| |
| |||||||
Log-Analyse und Auswertung: 2ter Rechner mit Win32.downloader.gen (Win 7)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
31.08.2013, 14:02
| #1 |
 |  2ter Rechner mit Win32.downloader.gen (Win 7) OK, das ist das Logfile von Spybot: Code:
ATTFilter Search results from Spybot - Search & Destroy
8/31/2013 11:50:06 AM
Scan took 00:29:35.
66 items found.
Win32.Downloader.gen: [SBI $4FAD8AA1] Configuration file (File, nothing done)
C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Firefox\Profiles\49a0ufp2.default\searchplugins\conduit.xml
Properties.size=943
Properties.md5=3AC23F4D45FFDC9477BD14ADCEB81CA0
Properties.filedate=1295271700
Properties.filedatetext=2011-01-17 15:41:40
Win32.Downloader.gen: [SBI $97C26527] Configuration file (File, nothing done)
C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Firefox\Profiles\49a0ufp2.default\prefs.js
Properties.size=30904
Properties.md5=1094C06DDEBA6EC394C8332A1045424B
Properties.filedate=1377940785
Properties.filedatetext=2013-08-31 11:19:44
Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done)
C:\Users\Bernhard Speiser\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\9MDNJMY4\cdn.flashtalking.com\ftLocalComms.sol
Properties.size=61
Properties.md5=FD3E80A7C58C90200C320A635DB3EF8B
Properties.filedate=1374089682
Properties.filedatetext=2013-07-17 21:34:41
Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done)
C:\Users\Bernhard Speiser\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\9MDNJMY4\cdn.flashtalking.com\FT_cookie.sol
Properties.size=43
Properties.md5=B36E1847615191796283CCC5FD9777EA
Properties.filedate=1371499070
Properties.filedatetext=2013-06-17 21:57:49
Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done)
C:\Users\Bernhard Speiser\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\9MDNJMY4\cdn.movad.net\movad.sol
Properties.size=67
Properties.md5=42864F95D4DAF9407D0B73991B1BDA76
Properties.filedate=1371291821
Properties.filedatetext=2013-06-15 12:23:41
Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done)
C:\Users\Bernhard Speiser\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\9MDNJMY4\www.paypalobjects.com\paypalLSO.sol
Properties.size=111
Properties.md5=7394400F12FEED90AA030FDB54BA7C84
Properties.filedate=1371297334
Properties.filedatetext=2013-06-15 13:55:34
Macromedia.FlashPlayer.Cookies: [SBI $6AA61750] Text file (File, nothing done)
C:\Users\Bernhard Speiser\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\9MDNJMY4\www.paypalobjects.com\ppLsoTest.sol
Properties.size=48
Properties.md5=74EE4375686A2069414EEF13E7B62789
Properties.filedate=1371297313
Properties.filedatetext=2013-06-15 13:55:13
Macromedia.FlashPlayer.Cookies: [SBI $5555F3D7] Text file (File, nothing done)
C:\Users\Bernhard Speiser\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\9MDNJMY4\heias.com\x\heias_sc.swf\heias.sol
Properties.size=63
Properties.md5=5DE47F5D69058879575330A3B88FA494
Properties.filedate=1370631939
Properties.filedatetext=2013-06-07 21:05:38
DoubleClick: [SBI $8E73A7FB] Tracking cookie (Internet Explorer (Benutzer): Bernhard Speiser) (Browser: Cookie, nothing done)
DoubleClick: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
MediaPlex: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
MediaPlex: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
MediaPlex: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
BurstMedia: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
Statcounter: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
MediaPlex: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
MediaPlex: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
WebTrends live: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
Tradedoubler: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
Tradedoubler: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
Tradedoubler: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
Tradedoubler: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
BurstMedia: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
BurstMedia: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
CasaleMedia: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
FastClick: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
CasaleMedia: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
CasaleMedia: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
CasaleMedia: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
CasaleMedia: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
DoubleClick: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
DoubleClick: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
DoubleClick: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
MediaPlex: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
DoubleClick: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
MediaPlex: [SBI $8E73A7FB] Tracking cookie (Firefox: Bernhard Speiser (default)) (Browser: Cookie, nothing done)
Internet Explorer: [SBI $1E8157BE] Typed URL list (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Internet Explorer\TypedURLs
Internet Explorer: [SBI $FF589D0C] Download directory (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Internet Explorer\Download Directory
Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
MS Management Console: [SBI $ECD50EAD] Recent command list (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Microsoft Management Console\Recent File List
MS Media Player: [SBI $5C51E349] Client ID (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\MediaPlayer\Player\Settings\Client ID
MS Direct3D: [SBI $7FB7B83F] Most recent application (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Direct3D\MostRecentApplication\Name
MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication\Name
MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Direct3D\MostRecentApplication\Name
MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Direct3D\MostRecentApplication\Name
MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name
MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\DirectInput\MostRecentApplication\Name
MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\DirectInput\MostRecentApplication\Id
MS Paint: [SBI $07867C39] Recent file list (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List
Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources
Windows.OpenWith: [SBI $16E309E0] Open with list - .ASF extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ASF\OpenWithList
Windows.OpenWith: [SBI $F7204896] Open with list - .AVI extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AVI\OpenWithList
Windows.OpenWith: [SBI $A1C94E79] Open with list - .BMP extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\OpenWithList
Windows Explorer: [SBI $AA0766B5] Stream history (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU
Windows Explorer: [SBI $D20DA0AD] Recent file global history (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Windows Media\WMSDK\General\ComputerName
Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Windows Media\WMSDK\General\UniqueID
Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
HKEY_USERS\S-1-5-21-2722081118-573702699-1194529636-1001\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber
Cookie: [SBI $49804B54] Browser: Cookie (41) (Browser: Cookie, nothing done)
Cache: [SBI $49804B54] Browser: Cache (43) (Browser: Cache, nothing done)
Verlauf: [SBI $49804B54] Browser: History (84) (Browser: History, nothing done)
Cookie: [SBI $49804B54] Browser: Cookie (1512) (Browser: Cookie, nothing done)
Cookie: [SBI $49804B54] Browser: Cookie (25) (Browser: Cookie, nothing done)
--- Spybot - Search & Destroy version: 2.1.18.131 DLL (build: 20130516) ---
2013-05-16 blindman.exe (2.1.18.151)
2013-05-16 explorer.exe (2.1.18.177)
2013-05-16 SDBootCD.exe (2.1.18.109)
2013-05-16 SDCleaner.exe (2.1.18.110)
2013-05-16 SDDelFile.exe (2.1.18.94)
2013-06-18 SDDisableProxy.exe
2013-05-16 SDFiles.exe (2.1.18.135)
2013-03-20 SDFileScanHelper.exe (2.1.16.1)
2013-05-16 SDFSSvc.exe (2.1.18.208)
2013-05-16 SDHookHelper.exe (2.1.18.2)
2013-05-16 SDHookInst32.exe (2.1.18.2)
2013-05-16 SDHookInst64.exe (2.1.18.2)
2013-05-16 SDImmunize.exe (2.1.18.130)
2013-05-16 SDLogReport.exe (2.1.18.107)
2013-05-16 SDOnAccess.exe (2.1.18.4)
2013-05-16 SDPESetup.exe (2.1.18.3)
2013-05-16 SDPEStart.exe (2.1.18.86)
2013-05-16 SDPhoneScan.exe (2.1.18.28)
2013-05-16 SDPRE.exe (2.1.18.22)
2013-05-16 SDPrepPos.exe (2.1.18.10)
2013-05-16 SDQuarantine.exe (2.1.18.103)
2013-05-16 SDRootAlyzer.exe (2.1.18.116)
2013-05-16 SDSBIEdit.exe (2.1.18.39)
2013-05-16 SDScan.exe (2.1.18.177)
2013-05-16 SDScript.exe (2.1.18.53)
2013-05-16 SDSettings.exe (2.1.18.136)
2013-05-16 SDShell.exe (2.1.18.2)
2013-05-16 SDShred.exe (2.1.18.107)
2013-05-16 SDSysRepair.exe (2.1.18.101)
2013-05-16 SDTools.exe (2.1.18.150)
2013-07-25 SDTray.exe (2.1.21.129)
2013-05-16 SDUpdate.exe (2.1.18.91)
2013-05-16 SDUpdSvc.exe (2.1.18.76)
2013-07-10 SDWelcome.exe (2.1.21.129)
2013-05-15 SDWSCSvc.exe (2.1.18.2)
2013-06-19 spybotsd2-translation-frx.exe
2013-08-31 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2013-05-16 SDAdvancedCheckLibrary.dll (2.1.18.98)
2013-05-16 SDAV.dll
2013-05-16 SDECon32.dll (2.1.18.113)
2013-05-16 SDECon64.dll (2.1.18.113)
2013-04-05 SDEvents.dll (2.1.16.2)
2013-05-16 SDFileScanLibrary.dll (2.1.18.12)
2013-05-16 SDHook32.dll (2.1.18.2)
2013-05-16 SDHook64.dll (2.1.18.2)
2013-05-16 SDImmunizeLibrary.dll (2.1.18.2)
2013-05-16 SDLicense.dll (2.1.18.0)
2013-05-16 SDLists.dll (2.1.18.4)
2013-05-16 SDResources.dll (2.1.18.7)
2013-05-16 SDScanLibrary.dll (2.1.18.131)
2013-05-16 SDTasks.dll (2.1.18.15)
2013-05-16 SDWinLogon.dll (2.1.18.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2013-05-16 Tools.dll (2.1.18.36)
2012-12-18 Includes\Adware.sbi (*)
2013-08-28 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2012-11-14 Includes\DialerC.sbi (*)
2012-11-14 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2012-11-14 Includes\HijackersC.sbi (*)
2013-08-22 Includes\iPhone.sbi (*)
2013-06-25 Includes\Keyloggers.sbi (*)
2012-12-18 Includes\KeyloggersC.sbi (*)
2013-05-29 Includes\Malware.sbi (*)
2013-08-28 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2013-08-06 Includes\PUPSC.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2012-11-14 Includes\SecurityC.sbi (*)
2013-05-22 Includes\Spyware.sbi (*)
2013-08-06 Includes\SpywareC.sbi (*)
2011-06-07 Includes\Tracks.sbi (*)
2012-11-19 Includes\Tracks.uti (*)
2013-01-16 Includes\Trojans.sbi (*)
2013-05-13 Includes\TrojansC-02.sbi (*)
2013-07-31 Includes\TrojansC-03.sbi (*)
2013-08-28 Includes\TrojansC-04.sbi (*)
2013-05-08 Includes\TrojansC-05.sbi (*)
2013-08-06 Includes\TrojansC.sbi (*)
Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:40 on 31/08/2013 (Bernhard Speiser)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-08-2013 01
Ran by Bernhard Speiser (administrator) on BSP on 31-08-2013 12:41:02
Running from C:\Users\Bernhard Speiser\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\system32\CISVC.EXE
(Microsoft Corporation) C:\Windows\system32\inetsrv\inetinfo.exe
(Intel Corporation) C:\Windows\system32\IProsetMonitor.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Microsoft Corporation) C:\Windows\System32\tcpsvcs.exe
(Microsoft Corporation) C:\Windows\System32\snmp.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Dropbox, Inc.) C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe
(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11490408 2010-10-22] (Realtek Semiconductor)
HKLM\...\Run: [ISW] - C:\Program Files\CheckPoint\ZAForceField\ForceField.exe [1127592 2012-11-22] (Check Point Software Technologies)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-10-01] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-09-14] (Intel Corporation)
HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-03] (CyberLink)
HKLM-x32\...\Run: [BDRegion] - C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [75048 2010-01-19] (cyberlink)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ZoneAlarm] - C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [73832 2013-01-29] (Check Point Software Technologies LTD)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
Startup: C:\Users\Bernhard Speiser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Bernhard Speiser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=MDNB&bmod=MDNB
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=MDNB&bmod=MDNB
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
SearchScopes: HKCU - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Firefox\Profiles\49a0ufp2.default
FF user.js: detected! => C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Firefox\Profiles\49a0ufp2.default\user.js
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @checkpoint.com/FFApi - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll ()
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=1.1.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Firefox\Profiles\49a0ufp2.default\searchplugins\conduit.xml
FF SearchPlugin: C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Firefox\Profiles\49a0ufp2.default\searchplugins\zonealarm.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wikipedia-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
FF Extension: No Name - C:\Users\Bernhard Speiser\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\TrustChecker
FF Extension: No Name - C:\Program Files\CheckPoint\ZAForceField\TrustChecker
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF Extension: ZoneAlarm Security Engine - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
==================== Services (Whitelisted) =================
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 ftpsvc; C:\Windows\system32\inetsrv\ftpsvc.dll [350720 2012-06-01] (Microsoft Corporation)
R2 IISADMIN; C:\Windows\system32\inetsrv\inetinfo.exe [15872 2010-11-20] (Microsoft Corporation)
R2 iprip; C:\Windows\System32\iprip.dll [35328 2009-07-14] (Microsoft Corporation)
R2 IswSvc; C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [828072 2012-11-22] (Check Point Software Technologies)
R2 LPDSVC; C:\Windows\system32\lpdsvc.dll [45568 2009-07-14] (Microsoft Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-04-17] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
R2 SNMP; C:\Windows\System32\snmp.exe [49664 2010-11-20] (Microsoft Corporation)
R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2447888 2013-01-29] (Check Point Software Technologies LTD)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)
S3 WMSVC; C:\Windows\system32\inetsrv\wmsvc.exe [10752 2009-07-14] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-29] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-29] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-29] ()
S3 IAMTVE; C:\Windows\system32\DRIVERS\IAMTVE.sys [43416 2007-04-12] (Intel Corporation)
S3 IAMTXPE; C:\Windows\system32\DRIVERS\IAMTXPE.sys [51096 2007-04-12] (Intel Corporation)
R2 ISWKL; C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33712 2012-11-22] (Check Point Software Technologies)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [611160 2012-11-15] (Kaspersky Lab)
R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [450136 2012-12-13] (Check Point Software Technologies LTD)
R2 {B154377D-700F-42cc-9474-23858FBDF4BD}; C:\Program Files (x86)\CyberLink\PowerDVD9\000.fcl [146928 2010-01-20] (CyberLink Corp.)
R2 {B154377D-700F-42cc-9474-23858FBDF4BD}; C:\Program Files (x86)\CyberLink\PowerDVD9\000.fcl [146928 2010-01-20] (CyberLink Corp.)
S3 GEARAspiWDM; system32\DRIVERS\GEARAspiWDM.sys [x]
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [89432 2012-11-15] (Kaspersky Lab)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-31 12:40 - 2013-08-31 12:40 - 00000000 ____D C:\FRST
2013-08-31 12:40 - 2013-08-31 12:40 - 00000000 _____ C:\Users\Bernhard Speiser\defogger_reenable
2013-08-31 12:37 - 2013-08-31 12:37 - 00377856 _____ C:\Users\Bernhard Speiser\Downloads\gmer_2.1.19163.exe
2013-08-31 12:37 - 2013-08-31 12:37 - 00377856 _____ C:\Users\Bernhard Speiser\Desktop\gmer_2.1.19163.exe
2013-08-31 12:36 - 2013-08-31 12:36 - 01587214 _____ (Farbar) C:\Users\Bernhard Speiser\Downloads\FRST64.exe
2013-08-31 12:36 - 2013-08-31 12:36 - 01587214 _____ (Farbar) C:\Users\Bernhard Speiser\Desktop\FRST64.exe
2013-08-31 12:35 - 2013-08-31 12:35 - 01082213 _____ (Farbar) C:\Users\Bernhard Speiser\Downloads\FRST.exe
2013-08-31 12:35 - 2013-08-31 12:35 - 00050477 _____ C:\Users\Bernhard Speiser\Desktop\Defogger.exe
2013-08-31 11:50 - 2013-08-31 11:50 - 00015147 _____ C:\Users\Bernhard Speiser\Desktop\Checks.130831-1150.txt
2013-08-31 11:03 - 2013-08-31 11:03 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-08-31 11:02 - 2013-08-31 12:32 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-31 11:02 - 2013-08-31 11:17 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-08-31 11:02 - 2013-08-31 11:02 - 00001383 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-08-31 11:02 - 2009-01-25 13:14 - 00017272 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2013-08-31 10:57 - 2013-08-31 10:58 - 37672592 _____ (Safer-Networking Ltd. ) C:\Users\Bernhard Speiser\Downloads\spybotsd-2.1.21-SR2.exe
2013-08-31 09:31 - 2013-08-31 09:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-29 12:59 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-29 12:59 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-29 12:59 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-29 12:59 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-29 12:59 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-29 12:59 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-29 12:59 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-29 12:59 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-29 12:59 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-29 12:59 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-29 12:59 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-29 12:59 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-29 12:59 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-29 12:59 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-29 12:59 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-29 12:59 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-29 12:59 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-29 12:59 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-29 12:59 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-29 12:59 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-29 12:59 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-29 12:59 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-29 12:59 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-29 12:59 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-29 12:59 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-29 12:59 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-29 12:59 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-29 12:59 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-29 12:59 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-29 12:59 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-29 12:59 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-29 12:08 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-29 12:08 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-29 12:08 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-29 12:08 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-29 12:08 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-29 12:08 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-29 12:08 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-29 12:08 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-29 12:08 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-29 12:08 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-29 12:08 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-29 12:08 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-29 12:08 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-29 12:08 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-29 12:08 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-29 12:07 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
==================== One Month Modified Files and Folders =======
2013-08-31 12:40 - 2013-08-31 12:40 - 00000494 _____ C:\Users\Bernhard Speiser\Desktop\defogger_disable.log
2013-08-31 12:40 - 2013-08-31 12:40 - 00000000 ____D C:\FRST
2013-08-31 12:40 - 2013-08-31 12:40 - 00000000 _____ C:\Users\Bernhard Speiser\defogger_reenable
2013-08-31 12:40 - 2011-03-17 00:05 - 00000000 ____D C:\Users\Bernhard Speiser
2013-08-31 12:40 - 2011-03-17 00:02 - 01049134 _____ C:\Windows\WindowsUpdate.log
2013-08-31 12:37 - 2013-08-31 12:37 - 00377856 _____ C:\Users\Bernhard Speiser\Downloads\gmer_2.1.19163.exe
2013-08-31 12:37 - 2013-08-31 12:37 - 00377856 _____ C:\Users\Bernhard Speiser\Desktop\gmer_2.1.19163.exe
2013-08-31 12:36 - 2013-08-31 12:36 - 01587214 _____ (Farbar) C:\Users\Bernhard Speiser\Downloads\FRST64.exe
2013-08-31 12:36 - 2013-08-31 12:36 - 01587214 _____ (Farbar) C:\Users\Bernhard Speiser\Desktop\FRST64.exe
2013-08-31 12:35 - 2013-08-31 12:35 - 01082213 _____ (Farbar) C:\Users\Bernhard Speiser\Downloads\FRST.exe
2013-08-31 12:35 - 2013-08-31 12:35 - 00050477 _____ C:\Users\Bernhard Speiser\Desktop\Defogger.exe
2013-08-31 12:34 - 2012-06-22 00:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-31 12:32 - 2013-08-31 11:02 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-31 12:12 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-31 12:10 - 2012-04-01 18:06 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-31 11:50 - 2013-08-31 11:50 - 00015147 _____ C:\Users\Bernhard Speiser\Desktop\Checks.130831-1150.txt
2013-08-31 11:17 - 2013-08-31 11:02 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-08-31 11:03 - 2013-08-31 11:03 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-08-31 11:02 - 2013-08-31 11:02 - 00001383 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-08-31 10:58 - 2013-08-31 10:57 - 37672592 _____ (Safer-Networking Ltd. ) C:\Users\Bernhard Speiser\Downloads\spybotsd-2.1.21-SR2.exe
2013-08-31 09:34 - 2009-07-14 06:45 - 00010096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-31 09:34 - 2009-07-14 06:45 - 00010096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-31 09:31 - 2013-08-31 09:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-31 09:30 - 2011-05-24 21:03 - 00000000 ___RD C:\Users\Bernhard Speiser\Dropbox
2013-08-31 09:30 - 2011-05-24 21:01 - 00000000 ____D C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox
2013-08-31 09:28 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\inetsrv
2013-08-31 09:25 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-31 09:24 - 2009-07-14 06:51 - 00116364 _____ C:\Windows\setupact.log
2013-08-29 12:55 - 2010-11-25 18:28 - 00777172 _____ C:\Windows\system32\perfh007.dat
2013-08-29 12:55 - 2010-11-25 18:28 - 00176608 _____ C:\Windows\system32\perfc007.dat
2013-08-29 12:55 - 2009-07-14 07:13 - 01835326 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-29 12:52 - 2013-07-27 16:56 - 00000000 ____D C:\Windows\system32\MRT
2013-08-29 12:49 - 2010-11-26 19:57 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-29 12:10 - 2012-04-01 18:06 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-29 12:10 - 2012-04-01 18:06 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-29 12:10 - 2011-06-03 15:30 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-29 11:53 - 2013-05-12 21:16 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-08-07 04:22 - 2010-11-26 19:22 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
Files to move or delete:
====================
C:\Users\BERNHA~1\AppData\Local\Temp\_is1334.exe
C:\Users\BERNHA~1\AppData\Local\Temp\_isFB61.exe
C:\Users\BERNHA~1\AppData\Local\Temp\{AC1AFBD6-44D4-404C-B7BB-402478A7C3EF}\ISSetup.dll
C:\Users\BERNHA~1\AppData\Local\Temp\{AC1AFBD6-44D4-404C-B7BB-402478A7C3EF}\_Setup.dll
C:\Users\BERNHA~1\AppData\Local\Temp\{98A57D83-0AE1-4370-91CD-87B70B361DEA}\ISSetup.dll
C:\Users\BERNHA~1\AppData\Local\Temp\{98A57D83-0AE1-4370-91CD-87B70B361DEA}\_Setup.dll
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-31 12:05
==================== End Of Log ============================
Das ist die Addition.txt von FRS: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-08-2013 01
Ran by Bernhard Speiser at 2013-08-31 12:41:43
Running from C:\Users\Bernhard Speiser\Desktop
Boot Mode: Normal
==========================================================
==================== Installed Programs =======================
Acrobat.com (x32 Version: 1.6.65)
Adobe AIR (x32 Version: 3.7.0.1530)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Reader X (10.1.7) - Deutsch (x32 Version: 10.1.7)
Apple Application Support (x32 Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (x32 Version: 2.1.3.127)
ATI Catalyst Install Manager (Version: 3.0.795.0)
avast! Free Antivirus (x32 Version: 8.0.1489.0)
BioShock (x32 Version: 2.62.0000)
Bonjour (Version: 3.0.0.10)
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0930.2237.38732)
Catalyst Control Center InstallProxy (x32 Version: 2010.0930.2237.38732)
Catalyst Control Center Localization All (x32 Version: 2010.0930.2237.38732)
CCC Help Danish (x32 Version: 2010.0930.2236.38732)
CCC Help Dutch (x32 Version: 2010.0930.2236.38732)
CCC Help English (x32 Version: 2010.0930.2236.38732)
CCC Help Finnish (x32 Version: 2010.0930.2236.38732)
CCC Help French (x32 Version: 2010.0930.2236.38732)
CCC Help German (x32 Version: 2010.0930.2236.38732)
CCC Help Italian (x32 Version: 2010.0930.2236.38732)
CCC Help Japanese (x32 Version: 2010.0930.2236.38732)
CCC Help Norwegian (x32 Version: 2010.0930.2236.38732)
CCC Help Spanish (x32 Version: 2010.0930.2236.38732)
CCC Help Swedish (x32 Version: 2010.0930.2236.38732)
ccc-core-static (x32 Version: 2010.0930.2237.38732)
ccc-utility64 (Version: 2010.0930.2237.38732)
Control ActiveX de Windows Live Mesh para conexiones remotas (x32 Version: 15.4.5722.2)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (x32 Version: 15.4.5722.2)
Controlo ActiveX do Windows Live Mesh para Ligações Remotas (x32 Version: 15.4.5722.2)
CyberLink LabelPrint (x32 Version: 2.5.2602)
CyberLink Power2Go (x32 Version: 6.1.3802)
CyberLink PowerDirector (x32 Version: 8.0.2815)
CyberLink PowerDVD 9 (x32 Version: 9.0.2519.50)
CyberLink PowerDVD Copy (x32 Version: 1.5.1306)
CyberLink PowerProducer (x32 Version: 5.0.2.2326)
D3DX10 (x32 Version: 15.4.2368.0902)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
Dropbox (HKCU Version: 2.0.22)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922)
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922)
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922)
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1118)
Intel(R) Network Connections 15.6.25.0 (Version: 15.6.25.0)
Intel(R) Rapid Storage Technology (x32 Version: 10.0.0.1046)
iTunes (Version: 11.0.4.4)
Java Auto Updater (x32 Version: 2.0.7.1)
Java(TM) 6 Update 31 (x32 Version: 6.0.310)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Kontrolnik Windows Live Mesh ActiveX za oddaljene povezave (x32 Version: 15.4.5722.2)
Medion Home Cinema (x32 Version: 8.0.1517)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2010 Service Pack 1 (SP1) (x32)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Home and Student 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Single Image 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
Mozilla Thunderbird 17.0.7 (x86 de) (x32 Version: 17.0.7)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MSXML 4.0 SP3 Parser (KB2721691) (x32 Version: 4.30.2114.0)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (KB973685) (x32 Version: 4.30.2107.0)
NVIDIA PhysX (x32 Version: 9.10.0222)
PlayReady PC Runtime amd64 (Version: 1.3.0)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922)
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922)
Pošta Windows Live (x32 Version: 15.4.3502.0922)
QuickTime (x32 Version: 7.74.80.86)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6225)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.26.0)
rosoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Skype Click to Call (x32 Version: 5.6.8442)
Skype™ 5.10 (x32 Version: 5.10.116)
Spybot - Search & Destroy (x32 Version: 2.1.21)
swMSM (x32 Version: 12.0.0.1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft Office 2010 (KB2494150) (x32)
Update for Microsoft Office 2010 (KB2553065) (x32)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2566458) (x32)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2597090) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32)
Update for Microsoft PowerPoint 2010 (KB2598240) 32-Bit Edition (x32)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)
VLC media player 1.1.7 (x32 Version: 1.1.7)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922)
Windows Live Fotótár (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3502.0922)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3502.0922)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Yahoo! Detect (x32)
ZoneAlarm Antivirus (x32 Version: 11.0.000.057)
ZoneAlarm Firewall (x32 Version: 11.0.000.057)
ZoneAlarm Free Antivirus + Firewall (x32 Version: 11.0.000.057)
ZoneAlarm LTD Toolbar
ZoneAlarm Security (x32 Version: 11.0.000.057)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922)
==================== Restore Points =========================
29-06-2013 10:34:37 Windows Update
11-07-2013 18:43:06 Windows Update
11-07-2013 19:07:20 Windows Update
17-07-2013 18:46:02 Windows Update
17-07-2013 21:45:55 Windows Update
22-07-2013 20:22:11 Windows Update
27-07-2013 09:46:25 Windows Update
27-07-2013 14:55:49 Windows Update
29-08-2013 10:07:31 Windows Update
29-08-2013 10:48:15 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {0E003600-969A-4AF0-9D27-DEC8B47E58EF} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe No File
Task: {2054264E-29A2-4F78-9CE8-390498C6EFF9} - System32\Tasks\{236C362C-4AAA-47B0-B5B5-7E635C71CF60} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2012-07-13] (Skype Technologies S.A.)
Task: {3512346C-C9A6-4FAC-A00E-E14319D7A3D3} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe No File
Task: {4593BA8F-4BCF-469E-B37C-BADF53F36877} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software)
Task: {77D903ED-A9EA-43BF-93B1-F0D2BD3067CC} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {7E361E09-42F3-4EFE-BACA-5DF606A86C11} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {93C0D303-8C98-4EFA-92F2-61A7335FF1D3} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {A35C0DD6-2375-4838-9A7A-377581035B7E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-29] (Adobe Systems Incorporated)
Task: {AA4C3CFE-FC3F-4CFC-94F0-F1C424120D4F} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {C12208C3-04C8-4E29-8C30-24E7DEFA258C} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe No File
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2013-05-12 21:15 - 2013-05-09 10:58 - 00302224 _____ (AVAST Software) C:\Program Files\AVAST Software\Avast\snxhk64.dll
2012-08-25 22:43 - 2012-07-05 00:16 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\NETAPI32.dll
2012-11-22 16:16 - 2012-11-22 16:16 - 01784320 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ISWRCS.dll
2012-11-22 16:36 - 2012-11-22 16:36 - 01221800 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\trustchecker\bin\trustchecker.dll
2012-11-22 16:35 - 2012-11-22 16:35 - 01509032 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ISWUL.dll
2012-11-22 16:35 - 2012-11-22 16:35 - 00879784 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ISWUL_MIN\ISWUL.dll
2012-11-22 16:35 - 2012-11-22 16:35 - 00796840 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWDMP.dll
2012-11-22 16:35 - 2012-11-22 16:35 - 01368744 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWMENUS.dll
2012-11-22 16:35 - 2012-11-22 16:35 - 00525992 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ISWUIlib.dll
2012-11-22 16:35 - 2012-11-22 16:35 - 00965288 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWFWMON.dll
2012-11-22 16:36 - 2012-11-22 16:36 - 00852648 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWUPD.dll
2012-11-22 16:36 - 2012-11-22 16:36 - 00311464 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\Plugins\updating.dll
2012-11-22 16:35 - 2012-11-22 16:35 - 00467624 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSTATS.dll
2012-11-22 16:35 - 2012-11-22 16:35 - 01050280 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
2012-11-22 16:36 - 2012-11-22 16:36 - 00545960 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\Plugins\SiteChecker.dll
2010-03-18 18:53 - 2010-03-18 18:53 - 08831840 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\trustchecker\bin\samplesites.dll
2010-09-22 00:49 - 2010-09-22 00:49 - 00170880 _____ (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
2011-08-31 00:05 - 2011-08-31 00:05 - 00132968 _____ (Apple Inc.) C:\Program Files\Bonjour\mdnsNSP.dll
2012-11-22 16:35 - 2012-11-22 16:35 - 00138408 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\trustchecker\bin\liblua.dll
2012-11-22 16:35 - 2012-11-22 16:35 - 00282280 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\trustchecker\bin\libtextcat.dll
2012-11-22 16:36 - 2012-11-22 16:36 - 00180392 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\trustchecker\bin\tcdata.dll
2010-11-25 18:07 - 2010-09-29 03:14 - 00039936 _____ (Advanced Micro Devices, Inc. ) C:\Windows\system32\atiuxp64.dll
2010-11-25 18:07 - 2010-09-29 03:54 - 00628224 _____ (ATI Technologies Inc. ) C:\Windows\system32\aticfx64.dll
2010-11-25 18:07 - 2010-09-29 03:37 - 04660224 _____ (ATI Technologies Inc. ) C:\Windows\system32\atidxx64.dll
2013-05-12 21:15 - 2013-05-09 10:58 - 00133840 _____ (AVAST Software) C:\Program Files\AVAST Software\Avast\ashShA64.dll
2013-05-25 02:36 - 2013-05-25 02:36 - 00164016 _____ (Dropbox, Inc.) C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
2012-11-22 16:36 - 2012-11-22 16:36 - 00906408 _____ (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
2011-07-01 21:21 - 2010-11-20 15:25 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\cabview.dll
2011-07-01 21:21 - 2010-11-20 15:25 - 00094720 _____ (Microsoft Corporation) C:\Windows\system32\Cabinet.dll
2009-07-14 02:17 - 2009-07-14 03:40 - 00024576 _____ (Microsoft Corporation) C:\Windows\System32\drprov.dll
2011-07-01 21:21 - 2010-11-20 15:27 - 00129536 _____ (Microsoft Corporation) C:\Windows\System32\ntlanman.dll
2011-07-01 21:22 - 2010-11-20 15:26 - 00100864 _____ (Microsoft Corporation) C:\Windows\System32\davclnt.dll
2009-07-14 01:23 - 2009-07-14 03:40 - 00025600 _____ (Microsoft Corporation) C:\Windows\System32\DAVHLPR.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00875008 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atiacm64.dll
2010-10-01 08:29 - 2010-10-01 08:29 - 00003584 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atiamdeu.dll
2011-02-04 23:40 - 2011-02-04 23:40 - 01269648 _____ (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
2009-07-14 02:25 - 2009-07-14 03:41 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\PhotoMetadataHandler.dll
2009-07-14 01:42 - 2009-07-14 03:41 - 01039872 _____ (Microsoft Corporation) C:\Windows\system32\OPENGL32.dll
2009-07-14 01:42 - 2009-07-14 03:40 - 00165376 _____ (Microsoft Corporation) C:\Windows\system32\GLU32.dll
2009-07-14 01:41 - 2009-07-14 03:40 - 00569344 _____ (Microsoft Corporation) C:\Windows\system32\DDRAW.dll
2009-07-14 01:38 - 2009-07-14 03:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\DCIMAN32.dll
2013-07-11 20:47 - 2013-04-24 00:56 - 09991832 _____ (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll
2013-07-17 20:43 - 2013-07-17 20:43 - 15577088 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\88744044294787b99dd4a8704ab75a79\mscorlib.ni.dll
2013-01-22 22:11 - 2012-10-05 12:52 - 01574496 _____ (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll
2013-08-31 09:28 - 2013-08-31 09:28 - 10655744 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System\af0a0b96a02f9925eb84392ee65a5cfa\System.ni.dll
2013-08-31 09:29 - 2013-08-31 09:29 - 02320384 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Drawing\868d117286ad259249f31d3fe813d39a\System.Drawing.ni.dll
2013-08-31 09:29 - 2013-08-31 09:29 - 17383424 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Windows.Forms\95674cb72317e3a5380ea450b913786f\System.Windows.Forms.ni.dll
2010-10-01 08:34 - 2010-10-01 08:34 - 00106496 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.Implementation.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00032768 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\LOG.Foundation.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00036864 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\LOG.Foundation.Private.dll
2010-10-01 08:34 - 2010-10-01 08:34 - 00065536 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\LOG.Foundation.Implementation.dll
2011-07-08 18:26 - 2010-11-13 02:08 - 00315392 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00005632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.Foundation.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00020480 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\LOG.Foundation.Implementation.Private.dll
2011-07-01 21:21 - 2010-11-05 03:58 - 00303104 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
2013-07-27 16:21 - 2013-04-20 00:54 - 05292032 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_64\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
2010-10-01 08:34 - 2010-10-01 08:34 - 00032768 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.Implementation.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00015360 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\NEWAEM.Foundation.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00098304 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Foundation.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00057344 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.SkinFactory.dll
2010-10-01 08:34 - 2010-10-01 08:34 - 00028672 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Foundation.XManifest.dll
2013-08-31 09:28 - 2013-08-31 09:28 - 06964736 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Xml\3975acf49313ceea1280da91f0383480\System.Xml.ni.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00061440 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Runtime.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00049152 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Runtime.Shared.Private.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00040960 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Foundation.Private.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00005632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Runtime.Shared.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00032768 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\ATICCCom.dll
2010-04-29 13:30 - 2010-04-29 13:30 - 00066048 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\ADL.Foundation.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00045056 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Server.dll
2010-11-25 18:07 - 2010-09-29 03:15 - 00340480 _____ (Advanced Micro Devices, Inc.) C:\Windows\system32\atiadlxx.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00006144 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Server.Shared.dll
2010-10-01 08:35 - 2010-10-01 08:35 - 00045056 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.Source.Kit.Server.dll
2010-10-01 08:35 - 2010-10-01 08:35 - 00006656 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.DPPE.Shared.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00007168 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.Hotkeys.Shared.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00006144 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.WinMessages.Shared.dll
2009-04-22 22:13 - 2009-04-22 22:13 - 00045056 _____ (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0601.dll
2010-03-04 10:27 - 2010-03-04 10:27 - 00016384 _____ (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Foundation.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00006656 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.dll
2010-08-18 13:28 - 2010-08-18 13:28 - 00450560 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\ATIDEMGX.dll
2013-08-31 09:28 - 2013-08-31 09:28 - 01320448 _____ (Microsoft Corporation) C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Configuration\1031b311ee568364d4ca1c4db634eaf0\System.Configuration.ni.dll
2010-11-25 18:07 - 2010-09-29 03:49 - 00421376 _____ (ATI Technologies, Inc.) C:\Windows\system32\atipdl64.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00385024 _____ (Advanced Mirco Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Runtime.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00155648 _____ (Advanced Mirco Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Shared.dll
2009-06-17 15:27 - 2009-06-17 15:27 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0709.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00005632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.GD.Shared.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00008192 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Actions.CCAA.Shared.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00007168 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\ResourceManagement.Foundation.Private.dll
2008-04-04 02:29 - 2008-04-04 02:29 - 00020480 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0804.dll
2010-10-01 08:33 - 2010-10-01 08:33 - 00045056 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll
2010-10-01 08:33 - 2010-10-01 08:33 - 00036864 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll
2010-10-01 08:33 - 2010-10-01 08:33 - 00040960 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll
2010-10-01 08:32 - 2010-10-01 08:32 - 00040960 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll
2010-10-01 08:31 - 2010-10-01 08:31 - 00008704 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Runtime.Shared.Private.dll
2010-10-01 08:32 - 2010-10-01 08:32 - 00065536 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll
2010-10-01 08:31 - 2010-10-01 08:31 - 00028672 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll
2010-10-01 08:33 - 2010-10-01 08:33 - 00073728 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Radeon3D.Graphics.Runtime.dll
2010-10-01 08:31 - 2010-10-01 08:31 - 00032768 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceLCD.Graphics.Shared.dll
2010-10-01 08:31 - 2010-10-01 08:31 - 00053248 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceDFP.Graphics.Shared.dll
2010-10-01 08:31 - 2010-10-01 08:31 - 00028672 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CustomFormats.Graphics.Shared.dll
2010-10-01 08:35 - 2010-10-01 08:35 - 00077824 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.OverDrive5.Graphics.Runtime.dll
2010-10-01 08:33 - 2010-10-01 08:33 - 00065536 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Radeon3D.Graphics.Shared.dll
2010-10-01 08:36 - 2010-10-01 08:36 - 00013824 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.TransCode.Graphics.Runtime.dll
2010-10-01 08:33 - 2010-10-01 08:33 - 00102400 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.MMVideo.Graphics.Runtime.dll
2010-10-01 08:36 - 2010-10-01 08:36 - 00013312 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Welcome.Graphics.Runtime.dll
2010-10-01 08:31 - 2010-10-01 08:31 - 00020480 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll
2010-10-01 08:34 - 2010-10-01 08:34 - 00077824 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceTV.Graphics.Runtime.dll
2010-10-01 08:32 - 2010-10-01 08:32 - 00065536 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.MMVideo.Graphics.Shared.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00020480 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll
2010-10-01 08:33 - 2010-10-01 08:33 - 00069632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCV.Graphics.Runtime.dll
2010-10-01 08:33 - 2010-10-01 08:33 - 00024576 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll
2010-10-01 08:33 - 2010-10-01 08:33 - 00053248 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCRT.Graphics.shared.dll
2010-10-01 08:35 - 2010-10-01 08:35 - 00045056 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.TransCode.Graphics.shared.dll
2009-06-17 20:24 - 2009-06-17 20:24 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0906.dll
2010-10-01 08:34 - 2010-10-01 08:34 - 00065536 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceTV.Graphics.shared.dll
2010-10-01 08:35 - 2010-10-01 08:35 - 00061440 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.OverDrive5.Graphics.shared.dll
2010-10-01 08:35 - 2010-10-01 08:35 - 00009728 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Welcome.Graphics.shared.dll
2010-10-01 08:33 - 2010-10-01 08:33 - 00040960 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCV.Graphics.Shared.dll
2009-12-08 16:49 - 2009-12-08 16:49 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0912.dll
2007-08-10 02:58 - 2007-08-10 02:58 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0706.dll
2009-06-17 20:24 - 2009-06-17 20:24 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0712.dll
2010-10-01 08:31 - 2010-10-01 08:31 - 00049152 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceProperty.Graphics.Shared.dll
2010-10-01 08:32 - 2010-10-01 08:32 - 00053248 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll
2008-12-30 21:04 - 2008-12-30 21:04 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0812.dll
2009-04-22 22:13 - 2009-04-22 22:13 - 00016384 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0805.dll
2007-05-03 03:44 - 2007-05-03 03:44 - 00020480 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\DEM.Graphics.I0703.dll
2009-01-20 23:51 - 2009-01-20 23:51 - 00007168 _____ ( ) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atixclib.dll
2010-10-01 08:35 - 2010-10-01 08:35 - 00011776 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.HydraVision.Runtime.dll
2010-10-01 08:35 - 2010-10-01 08:35 - 00008704 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.HydraVision.Shared.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00061440 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\APM.Server.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00020480 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\APM.Foundation.dll
2011-07-10 08:37 - 2010-11-13 02:08 - 00434176 _____ (Microsoft Corporation) C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00007168 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Runtime.Extension.EEU.dll
2010-10-01 08:35 - 2010-10-01 08:35 - 00005632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.REG.Shared.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00005632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\AEM.Plugin.EEU.Shared.dll
2010-10-01 08:34 - 2010-10-01 08:34 - 00581632 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Systemtray.dll
2010-10-01 08:31 - 2010-10-01 08:31 - 00040960 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Client.Shared.Private.dll
2010-10-01 08:31 - 2010-10-01 08:31 - 00405504 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Wizard.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00007680 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Client.Shared.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00020480 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Wizard.Shared.dll
2010-10-01 08:31 - 2010-10-01 08:31 - 00011776 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Wizard.Shared.Private.dll
2010-10-01 08:31 - 2010-10-01 08:31 - 00040960 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Wizard.dll
2010-10-01 08:31 - 2010-10-01 08:31 - 00016384 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Wizard.Shared.dll
2010-10-01 08:36 - 2010-10-01 08:36 - 00741376 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\ResourceManagement.Foundation.Implementation.dll
2010-10-01 08:33 - 2010-10-01 08:33 - 00094208 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Radeon3D.Graphics.Wizard.dll
2010-10-01 08:34 - 2010-10-01 08:34 - 00409600 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.MMVideo.Graphics.Wizard.dll
2010-10-01 08:36 - 2010-10-01 08:36 - 01708032 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysManager2.Graphics.Wizard.dll
2010-10-01 08:31 - 2010-10-01 08:31 - 00204800 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.InfoCentre.Graphics.Wizard.dll
2010-10-01 08:35 - 2010-10-01 08:35 - 00007680 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.HydraVision.Wizard.dll
2010-10-01 08:31 - 2010-10-01 08:31 - 01220608 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Dashboard.dll
2010-10-01 08:30 - 2010-10-01 08:30 - 00024576 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Dashboard.Shared.dll
2010-10-01 08:31 - 2010-10-01 08:31 - 00010240 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Component.Dashboard.Shared.Private.dll
2010-10-01 08:31 - 2010-10-01 08:31 - 00073728 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Dashboard.dll
2010-10-01 08:31 - 2010-10-01 08:31 - 00016384 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.Graphics.Dashboard.Shared.dll
2010-10-01 08:35 - 2010-10-01 08:35 - 00065536 _____ (Advanced Mirco Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Welcome.Graphics.Dashboard.dll
2010-10-01 08:31 - 2010-10-01 08:31 - 00196608 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll
2010-10-01 08:36 - 2010-10-01 08:36 - 01306624 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysManager2.Graphics.Dashboard.dll
2010-10-01 08:36 - 2010-10-01 08:36 - 00270336 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2010-10-01 08:33 - 2010-10-01 08:33 - 00094208 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll
2010-10-01 08:33 - 2010-10-01 08:33 - 00397312 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll
2010-10-01 08:32 - 2010-10-01 08:32 - 00376832 _____ (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll
2010-10-01 08:33 - 2010-10-01 08:33 - 00397312 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll
2010-10-01 08:31 - 2010-10-01 08:31 - 00573440 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll
2010-10-01 08:33 - 2010-10-01 08:33 - 00880640 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.MMVideo.Graphics.Dashboard.dll
2010-10-01 08:36 - 2010-10-01 08:36 - 00184320 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.TransCode.Graphics.Dashboard.dll
2010-10-01 08:35 - 2010-10-01 08:35 - 00655360 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.OverDrive5.Graphics.Dashboard.dll
2010-10-01 08:35 - 2010-10-01 08:35 - 00007680 _____ (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Caste.HydraVision.Dashboard.dll
2009-07-14 01:31 - 2009-07-14 03:41 - 00090624 _____ (Microsoft Corporation) C:\Windows\System32\wdi.dll
2009-07-14 01:32 - 2009-07-14 03:41 - 00071168 _____ (Microsoft Corporation) C:\Windows\system32\radarrs.dll
2009-07-14 01:35 - 2009-07-14 03:41 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\RstrtMgr.DLL
==================== Alternate Data Streams (whitelisted) ==========
==================== Faulty Device Manager Devices =============
Name: Realtek RTL8191SU Wireless LAN 802.11n USB 2.0 Network Adapter
Description: Realtek RTL8191SU Wireless LAN 802.11n USB 2.0 Network Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Realtek Semiconductor Corp.
Service: RTL8192su
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (08/31/2013 00:05:10 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
Error: (07/25/2013 09:52:24 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
Error: (07/17/2013 10:13:57 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
Error: (07/01/2013 09:10:06 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
Error: (06/24/2013 09:46:34 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
Error: (06/17/2013 10:55:47 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
Error: (06/13/2013 00:30:01 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
Error: (06/12/2013 08:56:19 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
Error: (06/08/2013 00:01:02 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
Error: (06/07/2013 07:57:35 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
System errors:
=============
Error: (08/31/2013 09:26:21 AM) (Source: SNMP) (User: )
Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten.
Error: (08/29/2013 11:52:30 AM) (Source: SNMP) (User: )
Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten.
Error: (07/28/2013 03:24:00 PM) (Source: SNMP) (User: )
Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten.
Error: (07/27/2013 10:44:01 PM) (Source: SNMP) (User: )
Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten.
Error: (07/27/2013 06:32:16 PM) (Source: SNMP) (User: )
Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten.
Error: (07/27/2013 06:15:18 PM) (Source: SNMP) (User: )
Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten.
Error: (07/27/2013 04:11:59 PM) (Source: SNMP) (User: )
Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten.
Error: (07/27/2013 11:40:15 AM) (Source: SNMP) (User: )
Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten.
Error: (07/25/2013 09:13:10 PM) (Source: SNMP) (User: )
Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten.
Error: (07/22/2013 11:11:10 PM) (Source: SNMP) (User: )
Description: Beim Zugreifen auf den Registrierungsschlüssel SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration ist ein Fehler aufgetreten.
Microsoft Office Sessions:
=========================
Error: (08/31/2013 00:05:10 PM) (Source: SideBySide)(User: )
Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2
Error: (07/25/2013 09:52:24 PM) (Source: SideBySide)(User: )
Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2
Error: (07/17/2013 10:13:57 PM) (Source: SideBySide)(User: )
Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2
Error: (07/01/2013 09:10:06 PM) (Source: SideBySide)(User: )
Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2
Error: (06/24/2013 09:46:34 PM) (Source: SideBySide)(User: )
Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2
Error: (06/17/2013 10:55:47 PM) (Source: SideBySide)(User: )
Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2
Error: (06/13/2013 00:30:01 AM) (Source: SideBySide)(User: )
Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2
Error: (06/12/2013 08:56:19 PM) (Source: SideBySide)(User: )
Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2
Error: (06/08/2013 00:01:02 PM) (Source: SideBySide)(User: )
Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2
Error: (06/07/2013 07:57:35 PM) (Source: SideBySide)(User: )
Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2
CodeIntegrity Errors:
===================================
Date: 2013-08-31 12:40:39.144
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-08-31 12:32:28.672
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-08-31 11:25:47.746
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-08-31 11:17:58.038
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-08-29 12:21:50.910
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-07-27 23:21:26.451
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-07-27 23:08:03.183
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-07-27 20:34:23.709
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-07-27 18:49:56.640
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-07-27 18:41:22.960
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 44%
Total physical RAM: 6125.64 MB
Available physical RAM: 3423.08 MB
Total Pagefile: 12249.47 MB
Available Pagefile: 9439.68 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: (Boot) (Fixed) (Total:900.41 GB) (Free:769.96 GB) NTFS
Drive d: (Recover) (Fixed) (Total:30 GB) (Free:9.48 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 932 GB) (Disk ID: 2BD2C32A)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=900 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=30 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)
==================== End Of Log ============================
|
|
31.08.2013, 14:04
| #2 |
| | 2ter Rechner mit Win32.downloader.gen (Win 7) GMER Log Teil 1:
__________________Code:
ATTFilter Rootkit scan 2013-08-31 13:02:30
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.JC4O 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\BERNHA~1\AppData\Local\Temp\fgtdqpow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 560 fffff80002db5000 45 bytes [00, 00, 09, 02, 56, 61, 64, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 607 fffff80002db502f 17 bytes [00, A7, 52, 07, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\csrss.exe[664] C:\Windows\SYSTEM32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\csrss.exe[724] C:\Windows\SYSTEM32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\wininit.exe[732] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\winlogon.exe[768] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\services.exe[828] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\lsass.exe[836] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\lsm.exe[844] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[936] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[128] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\atiesrxx.exe[584] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[896] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[1040] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1068] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1092] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1352] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe[1708] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe[1708] C:\Windows\system32\USER32.dll!SetLayeredWindowAttributes + 20 000000007764cd04 5 bytes JMP 0000000122310df8
.text C:\Windows\System32\spoolsv.exe[1860] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1944] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1304] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Windows\system32\svchost.exe[1348] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[880] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2008] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[2080] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[2104] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\inetsrv\inetinfo.exe[2144] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\IProsetMonitor.exe[2200] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[2252] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[2272] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe[2292] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[2536] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Windows\System32\tcpsvcs.exe[2572] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\System32\snmp.exe[2628] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[2664] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[2712] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2752] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3068] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 00000001001c075c
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001001c03a4
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 00000001001c0b14
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 00000001001c0ecc
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 00000001001c163c
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 00000001001c1284
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001001c19f4
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010041075c
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100411284
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100410ecc
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001004103a4
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100410b14
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010035075c
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001003503a4
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100350b14
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100350ecc
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010035163c
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100351284
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001003519f4
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010040075c
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100401284
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100400ecc
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001004003a4
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100400b14
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010046075c
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001004603a4
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100460b14
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100460ecc
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010046163c
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100461284
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001004619f4
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 00000001004b075c
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 00000001004b1284
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 00000001004b0ecc
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001004b03a4
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 00000001004b0b14
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100090600
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100090804
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100090c0c
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100090a08
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100090e10
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000901f8
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000903fc
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 00000001000a1014
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 00000001000a0804
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 00000001000a0a08
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 00000001000a0c0c
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 00000001000a0e10
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001000a01f8
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001000a03fc
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 00000001000a0600
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001000b01f8
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001000b03fc
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 00000001000b0804
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 00000001000b0600
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 00000001000b0a08
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010047075c
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001004703a4
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100470b14
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100470ecc
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010047163c
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100471284
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001004719f4
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010031075c
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100311284
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100310ecc
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001003103a4
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100310b14
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[964] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010029075c
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001002903a4
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100290b14
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100290ecc
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010029163c
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100291284
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001002919f4
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010048075c
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100481284
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100480ecc
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001004803a4
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100480b14
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 00000001003c075c
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001003c03a4
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 00000001003c0b14
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 00000001003c0ecc
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 00000001003c163c
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 00000001003c1284
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001003c19f4
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000007fff075c
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 000000007fff1284
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 000000007fff0ecc
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 000000007fff03a4
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 000000007fff0b14
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010035075c
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001003503a4
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100350b14
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100350ecc
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010035163c
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100351284
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001003519f4
.text C:\Windows\Explorer.EXE[4896] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Windows\Explorer.EXE[4896] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 00000001004d075c
.text C:\Windows\Explorer.EXE[4896] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 00000001004d1284
.text C:\Windows\Explorer.EXE[4896] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 00000001004d0ecc
.text C:\Windows\Explorer.EXE[4896] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001004d03a4
.text C:\Windows\Explorer.EXE[4896] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 00000001004d0b14
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010025075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001002503a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100250b14
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100250ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010025163c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100251284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001002519f4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010054075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100541284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100540ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001005403a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100540b14
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001002401f8
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001002403fc
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 0000000100240804
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 0000000100240600
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 0000000100240a08
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 0000000100251014
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 0000000100250804
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 0000000100250a08
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 0000000100250c0c
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 0000000100250e10
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001002501f8
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001002503fc
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 0000000100250600
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69 0000000075751465 2 bytes [75, 75]
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155 00000000757514bb 2 bytes [75, 75]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 00000001000d1014
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 00000001000d0804
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 00000001000d0a08
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 00000001000d0c0c
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 00000001000d0e10
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001000d01f8
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001000d03fc
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 00000001000d0600
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001000e01f8
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001000e03fc
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 00000001000e0804
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 00000001000e0600
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 00000001000e0a08
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001002401f8
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001002403fc
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 0000000100240804
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 0000000100240600
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 0000000100240a08
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 0000000100251014
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 0000000100250804
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 0000000100250a08
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 0000000100250c0c
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 0000000100250e10
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001002501f8
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001002503fc
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 0000000100250600
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
Code:
ATTFilter .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001001001f8
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001001003fc
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 0000000100100804
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 0000000100100600
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 0000000100100a08
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 0000000100111014
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 0000000100110804
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 0000000100110a08
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 0000000100110c0c
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 0000000100110e10
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001001101f8
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001001103fc
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 0000000100110600
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001001c01f8
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001001c03fc
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 00000001001c0804
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 00000001001c0600
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 00000001001c0a08
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 00000001001d1014
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 00000001001d0804
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 00000001001d0a08
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 00000001001d0c0c
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 00000001001d0e10
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001001d01f8
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001001d03fc
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 00000001001d0600
.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[3080] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010010075c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001001003a4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100100b14
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100100ecc
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010010163c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100101284
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001001019f4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 00000001004d075c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 00000001004d1284
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 00000001004d0ecc
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001004d03a4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 00000001004d0b14
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 0000000100091014
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 0000000100090804
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 0000000100090a08
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 0000000100090c0c
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 0000000100090e10
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001000901f8
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001000903fc
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 0000000100090600
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001000a01f8
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001000a03fc
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 00000001000a0804
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 00000001000a0600
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 00000001000a0a08
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010040075c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001004003a4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100400b14
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100400ecc
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010040163c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100401284
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001004019f4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010046075c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100461284
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100460ecc
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001004603a4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100460b14
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010020075c
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001002003a4
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100200b14
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100200ecc
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010020163c
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100201284
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001002019f4
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010036075c
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100361284
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100360ecc
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001003603a4
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100360b14
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010018075c
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001001803a4
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100180b14
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100180ecc
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010018163c
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100181284
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001001819f4
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010028075c
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100281284
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100280ecc
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001002803a4
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100280b14
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 00000001001d075c
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001001d03a4
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 00000001001d0b14
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 00000001001d0ecc
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 00000001001d163c
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 00000001001d1284
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001001d19f4
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 00000001002f075c
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 00000001002f1284
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 00000001002f0ecc
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001002f03a4
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 00000001002f0b14
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001002401f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001002403fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 0000000100240804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 0000000100240600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 0000000100240a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 0000000100251014
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 0000000100250804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 0000000100250a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 0000000100250c0c
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 0000000100250e10
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001002501f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001002503fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 0000000100250600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000075751465 2 bytes [75, 75]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000757514bb 2 bytes [75, 75]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001002301f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001002303fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 0000000100230804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 0000000100230600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 0000000100230a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 0000000100241014
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 0000000100240804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 0000000100240a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 0000000100240c0c
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 0000000100240e10
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001002401f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001002403fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 0000000100240600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000075751465 2 bytes [75, 75]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000757514bb 2 bytes [75, 75]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001000901f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001000903fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 0000000100090804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 0000000100090600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 0000000100090a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 00000001000a1014
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 00000001000a0804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 00000001000a0a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 00000001000a0c0c
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 00000001000a0e10
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001000a01f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001000a03fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 00000001000a0600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001002c01f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001002c03fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 00000001002c0804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 00000001002c0600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 00000001002c0a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 00000001002d1014
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 00000001002d0804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 00000001002d0a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 00000001002d0c0c
|
|
31.08.2013, 14:05
| #3 |
| | 2ter Rechner mit Win32.downloader.gen (Win 7) Gmer Teil 3:
__________________Code:
ATTFilter .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 00000001002d0e10
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001002d01f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001002d03fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 00000001002d0600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075751465 2 bytes [75, 75]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000757514bb 2 bytes [75, 75]
.text ... * 2
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010038075c
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001003803a4
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100380b14
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100380ecc
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010038163c
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100381284
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001003819f4
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010027075c
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001002703a4
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100270b14
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100270ecc
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010027163c
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100271284
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001002719f4
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Windows\system32\AUDIODG.EXE[8284] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Users\Bernhard Speiser\Desktop\gmer_2.1.19163.exe[1492] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [4248:4860] 000007fef0c59688
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Tag 3
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@DisableAutostart 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@MSIgnoreLSPDefault
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@DisplayName aswRvrt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Description avast! Revert
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@BootCounter 51
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@TickCounter 308742
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Tag 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@BehavShield 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@GadgetFolder \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@NoWelcomeScreen 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DisplayName avast! Network Shield Support
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Description avast! Network Shield TDI driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Tag 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi\Parameters@DisableAutostart 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi\Parameters@ProviderStart 3
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@DisplayName aswVmm
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Type 32
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Description Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Tag 3
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@DisableAutostart 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@MSIgnoreLSPDefault
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@DisplayName aswRvrt
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Description avast! Revert
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@BootCounter 51
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@TickCounter 308742
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Tag 2
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@BehavShield 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@GadgetFolder \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DisplayName avast! Network Shield Support
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Description avast! Network Shield TDI driver
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Tag 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi\Parameters@DisableAutostart 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi\Parameters@ProviderStart 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@DisplayName aswVmm
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Type 32
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Description Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Vielen Dank |
|
| Themen zu 2ter Rechner mit Win32.downloader.gen (Win 7) |
| dateien, files, helft, hoffe, infiziert., kriege, rechner, sauber, win, win 7, win32.downloader.gen, wisst, zweiter |
Hybrid-Darstellung
