Avast meldet Probleme mit "MapsGalaxy_39"
Hallo,
ich bin über das Wochenende mal wieder am PC meiner Mutter und soll ein Malware/Trojaner Problem lösen. Über Google bin ich auf diese Seite gestoßen und bin dem Rat gefolgt, nicht die Lösungsversuche für andere User zu übernehmen.
Avast hat ein Problem mit 2 dll's aus dem Ordner "MapsGalaxy_39", da wüsste ich gerne, ob das bedrohlich ist und was ich dagegen tun soll.
Hier die Logs, die ich nach der Anweisung erstellt habe: Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:15 on 02/11/2013 (Annette)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-10-2013
Ran by Annette at 2013-11-02 13:14:39
Running from C:\Users\Annette\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: avast! Antivirus (Enabled - Up to date) {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AS: avast! Antivirus (Enabled - Up to date) {904CF271-6431-DA47-5FCE-A87D98DFB681}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Acrobat.com (x32 Version: 0.0.0)
Acrobat.com (x32 Version: 1.1.377)
Adobe AIR (x32 Version: 3.8.0.1430)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117)
Adobe Reader 9 (x32 Version: 9.0.0)
AMD Accelerated Video Transcoding (Version: 12.10.100.30307)
AMD Catalyst Install Manager (Version: 8.0.911.0)
AMD Fuel (Version: 2013.0307.2216.39940)
AMD Steady Video Plug-In (Version: 2.06.0000)
AMD USB 3.0 Device Detector (Version: 2.1.27.0)
AMD VISION Engine Control Center (x32 Version: 2013.0307.2216.39940)
avast! Free Antivirus (x32 Version: 8.0.1497.0)
Catalyst Control Center InstallProxy (x32 Version: 2013.0307.2216.39940)
Catalyst Control Center Localization All (x32 Version: 2013.0307.2216.39940)
CCC Help Chinese Standard (x32 Version: 2013.0307.2215.39940)
CCC Help Chinese Traditional (x32 Version: 2013.0307.2215.39940)
CCC Help Czech (x32 Version: 2013.0307.2215.39940)
CCC Help Danish (x32 Version: 2013.0307.2215.39940)
CCC Help Dutch (x32 Version: 2013.0307.2215.39940)
CCC Help English (x32 Version: 2013.0307.2215.39940)
CCC Help Finnish (x32 Version: 2013.0307.2215.39940)
CCC Help French (x32 Version: 2013.0307.2215.39940)
CCC Help German (x32 Version: 2013.0307.2215.39940)
CCC Help Greek (x32 Version: 2013.0307.2215.39940)
CCC Help Hungarian (x32 Version: 2013.0307.2215.39940)
CCC Help Italian (x32 Version: 2013.0307.2215.39940)
CCC Help Japanese (x32 Version: 2013.0307.2215.39940)
CCC Help Korean (x32 Version: 2013.0307.2215.39940)
CCC Help Norwegian (x32 Version: 2013.0307.2215.39940)
CCC Help Polish (x32 Version: 2013.0307.2215.39940)
CCC Help Portuguese (x32 Version: 2013.0307.2215.39940)
CCC Help Russian (x32 Version: 2013.0307.2215.39940)
CCC Help Spanish (x32 Version: 2013.0307.2215.39940)
CCC Help Swedish (x32 Version: 2013.0307.2215.39940)
CCC Help Thai (x32 Version: 2013.0307.2215.39940)
CCC Help Turkish (x32 Version: 2013.0307.2215.39940)
ccc-utility64 (Version: 2013.0307.2216.39940)
D3DX10 (x32 Version: 15.4.2368.0902)
Dragon NaturallySpeaking 11 (x32 Version: 11.50.100)
Etron USB3.0 Host Controller (x32 Version: 0.114)
Junk Mail filter update (x32 Version: 16.4.3505.0912)
MapsGalaxy Firefox Toolbar (x32)
MapsGalaxy Internet Explorer Toolbar (x32)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (x32 Version: 10.0.30319)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSVCRT110 (x32 Version: 16.4.1108.0727)
MSVCRT110_amd64 (Version: 16.4.1109.0912)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MyTomTom 3.2.0.1220 (x32 Version: 3.2.0.1220)
RAPID Mode (Version: 1.0.1.42)
Realtek Ethernet Controller Driver (x32 Version: 7.48.823.2011)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6662)
Samsung Magician (x32 Version: 4.2.1)
Samsung ML-1640 Series (x32)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
Visual C++ 9.0 Runtime for Dragon NaturallySpeaking 64bit (x64) (Version: 11.0.0)
Visual Studio C++ 10.0 Runtime (x32 Version: 10.0.0)
Windows Live Communications Platform (x32 Version: 16.4.3505.0912)
Windows Live Essentials (x32 Version: 16.4.3505.0912)
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0)
Windows Live Installer (x32 Version: 16.4.3505.0912)
Windows Live Mail (x32 Version: 16.4.3505.0912)
Windows Live MIME IFilter (Version: 16.4.3505.0912)
Windows Live Photo Common (x32 Version: 16.4.3505.0912)
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912)
Windows Live SOXE (x32 Version: 16.4.3505.0912)
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912)
Windows Live UX Platform (x32 Version: 16.4.3505.0912)
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912)
Windows Live Writer (x32 Version: 16.4.3505.0912)
Windows Live Writer Resources (x32 Version: 16.4.3505.0912)
==================== Restore Points =========================
29-09-2013 09:00:41 Windows Update
29-09-2013 09:01:47 Windows Update
29-09-2013 11:40:29 Windows Update
04-10-2013 06:07:30 Windows Update
09-10-2013 14:52:39 Windows Update
09-10-2013 21:42:01 Windows Update
16-10-2013 15:28:38 Windows Update
22-10-2013 18:30:16 Windows Update
29-10-2013 18:48:06 Geplanter Prüfpunkt
02-11-2013 08:00:09 Windows Update
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {0E86F3A4-3440-4D37-82DD-4E25747BE93B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09] (Adobe Systems Incorporated)
Task: {CEA1E582-D376-4016-962F-CC9A4F42897E} - System32\Tasks\avast! Emergency Update => F:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-08-30] (AVAST Software)
Task: {D822CAA9-A6B9-4F74-A61B-60080C757498} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2013-10-09 16:07 - 2013-10-09 16:07 - 00292424 _____ () C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\AppIntegratorStub64.dll
2013-10-09 16:07 - 2013-10-09 16:07 - 00442952 _____ () C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\HPG64.DLL
2013-03-07 22:28 - 2013-03-07 22:28 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2013-11-01 22:24 - 2013-11-01 20:46 - 02107392 _____ () F:\Program Files\AVAST Software\Avast\defs\13110101\algo.dll
2012-09-12 14:57 - 2012-09-12 14:57 - 00282112 _____ () C:\Program Files (x86)\Windows Live\Writer\de\WindowsLive.Writer.Localization.resources.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\TEMP:0FF263E8
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (11/02/2013 08:57:55 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/01/2013 10:25:31 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/01/2013 10:20:19 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/01/2013 10:09:21 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/01/2013 10:03:13 PM) (Source: Software Protection Platform Service) (User: )
Description: Fehler beim Erwerb der Endbenutzerlizenz. hr=0xC004C008
SKU-ID=c1e88de3-96c4-4563-ad7d-775f65b1e670
Error: (11/01/2013 10:03:13 PM) (Source: Software Protection Platform Service) (User: )
Description: Lizenzerwerb-Fehlerdetails.
hr=0xC004C008
Error: (11/01/2013 10:00:10 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (11/01/2013 09:58:44 PM) (Source: Software Protection Platform Service) (User: )
Description: Fehler beim Erwerb der Endbenutzerlizenz. hr=0xC004C008
SKU-ID=c1e88de3-96c4-4563-ad7d-775f65b1e670
Error: (11/01/2013 09:58:44 PM) (Source: Software Protection Platform Service) (User: )
Description: Lizenzerwerb-Fehlerdetails.
hr=0xC004C008
Error: (11/01/2013 10:58:20 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (11/02/2013 08:56:10 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%20
Error: (11/01/2013 10:23:46 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%20
Error: (11/01/2013 10:21:32 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%20
Error: (11/01/2013 10:18:35 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%20
Error: (11/01/2013 10:07:35 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%20
Error: (11/01/2013 09:58:24 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%20
Error: (11/01/2013 10:56:34 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%20
Error: (10/31/2013 08:08:19 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%20
Error: (10/31/2013 09:30:14 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%20
Error: (10/30/2013 07:53:58 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%20
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Percentage of memory in use: 64%
Total physical RAM: 3546.3 MB
Available physical RAM: 1243.4 MB
Total Pagefile: 7090.79 MB
Available Pagefile: 4401.4 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:111.69 GB) (Free:75.32 GB) NTFS
Drive d: (Daten) (Fixed) (Total:195.31 GB) (Free:194.31 GB) NTFS
Drive f: (Programme) (Fixed) (Total:270.45 GB) (Free:269.6 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 112 GB) (Disk ID: A0FAF0A5)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=112 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 9B9F4896)
Partition 1: (Not Active) - (Size=195 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=270 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-10-2013
Ran by Annette (administrator) on TURBOKISTE on 02-11-2013 13:14:09
Running from C:\Users\Annette\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(AVAST Software) F:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\RAPID\CacheFilter\SamsungRapidApp.exe
() C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\AppIntegrator64.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(AVAST Software) F:\Program Files\AVAST Software\Avast\AvastUI.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe
(COMPANYVERS_NAME) C:\PROGRA~2\MAPSGA~2\bar\1.bin\39barsvc.exe
(Samsung Electronics Co., Ltd.) C:\Windows\system32\RAPID\SamsungRapidSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Windows\Samsung\PanelMgr\caller64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil64_11_9_900_117_ActiveX.exe
() C:\Users\Annette\Desktop\Defogger.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [NUSB3MON] - C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe [97280 2012-04-11] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [SamsungRapidApp] - C:\Program Files (x86)\RAPID\CacheFilter\SamsungRapidApp.exe [109280 2013-07-29] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [MapsGalaxy Home Page Guard 64 bit] - C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\AppIntegrator64.exe [548936 2013-10-09] ()
HKCU\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2010-07-29] (Acresso Corporation)
MountPoints2: {b387dda7-2849-11e3-81b3-806e6f6e6963} - D:\ASRSetup.exe
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-07] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [avast] - F:\Program Files\AVAST Software\Avast\AvastUI.exe [4858968 2013-08-30] (AVAST Software)
HKLM-x32\...\Run: [Samsung PanelMgr] - C:\Windows\Samsung\PanelMgr\SSMMgr.exe [614400 2009-08-14] ()
HKLM-x32\...\Run: [MapsGalaxy Search Scope Monitor] - C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39SrchMn.exe [44784 2013-10-09] (MindSpark)
HKLM-x32\...\Run: [MapsGalaxy_39 Browser Plugin Loader] - C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39brmon.exe [30096 2013-10-09] (VER_COMPANY_NAME)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xFA48BC765ABCCE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
URLSearchHook: HKCU - (No Name) - {26842a09-ffa8-4e2c-ae12-0c80f01c3295} - C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39SrcAs.dll (MindSpark)
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - F:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Toolbar BHO - {1e91a655-bb4b-4693-a05e-2edebc4c9d89} - C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39bar.dll (MindSpark)
BHO-x32: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Search Assistant BHO - {71c1d63a-c944-428a-a5bd-ba513190e5d2} - C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39SrcAs.dll (MindSpark)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - F:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - F:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - F:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM-x32 - MapsGalaxy - {364ea597-e728-4ce4-bb4a-ed846ef47970} - C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39bar.dll (MindSpark)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
==================== Services (Whitelisted) =================
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2013-03-07] (Advanced Micro Devices, Inc.)
R2 avast! Antivirus; F:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-08-30] (AVAST Software)
R2 MapsGalaxy_39Service; C:\PROGRA~2\MAPSGA~2\bar\1.bin\39barsvc.exe [42504 2013-10-09] (COMPANYVERS_NAME)
R2 SamsungRapidSvc; C:\Windows\System32\RAPID\SamsungRapidSvc.exe [27360 2013-07-29] (Samsung Electronics Co., Ltd.)
==================== Drivers (Whitelisted) ====================
R2 AODDriver4.2; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [57472 2012-04-09] (Advanced Micro Devices)
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-08-30] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-08-30] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-08-30] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-08-30] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-08-30] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-08-30] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-08-30] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [204880 2013-08-30] ()
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [53816 2009-06-08] (Samsung Electronics Co., Ltd.)
R0 SamsungRapidDiskFltr; C:\Windows\System32\DRIVERS\SamsungRapidDiskFltr.sys [240864 2013-07-29] (Samsung Electronics Co., Ltd.)
R0 SamsungRapidFSFltr; C:\Windows\System32\DRIVERS\SamsungRapidFSFltr.sys [111328 2013-07-29] (Samsung Electronics Co., Ltd.)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-02 13:14 - 2013-11-02 13:14 - 00000000 ____D C:\FRST
2013-11-02 13:13 - 2013-11-02 13:13 - 01957098 _____ (Farbar) C:\Users\Annette\Desktop\FRST64.exe
2013-11-02 13:13 - 2013-11-02 13:13 - 00000476 _____ C:\Users\Annette\Desktop\defogger_disable.log
2013-11-02 13:13 - 2013-11-02 13:13 - 00000000 _____ C:\Users\Annette\defogger_reenable
2013-11-02 13:12 - 2013-11-02 13:12 - 00050477 _____ C:\Users\Annette\Desktop\Defogger.exe
2013-11-02 13:08 - 2013-11-02 13:08 - 00000000 ____D C:\AdwCleaner
2013-10-09 22:49 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-10-09 22:49 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-10-09 22:49 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-10-09 22:49 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-10-09 22:49 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-10-09 22:49 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-10-09 22:49 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-10-09 22:49 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-10-09 22:49 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-10-09 22:49 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-10-09 22:49 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-10-09 22:49 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-10-09 22:49 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-10-09 22:49 - 2013-09-22 23:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-09 22:49 - 2013-09-22 23:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-09 22:49 - 2013-09-22 23:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-09 22:49 - 2013-09-22 23:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-09 22:49 - 2013-09-22 23:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-09 22:49 - 2013-09-22 23:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-09 22:49 - 2013-09-22 23:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-09 22:49 - 2013-09-22 23:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-09 22:49 - 2013-09-22 23:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-09 22:49 - 2013-09-22 23:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-09 22:49 - 2013-09-22 23:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-09 22:49 - 2013-09-22 23:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-09 22:49 - 2013-09-22 23:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-09 22:49 - 2013-09-22 23:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-09 22:49 - 2013-09-21 04:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-09 22:49 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-10-09 22:49 - 2013-09-21 03:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-09 22:49 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-10-09 16:07 - 2013-10-09 16:07 - 00000000 ____D C:\Program Files (x86)\MapsGalaxy_39
2013-10-09 15:54 - 2013-09-14 02:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-09 15:54 - 2013-09-08 03:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-09 15:54 - 2013-09-08 03:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-09 15:54 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-10-09 15:54 - 2013-09-04 13:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-09 15:54 - 2013-09-04 13:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-09 15:54 - 2013-09-04 13:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-09 15:54 - 2013-09-04 13:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-09 15:54 - 2013-09-04 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-09 15:54 - 2013-09-04 13:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-09 15:54 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-09 15:54 - 2013-08-29 03:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-09 15:54 - 2013-08-29 03:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-09 15:54 - 2013-08-29 03:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-09 15:54 - 2013-08-29 03:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-10-09 15:54 - 2013-08-29 03:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-09 15:54 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-10-09 15:54 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-10-09 15:54 - 2013-08-29 02:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-10-09 15:54 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-10-09 15:54 - 2013-08-29 02:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-10-09 15:54 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-10-09 15:54 - 2013-08-29 01:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-10-09 15:54 - 2013-08-29 01:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-10-09 15:54 - 2013-08-29 01:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-10-09 15:54 - 2013-08-29 01:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-10-09 15:54 - 2013-08-28 02:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-09 15:54 - 2013-08-28 02:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-09 15:54 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-09 15:54 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-09 15:54 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2013-10-09 15:54 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-09 15:54 - 2013-07-04 13:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-09 15:54 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-09 15:54 - 2013-07-04 13:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-09 15:54 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2013-10-09 15:54 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2013-10-09 15:54 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-10-09 15:54 - 2013-07-04 11:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-09 15:54 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-09 15:54 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-09 15:54 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-09 15:54 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-09 15:54 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-09 15:54 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-09 15:54 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-09 15:54 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2013-10-09 15:54 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2013-10-09 15:54 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2013-10-09 15:54 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-09 15:54 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-10-09 15:54 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
==================== One Month Modified Files and Folders =======
2013-11-02 13:14 - 2013-11-02 13:14 - 00000000 ____D C:\FRST
2013-11-02 13:13 - 2013-11-02 13:13 - 01957098 _____ (Farbar) C:\Users\Annette\Desktop\FRST64.exe
2013-11-02 13:13 - 2013-11-02 13:13 - 00000476 _____ C:\Users\Annette\Desktop\defogger_disable.log
2013-11-02 13:13 - 2013-11-02 13:13 - 00000000 _____ C:\Users\Annette\defogger_reenable
2013-11-02 13:13 - 2013-09-28 16:43 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-02 13:13 - 2013-09-28 15:31 - 00000000 ____D C:\Users\Annette
2013-11-02 13:12 - 2013-11-02 13:12 - 00050477 _____ C:\Users\Annette\Desktop\Defogger.exe
2013-11-02 13:08 - 2013-11-02 13:08 - 00000000 ____D C:\AdwCleaner
2013-11-02 10:59 - 2013-09-28 15:31 - 01811789 _____ C:\Windows\WindowsUpdate.log
2013-11-02 10:58 - 2013-09-28 16:37 - 00000000 ____D C:\Users\Annette\AppData\Local\Windows Live
2013-11-02 09:03 - 2009-07-14 05:45 - 00026000 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-02 09:03 - 2009-07-14 05:45 - 00026000 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-02 09:00 - 2011-04-12 08:43 - 00696620 _____ C:\Windows\system32\perfh007.dat
2013-11-02 09:00 - 2011-04-12 08:43 - 00147916 _____ C:\Windows\system32\perfc007.dat
2013-11-02 09:00 - 2009-07-14 06:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-02 08:56 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-02 08:56 - 2009-07-14 05:51 - 00030795 _____ C:\Windows\setupact.log
2013-11-01 10:56 - 2013-09-28 16:14 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-10-31 09:30 - 2010-11-21 04:47 - 00007154 _____ C:\Windows\PFRO.log
2013-10-26 11:28 - 2013-09-29 08:41 - 00000955 _____ C:\Users\Annette\AppData\Roaming\SAS7_000.DAT
2013-10-10 21:34 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-10-10 07:09 - 2009-07-14 05:45 - 00315528 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-09 22:51 - 2013-09-28 16:18 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-09 22:48 - 2013-09-29 10:02 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-09 22:48 - 2013-09-29 10:02 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-10-09 22:47 - 2013-09-28 15:49 - 01589442 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-10-09 22:45 - 2013-09-28 19:57 - 00000000 ____D C:\Windows\system32\MRT
2013-10-09 22:44 - 2013-09-28 19:56 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-09 16:13 - 2013-09-28 16:43 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-10-09 16:13 - 2013-09-28 16:43 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-10-09 16:13 - 2013-09-28 16:43 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-10-09 16:07 - 2013-10-09 16:07 - 00000000 ____D C:\Program Files (x86)\MapsGalaxy_39
2013-10-05 06:48 - 2013-09-28 15:31 - 00000000 ____D C:\Users\Annette\AppData\Local\VirtualStore
Some content of TEMP:
====================
C:\Users\Annette\AppData\Local\Temp\ose00000.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-31 09:52
==================== End Of Log ============================
Code:
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-02 13:27:28
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000005f Samsung_ rev.EXT0 111,79GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Annette\AppData\Local\Temp\ufldyaog.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002dfe000 45 bytes [00, 30, 00, 31, 00, 80, 26, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 574 fffff80002dfe02e 17 bytes [79, 00, 06, 5F, C5, 00, 6A, ...]
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\wininit.exe[684] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\system32\services.exe[748] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\system32\winlogon.exe[780] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\system32\lsass.exe[808] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[912] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1012] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\system32\atiesrxx.exe[360] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[740] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[1028] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1068] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1096] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1364] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\system32\Dwm.exe[1664] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\Explorer.EXE[1696] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\System32\spoolsv.exe[1856] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\system32\taskhost.exe[1868] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1920] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe[2004] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007615a2ba 1 byte [62]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2028] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\AppIntegrator64.exe[1104] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[1184] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007615a2ba 1 byte [62]
.text F:\Program Files\AVAST Software\Avast\AvastUI.exe[2064] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007615a2ba 1 byte [62]
.text C:\Windows\Samsung\PanelMgr\SSMMgr.exe[2096] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007615a2ba 1 byte [62]
.text C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe[2108] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\PROGRA~2\MAPSGA~2\bar\1.bin\39barsvc.exe[2304] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007615a2ba 1 byte [62]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2472] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\Samsung\PanelMgr\caller64.exe[2608] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076d43b10 5 bytes JMP 000000010016075c
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076d47ac0 5 bytes JMP 00000001001603a4
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076d71430 5 bytes JMP 0000000100160b14
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076d71490 5 bytes JMP 0000000100160ecc
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076d71570 5 bytes JMP 000000010016163c
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076d717b0 5 bytes JMP 0000000100161284
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d727e0 5 bytes JMP 00000001001619f4
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefd286e00 5 bytes JMP 000007ff7d2a1dac
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefd286f2c 5 bytes JMP 000007ff7d2a0ecc
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefd287220 5 bytes JMP 000007ff7d2a1284
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefd28739c 5 bytes JMP 000007ff7d2a163c
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefd287538 5 bytes JMP 000007ff7d2a19f4
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefd2875e8 5 bytes JMP 000007ff7d2a03a4
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefd28790c 5 bytes JMP 000007ff7d2a075c
.text C:\Windows\system32\svchost.exe[3220] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefd287ab4 5 bytes JMP 000007ff7d2a0b14
.text C:\Windows\system32\SearchIndexer.exe[3420] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076d43b10 5 bytes JMP 000000010042075c
.text C:\Windows\system32\SearchIndexer.exe[3420] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076d47ac0 5 bytes JMP 00000001004203a4
.text C:\Windows\system32\SearchIndexer.exe[3420] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076d71430 5 bytes JMP 0000000100420b14
.text C:\Windows\system32\SearchIndexer.exe[3420] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076d71490 5 bytes JMP 0000000100420ecc
.text C:\Windows\system32\SearchIndexer.exe[3420] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076d71570 5 bytes JMP 000000010042163c
.text C:\Windows\system32\SearchIndexer.exe[3420] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076d717b0 5 bytes JMP 0000000100421284
.text C:\Windows\system32\SearchIndexer.exe[3420] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d727e0 5 bytes JMP 00000001004219f4
.text C:\Windows\system32\SearchIndexer.exe[3420] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\system32\SearchIndexer.exe[3420] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefd286e00 5 bytes JMP 000007ff7d2a1dac
.text C:\Windows\system32\SearchIndexer.exe[3420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefd286f2c 5 bytes JMP 000007ff7d2a0ecc
.text C:\Windows\system32\SearchIndexer.exe[3420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefd287220 5 bytes JMP 000007ff7d2a1284
.text C:\Windows\system32\SearchIndexer.exe[3420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefd28739c 5 bytes JMP 000007ff7d2a163c
.text C:\Windows\system32\SearchIndexer.exe[3420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefd287538 5 bytes JMP 000007ff7d2a19f4
.text C:\Windows\system32\SearchIndexer.exe[3420] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefd2875e8 5 bytes JMP 000007ff7d2a03a4
.text C:\Windows\system32\SearchIndexer.exe[3420] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefd28790c 5 bytes JMP 000007ff7d2a075c
.text C:\Windows\system32\SearchIndexer.exe[3420] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefd287ab4 5 bytes JMP 000007ff7d2a0b14
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[3524] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076d43b10 5 bytes JMP 000000010016075c
.text C:\Windows\System32\svchost.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076d47ac0 5 bytes JMP 00000001001603a4
.text C:\Windows\System32\svchost.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076d71430 5 bytes JMP 0000000100160b14
.text C:\Windows\System32\svchost.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076d71490 5 bytes JMP 0000000100160ecc
.text C:\Windows\System32\svchost.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076d71570 5 bytes JMP 000000010016163c
.text C:\Windows\System32\svchost.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076d717b0 5 bytes JMP 0000000100161284
.text C:\Windows\System32\svchost.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d727e0 5 bytes JMP 00000001001619f4
.text C:\Windows\System32\svchost.exe[3796] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefd286e00 5 bytes JMP 000007ff7d2a1dac
.text C:\Windows\System32\svchost.exe[3796] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefd286f2c 5 bytes JMP 000007ff7d2a0ecc
.text C:\Windows\System32\svchost.exe[3796] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefd287220 5 bytes JMP 000007ff7d2a1284
.text C:\Windows\System32\svchost.exe[3796] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefd28739c 5 bytes JMP 000007ff7d2a163c
.text C:\Windows\System32\svchost.exe[3796] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefd287538 5 bytes JMP 000007ff7d2a19f4
.text C:\Windows\System32\svchost.exe[3796] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefd2875e8 5 bytes JMP 000007ff7d2a03a4
.text C:\Windows\System32\svchost.exe[3796] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefd28790c 5 bytes JMP 000007ff7d2a075c
.text C:\Windows\System32\svchost.exe[3796] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefd287ab4 5 bytes JMP 000007ff7d2a0b14
.text C:\Windows\system32\DllHost.exe[3496] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefd286e00 5 bytes JMP 000007ff7d2a1dac
.text C:\Windows\system32\DllHost.exe[3496] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefd286f2c 5 bytes JMP 000007ff7d2a0ecc
.text C:\Windows\system32\DllHost.exe[3496] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefd287220 5 bytes JMP 000007ff7d2a1284
.text C:\Windows\system32\DllHost.exe[3496] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefd28739c 5 bytes JMP 000007ff7d2a163c
.text C:\Windows\system32\DllHost.exe[3496] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefd287538 5 bytes JMP 000007ff7d2a19f4
.text C:\Windows\system32\DllHost.exe[3496] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefd2875e8 5 bytes JMP 000007ff7d2a03a4
.text C:\Windows\system32\DllHost.exe[3496] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefd28790c 5 bytes JMP 000007ff7d2a075c
.text C:\Windows\system32\DllHost.exe[3496] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefd287ab4 5 bytes JMP 000007ff7d2a0b14
.text C:\Windows\System32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076d43b10 5 bytes JMP 00000001002a075c
.text C:\Windows\System32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076d47ac0 5 bytes JMP 00000001002a03a4
.text C:\Windows\System32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076d71430 5 bytes JMP 00000001002a0b14
.text C:\Windows\System32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076d71490 5 bytes JMP 00000001002a0ecc
.text C:\Windows\System32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076d71570 5 bytes JMP 00000001002a163c
.text C:\Windows\System32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076d717b0 5 bytes JMP 00000001002a1284
.text C:\Windows\System32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d727e0 5 bytes JMP 00000001002a19f4
.text C:\Windows\System32\svchost.exe[884] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[884] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefd286e00 5 bytes JMP 000007ff7d2a1dac
.text C:\Windows\System32\svchost.exe[884] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefd286f2c 5 bytes JMP 000007ff7d2a0ecc
.text C:\Windows\System32\svchost.exe[884] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefd287220 5 bytes JMP 000007ff7d2a1284
.text C:\Windows\System32\svchost.exe[884] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefd28739c 5 bytes JMP 000007ff7d2a163c
.text C:\Windows\System32\svchost.exe[884] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefd287538 5 bytes JMP 000007ff7d2a19f4
.text C:\Windows\System32\svchost.exe[884] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefd2875e8 5 bytes JMP 000007ff7d2a03a4
.text C:\Windows\System32\svchost.exe[884] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefd28790c 5 bytes JMP 000007ff7d2a075c
.text C:\Windows\System32\svchost.exe[884] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefd287ab4 5 bytes JMP 000007ff7d2a0b14
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000076f1fac0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000076f1fb58 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000076f1fcb0 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000076f20038 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f21920 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 0000000076f3c4dd 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000076f41287 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007615a2ba 1 byte [62]
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000076365181 5 bytes JMP 0000000100091014
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000076365254 5 bytes JMP 0000000100090804
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000763653d5 5 bytes JMP 0000000100090a08
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000763654c2 5 bytes JMP 0000000100090c0c
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000763655e2 5 bytes JMP 0000000100090e10
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007636567c 5 bytes JMP 00000001000901f8
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007636589f 5 bytes JMP 00000001000903fc
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000076365a22 5 bytes JMP 0000000100090600
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\syswow64\USER32.dll!SetWinEventHook 0000000075faee09 5 bytes JMP 00000001000a01f8
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075fb3982 5 bytes JMP 00000001000a03fc
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075fb7603 5 bytes JMP 00000001000a0804
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 0000000075fb835c 5 bytes JMP 00000001000a0600
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 0000000075fcf52b 5 bytes JMP 00000001000a0a08
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074b81465 2 bytes [B8, 74]
.text C:\Program Files (x86)\Windows Live\Mail\wlmail.exe[1380] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074b814bb 2 bytes [B8, 74]
.text ... * 2
? C:\Windows\system32\mssprxy.dll [1380] entry point in ".rdata" section 000000006cd471e6
.text C:\Windows\system32\AUDIODG.EXE[4792] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Program Files\Internet Explorer\iexplore.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076d43b10 6 bytes {NOP ; JMP 0xffffffff8942cc4c}
.text C:\Program Files\Internet Explorer\iexplore.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076d47ac0 6 bytes {NOP ; JMP 0xffffffff894288e4}
.text C:\Program Files\Internet Explorer\iexplore.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076d71430 6 bytes {NOP ; JMP 0xffffffff893ff6e4}
.text C:\Program Files\Internet Explorer\iexplore.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076d71490 6 bytes {NOP ; JMP 0xffffffff893ffa3c}
.text C:\Program Files\Internet Explorer\iexplore.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076d71570 6 bytes {NOP ; JMP 0xffffffff894000cc}
.text C:\Program Files\Internet Explorer\iexplore.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076d717b0 6 bytes {NOP ; JMP 0xffffffff893ffad4}
.text C:\Program Files\Internet Explorer\iexplore.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d727e0 6 bytes {NOP ; JMP 0xffffffff893ff214}
.text C:\Program Files\Internet Explorer\iexplore.exe[2892] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Program Files\Internet Explorer\iexplore.exe[2892] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefd286e00 6 bytes {NOP ; JMP 0xffffffff8001afac}
.text C:\Program Files\Internet Explorer\iexplore.exe[2892] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefd286f2c 6 bytes {NOP ; JMP 0xffffffff80019fa0}
.text C:\Program Files\Internet Explorer\iexplore.exe[2892] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefd287220 6 bytes {NOP ; JMP 0xffffffff8001a064}
.text C:\Program Files\Internet Explorer\iexplore.exe[2892] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefd28739c 6 bytes {NOP ; JMP 0xffffffff8001a2a0}
.text C:\Program Files\Internet Explorer\iexplore.exe[2892] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefd287538 6 bytes {NOP ; JMP 0xffffffff8001a4bc}
.text C:\Program Files\Internet Explorer\iexplore.exe[2892] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefd2875e8 6 bytes {NOP ; JMP 0xffffffff80018dbc}
.text C:\Program Files\Internet Explorer\iexplore.exe[2892] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefd28790c 6 bytes {NOP ; JMP 0xffffffff80018e50}
.text C:\Program Files\Internet Explorer\iexplore.exe[2892] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefd287ab4 6 bytes {NOP ; JMP 0xffffffff80019060}
.text C:\Windows\system32\Macromed\Flash\FlashUtil64_11_9_900_117_ActiveX.exe[4660] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000076d43b10 5 bytes JMP 000000010014075c
.text C:\Windows\system32\Macromed\Flash\FlashUtil64_11_9_900_117_ActiveX.exe[4660] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000076d47ac0 5 bytes JMP 00000001001403a4
.text C:\Windows\system32\Macromed\Flash\FlashUtil64_11_9_900_117_ActiveX.exe[4660] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000076d71430 5 bytes JMP 0000000100140b14
.text C:\Windows\system32\Macromed\Flash\FlashUtil64_11_9_900_117_ActiveX.exe[4660] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000076d71490 5 bytes JMP 0000000100140ecc
.text C:\Windows\system32\Macromed\Flash\FlashUtil64_11_9_900_117_ActiveX.exe[4660] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076d71570 5 bytes JMP 000000010014163c
.text C:\Windows\system32\Macromed\Flash\FlashUtil64_11_9_900_117_ActiveX.exe[4660] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000076d717b0 5 bytes JMP 0000000100141284
.text C:\Windows\system32\Macromed\Flash\FlashUtil64_11_9_900_117_ActiveX.exe[4660] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d727e0 5 bytes JMP 00000001001419f4
.text C:\Windows\system32\Macromed\Flash\FlashUtil64_11_9_900_117_ActiveX.exe[4660] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076b5eecd 1 byte [62]
.text C:\Windows\system32\Macromed\Flash\FlashUtil64_11_9_900_117_ActiveX.exe[4660] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefd286e00 5 bytes JMP 000007ff7d2a1dac
.text C:\Windows\system32\Macromed\Flash\FlashUtil64_11_9_900_117_ActiveX.exe[4660] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefd286f2c 5 bytes JMP 000007ff7d2a0ecc
.text C:\Windows\system32\Macromed\Flash\FlashUtil64_11_9_900_117_ActiveX.exe[4660] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefd287220 5 bytes JMP 000007ff7d2a1284
.text C:\Windows\system32\Macromed\Flash\FlashUtil64_11_9_900_117_ActiveX.exe[4660] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefd28739c 5 bytes JMP 000007ff7d2a163c
.text C:\Windows\system32\Macromed\Flash\FlashUtil64_11_9_900_117_ActiveX.exe[4660] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefd287538 5 bytes JMP 000007ff7d2a19f4
.text C:\Windows\system32\Macromed\Flash\FlashUtil64_11_9_900_117_ActiveX.exe[4660] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefd2875e8 5 bytes JMP 000007ff7d2a03a4
.text C:\Windows\system32\Macromed\Flash\FlashUtil64_11_9_900_117_ActiveX.exe[4660] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefd28790c 5 bytes JMP 000007ff7d2a075c
.text C:\Windows\system32\Macromed\Flash\FlashUtil64_11_9_900_117_ActiveX.exe[4660] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefd287ab4 5 bytes JMP 000007ff7d2a0b14
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000076f1fac0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000076f1fb58 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000076f1fcb0 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000076f20038 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f21920 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 0000000076f3c4dd 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000076f41287 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007615a2ba 1 byte [62]
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000076365181 5 bytes JMP 0000000100101014
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000076365254 5 bytes JMP 0000000100100804
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000763653d5 5 bytes JMP 0000000100100a08
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000763654c2 5 bytes JMP 0000000100100c0c
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000763655e2 5 bytes JMP 0000000100100e10
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007636567c 5 bytes JMP 00000001001001f8
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007636589f 5 bytes JMP 00000001001003fc
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000076365a22 5 bytes JMP 0000000100100600
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\syswow64\user32.DLL!SetWinEventHook 0000000075faee09 5 bytes JMP 00000001001101f8
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\syswow64\user32.DLL!UnhookWinEvent 0000000075fb3982 5 bytes JMP 00000001001103fc
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\syswow64\user32.DLL!SetWindowsHookExW 0000000075fb7603 5 bytes JMP 0000000100110804
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\syswow64\user32.DLL!SetWindowsHookExA 0000000075fb835c 5 bytes JMP 0000000100110600
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\syswow64\user32.DLL!UnhookWindowsHookEx 0000000075fcf52b 5 bytes JMP 0000000100110a08
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074b81465 2 bytes [B8, 74]
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4588] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074b814bb 2 bytes [B8, 74]
.text ... * 2
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000076f1fac0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000076f1fb58 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 0000000076f1fcb0 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000076f20038 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f21920 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 0000000076f3c4dd 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000076f41287 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007615a2ba 1 byte [62]
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000076365181 5 bytes JMP 0000000100101014
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000076365254 5 bytes JMP 0000000100100804
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000763653d5 5 bytes JMP 0000000100100a08
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000763654c2 5 bytes JMP 0000000100100c0c
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000763655e2 5 bytes JMP 0000000100100e10
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007636567c 5 bytes JMP 00000001001001f8
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007636589f 5 bytes JMP 00000001001003fc
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000076365a22 5 bytes JMP 0000000100100600
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\syswow64\user32.DLL!SetWinEventHook 0000000075faee09 5 bytes JMP 00000001001101f8
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\syswow64\user32.DLL!UnhookWinEvent 0000000075fb3982 5 bytes JMP 00000001001103fc
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\syswow64\user32.DLL!SetWindowsHookExW 0000000075fb7603 5 bytes JMP 0000000100110804
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\syswow64\user32.DLL!SetWindowsHookExA 0000000075fb835c 5 bytes JMP 0000000100110600
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\syswow64\user32.DLL!UnhookWindowsHookEx 0000000075fcf52b 5 bytes JMP 0000000100110a08
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074b81465 2 bytes [B8, 74]
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4504] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074b814bb 2 bytes [B8, 74]
.text ... * 2
.text C:\Windows\System32\svchost.exe[2248] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefd286e00 5 bytes JMP 000007ff7d2a1dac
.text C:\Windows\System32\svchost.exe[2248] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefd286f2c 5 bytes JMP 000007ff7d2a0ecc
.text C:\Windows\System32\svchost.exe[2248] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefd287220 5 bytes JMP 000007ff7d2a1284
.text C:\Windows\System32\svchost.exe[2248] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefd28739c 5 bytes JMP 000007ff7d2a163c
.text C:\Windows\System32\svchost.exe[2248] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefd287538 5 bytes JMP 000007ff7d2a19f4
.text C:\Windows\System32\svchost.exe[2248] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefd2875e8 5 bytes JMP 000007ff7d2a03a4
.text C:\Windows\System32\svchost.exe[2248] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefd28790c 5 bytes JMP 000007ff7d2a075c
.text C:\Windows\System32\svchost.exe[2248] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefd287ab4 5 bytes JMP 000007ff7d2a0b14
.text C:\Users\Annette\Desktop\gmer_2.1.19163.exe[3996] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007615a2ba 1 byte [62]
---- Threads - GMER 2.1 ----
Thread C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe [3900:2396] 0000000076f52e65
Thread C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe [3900:608] 0000000076f53e85
Thread C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe [3900:3660] 000000006eaf8f48
Thread C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe [3900:2168] 0000000076f53e85
Thread C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe [3900:3540] 0000000076f53e85
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Tag 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@MSIgnoreLSPDefault
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@DisplayName aswRvrt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Description avast! Revert
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@BootCounter 81
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@TickCounter 863506
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Tag 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@ProgramFolder \DosDevices\F:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@BehavShield 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFolder \DosDevices\F:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@GadgetFolder \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DisplayName avast! Network Shield Support
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Description avast! Network Shield TDI driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Tag 9
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@DisplayName aswVmm
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Type 32
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ImagePath "F:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Description Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Tag 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@MSIgnoreLSPDefault
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@DisplayName aswRvrt
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Description avast! Revert
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@BootCounter 81
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@TickCounter 863506
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Tag 2
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@ProgramFolder \DosDevices\F:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@BehavShield 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFolder \DosDevices\F:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@GadgetFolder \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DisplayName avast! Network Shield Support
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Description avast! Network Shield TDI driver
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Tag 9
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@DisplayName aswVmm
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Type 32
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ImagePath "F:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Description Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.
---- EOF - GMER 2.1 ----
Die Logs von Avast kann ich leider trotz Google-Suche nicht finden. Würde sie gerne posten, wenn mir dabei jemand hilft :confused:
Bin für jede Hilfe dankbar.
Beste Grüße
Moe |
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
