd; [x]
S0 aswRvrt;aswRvrt; [x]
S0 aswVmm;aswVmm; [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2011-09-07 17536]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-07-03 15416]
S2 ASUS InstantOn;ASUS InstantOn Service;c:\program files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe [2012-02-16 277120]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-05-09 80816]
S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2011-08-02 146592]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2011-08-02 103584]
S2 DatamngrCoordinator;Datamngr Coordinator;c:\program files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe [2013-04-28 3019264]
S2 IBUpdaterService;Updater Service;c:\programdata\IBUpdaterService\ibsvc.exe [2013-04-02 569120]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [2013-04-23 3574624]
S2 TiMiniService;TiMiniService;c:\program files\Trend Micro\Titanium\TiMiniService.exe [2010-09-17 241488]
S2 tmevtmgr;tmevtmgr;c:\windows\system32\DRIVERS\tmevtmgr.sys [2010-09-17 67664]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2010-11-29 16120]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-21 2656280]
S3 AiCharger;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiCharger.sys [2011-02-26 16768]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2011-08-02 36000]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2011-08-02 330912]
S3 btath_avdt;Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys [2011-08-02 110240]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2011-08-02 30368]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2011-08-02 167584]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2011-08-02 68256]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2011-08-02 280992]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2011-08-02 511136]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2011-10-18 198448]
S3 FLxHCIc;Fresco Logic xHCI (USB3) Device Driver;c:\windows\system32\DRIVERS\FLxHCIc.sys [2011-10-17 202496]
S3 FLxHCIh;Fresco Logic xHCI (USB3) Hub Device Driver;c:\windows\system32\DRIVERS\FLxHCIh.sys [2011-10-17 69888]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2011-11-03 317440]
S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys [2011-03-15 311400]
S3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-04-10 13:07        1642448        ----a-w-        c:\program files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-05-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-05 08:02]
.
2013-05-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-17 15:28]
.
2013-05-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-17 15:28]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-05-09 08:58        133840        ----a-w-        c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2011-05-25 07:09        227840        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2011-05-25 07:09        227840        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        162552        ----a-w-        c:\users\Ann-Kristin.B\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        162552        ----a-w-        c:\users\Ann-Kristin.B\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        162552        ----a-w-        c:\users\Ann-Kristin.B\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32        162552        ----a-w-        c:\users\Ann-Kristin.B\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VizorHtmlDialog.exe"="c:\program files\Trend Micro\Titanium\UIFramework\VizorHtmlDialog.exe" [2010-10-08 1123664]
"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2010-10-12 192520]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-02-21 12452456]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-08-02 961184]
"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-11-03 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-11-03 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-11-03 416024]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - LocalService
FontCache
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: &Citavi Picker... - file://c:\programdata\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - c:\program files (x86)\ICQ7M\ICQ.exe
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Ann-Kristin.B\AppData\Roaming\Mozilla\Firefox\Profiles\psibyyw1.default\
FF - prefs.js: browser.search.selectedEngine - Search Results
FF - prefs.js: browser.startup.homepage - hxxp://www.searchnu.com/102?appid=110
FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&gct=ds&appid=110&systemid=102&apn_dtid=BND102&apn_ptnrs=AG7&apn_uid=1556205021544236&o=APN10646&q=
FF - ExtSQL: 2013-04-30 10:41; wrc@avast.com; c:\program files\AVAST Software\Avast\WebRep\FF
FF - ExtSQL: 2013-05-08 16:22; {7abe12ca-e995-4ab4-9a4e-ef8820a20182}; c:\users\Ann-Kristin.B\AppData\Roaming\Mozilla\Firefox\Profiles\psibyyw1.default\extensions\{7abe12ca-e995-4ab4-9a4e-ef8820a20182}
FF - ExtSQL: !HIDDEN! 2013-04-02 20:38; speedanalysis@SpeedAnalysis.com; c:\users\Ann-Kristin.B\AppData\Roaming\Mozilla\Extensions\speedanalysis@SpeedAnalysis.com
FF - user.js: extensions.delta.tlbrSrchUrl -
FF - user.js: extensions.delta.id - 1ef4549b00000000000082b9a5d1bc8b
FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
FF - user.js: extensions.delta.instlDay - 15797
FF - user.js: extensions.delta.vrsn - 1.8.10.0
FF - user.js: extensions.delta.vrsni - 1.8.10.0
FF - user.js: extensions.delta.vrsnTs - 1.8.10.020:39
FF - user.js: extensions.delta.prtnrId - delta
FF - user.js: extensions.delta.prdct - delta
FF - user.js: extensions.delta.aflt - babsst
FF - user.js: extensions.delta.smplGrp - none
FF - user.js: extensions.delta.tlbrId - base
FF - user.js: extensions.delta.instlRef - sst
FF - user.js: extensions.delta.dfltLng - en
FF - user.js: extensions.delta.excTlbr - false
FF - user.js: extensions.delta.admin - false
FF - user.js: extensions.delta.autoRvrt - false
FF - user.js: extensions.delta.rvrt - false
FF - user.js: extensions.delta.newTab - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{45564571-A21B-48ED-B584-69752EEE9C3D} - c:\program files (x86)\SpeedAnalysis.com\ScriptHost.dll
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
Toolbar-10 - (no file)
HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-05-23  20:38:30
ComboFix-quarantined-files.txt  2013-05-23 18:38
.
Vor Suchlauf: 4.446.199.808 Bytes frei
Nach Suchlauf: 6.674.223.104 Bytes frei
.
- - End Of File - - 195CFBD74896647ACD12C4295B49D9C9
ADW 1:

Code:
# AdwCleaner v2.301 - Datei am 23/05/2013 um 20:55:55 erstellt
# Aktualisiert am 16/05/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Ann-Kristin.B - ANN-KRISTINB-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Ann-Kristin.B\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****

Gestoppt & Gelöscht : DatamngrCoordinator
Gestoppt & Gelöscht : IBUpdaterService
Gestoppt & Gelöscht : ICQ Service

***** [Dateien / Ordner] *****

Datei Gelöscht : C:\END
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
Datei Gelöscht : C:\Program Files (x86)\Mozilla FireFox\searchplugins\Search_Results.xml
Datei Gelöscht : C:\Users\Ann-Kristin.B\AppData\Roaming\Mozilla\Firefox\Profiles\psibyyw1.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Users\Ann-Kristin.B\AppData\Roaming\Mozilla\Firefox\Profiles\psibyyw1.default\searchplugins\delta.xml
Datei Gelöscht : C:\Users\Ann-Kristin.B\AppData\Roaming\Mozilla\Firefox\Profiles\psibyyw1.default\searchplugins\Search_Results.xml
Gelöscht mit Neustart : C:\Program Files (x86)\search results toolbar
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\Program Files (x86)\ICQ6Toolbar
Ordner Gelöscht : C:\Program Files (x86)\SpeedAnalysis.com
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\IBUpdaterService
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\Users\Ann-Kristin.B\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\Ann-Kristin.B\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Ann-Kristin.B\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\Ann-Kristin.B\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Ann-Kristin.B\AppData\Roaming\file scout
Ordner Gelöscht : C:\Users\Ann-Kristin.B\AppData\Roaming\Mozilla\Firefox\Profiles\psibyyw1.default\CT2625848
Ordner Gelöscht : C:\Users\Ann-Kristin.B\AppData\Roaming\Mozilla\Firefox\Profiles\psibyyw1.default\extensions\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}
Ordner Gelöscht : C:\Users\Ann-Kristin.B\AppData\Roaming\Mozilla\Firefox\Profiles\psibyyw1.default\extensions\{C4A4F5A0-4B89-4392-AFAC-D58010E349AF}
Ordner Gelöscht : C:\Users\Ann-Kristin.B\AppData\Roaming\Mozilla\Firefox\Profiles\psibyyw1.default\Smartbar
Ordner Gelöscht : C:\Users\Ann-Kristin.B\AppData\Roaming\PerformerSoft
Ordner Gelöscht : C:\Users\Ann-Kristin.B\AppData\Roaming\SpeedanAlysis

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\APN DTX
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\BabylonToolbar
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKCU\Software\5a5388ddb138e513
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{562B9316-C08A-444A-9482-62080DD851AE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{5D723752-5899-47E8-99B4-62C824EF9E13}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ICQ Service.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\PropertySync.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetup.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2625848
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\5a5388ddb138e513
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ICQToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Search Results Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Updater Service
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CC1AC828-BB47-4361-AFB5-96EEE259DD87}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [speedanalysis@SpeedAnalysis.com]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [DataMngr]
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [speedanalysis@SpeedAnalysis.com]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16576

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - ICQ Search] = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd --> hxxp://www.google.com

-\\ Mozilla Firefox v20.0.1 (de)

Datei : C:\Users\Ann-Kristin.B\AppData\Roaming\Mozilla\Firefox\Profiles\psibyyw1.default\prefs.js

C:\Users\Ann-Kristin.B\AppData\Roaming\Mozilla\Firefox\Profiles\psibyyw1.default\user.js ... Gelöscht !

Gelöscht : user_pref("CT2625848.1000082.isDisplayHidden", "true");
Gelöscht : user_pref("CT2625848.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description[...]
Gelöscht : user_pref("CT2625848.2625848a129894023611240511000000paramsGK1.enc", "eyJ1cGRhdGVSZXFUaW1lIjoxMzU1MD[...]
Gelöscht : user_pref("CT2625848.CBOpenMAMSettings.enc", "MA==");
Gelöscht : user_pref("CT2625848.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Gelöscht : user_pref("CT2625848.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]
Gelöscht : user_pref("CT2625848.FirstTime", "true");
Gelöscht : user_pref("CT2625848.FirstTimeFF3", "true");
Gelöscht : user_pref("CT2625848.LoginRevertSettingsEnabled", true);
Gelöscht : user_pref("CT2625848.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT262[...]
Gelöscht : user_pref("CT2625848.UserID", "UN98849297996196027");
Gelöscht : user_pref("CT2625848.addressBarTakeOverEnabledInHidden", "true");
Gelöscht : user_pref("CT2625848.autoDisableScopes", -1);
Gelöscht : user_pref("CT2625848.browser.search.defaultthis.engineName", true);
Gelöscht : user_pref("CT2625848.cbcountry_001.enc", "RlI=");
Gelöscht : user_pref("CT2625848.cbfirsttime.enc", "U3VuIERlYyAwOSAyMDEyIDE4OjA1OjQwIEdNVCswMTAw");
Gelöscht : user_pref("CT2625848.defaultSearch", "true");
Gelöscht : user_pref("CT2625848.enableAlerts", "false");
Gelöscht : user_pref("CT2625848.enableFix404ByUser", "TRUE");
Gelöscht : user_pref("CT2625848.enableSearchFromAddressBar", "true");
Gelöscht : user_pref("CT2625848.firstTimeDialogOpened", "true");
Gelöscht : user_pref("CT2625848.fixPageNotFoundError", "true");
Gelöscht : user_pref("CT2625848.fixPageNotFoundErrorByUser", "true");
Gelöscht : user_pref("CT2625848.fixPageNotFoundErrorInHidden", "true");
Gelöscht : user_pref("CT2625848.fixUrls", true);
Gelöscht : user_pref("CT2625848.installId", "conduitnsisintegration");
Gelöscht : user_pref("CT2625848.installType", "conduitnsisintegration");
Gelöscht : user_pref("CT2625848.isCheckedStartAsHidden", true);
Gelöscht : user_pref("CT2625848.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Gelöscht : user_pref("CT2625848.isFirstTimeToolbarLoading", "false");
Gelöscht : user_pref("CT2625848.isNewTabEnabled", false);
Gelöscht : user_pref("CT2625848.isPerformedSmartBarTransition", "true");
Gelöscht : user_pref("CT2625848.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Gelöscht : user_pref("CT2625848.keyword", true);
Gelöscht : user_pref("CT2625848.lastNewTabSettings", "{\"isEnabled\":false,\"newTabUrl\":\"hxxp://search.condui[...]
Gelöscht : user_pref("CT2625848.lastVersion", "10.16.2.509");
Gelöscht : user_pref("CT2625848.migrateAppsAndComponents", true);
Gelöscht : user_pref("CT2625848.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fvenicebeach.pfit[...]
Gelöscht : user_pref("CT2625848.newSettings", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Gelöscht : user_pref("CT2625848.openThankYouPage", "false");
Gelöscht : user_pref("CT2625848.openUninstallPage", "true");
Gelöscht : user_pref("CT2625848.price-gong.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\[...]
Gelöscht : user_pref("CT2625848.price-gong.isManagedApp", "true");
Gelöscht : user_pref("CT2625848.revertSettingsEnabled", "false");
Gelöscht : user_pref("CT2625848.search.searchAppId", "129181467799155027");
Gelöscht : user_pref("CT2625848.search.searchCount", "0");
Gelöscht : user_pref("CT2625848.searchInNewTabEnabled", "false");
Gelöscht : user_pref("CT2625848.searchInNewTabEnabledByUser", "false");
Gelöscht : user_pref("CT2625848.searchInNewTabEnabledInHidden", "true");
Gelöscht : user_pref("CT2625848.searchProtector.notifyChanges", "{\"dataType\":\"string\",\"data\":\"true\"}");
Gelöscht : user_pref("CT2625848.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Gelöscht : user_pref("CT2625848.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]
Gelöscht : user_pref("CT2625848.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]
Gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]
Gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]
Gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]
Gelöscht : user_pref("CT2625848.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]
Gelöscht : user_pref("CT2625848.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1355072729594");
Gelöscht : user_pref("CT2625848.serviceLayer_services_appsMetadata_lastUpdate", "1355091236146");
Gelöscht : user_pref("CT2625848.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1355072731824");
Gelöscht : user_pref("CT2625848.serviceLayer_services_location_lastUpdate", "1368783246593");
Gelöscht : user_pref("CT2625848.serviceLayer_services_login_10.13.40.15_lastUpdate", "1358341037087");
Gelöscht : user_pref("CT2625848.serviceLayer_services_login_10.14.40.128_lastUpdate", "1359408750486");
Gelöscht : user_pref("CT2625848.serviceLayer_services_login_10.14.42.7_lastUpdate", "1360770137853");
Gelöscht : user_pref("CT2625848.serviceLayer_services_login_10.14.65.43_lastUpdate", "1364915677878");
Gelöscht : user_pref("CT2625848.serviceLayer_services_login_10.15.0.562_lastUpdate", "1368783247801");
Gelöscht : user_pref("CT2625848.serviceLayer_services_login_10.16.2.509_lastUpdate", "1368823121192");
Gelöscht : user_pref("CT2625848.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1355072732725");
Gelöscht : user_pref("CT2625848.serviceLayer_services_searchAPI_lastUpdate", "1355072726097");
Gelöscht : user_pref("CT2625848.serviceLayer_services_serviceMap_lastUpdate", "1368783246446");
Gelöscht : user_pref("CT2625848.serviceLayer_services_toolbarContextMenu_lastUpdate", "1355072731355");
Gelöscht : user_pref("CT2625848.serviceLayer_services_toolbarSettings_lastUpdate", "1368823120995");
Gelöscht : user_pref("CT2625848.serviceLayer_services_translation_lastUpdate", "1368783247770");
Gelöscht : user_pref("CT2625848.serviceLayer_services_userApps1ec55dac-8dca-406b-9697-5d68893c1c0c_lastUpdate",[...]
Gelöscht : user_pref("CT2625848.serviceLayer_services_userApps_lastUpdate", "1355091237052");
Gelöscht : user_pref("CT2625848.settingsINI", true);
Gelöscht : user_pref("CT2625848.shouldFirstTimeDialog", "false");
Gelöscht : user_pref("CT2625848.showToolbarPermission", "false");
Gelöscht : user_pref("CT2625848.smartbar.CTID", "CT2625848");
Gelöscht : user_pref("CT2625848.smartbar.Uninstall", "0");
Gelöscht : user_pref("CT2625848.smartbar.homepage", true);
Gelöscht : user_pref("CT2625848.smartbar.isHidden", true);
Gelöscht : user_pref("CT2625848.smartbar.toolbarName", "DVDVideoSoftTB DE ");
Gelöscht : user_pref("CT2625848.startPage", "userChanged");
Gelöscht : user_pref("CT2625848.toolbarBornServerTime", "9-12-2012");
Gelöscht : user_pref("CT2625848.toolbarCurrentServerTime", "17-5-2013");
Gelöscht : user_pref("CT2625848.toolbarLoginClientTime", "Tue Apr 02 2013 20:48:16 GMT+0200");
Gelöscht : user_pref("CT2625848.url_history0001.enc", "aHR0cDovL3d3dy5mYWNlYm9vay5jb20vP3JlZj10bl90bm1uOjo6Y2xp[...]
Gelöscht : user_pref("CT2625848_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]
Gelöscht : user_pref("browser.search.defaultenginename", "Search Results");
Gelöscht : user_pref("browser.search.order.1", "Search Results");
Gelöscht : user_pref("browser.search.selectedEngine", "Search Results");
Gelöscht : user_pref("browser.startup.homepage", "hxxp://www.searchnu.com/102?appid=110");
Gelöscht : user_pref("extensions.delta.admin", false);
Gelöscht : user_pref("extensions.delta.aflt", "babsst");
Gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Gelöscht : user_pref("extensions.delta.autoRvrt", "false");
Gelöscht : user_pref("extensions.delta.dfltLng", "en");
Gelöscht : user_pref("extensions.delta.excTlbr", false);
Gelöscht : user_pref("extensions.delta.id", "1ef4549b00000000000082b9a5d1bc8b");
Gelöscht : user_pref("extensions.delta.instlDay", "15797");
Gelöscht : user_pref("extensions.delta.instlRef", "sst");
Gelöscht : user_pref("extensions.delta.newTab", false);
Gelöscht : user_pref("extensions.delta.prdct", "delta");
Gelöscht : user_pref("extensions.delta.prtnrId", "delta");
Gelöscht : user_pref("extensions.delta.rvrt", "false");
Gelöscht : user_pref("extensions.delta.smplGrp", "none");
Gelöscht : user_pref("extensions.delta.tlbrId", "base");
Gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");
Gelöscht : user_pref("extensions.delta.vrsn", "1.8.10.0");
Gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.10.020:39:32");
Gelöscht : user_pref("extensions.delta.vrsni", "1.8.10.0");
Gelöscht : user_pref("keyword.URL", "hxxp://dts.search-results.com/sr?src=ffb&gct=ds&appid=110&systemid=102&apn[...]
Gelöscht : user_pref("smartbar.machineId", "/WE+C6HSXEKKYNUWLB0B9TKC262SVRCHMIC8H/PG4ISWWGHXIV8R+OW7X8/SGFK5GM9[...]

-\\ Google Chrome v26.0.1410.64

Datei : C:\Users\Ann-Kristin.B\AppData\Local\Google\Chrome\User Data\Default\Preferences

Gelöscht [l.30] : keyword = "search-results.com",
Gelöscht [l.34] : search_url = "hxxp://dts.search-results.com/sr?src=crb&gct=ds&appid=110&systemid=102&apn_uid=[...]

*************************

AdwCleaner[S1].txt - [17373 octets] - [23/05/2013 20:55:55]

########## EOF - C:\AdwCleaner[S1].txt - [17434 octets] ##########
ADW 2:

Code:
# AdwCleaner v2.301 - Datei am 23/05/2013 um 21:06:37 erstellt
# Aktualisiert am 16/05/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Ann-Kristin.B - ANN-KRISTINB-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Ann-Kristin.B\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\Program Files (x86)\search results toolbar

***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16576

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v20.0.1 (de)

Datei : C:\Users\Ann-Kristin.B\AppData\Roaming\Mozilla\Firefox\Profiles\psibyyw1.default\prefs.js

[OK] Die Datei ist sauber.

-\\ Google Chrome v26.0.1410.64

Datei : C:\Users\Ann-Kristin.B\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [17490 octets] - [23/05/2013 20:55:55]
AdwCleaner[S2].txt - [1040 octets] - [23/05/2013 21:06:37]

########## EOF - C:\AdwCleaner[S2].txt - [1100 octets] ##########
Und zu guter Letzt:

JRT:

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Home Premium x64
Ran by Ann-Kristin.B on 23.05.2013 at 21:26:45,70
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{7abe12ca-e995-4ab4-9a4e-ef8820a20182}



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\filescout
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{651C3DAB-BC92-4E1E-8A9D-75C0AEFB3A03}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\datamngr"
Successfully deleted: [Folder] "C:\ProgramData\wincert"
Successfully deleted: [Folder] "C:\Users\Ann-Kristin.B\appdata\locallow\datamngr"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
Successfully deleted: [Empty Folder] C:\Users\Ann-Kristin.B\appdata\local\{11C79FC3-DC6C-47B2-8AB2-98ED1F59F347}
Successfully deleted: [Empty Folder] C:\Users\Ann-Kristin.B\appdata\local\{309528E5-C24A-4175-A8BC-173AAC6A6462}
Successfully deleted: [Empty Folder] C:\Users\Ann-Kristin.B\appdata\local\{485147DC-960C-43FC-BD83-56BD1F63A273}
Successfully deleted: [Empty Folder] C:\Users\Ann-Kristin.B\appdata\local\{85F4E600-4FD7-422E-9CDA-5FEDEDA94991}
Successfully deleted: [Empty Folder] C:\Users\Ann-Kristin.B\appdata\local\{B9CA9FDB-B57D-434A-98CF-39344F8A5CF5}
Successfully deleted: [Empty Folder] C:\Users\Ann-Kristin.B\appdata\local\{CEFC52FF-D3DA-476D-906B-D48D1B5EDBE1}
Successfully deleted: [Empty Folder] C:\Users\Ann-Kristin.B\appdata\local\{F566808F-E3CF-42BA-9E26-CF76E5AD80DB}



~~~ FireFox

Successfully deleted: [File] C:\Users\Ann-Kristin.B\AppData\Roaming\mozilla\firefox\profiles\psibyyw1.default\invalidprefs.js
Emptied folder: C:\Users\Ann-Kristin.B\AppData\Roaming\mozilla\firefox\profiles\psibyyw1.default\minidumps [92 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 23.05.2013 at 21:48:18,08
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

M-K-D-B 24.05.2013 16:57
Servus,




Mir ist aufgefallen, dass Du mehr als ein Anti-Virus-Programm mit Hintergrundwächter laufen hast:
Code:
Trend Micro Titanium Internet Security
avast! Antivirus
Das ist gefährlich, da sich die Programme in die Quere kommen können und dadurch Viren erst recht auf dem Rechner landen können. Ausserdem bremst es auch das System aus. Entscheide Dich für eine Variante und deinstalliere die andere über Systemsteuerung => Programme deinstallieren / Software.
Berichte, für welches Anti-Virus-Programm Du Dich entschieden hast.

Zitat:
Speedy hat letztens eine einleuchtende Erklärung dazu geliefert: "Man stelle sich einen Torwart vor, der das Tor hüten soll (Anti-Virus-Programm), der Ball kommt angeflogen (Virus), der Torhüter konzentriert sich auf den Ball und fängt ihn. Jetzt stelle Dir zwei Torhüter im Tor vor ...., die knallen aneinander und der Ball kann ungehindert ins Tor wandern."




Wir spüren jetzt noch die Reste auf, damit wir sie im nächsten Schritt entfernen können:




Schritt 1
Starte bitte OTL.exe.
Wähle unter
Extra Registrierung: Benutze Safe List und klicke auf den Scan Button.
Poste die OTL.txt und die Extras.txt hier in deinen Thread.





Schritt 2
Lade SystemLook von jpshortstuff vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop.
SystemLook (64 bit)
  • Doppelklicke auf die SystemLook_x64.exe, um das Tool zu starten.
  • Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:
    Code:
    :filefind
    *speedanalysis*
    *Datamngr*
    *IBUpdater*
    *babylon*
    *Search_Results*
    *Askcom*
    *search results toolbar*
    *Conduit*
    *ICQ6Toolbar*
    *PriceGong*
    *file scout*
    *PerformerSoft*
    *wincert*

    :folderfind
    *speedanalysis*
    *Datamngr*
    *IBUpdater*
    *babylon*
    *Search_Results*
    *Askcom*
    *search results toolbar*
    *Conduit*
    *ICQ6Toolbar*
    *PriceGong*
    *file scout*
    *PerformerSoft*
    *wincert*

    :regfind
    speedanalysis
    Datamngr
    IBUpdater
    babylon
    Search_Results
    Askcom
    search results toolbar
    Conduit
    ICQ6Toolbar
    PriceGong
    file scout
    PerformerSoft
    wincert
  • Klicke nun auf den Button Look, um den Scan zu starten.
  • Der Suchlauf kann einige Zeit dauern.
  • Wenn der Suchlauf beendet ist, wird sich Dein Editor mit den Ergebnissen öffnen, poste diese in deinen Thread.
  • Die Ergebnisse werden auf dem Desktop als SystemLook.txt gespeichert.





Bitte poste mit deiner nächsten Antwort
  • die beiden Logdateien von OTL,
  • die Logdatei von SystemLook.

painfiller 25.05.2013 12:58
Alles klar, vielen Dank für den Hinweis.

Haben uns für Avast entschieden und das andere deinstalliert.

Hier sind die neuen Logs:

OTL:
Code:
OTL logfile created on: 25.05.2013 10:47:47 - Run 2
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Ann-Kristin.B\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,90 Gb Total Physical Memory | 1,78 Gb Available Physical Memory | 45,53% Memory free
7,81 Gb Paging File | 5,51 Gb Available in Paging File | 70,56% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 95,39 Gb Total Space | 5,88 Gb Free Space | 6,16% Space Free | Partition Type: NTFS
Drive D: | 135,08 Gb Total Space | 134,26 Gb Free Space | 99,39% Space Free | Partition Type: NTFS
 
Computer Name: ANN-KRISTINB-PC | User Name: Ann-Kristin.B | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Ann-Kristin.B\Downloads\OTL (1).exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
PRC - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Users\Ann-Kristin.B\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Windows\SysWOW64\nlssrv32.exe (Nalpeiron Ltd.)
PRC - C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (ASUS)
PRC - C:\Windows\SysWOW64\ACEngSvr.exe (ASUSTeK)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe (ASUS)
PRC - C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Atheros)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe (ASUSTek Computer Inc.)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Microsoft\Office Live\OfficeLiveSignIn.exe (Microsoft Corp.)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (ASUS)
PRC - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (ASUS)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\PepperFlash\pepflashplayer.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\pdf.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\libglesv2.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\libegl.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\ffmpegsumo.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\eaf6697da0b67374001d147aee75009d\System.Net.Http.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\70d72313a775557439a05ce6f5baeb07\System.Xml.Linq.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web\4369540a5881bc82e4f1f905824a9073\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Comp46f2b404#\945ae339d39571f0924e9d441ff9d62c\System.ComponentModel.DataAnnotations.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.CSharp\a11bc88101ba0e0e015b7418822c2d8f\Microsoft.CSharp.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Dynamic\a964921389340c43b7b16f38111bfaca\System.Dynamic.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\94895ef7ca8ea1d634a8015b0210ffe2\System.Data.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\812da0e8734a45ff568ae1d4498e06b6\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\50de0ff497200bcbe7c967358991fb4b\Microsoft.VisualBasic.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\b88c80d6ad9a63ca4c65930681a5751b\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\b4128a0494cfe6f9a302e1b025c4f586\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\964e0354282f8c375c8f8853099a665f\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\200f2ade9d2ce2c8109fda203f134461\System.Runtime.Serialization.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\82769badec67251e79fd19a91001577f\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\fcffcb53b4be0d90791adef7f3d3aec5\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System\840663d1ea5099ecc97b54175a64b7a2\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\CustomMarshalers\695a7623115fe0895ddc13c885d659be\CustomMarshalers.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Numerics\8509330f3011cef23ba3b625550c20a9\System.Numerics.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\506bcca8d286f754825f3f1b0bf64894\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7150b9136fad5b79e88f6c7f9d3d2c39\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL ()
MOD - C:\Program Files (x86)\ASUS\Splendid\GLCDdll.dll ()
MOD - C:\Program Files (x86)\ASUS\Wireless Console 3\acAuth.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (avast! Antivirus) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV:64bit: - (TurboBoost) -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe (Intel(R) Corporation)
SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (TeamViewer8) -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (McComponentHostService) -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe (McAfee, Inc.)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (nlsX86cc) -- C:\Windows\SysWOW64\nlssrv32.exe (Nalpeiron Ltd.)
SRV - (ASUS InstantOn) -- C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe (ASUS)
SRV - (Atheros Bt&Wlan Coex Agent) -- C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Atheros)
SRV - (AtherosSvc) -- C:\Program Files (x86)\Bluetooth Suite\adminservice.exe (Atheros Commnucations)
SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (ATKGFNEXSrv) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)
SRV - (ASLDRService) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (esgiguard) -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys File not found
DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software)
DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software)
DRV:64bit: - (aswVmm) -- C:\Windows\SysNative\drivers\aswVmm.sys ()
DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software)
DRV:64bit: - (aswRvrt) -- C:\Windows\SysNative\drivers\aswRvrt.sys ()
DRV:64bit: - (aswTdi) -- C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software)
DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)
DRV:64bit: - (aswFsBlk) -- C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software)
DRV:64bit: - (acsock) -- C:\Windows\SysNative\drivers\acsock64.sys (Cisco Systems, Inc.)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (IntcDAud) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (ETD) -- C:\Windows\SysNative\drivers\ETD.sys (ELAN Microelectronics Corp.)
DRV:64bit: - (FLxHCIc) -- C:\Windows\SysNative\drivers\FLxHCIc.sys (Fresco Logic)
DRV:64bit: - (FLxHCIh) -- C:\Windows\SysNative\drivers\FLxHCIh.sys (Fresco Logic)
DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (BtFilter) -- C:\Windows\SysNative\drivers\btfilter.sys (Atheros)
DRV:64bit: - (BTATH_RCP) -- C:\Windows\SysNative\drivers\btath_rcp.sys (Atheros)
DRV:64bit: - (BTATH_LWFLT) -- C:\Windows\SysNative\drivers\btath_lwflt.sys (Atheros)
DRV:64bit: - (BTATH_HCRP) -- C:\Windows\SysNative\drivers\btath_hcrp.sys (Atheros)
DRV:64bit: - (AthBTPort) -- C:\Windows\SysNative\drivers\btath_flt.sys (Atheros)
DRV:64bit: - (BTATH_BUS) -- C:\Windows\SysNative\drivers\btath_bus.sys (Atheros)
DRV:64bit: - (btath_avdt) -- C:\Windows\SysNative\drivers\btath_avdt.sys (Atheros)
DRV:64bit: - (BTATH_A2DP) -- C:\Windows\SysNative\drivers\btath_a2dp.sys (Atheros)
DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (RSUSBVSTOR) -- C:\Windows\SysNative\drivers\rtsuvstor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (AiCharger) -- C:\Windows\SysNative\drivers\AiCharger.sys (ASUSTek Computer Inc.)
DRV:64bit: - (TurboB) -- C:\Windows\SysNative\drivers\TurboB.sys (Intel(R) Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (assd) -- C:\Windows\SysNative\drivers\assd.sys (ASUS Corporation)
DRV:64bit: - (kbfiltr) -- C:\Windows\SysNative\drivers\kbfiltr.sys ( )
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (TPM) -- C:\Windows\SysNative\drivers\tpm.sys (Microsoft Corporation)
DRV:64bit: - (SiSGbeLH) -- C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (L1C) -- C:\Windows\SysNative\drivers\L1C62x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (ATKWMIACPIIO) -- C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys (ASUS)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (ASMMAP64) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys (ASUS)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=NP06&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=NP06&src=IE-SearchBox
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: speedanalysis%40SpeedAnalysis.com:1.0.0.1
FF - prefs.js..extensions.enabledAddons: %7BC4A4F5A0-4B89-4392-AFAC-D58010E349AF%7D:5.0.0.7066
FF - prefs.js..extensions.enabledAddons: %7B0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff%7D:10.16.2.509
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.com/firefox"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.order.1: "Google"
FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q="
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\ZEON/PDF,version=2.0: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013.05.18 11:05:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}\\: C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2013.05.15 11:20:55 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.05.02 10:50:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.05.02 10:50:51 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2013.05.08 16:21:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ann-Kristin.B\AppData\Roaming\mozilla\Extensions
[2013.05.24 11:14:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ann-Kristin.B\AppData\Roaming\mozilla\Firefox\Profiles\psibyyw1.default\extensions
[2012.12.09 19:05:29 | 000,001,064 | ---- | M] () -- C:\Users\Ann-Kristin.B\AppData\Roaming\mozilla\firefox\profiles\psibyyw1.default\searchplugins\dvdvideosofttb-de-customized-web-search.xml
[2013.05.08 16:21:51 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.05.02 10:50:50 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2013.05.02 10:50:38 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.05.02 10:50:38 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013.05.02 10:50:38 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2013.05.02 10:50:38 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.05.02 10:50:38 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.05.02 10:50:38 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 7 U21 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: McAfee Security Scanner + (Enabled) = C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll
CHR - plugin: Zeon Plus (Enabled) = C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll
CHR - plugin: Java Deployment Toolkit 7.0.210.11 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - Extension: Citavi Picker = C:\Users\Ann-Kristin.B\AppData\Local\Google\Chrome\User Data\Default\Extensions\piehhloihgjjiomhieeddiidpekaajio\2013.4.29_0\
 
O1 HOSTS File: ([2013.05.23 20:29:33 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (no name) - {45564571-A21B-48ED-B584-69752EEE9C3D} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {7abe12ca-e995-4ab4-9a4e-ef8820a20182} - No CLSID value found.
O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [AtherosBtStack] C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Communications)
O4:64bit: - HKLM..\Run: [ETDCtrl] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [FLxHCIm64] C:\Program Files\Fresco Logic\Fresco Logic USB3.0 Host Controller\amd64_host\FLxHCIm.exe (Windows (R) Win 7 DDK provider)
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe (ASUS)
O4 - HKCU..\Run: [Spotify] C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\spotify.exe (Spotify Ltd)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Ann-Kristin.B\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - Startup: C:\Users\Ann-Kristin.B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Ann-Kristin.B\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Ann-Kristin.B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Persbackup.lnk =  File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: &Citavi Picker... - C:\ProgramData\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: &Citavi Picker... - C:\ProgramData\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 134.155.96.52 134.155.96.53
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{00DB7D09-6DFF-40CD-B304-5D415F5092A2}: DhcpNameServer = 134.155.96.52 134.155.96.53
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013.04.30 22:03:18 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.05.23 22:42:52 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\Desktop\Trojanerboard
[2013.05.23 22:41:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
[2013.05.23 21:26:43 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013.05.23 21:24:40 | 000,000,000 | ---D | C] -- C:\JRT
[2013.05.23 21:01:33 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.05.23 20:38:35 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013.05.23 19:31:12 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.05.23 19:31:12 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.05.23 19:31:12 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.05.23 19:29:43 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.05.23 19:29:12 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.05.23 18:57:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TeamViewer
[2013.05.20 11:03:06 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\Documents\PersBackup
[2013.05.20 11:02:57 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\AppData\Roaming\PersBackup5
[2013.05.20 11:02:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Personal Backup
[2013.05.20 11:02:15 | 000,000,000 | ---D | C] -- C:\Program Files\Personal Backup 5
[2013.05.20 11:01:58 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\AppData\Local\Programs
[2013.05.19 20:34:25 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\Desktop\Lac de Madine nach Auchan Laxou - Google Maps_files
[2013.05.17 20:55:30 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013.05.17 20:55:29 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013.05.17 20:55:28 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013.05.17 20:55:20 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013.05.17 20:55:20 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013.05.17 20:55:19 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013.05.17 20:55:19 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013.05.17 20:55:18 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013.05.17 20:55:17 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013.05.17 20:55:17 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013.05.17 20:55:17 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013.05.17 20:55:16 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013.05.17 20:55:04 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013.05.17 20:55:04 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013.05.17 20:54:58 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013.05.16 10:24:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Gibraltar
[2013.05.15 11:20:20 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Citavi 4
[2013.05.15 11:16:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Citavi 4
[2013.05.15 11:11:36 | 000,265,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\dxgmms1.sys
[2013.05.15 11:11:36 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdd.dll
[2013.05.15 11:10:50 | 001,930,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\authui.dll
[2013.05.15 11:10:50 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\shdocvw.dll
[2013.05.15 11:10:42 | 000,111,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\consent.exe
[2013.05.15 11:10:38 | 001,796,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\authui.dll
[2013.05.15 11:09:47 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wwanprotdim.dll
[2013.05.14 17:13:27 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\AppData\Roaming\Swiss Academic Software
[2013.05.14 16:54:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Swiss Academic Software
[2013.05.14 16:47:05 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\AppData\Local\Downloaded Installations
[2013.05.08 16:21:37 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\AppData\Local\jZip
[2013.05.08 16:21:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\jZip
[2013.05.01 03:09:55 | 001,054,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2013.05.01 03:09:54 | 001,441,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2013.05.01 03:09:54 | 001,400,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dat
[2013.05.01 03:09:54 | 000,719,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll
[2013.05.01 03:09:54 | 000,629,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2013.05.01 03:09:54 | 000,361,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2013.05.01 03:09:54 | 000,232,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2013.05.01 03:09:54 | 000,226,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\elshyph.dll
[2013.05.01 03:09:54 | 000,185,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\elshyph.dll
[2013.05.01 03:09:54 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2013.05.01 03:09:54 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iexpress.exe
[2013.05.01 03:09:54 | 000,138,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wextract.exe
[2013.05.01 03:09:54 | 000,137,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2013.05.01 03:09:54 | 000,125,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll
[2013.05.01 03:09:54 | 000,117,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2013.05.01 03:09:54 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\IEAdvpack.dll
[2013.05.01 03:09:54 | 000,082,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll
[2013.05.01 03:09:54 | 000,079,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2013.05.01 03:09:54 | 000,073,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\SetIEInstalledDate.exe
[2013.05.01 03:09:54 | 000,069,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\icardie.dll
[2013.05.01 03:09:54 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx
[2013.05.01 03:09:54 | 000,057,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\pngfilt.dll
[2013.05.01 03:09:54 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmler.dll
[2013.05.01 03:09:54 | 000,023,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2013.05.01 03:09:54 | 000,011,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2013.05.01 03:09:53 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2013.05.01 03:09:50 | 001,509,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2013.05.01 03:09:50 | 001,400,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dat
[2013.05.01 03:09:50 | 000,905,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll
[2013.05.01 03:09:50 | 000,762,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2013.05.01 03:09:50 | 000,599,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2013.05.01 03:09:50 | 000,452,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2013.05.01 03:09:50 | 000,441,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2013.05.01 03:09:50 | 000,281,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2013.05.01 03:09:50 | 000,235,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2013.05.01 03:09:50 | 000,216,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll
[2013.05.01 03:09:50 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2013.05.01 03:09:50 | 000,167,424 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iexpress.exe
[2013.05.01 03:09:50 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll
[2013.05.01 03:09:50 | 000,144,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wextract.exe
[2013.05.01 03:09:50 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2013.05.01 03:09:50 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll
[2013.05.01 03:09:50 | 000,102,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll
[2013.05.01 03:09:50 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2013.05.01 03:09:50 | 000,092,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\SetIEInstalledDate.exe
[2013.05.01 03:09:50 | 000,081,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll
[2013.05.01 03:09:50 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx
[2013.05.01 03:09:50 | 000,062,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll
[2013.05.01 03:09:50 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll
[2013.05.01 03:09:50 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll
[2013.05.01 03:09:50 | 000,027,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2013.05.01 03:09:50 | 000,013,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshta.exe
[2013.05.01 03:09:50 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2013.04.30 22:02:18 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2013.04.30 15:25:45 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\Desktop\Hochladen
[2013.04.30 11:46:08 | 002,776,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll
[2013.04.30 11:46:08 | 002,565,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll
[2013.04.30 11:46:08 | 001,682,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll
[2013.04.30 11:46:08 | 001,643,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll
[2013.04.30 11:46:08 | 001,504,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll
[2013.04.30 11:46:08 | 001,158,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsPrint.dll
[2013.04.30 11:46:08 | 000,522,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll
[2013.04.30 11:46:08 | 000,465,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMPhoto.dll
[2013.04.30 11:46:08 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMPhoto.dll
[2013.04.30 11:46:08 | 000,364,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsGdiConverter.dll
[2013.04.30 11:46:08 | 000,363,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxgi.dll
[2013.04.30 11:46:08 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.04.30 11:46:08 | 000,010,752 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.04.30 11:46:08 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.04.30 11:46:08 | 000,009,728 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.04.30 11:46:08 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.04.30 11:46:08 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.04.30 11:46:08 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.04.30 11:46:08 | 000,005,632 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.04.30 11:46:08 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.04.30 11:46:08 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.04.30 11:46:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.04.30 11:46:08 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.04.30 11:46:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
[2013.04.30 11:46:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll
[2013.04.30 11:46:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.04.30 11:46:08 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.04.30 11:46:08 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.04.30 11:46:08 | 000,002,560 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.04.30 11:46:07 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll
[2013.04.30 11:46:07 | 001,238,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10.dll
[2013.04.30 11:46:07 | 000,648,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll
[2013.04.30 11:46:07 | 000,333,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1core.dll
[2013.04.30 11:46:07 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10core.dll
[2013.04.30 11:46:07 | 000,245,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecsExt.dll
[2013.04.30 11:46:07 | 000,194,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll
[2013.04.30 11:46:03 | 000,221,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\UIAnimation.dll
[2013.04.30 11:46:03 | 000,187,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\UIAnimation.dll
[2013.04.30 11:38:23 | 000,263,584 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013.04.30 11:37:06 | 000,095,648 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013.04.30 11:37:03 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013.04.30 11:37:03 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013.04.30 11:35:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2013.04.30 10:59:11 | 000,378,432 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2013.04.30 10:59:11 | 000,033,400 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2013.04.30 10:59:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2013.04.30 10:59:10 | 000,072,016 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys
[2013.04.30 10:59:10 | 000,064,288 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2013.04.30 10:43:30 | 001,025,808 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2013.04.30 10:42:48 | 000,080,816 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2013.04.30 10:42:45 | 000,287,840 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2013.04.30 10:42:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2013.04.30 10:40:00 | 000,041,664 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2013.04.30 10:38:57 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2013.04.30 10:33:54 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2013.04.30 10:21:17 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\searchplugins
[2013.04.29 10:11:34 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\Desktop\Bewerbung
[2013.04.26 16:07:10 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\Desktop\BA-Arbeit
[3 C:\Users\Ann-Kristin.B\Desktop\*.tmp files -> C:\Users\Ann-Kristin.B\Desktop\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.05.25 10:33:00 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.05.25 10:01:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.05.25 08:55:36 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.05.24 21:25:54 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.05.24 21:15:38 | 000,002,185 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013.05.24 11:33:30 | 000,047,723 | ---- | M] () -- C:\Users\Ann-Kristin.B\Desktop\Reisekostenformular_Steuerberatung.pdf
[2013.05.24 11:23:46 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.05.24 11:23:46 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.05.24 11:16:44 | 000,000,374 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.ics
[2013.05.24 11:16:00 | 3144,658,944 | -HS- | M] () -- C:\hiberfil.sys
[2013.05.24 09:34:12 | 000,045,056 | ---- | M] () -- C:\Windows\SysWow64\acovcnt.exe
[2013.05.23 21:04:03 | 009,356,676 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.05.23 21:04:03 | 000,749,256 | ---- | M] () -- C:\Windows\SysNative\perfh00C.dat
[2013.05.23 21:04:03 | 000,748,996 | ---- | M] () -- C:\Windows\SysNative\perfh00A.dat
[2013.05.23 21:04:03 | 000,747,038 | ---- | M] () -- C:\Windows\SysNative\perfh013.dat
[2013.05.23 21:04:03 | 000,743,586 | ---- | M] () -- C:\Windows\SysNative\perfh010.dat
[2013.05.23 21:04:03 | 000,732,558 | ---- | M] () -- C:\Windows\SysNative\prfh0816.dat
[2013.05.23 21:04:03 | 000,728,140 | ---- | M] () -- C:\Windows\SysNative\perfh019.dat
[2013.05.23 21:04:03 | 000,711,078 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.05.23 21:04:03 | 000,665,876 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.05.23 21:04:03 | 000,610,528 | ---- | M] () -- C:\Windows\SysNative\perfh008.dat
[2013.05.23 21:04:03 | 000,482,554 | ---- | M] () -- C:\Windows\SysNative\perfh001.dat
[2013.05.23 21:04:03 | 000,412,012 | ---- | M] () -- C:\Windows\SysNative\prfh0404.dat
[2013.05.23 21:04:03 | 000,395,884 | ---- | M] () -- C:\Windows\SysNative\perfh00D.dat
[2013.05.23 21:04:03 | 000,162,418 | ---- | M] () -- C:\Windows\SysNative\perfc00A.dat
[2013.05.23 21:04:03 | 000,157,046 | ---- | M] () -- C:\Windows\SysNative\perfc013.dat
[2013.05.23 21:04:03 | 000,156,850 | ---- | M] () -- C:\Windows\SysNative\prfc0816.dat
[2013.05.23 21:04:03 | 000,154,786 | ---- | M] () -- C:\Windows\SysNative\perfc019.dat
[2013.05.23 21:04:03 | 000,153,526 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.05.23 21:04:03 | 000,153,524 | ---- | M] () -- C:\Windows\SysNative\perfc00C.dat
[2013.05.23 21:04:03 | 000,150,790 | ---- | M] () -- C:\Windows\SysNative\perfc010.dat
[2013.05.23 21:04:03 | 000,126,088 | ---- | M] () -- C:\Windows\SysNative\prfc0404.dat
[2013.05.23 21:04:03 | 000,126,088 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.05.23 21:04:03 | 000,115,072 | ---- | M] () -- C:\Windows\SysNative\perfc008.dat
[2013.05.23 21:04:03 | 000,098,716 | ---- | M] () -- C:\Windows\SysNative\perfc001.dat
[2013.05.23 21:04:03 | 000,088,702 | ---- | M] () -- C:\Windows\SysNative\perfc00D.dat
[2013.05.23 20:57:48 | 000,413,656 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.05.23 20:56:50 | 000,000,113 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat
[2013.05.23 20:29:33 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.05.23 18:57:41 | 000,001,164 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 8.lnk
[2013.05.23 11:28:56 | 000,000,000 | ---- | M] () -- C:\Users\Ann-Kristin.B\defogger_reenable
[2013.05.20 18:04:29 | 000,076,827 | ---- | M] () -- C:\Users\Ann-Kristin.B\Desktop\ESTA-Antrag.pdf
[2013.05.20 14:09:01 | 000,002,028 | ---- | M] () -- C:\Users\Ann-Kristin.B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Persbackup.lnk
[2013.05.19 20:37:26 | 000,145,257 | ---- | M] () -- C:\Users\Ann-Kristin.B\Desktop\Lac de Madine nach Auchan Laxou - Google Maps.pdf
[2013.05.19 20:34:25 | 000,179,598 | ---- | M] () -- C:\Users\Ann-Kristin.B\Desktop\Lac de Madine nach Auchan Laxou - Google Maps.htm
[2013.05.18 20:26:09 | 009,159,930 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013.05.18 11:06:13 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2013.05.15 11:20:20 | 000,002,099 | ---- | M] () -- C:\Users\Ann-Kristin.B\Desktop\Citavi 4.lnk
[2013.05.15 10:02:02 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.05.15 10:02:02 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.05.09 10:59:07 | 001,025,808 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2013.05.09 10:59:07 | 000,378,432 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2013.05.09 10:59:07 | 000,189,936 | ---- | M] () -- C:\Windows\SysNative\drivers\aswVmm.sys
[2013.05.09 10:59:07 | 000,072,016 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys
[2013.05.09 10:59:07 | 000,065,336 | ---- | M] () -- C:\Windows\SysNative\drivers\aswRvrt.sys
[2013.05.09 10:59:07 | 000,064,288 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2013.05.09 10:59:06 | 000,080,816 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2013.05.09 10:59:06 | 000,033,400 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2013.05.09 10:58:37 | 000,041,664 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2013.05.09 10:58:11 | 000,287,840 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2013.05.01 03:09:55 | 001,054,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2013.05.01 03:09:54 | 001,441,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2013.05.01 03:09:54 | 001,400,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dat
[2013.05.01 03:09:54 | 000,719,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll
[2013.05.01 03:09:54 | 000,629,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2013.05.01 03:09:54 | 000,361,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2013.05.01 03:09:54 | 000,232,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2013.05.01 03:09:54 | 000,226,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\elshyph.dll
[2013.05.01 03:09:54 | 000,185,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\elshyph.dll
[2013.05.01 03:09:54 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2013.05.01 03:09:54 | 000,150,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iexpress.exe
[2013.05.01 03:09:54 | 000,138,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\wextract.exe
[2013.05.01 03:09:54 | 000,137,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2013.05.01 03:09:54 | 000,125,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\occache.dll
[2013.05.01 03:09:54 | 000,117,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2013.05.01 03:09:54 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\IEAdvpack.dll
[2013.05.01 03:09:54 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inseng.dll
[2013.05.01 03:09:54 | 000,079,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2013.05.01 03:09:54 | 000,073,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\SetIEInstalledDate.exe
[2013.05.01 03:09:54 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\icardie.dll
[2013.05.01 03:09:54 | 000,061,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\tdc.ocx
[2013.05.01 03:09:54 | 000,057,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\pngfilt.dll
[2013.05.01 03:09:54 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmler.dll
[2013.05.01 03:09:54 | 000,025,185 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.05.01 03:09:54 | 000,023,040 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2013.05.01 03:09:54 | 000,011,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2013.05.01 03:09:53 | 000,197,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2013.05.01 03:09:50 | 001,509,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2013.05.01 03:09:50 | 001,400,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dat
[2013.05.01 03:09:50 | 000,905,728 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll
[2013.05.01 03:09:50 | 000,762,368 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2013.05.01 03:09:50 | 000,599,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2013.05.01 03:09:50 | 000,452,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2013.05.01 03:09:50 | 000,441,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2013.05.01 03:09:50 | 000,281,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2013.05.01 03:09:50 | 000,235,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2013.05.01 03:09:50 | 000,216,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msls31.dll
[2013.05.01 03:09:50 | 000,173,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2013.05.01 03:09:50 | 000,167,424 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iexpress.exe
[2013.05.01 03:09:50 | 000,149,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\occache.dll
[2013.05.01 03:09:50 | 000,144,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\wextract.exe
[2013.05.01 03:09:50 | 000,136,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2013.05.01 03:09:50 | 000,135,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\IEAdvpack.dll
[2013.05.01 03:09:50 | 000,102,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inseng.dll
[2013.05.01 03:09:50 | 000,097,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2013.05.01 03:09:50 | 000,092,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\SetIEInstalledDate.exe
[2013.05.01 03:09:50 | 000,081,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\icardie.dll
[2013.05.01 03:09:50 | 000,077,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\tdc.ocx
[2013.05.01 03:09:50 | 000,062,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\pngfilt.dll
[2013.05.01 03:09:50 | 000,051,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\imgutil.dll
[2013.05.01 03:09:50 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmler.dll
[2013.05.01 03:09:50 | 000,027,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2013.05.01 03:09:50 | 000,025,185 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2013.05.01 03:09:50 | 000,013,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshta.exe
[2013.05.01 03:09:50 | 000,012,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2013.04.30 22:03:18 | 000,000,000 | ---- | M] () -- C:\autoexec.bat
[2013.04.30 18:02:18 | 000,001,068 | ---- | M] () -- C:\Users\Ann-Kristin.B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013.04.30 11:46:08 | 003,928,064 | ---- | M] () -- C:\Windows\SysNative\d2d1.dll
[2013.04.30 11:46:08 | 002,776,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msmpeg2vdec.dll
[2013.04.30 11:46:08 | 002,565,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10warp.dll
[2013.04.30 11:46:08 | 002,284,544 | ---- | M] () -- C:\Windows\SysWow64\msmpeg2vdec.dll
[2013.04.30 11:46:08 | 001,682,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\XpsPrint.dll
[2013.04.30 11:46:08 | 001,643,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll
[2013.04.30 11:46:08 | 001,504,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\d3d11.dll
[2013.04.30 11:46:08 | 001,247,744 | ---- | M] () -- C:\Windows\SysWow64\DWrite.dll
[2013.04.30 11:46:08 | 001,230,336 | ---- | M] () -- C:\Windows\SysWow64\WindowsCodecs.dll
[2013.04.30 11:46:08 | 001,158,144 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsPrint.dll
[2013.04.30 11:46:08 | 000,522,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\XpsGdiConverter.dll
[2013.04.30 11:46:08 | 000,465,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WMPhoto.dll
[2013.04.30 11:46:08 | 000,417,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\WMPhoto.dll
[2013.04.30 11:46:08 | 000,364,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\XpsGdiConverter.dll
[2013.04.30 11:46:08 | 000,363,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dxgi.dll
[2013.04.30 11:46:08 | 000,220,160 | ---- | M] () -- C:\Windows\SysWow64\d3d10core.dll
[2013.04.30 11:46:08 | 000,010,752 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.04.30 11:46:08 | 000,010,752 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l1-1-0.dll
[2013.04.30 11:46:08 | 000,009,728 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.04.30 11:46:08 | 000,009,728 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l1-1-0.dll
[2013.04.30 11:46:08 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.04.30 11:46:08 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shlwapi-l2-1-0.dll
[2013.04.30 11:46:08 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.04.30 11:46:08 | 000,005,632 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-ole32-l1-1-0.dll
[2013.04.30 11:46:08 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.04.30 11:46:08 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-user32-l1-1-0.dll
[2013.04.30 11:46:08 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.04.30 11:46:08 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-advapi32-l2-1-0.dll
[2013.04.30 11:46:08 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
[2013.04.30 11:46:08 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-version-l1-1-0.dll
[2013.04.30 11:46:08 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.04.30 11:46:08 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-shell32-l1-1-0.dll
[2013.04.30 11:46:08 | 000,002,560 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.04.30 11:46:08 | 000,002,560 | -H-- | M] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-downlevel-normaliz-l1-1-0.dll
[2013.04.30 11:46:07 | 001,887,232 | ---- | M] () -- C:\Windows\SysNative\d3d11.dll
[2013.04.30 11:46:07 | 001,424,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll
[2013.04.30 11:46:07 | 001,238,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10.dll
[2013.04.30 11:46:07 | 000,648,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10level9.dll
[2013.04.30 11:46:07 | 000,333,312 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1core.dll
[2013.04.30 11:46:07 | 000,296,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10core.dll
[2013.04.30 11:46:07 | 000,245,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecsExt.dll
[2013.04.30 11:46:07 | 000,194,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\d3d10_1.dll
[2013.04.30 11:46:07 | 000,187,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\UIAnimation.dll
[2013.04.30 11:46:03 | 000,221,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\UIAnimation.dll
[2013.04.30 11:36:28 | 000,095,648 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013.04.30 11:36:07 | 000,263,584 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013.04.30 11:36:06 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013.04.30 11:36:06 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013.04.30 11:35:53 | 000,866,720 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2013.04.30 11:35:52 | 000,788,896 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2013.04.30 10:59:11 | 000,001,924 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[3 C:\Users\Ann-Kristin.B\Desktop\*.tmp files -> C:\Users\Ann-Kristin.B\Desktop\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.05.24 11:33:30 | 000,047,723 | ---- | C] () -- C:\Users\Ann-Kristin.B\Desktop\Reisekostenformular_Steuerberatung.pdf
[2013.05.23 20:56:07 | 000,000,113 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat
[2013.05.23 19:31:12 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.05.23 19:31:12 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.05.23 19:31:12 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.05.23 19:31:12 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.05.23 19:31:12 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.05.23 18:57:41 | 000,001,176 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 8.lnk
[2013.05.23 18:57:41 | 000,001,164 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 8.lnk
[2013.05.23 11:28:56 | 000,000,000 | ---- | C] () -- C:\Users\Ann-Kristin.B\defogger_reenable
[2013.05.20 18:04:29 | 000,076,827 | ---- | C] () -- C:\Users\Ann-Kristin.B\Desktop\ESTA-Antrag.pdf
[2013.05.20 14:09:01 | 000,002,028 | ---- | C] () -- C:\Users\Ann-Kristin.B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Persbackup.lnk
[2013.05.19 20:37:26 | 000,145,257 | ---- | C] () -- C:\Users\Ann-Kristin.B\Desktop\Lac de Madine nach Auchan Laxou - Google Maps.pdf
[2013.05.19 20:34:24 | 000,179,598 | ---- | C] () -- C:\Users\Ann-Kristin.B\Desktop\Lac de Madine nach Auchan Laxou - Google Maps.htm
[2013.05.15 11:20:20 | 000,002,099 | ---- | C] () -- C:\Users\Ann-Kristin.B\Desktop\Citavi 4.lnk
[2013.05.08 16:21:53 | 000,001,015 | ---- | C] () -- C:\Users\Ann-Kristin.B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\jZip.lnk
[2013.05.01 03:09:54 | 000,025,185 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.05.01 03:09:50 | 000,025,185 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2013.04.30 22:03:18 | 000,000,000 | ---- | C] () -- C:\autoexec.bat
[2013.04.30 18:02:18 | 000,001,068 | ---- | C] () -- C:\Users\Ann-Kristin.B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013.04.30 11:46:08 | 003,928,064 | ---- | C] () -- C:\Windows\SysNative\d2d1.dll
[2013.04.30 11:46:08 | 002,284,544 | ---- | C] () -- C:\Windows\SysWow64\msmpeg2vdec.dll
[2013.04.30 11:46:08 | 001,247,744 | ---- | C] () -- C:\Windows\SysWow64\DWrite.dll
[2013.04.30 11:46:08 | 001,175,552 | ---- | C] () -- C:\Windows\SysNative\FntCache.dll
[2013.04.30 11:46:08 | 000,220,160 | ---- | C] () -- C:\Windows\SysWow64\d3d10core.dll
[2013.04.30 11:46:07 | 001,887,232 | ---- | C] () -- C:\Windows\SysNative\d3d11.dll
[2013.04.30 11:46:07 | 001,230,336 | ---- | C] () -- C:\Windows\SysWow64\WindowsCodecs.dll
[2013.04.30 10:59:11 | 000,001,924 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2013.04.30 10:43:25 | 000,189,936 | ---- | C] () -- C:\Windows\SysNative\drivers\aswVmm.sys
[2013.04.30 10:43:20 | 000,065,336 | ---- | C] () -- C:\Windows\SysNative\drivers\aswRvrt.sys
[2013.04.30 10:42:45 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\config.nt
[2012.12.11 16:35:35 | 000,000,355 | ---- | C] () -- C:\Users\Ann-Kristin.B\Computer - Verknüpfung.lnk
[2012.09.30 09:49:38 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\acovcnt.exe
[2011.11.03 18:09:24 | 000,217,536 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011.11.03 18:09:22 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2011.11.03 18:09:16 | 013,903,872 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll
[2011.10.20 08:47:09 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011.10.20 08:46:53 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2011.10.19 06:11:04 | 009,159,930 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >

painfiller 25.05.2013 13:04
OTL extras:

Code:
OTL Extras logfile created on: 25.05.2013 10:47:47 - Run 2
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Ann-Kristin.B\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,90 Gb Total Physical Memory | 1,78 Gb Available Physical Memory | 45,53% Memory free
7,81 Gb Paging File | 5,51 Gb Available in Paging File | 70,56% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 95,39 Gb Total Space | 5,88 Gb Free Space | 6,16% Space Free | Partition Type: NTFS
Drive D: | 135,08 Gb Total Space | 134,26 Gb Free Space | 99,39% Space Free | Partition Type: NTFS
 
Computer Name: ANN-KRISTINB-PC | User Name: Ann-Kristin.B | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htafile [open] -- "%1" %*
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L"
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{11AB1217-C14A-434C-A214-CA789E4E6665}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2486CC2E-1ED4-4EC9-9DC2-3D94C0FDF57D}" = rport=137 | protocol=17 | dir=out | app=system |
"{25DBE947-1D8A-429A-BBEF-9F39F4DD18C1}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{304F06C8-44C4-4508-99F6-7F41FDC98E1A}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{35138EFB-A5CD-4F9C-B0CA-22955FD728C8}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe |
"{3AB3FE31-A7E2-47C5-A3B7-D9B89F783636}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{3D8F0BCE-0B78-4F48-90C4-FF8D8BB72E23}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{45965A9E-CB6E-4F80-8CB6-2479306B6448}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{489C0B04-3012-4790-AD7B-600C87045BA3}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{5148AB41-415B-4761-BC08-320445C478AB}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{52CFE999-B874-4610-B4C0-89F64D9DF3E5}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{5313633B-0C5E-4733-B274-FAA7C016D82D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{5E36473F-385E-4418-AFF4-A3CDBB1A8FE3}" = rport=2869 | protocol=6 | dir=out | app=system |
"{66BA708F-8FBD-4858-8D6A-3B080147F7BB}" = rport=139 | protocol=6 | dir=out | app=system |
"{706E474C-B565-463C-BE7C-416FD89AD845}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{70D5E0F2-FAD1-411A-A9B0-8C232FA11204}" = lport=2869 | protocol=6 | dir=in | app=system |
"{728C3760-A594-4DED-8B6E-8DD1C4E77369}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{78453381-8146-489E-8C70-43E70788B6B2}" = lport=137 | protocol=17 | dir=in | app=system |
"{7AC46C47-1AD2-49D4-AF80-154F16D3E0AC}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{85DCF5FF-D80A-4600-8D00-468537DCEE90}" = rport=445 | protocol=6 | dir=out | app=system |
"{8A6B58BD-6BAA-43E7-88BB-71717E5386C4}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{8AEB04BB-59D3-4048-B4BB-9091F619D2E6}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8DD9D8F6-F5E3-484D-BE94-59452D142224}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{91F3C7C3-E2BA-457B-9815-878F7C441EB6}" = rport=138 | protocol=17 | dir=out | app=system |
"{99A1359C-B3F6-4D01-8FE9-837A812C0997}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{9E60ED47-D869-4D86-B4B5-78E813852362}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{AC882C1F-EBF3-48BF-83D5-5954B640008A}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{B0862B5F-83C4-4410-95B1-A01F57B25ADF}" = lport=2869 | protocol=6 | dir=in | app=system |
"{B2F5C2D9-2E2B-43FD-8368-3A0D08433B69}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BA6CA42A-B1B7-431E-9B98-54A4CFD84562}" = lport=138 | protocol=17 | dir=in | app=system |
"{BCD4C04D-69E6-4DFF-AE9A-B7344B6A8234}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{BDC53C73-0E33-4C4F-B4A8-D0B01E2AB520}" = lport=445 | protocol=6 | dir=in | app=system |
"{C56FB0F5-31E6-40EC-8017-5E902BE61C17}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{CABD667A-D7FF-445A-A641-EB406C641FC0}" = rport=10243 | protocol=6 | dir=out | app=system |
"{CE845B0A-8C47-45E5-B64A-30565AD8140A}" = lport=139 | protocol=6 | dir=in | app=system |
"{D1265378-4793-42FC-A6D1-78AE9466C623}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{D3DA41FE-69C5-4E3E-992A-DB7BC87D66A4}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{DFFB1129-CDFD-488F-9636-333D51D3A37B}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EBBC876C-FCF8-4B4F-A9E6-D3F168DD81C0}" = lport=10243 | protocol=6 | dir=in | app=system |
"{F6125247-F86F-4AC2-B4CA-E6CD2F0F2E7D}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{F80E1847-BE3D-43CD-BC94-B2D77DD84196}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F845247F-1E63-4FE3-965D-FB92243F35F8}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{057587D7-F584-4B7E-B560-7795152A3390}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7m\icq.exe |
"{1123624D-F4CA-40D0-9E83-EA8212EA0C07}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{1772B24C-4253-4517-864D-DFF680280AA6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{200E67EE-4780-4CB7-9989-D72723446988}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{209F67F8-9274-4899-AF62-8973792805E9}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
"{22D3B5E2-94C6-4EA3-A595-6B098036A06F}" = protocol=6 | dir=in | app=c:\program files (x86)\icq7m\icq.exe |
"{26AC851B-32DA-4FDD-88B1-1FB3A5BD0938}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{293C2774-1FFB-4A93-B83E-406F22ABD302}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 |
"{2E3346A1-B250-409D-9246-7EF7F768BAD6}" = protocol=6 | dir=in | app=c:\program files (x86)\search results toolbar\datamngr\srtool~1\dtuser.exe |
"{37ADF6F8-ED6A-4D37-B984-753C8260F961}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{405C0A6A-178A-4CA4-B81F-19A3BBCE444D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{438FF002-C9D9-4138-8D89-29742F2A3DFF}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{4CC1A29E-4EB8-4374-8995-AA3CB6CCD94C}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{57DA4DAA-D0AE-432E-B6FF-BF6FA88FE834}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{58629E3E-7D21-4FC5-8B74-2BCCDB9ECEDF}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{591D37B9-FBC0-4341-B868-ECF7F29B626D}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{5E2E44C9-295F-4E2E-AE58-AE4E342DAC43}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{681CFC57-F415-44D3-B15B-21BAA8AD190F}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{6B951511-95C4-4670-94D1-3317AFA8B834}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe |
"{6D1D3A4C-A07A-4829-9741-507E617A36C9}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{73C9730C-C958-46A0-9CE7-6BC257BAF59C}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7m\icq.exe |
"{75F3B432-54D1-49F8-937A-ABF57110E1C5}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{798D0F6C-3ADD-445A-87C3-704DF4308C2D}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{800A286C-6428-48F2-A50E-102826E6E861}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8BCD0107-EA58-41CD-9836-73618D67CC75}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{96A03537-287E-48FA-800B-DFF724D8D3B7}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{97A7C9EF-CB4E-4921-95D9-FED64770B231}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{9C7C9A34-7C60-44CF-A908-7A33198AD324}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{9F6A35B9-61F0-457A-BB7D-A1B622F71F77}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{A9CE206F-A4C3-4AA2-8379-C4AC27D67B5F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A9D89E4C-9ACF-460C-B3BB-82640289AFB4}" = protocol=6 | dir=out | app=system |
"{AB857E93-B320-43B3-9C30-B8F959487842}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{B1FBA132-9554-464A-90A0-4EDF7B6862BC}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{B3ADBCAB-D3AB-4A92-8AC7-DDBDAF57EF58}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{B6B8422D-2270-4BBB-BE55-87F0E0BC8012}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{B825761A-0490-4CE2-B4F1-3B67B70D0757}" = protocol=17 | dir=in | app=c:\program files (x86)\icq7m\icq.exe |
"{BF99167F-EAED-4CF2-8931-6C1FAB26AB70}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe |
"{BFC62DE7-34D2-4533-B7A4-E9CBCDCDC2DC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{CA507FC3-0647-49EC-8727-CF326E337140}" = protocol=17 | dir=in | app=c:\program files (x86)\search results toolbar\datamngr\srtool~1\dtuser.exe |
"{CDF2B718-9927-457E-83CF-82155C9761CE}" = protocol=17 | dir=in | app=c:\users\ann-kristin.b\appdata\roaming\dropbox\bin\dropbox.exe |
"{D129C0AA-43B7-47B2-8F51-C90B88398569}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{DBC075B4-AC56-4C61-95AE-6577F85A0D7E}" = protocol=6 | dir=in | app=c:\users\ann-kristin.b\appdata\roaming\dropbox\bin\dropbox.exe |
"{E119CC67-6F4B-4A66-8245-E80860F9E499}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{E8EAEFE6-7F0B-4BC8-84DC-DE8D288892F8}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe |
"{F58E3A90-C478-4F80-8BCA-B04C1E114591}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{F991A32A-075F-4B7E-A7CD-1EE5E229829D}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{F9E64A06-80B3-4A6F-8AF3-2AE59FB11A0C}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe |
"{FC96263D-6D88-4B8C-BFAF-26CEA6AF87D8}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{FDD96A5B-D830-49E1-B8D6-3C634B41B339}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"TCP Query User{1B4B9571-D86D-4A9F-BDB7-011955A50BDF}C:\users\ann-kristin.b\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\ann-kristin.b\appdata\roaming\spotify\spotify.exe |
"TCP Query User{45F83161-AAF1-47F3-B7BF-88DF892A44E1}C:\program files (x86)\icq7m\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icq7m\icq.exe |
"TCP Query User{52842473-25C5-4527-A9BE-EB64A2E3A8AE}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"TCP Query User{57A56DE4-DB8C-4167-A168-B60CD04F487D}C:\users\ann-kristin.b\appdata\roaming\spotify\spotify.exe" = protocol=6 | dir=in | app=c:\users\ann-kristin.b\appdata\roaming\spotify\spotify.exe |
"TCP Query User{E91A5721-FE31-4D79-A232-964E7A6383A5}C:\users\ann-kristin.b\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\ann-kristin.b\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{06F16684-0F3E-49EE-9F52-CE3B78AB936E}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"UDP Query User{3F1CF8FC-E4CE-4E03-B455-B360D4E70AEC}C:\program files (x86)\icq7m\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icq7m\icq.exe |
"UDP Query User{6EEEAD1F-BDD5-461F-895F-9128E04A8D58}C:\users\ann-kristin.b\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\ann-kristin.b\appdata\roaming\spotify\spotify.exe |
"UDP Query User{777D5FA4-504B-4195-82C8-47F297F896DC}C:\users\ann-kristin.b\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\ann-kristin.b\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{9AC40C84-A7E6-4F85-A487-D00EDE9C0253}C:\users\ann-kristin.b\appdata\roaming\spotify\spotify.exe" = protocol=17 | dir=in | app=c:\users\ann-kristin.b\appdata\roaming\spotify\spotify.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01E66AC4-B28B-494C-993D-3CD17020BEBC}" = Fresco Logic USB3.0 Host Controller
"{0225AD21-F3E2-4916-BFF3-65D3F9052582}" = iTunes
"{0919C44F-F18A-4E3B-A737-03685272CE72}" = Windows Live Remote Service Resources
"{11BA2B00-1495-47B8-BFA8-D08C605AB2CC}" = Windows Live Family Safety
"{17A4FD95-A507-43F1-BC92-D8572AF8340A}" = Windows Live Remote Service Resources
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{19F09425-3C20-4730-9E2A-FC2E17C9F362}" = Windows Live Remote Service Resources
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1AD147D0-BE0E-3D6C-AC11-64F6DC4163F1}" = Microsoft .NET Framework 4.5
"{1EB2CFC3-E1C5-4FC4-B1F8-549DD6242C67}" = Windows Live Remote Service Resources
"{1FB31F44-D4D0-4D76-944A-A1A5D79FD321}" = Windows Live Family Safety
"{230D1595-57DA-4933-8C4E-375797EBB7E1}" = Bluetooth Win7 Suite (64)
"{2F72F540-1F60-4266-9506-952B21D6640D}" = Apple Mobile Device Support
"{3CE222BA-66A6-4D18-BEE9-5D21C5798C3E}" = Windows Live Family Safety
"{3D7F836A-AE1F-4FA6-8DB9-4FE06697AB0A}" = Windows Live Family Safety
"{3E776E7A-F4C3-4A89-8EAD-535E722C8397}" = Windows Live Family Safety
"{53375A2B-FE08-42B6-8EB8-16818CD27B2C}" = Windows Live Family Safety
"{5E2CD4FB-4538-4831-8176-05D653C3E6D4}" = Windows Live Remote Service Resources
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{5FEAD3E5-A158-4B66-B92B-0C959D7CF838}" = Windows Live Remote Service Resources
"{63919769-655A-48A8-AD6C-39B471F683ED}" = Windows Live Family Safety
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{692CCE55-9EAE-4F57-A834-092882E7FE0B}" = Windows Live Remote Client Resources
"{6CBFDC3C-CF21-4C02-A6DC-A5A2707FAF55}" = Windows Live Remote Service Resources
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6DDCFF78-6F91-438C-9567-C5CAA9D7F56C}" = Windows Live Family Safety
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{761C6783-D3BC-48AB-8E7C-61CE918A8436}" = ASUS Secure Delete
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{825C7D3F-D0B3-49D5-A42B-CBB0FBE85E99}" = Windows Live Remote Client Resources
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{8970AE69-40BE-4058-9916-0ACB1B974A3D}" = Windows Live Remote Client Resources
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8EB588BD-D398-40D0-ADF7-BE1CEEF7C116}" = Windows Live Remote Client Resources
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}" = ASUS Power4Gear Hybrid
"{A679FBE4-BA2D-4514-8834-030982C8B31A}" = Windows Live Remote Service Resources
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B0BF8602-EA52-4B0A-A2BD-EDABB0977030}" = Windows Live Remote Client Resources
"{B36055BF-5F0E-4EAB-804D-9203DFB34ADC}" = Windows Live Family Safety
"{B750FA38-7AB0-42CB-ACBB-E7DBE9FF603F}" = Windows Live Remote Client Resources
"{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}" = Intel(R) Turbo Boost Technology Monitor 2.0
"{C504EC13-E122-4939-BD6E-EE5A3BAA5FEC}" = Windows Live Remote Client Resources
"{C9F05151-95A9-4B9B-B534-1760E2D014A5}" = Windows Live Remote Client Resources
"{CEA21F20-DBF4-464C-8B81-28B8508AFDDD}" = Windows Live Family Safety
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DBEDAF67-C5A3-4C91-951D-31F3FE63AF3F}" = Windows Live Remote Client Resources
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E01819BD-709F-43A1-9600-6F5E4C584C37}" = Windows Live Family Safety
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{E60F14FA-E114-4F25-AEE0-33FE9EC9B1C3}" = Windows Live Family Safety
"{EFB20CF5-1A6D-41F3-8895-223346CE6291}" = Windows Live Remote Service Resources
"{F11009B0-F4DB-463B-B717-5266E47498AA}" = Windows Live Family Safety
"{FAA3933C-6F0D-4350-B66B-9D7F7031343E}" = Windows Live Remote Service Resources
"{FAD0EC0B-753B-4A97-AD34-32AC1EC8DB69}" = Windows Live Remote Client Resources
"Elantech" = ETDWare PS/2-X64 10.0.5.2_WHQL
"Personal Backup 5_is1" = Personal Backup 5.4
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{039480EE-6933-4845-88B8-77FD0C3D059D}" = Windows Live Mesh
"{05E379CC-F626-4E7D-8354-463865B303BF}" = Windows Live UX Platform Language Pack
"{062E4D94-8306-46D5-81B6-45E6AD09C799}" = Windows Live Messenger
"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology
"{0A4C4B29-5A9D-4910-A13C-B920D5758744}" = بريد Windows Live
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D261C88-454B-46FE-B43B-640E621BDA11}" = Windows Live Mail
"{0EC0B576-90F9-43C3-8FAD-A4902DF4B8F4}" = Galeria de Fotografias do Windows Live
"{128133D3-037A-4C62-B1B7-55666A10587A}" = Windows Live UX Platform Language Pack
"{14B441B7-774D-4170-98EA-A13667AE6218}" = Windows Live Writer Resources
"{168E7302-890A-4138-9109-A225ACAF7AD1}" = Windows Live Photo Common
"{17F99FCE-8F03-4439-860A-25C5A5434E18}" = Windows Live Essentials
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{198EA334-8A3F-4CB2-9D61-6C10B8168A6F}" = Windows Live Writer
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1A82AE99-84D3-486D-BAD6-675982603E14}" = Windows Live Writer
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2511AAD7-82DF-4B97-B0B3-E1B933317010}" = Windows Live Writer Resources
"{25A381E1-0AB9-4E7A-ACCE-BA49D519CF4E}" = Windows Live Mail
"{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{29373E24-AC72-424E-8F2A-FB0F9436F21F}" = Windows Live Photo Common
"{2A07C35B-8384-4DA4-9A95-442B6C89A073}" = Windows Live Essentials
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2C4E06CC-1F04-4C25-8B3C-93A9049EC42C}" = Windows Live UX Platform Language Pack
"{2C865FB0-051E-4D22-AC62-428E035AEAF0}" = Windows Live Mesh
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{370F888E-42A7-4911-9E34-7D74632E17EB}" = Windows Live Photo Common
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3B9A92DA-6374-4872-B646-253F18624D5F}" = Windows Live Writer
"{3F4143A1-9C21-4011-8679-3BC1014C6886}" = Windows Live Mesh
"{40BFD84C-64CD-42CC-9909-8734C50429C6}" = Windows Live UX Platform Language Pack
"{45C56AA7-ED1B-4800-A97F-EDDF3F3520B1}" = Apple Application Support
"{46872828-6453-4138-BE1C-CE35FBF67978}" = Windows Live Mesh
"{48294D95-EE9A-4377-8213-44FC4265FB27}" = Windows Live Messenger
"{488F0347-C4A7-4374-91A7-30818BEDA710}" = Galerie de photos Windows Live
"{48C0DC5E-820A-44F2-890E-29B68EDD3C78}" = Windows Live Writer
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B28D47A-5FF0-45F8-8745-11DC2A1C9D0F}" = Windows Live Writer
"{4D83F339-5A5C-4B21-8FD3-5D407B981E72}" = Windows Live Photo Common
"{506FC723-8E6C-4417-9CFF-351F99130425}" = Windows Live UX Platform Language Pack
"{54A168C9-2250-4058-80EB-1F4A4192548A}" = AX88772B Windows 7 Drivers
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{58172D66-2F69-4215-9AEC-ED8196023736}" = ASUS Tutor
"{5AF4B3C4-C393-48D7-AC7E-8E7615579548}" = Adobe AIR
"{5D273F60-0525-48BA-A5FB-D0CAA4A952AE}" = Windows Live Movie Maker
"{62687B11-58B5-4A18-9BC3-9DF4CE03F194}" = Windows Live Writer Resources
"{62BBB2F0-E220-4821-A564-730807D2C34D}" = Realtek USB 2.0 Reader Driver
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{677AAD91-1790-4FC5-B285-0E6A9D65F7DC}" = Windows Live Mail
"{6807427D-8D68-4D30-AF5B-0B38F8F948C8}" = Windows Live Writer Resources
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A4ABCDC-0A49-4132-944E-01FBCCB3465C}" = Windows Live UX Platform Language Pack
"{6CB36609-E3A6-446C-A3C1-C71E311D2B9C}" = Windows Live Movie Maker
"{6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}" = Windows Live Movie Maker
"{6E8AFC13-F7B8-41D8-88AB-F1D0CFC56305}" = Windows Live Messenger
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73FC3510-6421-40F7-9503-EDAE4D0CF70D}" = Windows Live Photo Common
"{7465A996-0FCA-4D2D-A52C-F833B0829B5B}" = Windows Live Movie Maker
"{7496FD31-E5CB-4AE4-82D3-31099558BF6A}" = Windows Live Mesh
"{749F674B-2674-47E8-879C-5626A06B2A91}" = InstantOn for NB
"{74E8A7F6-575D-42C7-9178-E87D1B3BEFE8}" = Windows Live UX Platform Language Pack
"{77477AEA-5757-47D8-8B33-939F43D82218}" = Windows Live UX Platform Language Pack
"{77F69CA1-E53D-4D77-8BA3-FA07606CC851}" = Фотоальбом Windows Live
"{781B39EC-2E18-41FC-9B00-B84E4FFCA85F}" = ICQ7M
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78DAE910-CA72-450E-AD22-772CB1A00678}" = Windows Live Mesh
"{78DBE8CE-61F6-4D6C-806C-A0FFF65F5E1D}" = Windows Live Messenger
"{7D1C7B9F-2744-4388-B128-5C75B8BCCC84}" = Windows Live Essentials
"{7D916FA5-DAE9-4A25-B089-655C70EAF607}" = Qualcomm Atheros WiFi Driver Installation
"{7E017923-16F8-4E32-94EF-0A150BD196FE}" = Windows Live Writer
"{7FF11E53-C002-4F40-8D68-6BE751E5DD62}" = Windows Live Writer Resources
"{804DE397-F82C-4867-9085-E0AA539A3294}" = Windows Live Writer
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111249233}" = Dream Vacation Solitaire
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}" = Galapago
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}" = Dream Day First Home
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115290153}" = Go Go Gourmet Chef of the Year
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115320460}" = Turbo Fiesta
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-116672750}" = World of Goo
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117080787}" = Plants vs Zombies
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117948443}" = Mahjong Memoirs
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-118716773}" = Deadtime Stories
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-119205603}" = Farm Frenzy 3 - Madagascar
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{841F1FB4-FDF8-461C-A496-3E1CFD84C0B5}" = Windows Live Mesh
"{84A411F9-40A5-4CDA-BF46-E09FBB2BC313}" = Windows Live Essentials
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8F21291E-0444-4B1D-B9F9-4370A73E346D}" = WinFlash
"{8FF3891F-01B5-4A71-BFCD-20761890471C}" = Windows Live Messenger
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{93E464B3-D075-4989-87FD-A828B5C308B1}" = Windows Live Writer Resources
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BD262D0-B788-4546-A0A5-F4F56EC3834B}" = Windows Live Photo Common
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9DB90178-B5B0-45BD-B0A7-D40A6A1DF1CA}" = Windows Live Movie Maker
"{9FAE6E8D-E686-49F5-A574-0A58DFD9580C}" = Windows Live Mail
"{A0B91308-6666-4249-8FF6-1E11AFD75FE1}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A41A708E-3BE6-4561-855D-44027C1CF0F8}" = Windows Live Photo Common
"{A60B3BF0-954B-42AF-B8D8-2C1D34B613AA}" = Windows Live Photo Gallery
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}" = ATK Package
"{AB61A2E9-37D3-485D-9085-19FBDF8CEF4A}" = Windows Live Messenger
"{ABD534B7-E951-470E-92C2-CD5AF1735726}" = Windows Live Essentials
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.03) - Deutsch
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{ADE85655-8D1E-4E4B-BF88-5E312FB2C74F}" = Windows Live Mail
"{ADFE4AED-7F8E-4658-8D6E-742B15B9F120}" = Windows Live Photo Common
"{AECA3622-E634-4A55-A696-70A511CBE06E}" = ASUS USB Charger Plus
"{AF01B90A-D25C-4F60-AECD-6EEDF509DC11}" = Windows Live Mesh
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B2BCA478-EC0F-45EE-A9E9-5EABE87EA72D}" = Windows Live Photo Common
"{B2E90616-C50D-4B89-A40D-92377AC669E5}" = Windows Live Messenger
"{B480904D-F73F-4673-B034-8A5F492C9184}" = Nuance PDF Reader
"{B618C3BF-5142-4630-81DD-F96864F97C7E}" = Windows Live Essentials
"{B63F0CE3-CCD0-490A-9A9C-E1A3B3A17137}" = Почта Windows Live
"{B7B60C4F-0DB8-42EF-8EDC-5F21D4C2D73F}" = PWR Option
"{BAEE89D5-6E87-4F89-9603-A1C100479181}" = Windows Live Messenger
"{BF022D76-9F72-4203-B8FA-6522DC66DFDA}" = Windows Live Movie Maker
"{C00C2A91-6CB3-483F-80B3-2958E29468F1}" = Συλλογή φωτογραφιών του Windows Live
"{C29FC15D-E84B-4EEC-8505-4DED94414C59}" = Windows Live Writer Resources
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C4BC5A5F-4A97-47CC-99C3-AB8E10572AFE}" = Wireless Console 3
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}" = Windows Live Mesh ActiveX Control for Remote Connections
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common
"{C95A5A77-622F-45CA-9540-84468FCB18B1}" = Windows Live Messenger
"{CB7224D9-6DCA-43F1-8F83-6B1E39A00F92}" = Windows Live Movie Maker
"{CBFD061C-4B27-4A89-ADD8-210316EEFA11}" = Windows Live Messenger
"{CC0A85B2-734A-45B3-B678-05F6A6499AC7}" = Citavi 4
"{CDC39BF2-9697-4959-B893-A2EE05EF6ACB}" = Windows Live Writer
"{CE929F09-3853-4180-BD90-30764BFF7136}" = גלריית התמונות של Windows Live
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D299197D-CDEA-41A6-A363-F532DE4114FD}" = Windows Live UX Platform Language Pack
"{D39F0676-163E-4595-A917-E28F99BBD4D2}" = ASUS AI Recovery
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D588365A-AE39-4F27-BDAE-B4E72C8E900C}" = Windows Live Mail
"{D6F25CF9-4E87-43EB-B324-C12BE9CDD668}" = Windows Live UX Platform Language Pack
"{DAEF48AD-89C8-4A93-B1DD-45B7E4FB6071}" = Windows Live Movie Maker
"{DBAA2B17-D596-4195-A169-BA2166B0D69B}" = Windows Live Mail
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DE7C13A6-E4EA-4296-B0D5-5D7E8AD69501}" = Windows Live Writer
"{DE8F99FD-2FC7-4C98-AA67-2729FDE1F040}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DEF91E0F-D266-453D-B6F2-1BA002B40CB6}" = Windows Live Essentials
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E54EEB5D-41ED-40FE-B4A8-8565DB81469B}" = Controlo ActiveX do Windows Live Mesh para Ligações Remotas
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E62E0550-C098-43A2-B54B-03FB1E634483}" = Windows Live Writer
"{E727A662-AF9F-4DEE-81C5-F4A1686F3DFC}" = Windows Live Writer Resources
"{E83DC314-C926-4214-AD58-147691D6FE9F}" = Основные компоненты Windows Live
"{E85A4EFC-82F2-4CEE-8A8E-62FDAD353A66}" = Galería fotográfica de Windows Live
"{EA17F4FC-FDBF-4CF8-A529-2D983132D053}" = Skype™ 6.0
"{ED16B700-D91F-44B0-867C-7EB5253CA38D}" = Raccolta foto di Windows Live
"{EEF99142-3357-402C-B298-DEC303E12D92}" = Windows Live 影像中心
"{EF7EAB13-46FC-49DD-8E3C-AAF8A286C5BB}" = Windows Live 程式集
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F52C5BE7-3F57-464E-8A54-908402E43CE8}" = Windows Live Writer Resources
"{F7E80BA7-A09D-4DD1-828B-C4A0274D4720}" = Windows Live Mesh
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}" = ASUS Live Update
"{FBCA06D2-4642-4F33-B20A-A7AB3F0D2E69}" = معرض صور Windows Live
"{FCDE76CB-989D-4E32-9739-6A272D2B0ED7}" = Windows Live Mesh
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF105207-8423-4E13-B0B1-50753170B245}" = Windows Live Movie Maker
"{FF3DFA01-1E98-46B4-A065-DA8AD47C9598}" = Windows Live Movie Maker
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"ALDI Bestellsoftware" = ALDI Bestellsoftware 4.12.2
"Asus Vibe2.0" = AsusVibe2.0
"ASUS WebStorage" = ASUS WebStorage
"avast" = avast! Free Antivirus
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Game Park Console" = Game Park Console
"GMATPrep 2.1.279" = GMATPrep
"Google Chrome" = Google Chrome
"InstallShield_{54A168C9-2250-4058-80EB-1F4A4192548A}" = AX88772B Windows 7 Drivers
"McAfee Security Scan" = McAfee Security Scan Plus
"Mozilla Firefox 20.0.1 (x86 de)" = Mozilla Firefox 20.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"TeamViewer 8" = TeamViewer 8
"WinLiveSuite" = Windows Live Essentials
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"jZip" = jZip
"Spotify" = Spotify
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 24.05.2013 09:39:06 | Computer Name = Ann-KristinB-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 3135
 
Error - 24.05.2013 09:39:07 | Computer Name = Ann-KristinB-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 24.05.2013 09:39:07 | Computer Name = Ann-KristinB-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 4134
 
Error - 24.05.2013 09:39:07 | Computer Name = Ann-KristinB-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 4134
 
Error - 24.05.2013 09:39:09 | Computer Name = Ann-KristinB-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 24.05.2013 09:39:09 | Computer Name = Ann-KristinB-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 5616
 
Error - 24.05.2013 09:39:09 | Computer Name = Ann-KristinB-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 5616
 
Error - 24.05.2013 15:33:34 | Computer Name = Ann-KristinB-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 24.05.2013 15:33:34 | Computer Name = Ann-KristinB-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1123
 
Error - 24.05.2013 15:33:34 | Computer Name = Ann-KristinB-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1123
 
[ OSession Events ]
Error - 11.12.2012 12:25:29 | Computer Name = Ann-KristinB-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6662.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 2670
 seconds with 120 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 24.05.2013 05:16:40 | Computer Name = Ann-KristinB-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  cdrom
 
Error - 24.05.2013 05:16:44 | Computer Name = Ann-KristinB-PC | Source = ipnathlp | ID = 31004
Description =
 
Error - 24.05.2013 09:31:10 | Computer Name = Ann-KristinB-PC | Source = ipnathlp | ID = 31004
Description =
 
Error - 24.05.2013 09:33:54 | Computer Name = Ann-KristinB-PC | Source = DCOM | ID = 10010
Description =
 
Error - 24.05.2013 15:11:58 | Computer Name = Ann-KristinB-PC | Source = ipnathlp | ID = 31004
Description =
 
Error - 24.05.2013 15:12:00 | Computer Name = Ann-KristinB-PC | Source = ipnathlp | ID = 31004
Description =
 
Error - 24.05.2013 15:12:02 | Computer Name = Ann-KristinB-PC | Source = ipnathlp | ID = 31004
Description =
 
Error - 25.05.2013 02:55:41 | Computer Name = Ann-KristinB-PC | Source = ipnathlp | ID = 31004
Description =
 
Error - 25.05.2013 02:55:52 | Computer Name = Ann-KristinB-PC | Source = ipnathlp | ID = 31004
Description =
 
Error - 25.05.2013 03:08:36 | Computer Name = Ann-KristinB-PC | Source = bowser | ID = 8003
Description =
 
 
< End of report >
Systemlook

Code:
SystemLook 30.07.11 by jpshortstuff
Log created at 11:10 on 25/05/2013 by Ann-Kristin.B
Administrator - Elevation successful

========== filefind ==========

Searching for "*speedanalysis*"
C:\Users\Ann-Kristin.B\AppData\Roaming\speedanalysis.ico        --a---- 30894 bytes        [18:38 02/04/2013]        [18:38 02/04/2013] 7E87C3301ED85E468ABF1204B85B335C

Searching for "*Datamngr*"
No files found.

Searching for "*IBUpdater*"
No files found.

Searching for "*babylon*"
No files found.

Searching for "*Search_Results*"
No files found.

Searching for "*Askcom*"
C:\Windows\System32\taskcomp.dll        --a---- 473600 bytes        [19:49 18/02/2011]        [13:27 20/11/2010] 6DC4A7242F565C9E9C9CCC7BB0FA75C7
C:\Windows\System32\ar-SA\taskcomp.dll.mui        --a---- 12288 bytes        [12:03 11/04/2011]        [12:03 11/04/2011] BD32A4D82703D6929AD5D818691DA74A
C:\Windows\System32\de-DE\taskcomp.dll.mui        --a---- 14848 bytes        [04:23 19/02/2011]        [04:23 19/02/2011] BD0A09B79E8F7F89908E2C94DAE064AF
C:\Windows\System32\el-GR\taskcomp.dll.mui        --a---- 15872 bytes        [04:55 19/02/2011]        [04:55 19/02/2011] 863583E87D9FB3B8D9F3754705BCC749
C:\Windows\System32\en-US\taskcomp.dll.mui        --a---- 13312 bytes        [05:35 14/07/2009]        [02:29 14/07/2009] 8DE7E652F99E53C697B9B01308791105
C:\Windows\System32\es-ES\taskcomp.dll.mui        --a---- 14336 bytes        [04:18 19/02/2011]        [04:18 19/02/2011] C2A7DD800360F59C1D1F7797F232B94B
C:\Windows\System32\fr-FR\taskcomp.dll.mui        --a---- 15360 bytes        [04:28 19/02/2011]        [04:28 19/02/2011] 6A5DC45C9109B48FECD371F9D386F055
C:\Windows\System32\he-IL\taskcomp.dll.mui        --a---- 11776 bytes        [05:00 19/02/2011]        [05:00 19/02/2011] D05315037E0094869663B6630219E329
C:\Windows\System32\it-IT\taskcomp.dll.mui        --a---- 15360 bytes        [04:34 19/02/2011]        [04:34 19/02/2011] A9D348EA3B3A38E83C6C2065ABE485CB
C:\Windows\System32\nl-NL\taskcomp.dll.mui        --a---- 13824 bytes        [04:39 19/02/2011]        [04:39 19/02/2011] 8743503CDA5D338F47FF5B1ED977BA2B
C:\Windows\System32\pt-PT\taskcomp.dll.mui        --a---- 14848 bytes        [04:44 19/02/2011]        [04:44 19/02/2011] 54681B0C0F8FF3C8C9AE5AEC8643902E
C:\Windows\System32\ru-RU\taskcomp.dll.mui        --a---- 13824 bytes        [11:50 17/03/2011]        [11:50 17/03/2011] 4D459E2F2882629533A60EECF88D94C1
C:\Windows\System32\zh-TW\taskcomp.dll.mui        --a---- 7168 bytes        [04:50 19/02/2011]        [04:50 19/02/2011] 498F40A6D1CA5C401A070B56497B6A0E
C:\Windows\SysWOW64\taskcomp.dll        --a---- 305152 bytes        [19:49 18/02/2011]        [12:21 20/11/2010] 1C3E8371377E988B683797A132EFFE1B
C:\Windows\SysWOW64\ar-SA\taskcomp.dll.mui        --a---- 12288 bytes        [12:03 11/04/2011]        [12:03 11/04/2011] 69454B378B3EAC84143ED0B7294A863C
C:\Windows\SysWOW64\de-DE\taskcomp.dll.mui        --a---- 14848 bytes        [04:23 19/02/2011]        [04:23 19/02/2011] E758D59C883A37BBF8A72CFE431FBFB7
C:\Windows\SysWOW64\el-GR\taskcomp.dll.mui        --a---- 15872 bytes        [04:55 19/02/2011]        [04:55 19/02/2011] 9C1FBCC7CA125FCEC69B00B3443980ED
C:\Windows\SysWOW64\en-US\taskcomp.dll.mui        --a---- 13312 bytes        [05:35 14/07/2009]        [02:05 14/07/2009] FC245ABE9E103F75C5F94B8BBAD0BD68
C:\Windows\SysWOW64\es-ES\taskcomp.dll.mui        --a---- 14336 bytes        [04:18 19/02/2011]        [04:18 19/02/2011] 96954FA74BC1F644065C1DC417B7B30D
C:\Windows\SysWOW64\fr-FR\taskcomp.dll.mui        --a---- 15360 bytes        [04:28 19/02/2011]        [04:28 19/02/2011] 39AB1E8E8675ECD2DD994F217B89AD31
C:\Windows\SysWOW64\he-IL\taskcomp.dll.mui        --a---- 11776 bytes        [05:01 19/02/2011]        [05:01 19/02/2011] 24E5D55190AF762BA8AEED37B5C7E138
C:\Windows\SysWOW64\it-IT\taskcomp.dll.mui        --a---- 15360 bytes        [04:34 19/02/2011]        [04:34 19/02/2011] B2483F3179C4FBA165CA5FD47E6A5074
C:\Windows\SysWOW64\nl-NL\taskcomp.dll.mui        --a---- 13824 bytes        [04:39 19/02/2011]        [04:39 19/02/2011] 75C91D3C8D3B926ADEA91E4B6F5AF88C
C:\Windows\SysWOW64\pt-PT\taskcomp.dll.mui        --a---- 14848 bytes        [04:44 19/02/2011]        [04:44 19/02/2011] 011B34490A82DE019420246798ED4511
C:\Windows\SysWOW64\ru-RU\taskcomp.dll.mui        --a---- 13824 bytes        [11:50 17/03/2011]        [11:50 17/03/2011] 238AE2330EE8B323F441572DCB1EB3EA
C:\Windows\SysWOW64\zh-TW\taskcomp.dll.mui        --a---- 7168 bytes        [04:50 19/02/2011]        [04:50 19/02/2011] 22337AD566D0092AB14AA1B1682F6C64
C:\Windows\winsxs\amd64_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_ar-sa_c15ea8c3a0bb475d\taskcomp.dll.mui        --a---- 12288 bytes        [12:03 11/04/2011]        [12:03 11/04/2011] BD32A4D82703D6929AD5D818691DA74A
C:\Windows\winsxs\amd64_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ad0d764a76dfc578\taskcomp.dll.mui        --a---- 14848 bytes        [04:23 19/02/2011]        [04:23 19/02/2011] BD0A09B79E8F7F89908E2C94DAE064AF
C:\Windows\winsxs\amd64_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_55a3a3dd65f52e06\taskcomp.dll.mui        --a---- 15872 bytes        [04:55 19/02/2011]        [04:55 19/02/2011] 863583E87D9FB3B8D9F3754705BCC749
C:\Windows\winsxs\amd64_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_en-us_55fe4c4365bdd13d\taskcomp.dll.mui        --a---- 13312 bytes        [05:35 14/07/2009]        [02:29 14/07/2009] 8DE7E652F99E53C697B9B01308791105
C:\Windows\winsxs\amd64_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_es-es_55c9a92765e4c2e2\taskcomp.dll.mui        --a---- 14336 bytes        [04:18 19/02/2011]        [04:18 19/02/2011] C2A7DD800360F59C1D1F7797F232B94B
C:\Windows\winsxs\amd64_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f8811f2658b6d944\taskcomp.dll.mui        --a---- 15360 bytes        [04:28 19/02/2011]        [04:28 19/02/2011] 6A5DC45C9109B48FECD371F9D386F055
C:\Windows\winsxs\amd64_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_he-il_3ca0c6c83f25da32\taskcomp.dll.mui        --a---- 11776 bytes        [05:00 19/02/2011]        [05:00 19/02/2011] D05315037E0094869663B6630219E329
C:\Windows\winsxs\amd64_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_it-it_e2a9156d2fe8bec2\taskcomp.dll.mui        --a---- 15360 bytes        [04:34 19/02/2011]        [04:34 19/02/2011] A9D348EA3B3A38E83C6C2065ABE485CB
C:\Windows\winsxs\amd64_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_nl-nl_0f0a3da1eec5cd44\taskcomp.dll.mui        --a---- 13824 bytes        [04:39 19/02/2011]        [04:39 19/02/2011] 8743503CDA5D338F47FF5B1ED977BA2B
C:\Windows\winsxs\amd64_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_pt-pt_587c5233d1e13eb8\taskcomp.dll.mui        --a---- 14848 bytes        [04:44 19/02/2011]        [04:44 19/02/2011] 54681B0C0F8FF3C8C9AE5AEC8643902E
C:\Windows\winsxs\amd64_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_ru-ru_9f1f63f7b6c2cce4\taskcomp.dll.mui        --a---- 13824 bytes        [11:50 17/03/2011]        [11:50 17/03/2011] 4D459E2F2882629533A60EECF88D94C1
C:\Windows\winsxs\amd64_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_zh-tw_b980f4074a5087bf\taskcomp.dll.mui        --a---- 7168 bytes        [04:50 19/02/2011]        [04:50 19/02/2011] 498F40A6D1CA5C401A070B56497B6A0E
C:\Windows\winsxs\amd64_microsoft-windows-t..duler-compatibility_31bf3856ad364e35_6.1.7600.16385_none_c489ed71f5ecb9f6\taskcomp.dll        --a---- 473600 bytes        [23:47 13/07/2009]        [01:41 14/07/2009] AEFBD8D2C9CE363F84AE0F89036412A6
C:\Windows\winsxs\amd64_microsoft-windows-t..duler-compatibility_31bf3856ad364e35_6.1.7601.17514_none_c6bb0139f2db3d90\taskcomp.dll        --a---- 473600 bytes        [19:49 18/02/2011]        [13:27 20/11/2010] 6DC4A7242F565C9E9C9CCC7BB0FA75C7
C:\Windows\winsxs\x86_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_ar-sa_65400d3fe85dd627\taskcomp.dll.mui        --a---- 12288 bytes        [12:03 11/04/2011]        [12:03 11/04/2011] 69454B378B3EAC84143ED0B7294A863C
C:\Windows\winsxs\x86_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_de-de_50eedac6be825442\taskcomp.dll.mui        --a---- 14848 bytes        [04:23 19/02/2011]        [04:23 19/02/2011] E758D59C883A37BBF8A72CFE431FBFB7
C:\Windows\winsxs\x86_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_f9850859ad97bcd0\taskcomp.dll.mui        --a---- 15872 bytes        [04:55 19/02/2011]        [04:55 19/02/2011] 9C1FBCC7CA125FCEC69B00B3443980ED
C:\Windows\winsxs\x86_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f9dfb0bfad606007\taskcomp.dll.mui        --a---- 13312 bytes        [05:35 14/07/2009]        [02:05 14/07/2009] FC245ABE9E103F75C5F94B8BBAD0BD68
C:\Windows\winsxs\x86_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_es-es_f9ab0da3ad8751ac\taskcomp.dll.mui        --a---- 14336 bytes        [04:18 19/02/2011]        [04:18 19/02/2011] 96954FA74BC1F644065C1DC417B7B30D
C:\Windows\winsxs\x86_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_9c6283a2a059680e\taskcomp.dll.mui        --a---- 15360 bytes        [04:28 19/02/2011]        [04:28 19/02/2011] 39AB1E8E8675ECD2DD994F217B89AD31
C:\Windows\winsxs\x86_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_he-il_e0822b4486c868fc\taskcomp.dll.mui        --a---- 11776 bytes        [05:01 19/02/2011]        [05:01 19/02/2011] 24E5D55190AF762BA8AEED37B5C7E138
C:\Windows\winsxs\x86_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_it-it_868a79e9778b4d8c\taskcomp.dll.mui        --a---- 15360 bytes        [04:34 19/02/2011]        [04:34 19/02/2011] B2483F3179C4FBA165CA5FD47E6A5074
C:\Windows\winsxs\x86_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_nl-nl_b2eba21e36685c0e\taskcomp.dll.mui        --a---- 13824 bytes        [04:39 19/02/2011]        [04:39 19/02/2011] 75C91D3C8D3B926ADEA91E4B6F5AF88C
C:\Windows\winsxs\x86_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_pt-pt_fc5db6b01983cd82\taskcomp.dll.mui        --a---- 14848 bytes        [04:44 19/02/2011]        [04:44 19/02/2011] 011B34490A82DE019420246798ED4511
C:\Windows\winsxs\x86_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_ru-ru_4300c873fe655bae\taskcomp.dll.mui        --a---- 13824 bytes        [11:50 17/03/2011]        [11:50 17/03/2011] 238AE2330EE8B323F441572DCB1EB3EA
C:\Windows\winsxs\x86_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_zh-tw_5d62588391f31689\taskcomp.dll.mui        --a---- 7168 bytes        [04:50 19/02/2011]        [04:50 19/02/2011] 22337AD566D0092AB14AA1B1682F6C64
C:\Windows\winsxs\x86_microsoft-windows-t..duler-compatibility_31bf3856ad364e35_6.1.7600.16385_none_686b51ee3d8f48c0\taskcomp.dll        --a---- 304640 bytes        [23:30 13/07/2009]        [01:16 14/07/2009] 0D4E8439AD3159A335FA720E043EA22E
C:\Windows\winsxs\x86_microsoft-windows-t..duler-compatibility_31bf3856ad364e35_6.1.7601.17514_none_6a9c65b63a7dcc5a\taskcomp.dll        --a---- 305152 bytes        [19:49 18/02/2011]        [12:21 20/11/2010] 1C3E8371377E988B683797A132EFFE1B

Searching for "*search results toolbar*"
No files found.

Searching for "*Conduit*"
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\iSyncConduit.dll        --a---- 1207392 bytes        [11:43 06/12/2012]        [11:43 06/12/2012] C963B2DECF0872C4A79D4E5E97062E8C
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Internet Explorer\DOMStore\SHMEP9SR\fbtemplate.conduitapps[1].xml        --a---- 13 bytes        [18:39 02/04/2013]        [18:39 02/04/2013] C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Internet Explorer\DOMStore\SHMEP9SR\storage.conduit[1].xml        --a---- 13 bytes        [18:39 02/04/2013]        [18:39 02/04/2013] C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\4G8X40E0\sf_conduit_loader[1].htm        ------- 7757 bytes        [09:27 30/04/2013]        [09:27 30/04/2013] D515D54078E48B8D510EEAEFE950B2F8
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CTGFPDSH\appsmetadata_toolbar_conduit-services_com[1].txt        ------- 2963 bytes        [12:27 29/04/2013]        [12:27 29/04/2013] 04D63038377403F2E5EC32F2BBB8ACEA
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CTGFPDSH\contextmenu_toolbar_conduit-services_com[1].htm        ------- 1292 bytes        [08:52 10/03/2013]        [08:52 10/03/2013] 7C8B60DA9FA3A225B5E74008392448F9
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\IRVPQ839\contextmenu_toolbar_conduit-services_com[1].htm        ------- 1292 bytes        [08:52 10/03/2013]        [08:52 10/03/2013] 7C8B60DA9FA3A225B5E74008392448F9
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\IRVPQ839\contextmenu_toolbar_conduit-services_com[2].htm        ------- 1292 bytes        [08:52 10/03/2013]        [08:52 10/03/2013] 7C8B60DA9FA3A225B5E74008392448F9
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\S07UL6GK\search_conduit_com[1].htm        ------- 206 bytes        [09:13 10/03/2013]        [09:13 10/03/2013] 13BFF8DAE9C2478345727EE4098D5E27
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\S07UL6GK\sf_conduit_mam_app[1].htm        ------- 4127 bytes        [09:27 30/04/2013]        [09:27 30/04/2013] D23286417EAFC54E79FCD5D940523958
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\SWTQ0RMH\conduit[1].png        ------- 3213 bytes        [18:38 05/01/2013]        [18:38 05/01/2013] 1F33D127AF47707401FDF33A2EC2F5C5
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\T390JW25\contextmenu_toolbar_conduit-services_com[1].htm        ------- 1292 bytes        [08:52 10/03/2013]        [08:52 10/03/2013] 7C8B60DA9FA3A225B5E74008392448F9
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TUL8R3CO\translation_toolbar_conduit-services_com[1].txt        ------- 113722 bytes        [12:27 29/04/2013]        [12:27 29/04/2013] EAB421D02915E000E993E3280535836C
C:\Users\Ann-Kristin.B\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\TKVH019R\storage.conduit[1].xml        --a---- 13 bytes        [12:37 11/12/2012]        [12:37 11/12/2012] C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
C:\Users\Ann-Kristin.B\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VG613M5D\app.mam.conduit[1].xml        --a---- 13 bytes        [09:27 30/04/2013]        [09:27 30/04/2013] C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
C:\Users\Ann-Kristin.B\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\Z08Y2JCT\fbtemplate.conduitapps[1].xml        --a---- 13 bytes        [12:37 11/12/2012]        [12:37 11/12/2012] C1DDEA3EF6BBEF3E7060A1A9AD89E4C5

Searching for "*ICQ6Toolbar*"
No files found.

Searching for "*PriceGong*"
No files found.

Searching for "*file scout*"
No files found.

Searching for "*PerformerSoft*"
No files found.

Searching for "*wincert*"
No files found.

========== folderfind ==========

Searching for "*speedanalysis*"
C:\Qoobox\Quarantine\C\Program Files (x86)\SpeedAnalysis.com        d------        [18:25 23/05/2013]

Searching for "*Datamngr*"
No folders found.

Searching for "*IBUpdater*"
No folders found.

Searching for "*babylon*"
C:\Program Files (x86)\ICQ7M\Xtraz\icq\theme\babylon_feed        d------        [19:43 30/09/2012]

Searching for "*Search_Results*"
No folders found.

Searching for "*Askcom*"
No folders found.

Searching for "*search results toolbar*"
No folders found.

Searching for "*Conduit*"
No folders found.

Searching for "*ICQ6Toolbar*"
No folders found.

Searching for "*PriceGong*"
No folders found.

Searching for "*file scout*"
No folders found.

Searching for "*PerformerSoft*"
No folders found.

Searching for "*wincert*"
No folders found.

========== regfind ==========

Searching for "speedanalysis"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1858121287-577351245-2587876083-1000\Software\SpeedAnalysis.com]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{05E242CB-338E-4A4F-A726-80BAB386D079}\1.0\0\win32]
@="C:\Program Files (x86)\SpeedAnalysis.com\PropertySync.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{05E242CB-338E-4A4F-A726-80BAB386D079}\1.0\HELPDIR]
@="C:\Program Files (x86)\SpeedAnalysis.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{30195ABF-E343-4827-9EE0-CF88CD0C2457}\1.0\0\win32]
@="C:\Program Files (x86)\SpeedAnalysis.com\AddonsFramework.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{30195ABF-E343-4827-9EE0-CF88CD0C2457}\1.0\HELPDIR]
@="C:\Program Files (x86)\SpeedAnalysis.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5D08AF8C-7CC2-45A4-BBA7-E997C3B21CDB}\1.0\0\win32]
@="C:\Program Files (x86)\SpeedAnalysis.com\ButtonSite.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5D08AF8C-7CC2-45A4-BBA7-E997C3B21CDB}\1.0\HELPDIR]
@="C:\Program Files (x86)\SpeedAnalysis.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{167393A7-540B-4E38-85C2-124836F6B011}\InprocServer32]
@="C:\Program Files (x86)\SpeedAnalysis.com\ScriptHost.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}\InProcServer32]
@="C:\Program Files (x86)\SpeedAnalysis.com\PropertySyncPS.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4C402865-4845-409D-BD6C-FC55DFAC509C}\InprocServer32]
@="C:\Program Files (x86)\SpeedAnalysis.com\ButtonSite.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D6B3AF56-1EAF-43D9-A733-D36AD06F16A2}\LocalServer32]
@=""C:\Program Files (x86)\SpeedAnalysis.com\PropertySync.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{05E242CB-338E-4A4F-A726-80BAB386D079}\1.0\0\win32]
@="C:\Program Files (x86)\SpeedAnalysis.com\PropertySync.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{05E242CB-338E-4A4F-A726-80BAB386D079}\1.0\HELPDIR]
@="C:\Program Files (x86)\SpeedAnalysis.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{30195ABF-E343-4827-9EE0-CF88CD0C2457}\1.0\0\win32]
@="C:\Program Files (x86)\SpeedAnalysis.com\AddonsFramework.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{30195ABF-E343-4827-9EE0-CF88CD0C2457}\1.0\HELPDIR]
@="C:\Program Files (x86)\SpeedAnalysis.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{5D08AF8C-7CC2-45A4-BBA7-E997C3B21CDB}\1.0\0\win32]
@="C:\Program Files (x86)\SpeedAnalysis.com\ButtonSite.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{5D08AF8C-7CC2-45A4-BBA7-E997C3B21CDB}\1.0\HELPDIR]
@="C:\Program Files (x86)\SpeedAnalysis.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\cfcbmgbfdbijmjgjihagbomfbjfjmgon]
"path"="C:\Users\Ann-Kristin.B\AppData\Roaming\SpeedanAlysis\speedanalysis.crx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{86AEAFD8-62A8-4bfa-BC64-A8CCB8BC412F}]
"AppPath"="C:\Program Files (x86)\SpeedAnalysis.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{167393A7-540B-4E38-85C2-124836F6B011}\InprocServer32]
@="C:\Program Files (x86)\SpeedAnalysis.com\ScriptHost.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}\InProcServer32]
@="C:\Program Files (x86)\SpeedAnalysis.com\PropertySyncPS.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{4C402865-4845-409D-BD6C-FC55DFAC509C}\InprocServer32]
@="C:\Program Files (x86)\SpeedAnalysis.com\ButtonSite.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{D6B3AF56-1EAF-43D9-A733-D36AD06F16A2}\LocalServer32]
@=""C:\Program Files (x86)\SpeedAnalysis.com\PropertySync.exe""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{05E242CB-338E-4A4F-A726-80BAB386D079}\1.0\0\win32]
@="C:\Program Files (x86)\SpeedAnalysis.com\PropertySync.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{05E242CB-338E-4A4F-A726-80BAB386D079}\1.0\HELPDIR]
@="C:\Program Files (x86)\SpeedAnalysis.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{30195ABF-E343-4827-9EE0-CF88CD0C2457}\1.0\0\win32]
@="C:\Program Files (x86)\SpeedAnalysis.com\AddonsFramework.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{30195ABF-E343-4827-9EE0-CF88CD0C2457}\1.0\HELPDIR]
@="C:\Program Files (x86)\SpeedAnalysis.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{5D08AF8C-7CC2-45A4-BBA7-E997C3B21CDB}\1.0\0\win32]
@="C:\Program Files (x86)\SpeedAnalysis.com\ButtonSite.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{5D08AF8C-7CC2-45A4-BBA7-E997C3B21CDB}\1.0\HELPDIR]
@="C:\Program Files (x86)\SpeedAnalysis.com"
[HKEY_USERS\S-1-5-21-1858121287-577351245-2587876083-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1858121287-577351245-2587876083-1000\Software\SpeedAnalysis.com]

Searching for "Datamngr"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jbajpeofkjjeiamcglnmldoboonfkiol]
"path"="C:\Program Files (x86)\Search Results Toolbar\Datamngr\chromeExtension.crx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\jZipSRTB]
"Folder"="C:\Program Files (x86)\Search Results Toolbar\Datamngr\SRToolBar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{107B509A-5435-4938-9691-0D173CAFD1D0}]
"AppPath"="C:\PROGRA~2\SEARCH~1\Datamngr\SRTOOL~1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7abe12ca-e995-4ab4-9a4e-ef8820a20182}]
"AppPath"="C:\PROGRA~2\SEARCH~1\Datamngr\SRTOOL~1"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2E3346A1-B250-409D-9246-7EF7F768BAD6}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{CA507FC3-0647-49EC-8727-CF326E337140}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2E3346A1-B250-409D-9246-7EF7F768BAD6}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{CA507FC3-0647-49EC-8727-CF326E337140}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2E3346A1-B250-409D-9246-7EF7F768BAD6}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{CA507FC3-0647-49EC-8727-CF326E337140}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"

Searching for "IBUpdater"
[HKEY_USERS\.DEFAULT\Software\IBUpdaterService]
[HKEY_USERS\S-1-5-18\Software\IBUpdaterService]

Searching for "babylon"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
"DllName"="BabylonToolbarTlbr.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}]
"DllName"="BabylonToolbar.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}]
"DllName"="BabylonToolbarTlbr.dll"

Searching for "Search_Results"
No data found.

Searching for "Askcom"
No data found.

Searching for "search results toolbar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jbajpeofkjjeiamcglnmldoboonfkiol]
"path"="C:\Program Files (x86)\Search Results Toolbar\Datamngr\chromeExtension.crx"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\jZipSRTB]
"Folder"="C:\Program Files (x86)\Search Results Toolbar\Datamngr\SRToolBar"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2E3346A1-B250-409D-9246-7EF7F768BAD6}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{CA507FC3-0647-49EC-8727-CF326E337140}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2E3346A1-B250-409D-9246-7EF7F768BAD6}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{CA507FC3-0647-49EC-8727-CF326E337140}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2E3346A1-B250-409D-9246-7EF7F768BAD6}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{CA507FC3-0647-49EC-8727-CF326E337140}"="v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\dtUser.exe|Name=Search-Results Toolbar DTX Broker|"

Searching for "Conduit"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs]
"url7"="hxxp://search.conduit.com/?SearchSource=10&ctid=CT2625848"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs]
"url10"="https://wifi.free.fr/?url=hxxp://search.conduit.com/SearchSource=10&ctid=CT2625848"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966]
"045F27F206F16624596059B2126D46D0"="C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\iSyncConduit.dll"
[HKEY_USERS\S-1-5-21-1858121287-577351245-2587876083-1000\Software\Microsoft\Internet Explorer\TypedURLs]
"url7"="hxxp://search.conduit.com/?SearchSource=10&ctid=CT2625848"
[HKEY_USERS\S-1-5-21-1858121287-577351245-2587876083-1000\Software\Microsoft\Internet Explorer\TypedURLs]
"url10"="https://wifi.free.fr/?url=hxxp://search.conduit.com/SearchSource=10&ctid=CT2625848"

Searching for "ICQ6Toolbar"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ICQ\ICQToolbar]
"InstallDir"="C:\Program Files (x86)\ICQ6Toolbar\"

Searching for "PriceGong"
No data found.

Searching for "file scout"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\filescout\command]
@=""C:\Users\Ann-Kristin.B\AppData\Roaming\File Scout\filescout.exe" /sc "%1""

Searching for "PerformerSoft"
No data found.

Searching for "wincert"
No data found.

-= EOF =-

M-K-D-B 25.05.2013 15:38
Servus,



wir entfernen noch die letzten Reste und kontrollieren nochmal alles:





Schritt 1
  • Folge folgendem Pfad: Start -> Systemsteuerung -> Software / Programme deinstallieren
  • Suche in der Liste Software mit dem folgenden Namen
    • jZip
    und deinstalliere das Programm.
  • Solltest du am Ende der Deinstallation zu einem Neustart aufgefordert werden, so führe diesen durch.
  • Sollte es Probleme mit der Deinstallation geben, so lass es mich bitte wissen.




Schritt 2

Fixen mit OTL

  • Starte bitte die OTL.exe.
  • Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:
:OTL
DRV:64bit: - (esgiguard) -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys File not found
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook:  - No CLSID value found
FF - prefs.js..extensions.enabledAddons: speedanalysis%40SpeedAnalysis.com:1.0.0.1
FF - prefs.js..extensions.enabledAddons: %7BC4A4F5A0-4B89-4392-AFAC-D58010E349AF%7D:5.0.0.7066
FF - prefs.js..extensions.enabledAddons: %7B0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff%7D:10.16.2.509
[2012.12.09 19:05:29 | 000,001,064 | ---- | M] () -- C:\Users\Ann-Kristin.B\AppData\Roaming\mozilla\firefox\profiles\psibyyw1.default\searchplugins\dvdvideosofttb-de-customized-web-search.xml
O2 - BHO: (no name) - {45564571-A21B-48ED-B584-69752EEE9C3D} - No CLSID value found.
O2 - BHO: (no name) - {7abe12ca-e995-4ab4-9a4e-ef8820a20182} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
[2013.05.08 16:21:37 | 000,000,000 | ---D | C] -- C:\Users\Ann-Kristin.B\AppData\Local\jZip
[2013.05.08 16:21:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\jZip
[2013.04.30 22:02:18 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2013.04.30 10:42:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2013.04.30 10:21:17 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\searchplugins
[2013.05.23 20:56:50 | 000,000,113 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat
[2013.05.08 16:21:53 | 000,001,015 | ---- | C] () -- C:\Users\Ann-Kristin.B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\jZip.lnk

:files
C:\Users\Ann-Kristin.B\AppData\Roaming\speedanalysis.ico
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Internet Explorer\DOMStore\SHMEP9SR\fbtemplate.conduitapps[1].xml
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Internet Explorer\DOMStore\SHMEP9SR\storage.conduit[1].xml
C:\Users\Ann-Kristin.B\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\TKVH019R\storage.conduit[1].xml
C:\Users\Ann-Kristin.B\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VG613M5D\app.mam.conduit[1].xml
C:\Users\Ann-Kristin.B\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\Z08Y2JCT\fbtemplate.conduitapps[1].xml

:reg
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"jZip"=-

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\jzip]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1858121287-577351245-2587876083-1000\Software\SpeedAnalysis.com]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{05E242CB-338E-4A4F-A726-80BAB386D079}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{30195ABF-E343-4827-9EE0-CF88CD0C2457}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5D08AF8C-7CC2-45A4-BBA7-E997C3B21CDB}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{167393A7-540B-4E38-85C2-124836F6B011}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4C402865-4845-409D-BD6C-FC55DFAC509C}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D6B3AF56-1EAF-43D9-A733-D36AD06F16A2}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\cfcbmgbfdbijmjgjihagbomfbjfjmgon]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{86AEAFD8-62A8-4bfa-BC64-A8CCB8BC412F}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jbajpeofkjjeiamcglnmldoboonfkiol]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\jZipSRTB]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{107B509A-5435-4938-9691-0D173CAFD1D0}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7abe12ca-e995-4ab4-9a4e-ef8820a20182}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{2E3346A1-B250-409D-9246-7EF7F768BAD6}"=-
"{CA507FC3-0647-49EC-8727-CF326E337140}"=-

[-HKEY_USERS\.DEFAULT\Software\IBUpdaterService]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs]
"url7"=-
"url10"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ICQ\ICQToolbar]

:commands
[Emptytemp]
  • Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
  • Schließe bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread






Schritt 3
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.






Schritt 4

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset






Schritt 5
Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.





Bitte poste mit deiner nächsten Antwort
  • die Logdatei von OTL,
  • die Logdatei von MBAM,
  • die Logdatei von ESET,
  • die Logdatei von SecurityCheck.

painfiller 28.05.2013 00:22
Es hat etwas gedauert, aber hier die Ergebnisse:

OTL:
Code:
All processes killed
========== OTL ==========
Service esgiguard stopped successfully!
Service esgiguard deleted successfully!
File  C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys File not found not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Prefs.js: speedanalysis%40SpeedAnalysis.com:1.0.0.1 removed from extensions.enabledAddons
Prefs.js: %7BC4A4F5A0-4B89-4392-AFAC-D58010E349AF%7D:5.0.0.7066 removed from extensions.enabledAddons
Prefs.js: %7B0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff%7D:10.16.2.509 removed from extensions.enabledAddons
C:\Users\Ann-Kristin.B\AppData\Roaming\mozilla\firefox\profiles\psibyyw1.default\searchplugins\dvdvideosofttb-de-customized-web-search.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{45564571-A21B-48ED-B584-69752EEE9C3D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{45564571-A21B-48ED-B584-69752EEE9C3D}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7abe12ca-e995-4ab4-9a4e-ef8820a20182}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7abe12ca-e995-4ab4-9a4e-ef8820a20182}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
C:\Users\Ann-Kristin.B\AppData\Local\jZip folder moved successfully.
Folder C:\Program Files (x86)\jZip\ not found.
C:\Program Files\Enigma Software Group\SpyHunter\Log folder moved successfully.
C:\Program Files\Enigma Software Group\SpyHunter folder moved successfully.
C:\Program Files\Enigma Software Group folder moved successfully.
C:\Program Files (x86)\Common Files\Wise Installation Wizard folder moved successfully.
C:\Windows\SysWow64\searchplugins folder moved successfully.
C:\Windows\DeleteOnReboot.bat moved successfully.
File C:\Users\Ann-Kristin.B\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\jZip.lnk not found.
========== FILES ==========
C:\Users\Ann-Kristin.B\AppData\Roaming\speedanalysis.ico moved successfully.
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Internet Explorer\DOMStore\SHMEP9SR\fbtemplate.conduitapps[1].xml moved successfully.
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Internet Explorer\DOMStore\SHMEP9SR\storage.conduit[1].xml moved successfully.
C:\Users\Ann-Kristin.B\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\TKVH019R\storage.conduit[1].xml moved successfully.
C:\Users\Ann-Kristin.B\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\VG613M5D\app.mam.conduit[1].xml moved successfully.
C:\Users\Ann-Kristin.B\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\Z08Y2JCT\fbtemplate.conduitapps[1].xml moved successfully.
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\\jZip not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\jzip\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1858121287-577351245-2587876083-1000\Software\SpeedAnalysis.com\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{05E242CB-338E-4A4F-A726-80BAB386D079}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{05E242CB-338E-4A4F-A726-80BAB386D079}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{30195ABF-E343-4827-9EE0-CF88CD0C2457}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30195ABF-E343-4827-9EE0-CF88CD0C2457}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5D08AF8C-7CC2-45A4-BBA7-E997C3B21CDB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5D08AF8C-7CC2-45A4-BBA7-E997C3B21CDB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{167393A7-540B-4E38-85C2-124836F6B011}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{167393A7-540B-4E38-85C2-124836F6B011}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4C402865-4845-409D-BD6C-FC55DFAC509C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4C402865-4845-409D-BD6C-FC55DFAC509C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D6B3AF56-1EAF-43D9-A733-D36AD06F16A2}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D6B3AF56-1EAF-43D9-A733-D36AD06F16A2}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\cfcbmgbfdbijmjgjihagbomfbjfjmgon\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{86AEAFD8-62A8-4bfa-BC64-A8CCB8BC412F}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86AEAFD8-62A8-4bfa-BC64-A8CCB8BC412F}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jbajpeofkjjeiamcglnmldoboonfkiol\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\jZipSRTB\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{107B509A-5435-4938-9691-0D173CAFD1D0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{107B509A-5435-4938-9691-0D173CAFD1D0}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7abe12ca-e995-4ab4-9a4e-ef8820a20182}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7abe12ca-e995-4ab4-9a4e-ef8820a20182}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{2E3346A1-B250-409D-9246-7EF7F768BAD6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2E3346A1-B250-409D-9246-7EF7F768BAD6}\ not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{CA507FC3-0647-49EC-8727-CF326E337140} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CA507FC3-0647-49EC-8727-CF326E337140}\ not found.
Registry key HKEY_USERS\.DEFAULT\Software\IBUpdaterService\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs\\url7 deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs\\url10 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ICQ\ICQToolbar\ deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Ann-Kristin.B
->Temp folder emptied: 15616252 bytes
->Temporary Internet Files folder emptied: 495519284 bytes
->Java cache emptied: 662516 bytes
->FireFox cache emptied: 159595200 bytes
->Google Chrome cache emptied: 53399839 bytes
->Flash cache emptied: 101720 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 57616 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1716218 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 98534499 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 42287547 bytes
RecycleBin emptied: 1348184 bytes
 
Total Files Cleaned = 829,00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 05252013_175800

Files\Folders moved on Reboot...
C:\Users\Ann-Kristin.B\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File\Folder C:\Users\Ann-Kristin.B\AppData\Local\Temp\~DF3EA25A8140ACA1C8.TMP not found!
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{51C73E0E-EEF7-457E-91CD-E35CB6138465}.tmp moved successfully.
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{305FE778-2ED5-490A-8F9A-7EAEBE6416B6}.tmp moved successfully.
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{3D400EF3-0203-4BCA-9CD2-5AAEF3D2652A}.tmp moved successfully.
File\Folder C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{46D06F70-6019-4D7A-9655-B511EF43919C}.tmp not found!
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{5B358BDA-142A-4B71-AD98-245EA168E5D8}.tmp moved successfully.
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{6D008388-384E-4DAC-AA9B-DCBF3EFAED80}.tmp moved successfully.
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{B86E60EE-154A-4278-8398-9B0A746B21E9}.tmp moved successfully.
C:\Users\Ann-Kristin.B\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
Malwarebytes:

Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.05.25.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16576
Ann-Kristin.B :: ANN-KRISTINB-PC [Administrator]

25.05.2013 18:12:43
mbam-log-2013-05-25 (18-12-43).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 221127
Laufzeit: 5 Minute(n), 43 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Und hier die anderen beiden:

ESET:

Code:
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=f0d51e6cded63b428978cda75c46a957
# engine=13929
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-05-27 04:58:52
# local_time=2013-05-27 06:58:52 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=774 16777213 85 91 803199 146387404 0 0
# compatibility_mode=5893 16776573 100 94 200994 121303782 0 0
# scanned=442976
# found=0
# cleaned=0
# scan_time=6477
Security Check:

Code:
Results of screen317's Security Check version 0.99.63 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 9 
``````````````Antivirus/Firewall Check:``````````````
avast! Antivirus 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Malwarebytes Anti-Malware Version 1.75.0.1300 
 Java 7 Update 21 
 Adobe Flash Player 11.7.700.202 
 Adobe Reader XI 
 Mozilla Firefox (20.0.1)
 Google Chrome 26.0.1410.64 
 Google Chrome 27.0.1453.94 
````````Process Check: objlist.exe by Laurent```````` 
 AVAST Software Avast AvastSvc.exe 
 AVAST Software Avast AvastUI.exe 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````

painfiller 28.05.2013 10:37
Liste der Anhänge anzeigen (Anzahl: 1)
Es kommt leider immer wieder eine Fehlermeldung, die nicht ganz gesund aussieht..

Ein Bild findest du im Anhang!

Hast du eine Idee wo die herkommt und wie man die behaben kann?

Ansonsten rekonfiguriert sich Windows bei jedem Neustart, was immens viel Zeit in Anspruch nimmt (auch noch nach mehrfachen Neustart).

Vielen Dank und beste Grüße

M-K-D-B 28.05.2013 16:19
Zitat:
Zitat von painfiller (Beitrag 1071940)
Es kommt leider immer wieder eine Fehlermeldung, die nicht ganz gesund aussieht..

Ein Bild findest du im Anhang!

Hast du eine Idee wo die herkommt und wie man die behaben kann?
ATKOSD2 ist ein Programm von ASUSTeK Computer Inc... anscheinend funktioniert es nicht mehr. Evtl. hast du ja eine Support CD oder Ähnliches von ASUS.
Oder du deinstallierst das genannte Programm, jedoch kann es dann sein, dass evtl. einige Funktionen der Asus-Software nicht mehr zur Verfügung stehen.



Zitat:
Zitat von painfiller (Beitrag 1071940)
Ansonsten rekonfiguriert sich Windows bei jedem Neustart, was immens viel Zeit in Anspruch nimmt (auch noch nach mehrfachen Neustart).
Was meinst du mit "rekonfiguriert"?


Folgendes kannst du noch versuchen:
  • Klicke auf Start > Alle Programme > Zubehör
  • Rechtsklicke auf Eingabeaufforderung und wähle Als Administrator starten
  • Gib folgendes ein: sfc /scannow
  • Bestätige mit Enter.
  • Die Überprüfung kann einige Zeit dauern.
  • Starte deinen Rechner im Abschluss neu auf.
    Bebilderte Anleitung








Wenn du keine Probleme mehr hast, dann sind wir hier fertig. Deine Logdateien sind sauber. :daumenhoc
Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern.






Schritt 1
Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.







Schritt 2
Abschließend habe ich noch ein paar Tipps zur Absicherung deines Systems.


Ich kann gar nicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher, dass du immer nur eine Anti-Viren Software installiert hast und dass diese auch up to date ist!


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion bietet zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • WOT (Web of trust)
    Dieses AddOn warnt dich, bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser
Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt, wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.


Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC


Halte dich fern von Registry Cleanern.
Diese Schaden deinem System mehr als dass sie helfen. Hier ein englischer Link:
Miekemoes Blogspot ( MVP )


Was du vermeiden solltest:
  • Klicke nicht auf alles, nur weil es dich dazu auffordert und schön bunt ist.
  • Verwende keine P2P oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie z.B. deinFoto.jpg.exe.



Nun bleibt mir nur noch dir viel Spaß beim sicheren Surfen zu wünschen... ... und vielleicht möchtest du ja das Trojaner-Board unterstützen?


Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.

M-K-D-B 31.05.2013 16:21
Ich bin froh, dass wir helfen konnten :abklatsch:

In diesem Forum kannst du eine kurze Rückmeldung zur Bereinigung abgeben, sofern du das möchtest:
Lob, Kritik und Wünsche
Klicke dazu auf den Button "NEUES THEMA" und poste ein kleines Feedback. Vielen Dank! :)

Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen.


Alle Zeitangaben in WEZ +1. Es ist jetzt 17:51 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131