| |
| |||||||
Log-Analyse und Auswertung: 2ter Rechner mit Win32.downloader.gen (Win 7)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
31.08.2013, 14:04
| #1 |
 |  2ter Rechner mit Win32.downloader.gen (Win 7) GMER Log Teil 1: Code:
ATTFilter Rootkit scan 2013-08-31 13:02:30
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.JC4O 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\BERNHA~1\AppData\Local\Temp\fgtdqpow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 560 fffff80002db5000 45 bytes [00, 00, 09, 02, 56, 61, 64, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 607 fffff80002db502f 17 bytes [00, A7, 52, 07, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\csrss.exe[664] C:\Windows\SYSTEM32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\csrss.exe[724] C:\Windows\SYSTEM32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\wininit.exe[732] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\winlogon.exe[768] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\services.exe[828] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\lsass.exe[836] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\lsm.exe[844] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[936] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[128] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\atiesrxx.exe[584] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[896] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[1040] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1068] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1092] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1352] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe[1708] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe[1708] C:\Windows\system32\USER32.dll!SetLayeredWindowAttributes + 20 000000007764cd04 5 bytes JMP 0000000122310df8
.text C:\Windows\System32\spoolsv.exe[1860] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1944] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1304] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Windows\system32\svchost.exe[1348] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[880] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2008] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[2080] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[2104] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\inetsrv\inetinfo.exe[2144] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\IProsetMonitor.exe[2200] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[2252] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[2272] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe[2292] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[2536] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Windows\System32\tcpsvcs.exe[2572] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\System32\snmp.exe[2628] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[2664] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[2712] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2752] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3068] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 00000001001c075c
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001001c03a4
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 00000001001c0b14
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 00000001001c0ecc
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 00000001001c163c
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 00000001001c1284
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001001c19f4
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010041075c
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100411284
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100410ecc
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001004103a4
.text C:\Windows\system32\svchost.exe[3880] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100410b14
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010035075c
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001003503a4
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100350b14
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100350ecc
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010035163c
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100351284
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001003519f4
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010040075c
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100401284
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100400ecc
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001004003a4
.text C:\Windows\system32\SearchIndexer.exe[3440] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100400b14
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010046075c
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001004603a4
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100460b14
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100460ecc
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010046163c
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100461284
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001004619f4
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 00000001004b075c
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 00000001004b1284
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 00000001004b0ecc
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001004b03a4
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 00000001004b0b14
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Windows\system32\atieclxx.exe[4504] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100090600
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100090804
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100090c0c
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100090a08
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100090e10
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000901f8
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000903fc
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 00000001000a1014
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 00000001000a0804
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 00000001000a0a08
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 00000001000a0c0c
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 00000001000a0e10
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001000a01f8
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001000a03fc
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 00000001000a0600
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001000b01f8
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001000b03fc
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 00000001000b0804
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 00000001000b0600
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4280] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 00000001000b0a08
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010047075c
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001004703a4
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100470b14
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100470ecc
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010047163c
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100471284
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001004719f4
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010031075c
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100311284
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100310ecc
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001003103a4
.text C:\Windows\System32\svchost.exe[4248] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100310b14
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[964] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010029075c
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001002903a4
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100290b14
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100290ecc
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010029163c
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100291284
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001002919f4
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010048075c
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100481284
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100480ecc
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001004803a4
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100480b14
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Windows\system32\taskhost.exe[3136] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 00000001003c075c
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001003c03a4
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 00000001003c0b14
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 00000001003c0ecc
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 00000001003c163c
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 00000001003c1284
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001003c19f4
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000007fff075c
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 000000007fff1284
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 000000007fff0ecc
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 000000007fff03a4
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 000000007fff0b14
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Windows\system32\Dwm.exe[3480] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010035075c
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001003503a4
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100350b14
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100350ecc
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010035163c
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100351284
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001003519f4
.text C:\Windows\Explorer.EXE[4896] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Windows\Explorer.EXE[4896] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Windows\Explorer.EXE[4896] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 00000001004d075c
.text C:\Windows\Explorer.EXE[4896] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 00000001004d1284
.text C:\Windows\Explorer.EXE[4896] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 00000001004d0ecc
.text C:\Windows\Explorer.EXE[4896] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001004d03a4
.text C:\Windows\Explorer.EXE[4896] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 00000001004d0b14
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010025075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001002503a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100250b14
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100250ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010025163c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100251284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001002519f4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010054075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100541284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100540ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001005403a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4420] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100540b14
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001002401f8
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001002403fc
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 0000000100240804
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 0000000100240600
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 0000000100240a08
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 0000000100251014
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 0000000100250804
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 0000000100250a08
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 0000000100250c0c
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 0000000100250e10
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001002501f8
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001002503fc
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 0000000100250600
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69 0000000075751465 2 bytes [75, 75]
.text C:\Users\Bernhard Speiser\AppData\Roaming\Dropbox\bin\Dropbox.exe[4820] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155 00000000757514bb 2 bytes [75, 75]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 00000001000d1014
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 00000001000d0804
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 00000001000d0a08
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 00000001000d0c0c
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 00000001000d0e10
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001000d01f8
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001000d03fc
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 00000001000d0600
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001000e01f8
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001000e03fc
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 00000001000e0804
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 00000001000e0600
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5076] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 00000001000e0a08
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001002401f8
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001002403fc
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 0000000100240804
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 0000000100240600
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 0000000100240a08
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 0000000100251014
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 0000000100250804
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 0000000100250a08
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 0000000100250c0c
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 0000000100250e10
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001002501f8
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001002503fc
.text C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5080] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 0000000100250600
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
Code:
ATTFilter .text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001001001f8
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001001003fc
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 0000000100100804
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 0000000100100600
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 0000000100100a08
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 0000000100111014
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 0000000100110804
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 0000000100110a08
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 0000000100110c0c
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 0000000100110e10
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001001101f8
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001001103fc
.text C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE[5032] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 0000000100110600
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001001c01f8
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001001c03fc
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 00000001001c0804
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 00000001001c0600
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 00000001001c0a08
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 00000001001d1014
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 00000001001d0804
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 00000001001d0a08
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 00000001001d0c0c
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 00000001001d0e10
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001001d01f8
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001001d03fc
.text C:\Program Files (x86)\CyberLink\Shared files\brs.exe[5072] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 00000001001d0600
.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[3080] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010010075c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001001003a4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100100b14
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100100ecc
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010010163c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100101284
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001001019f4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 00000001004d075c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 00000001004d1284
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 00000001004d0ecc
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001004d03a4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3208] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 00000001004d0b14
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 0000000100091014
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 0000000100090804
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 0000000100090a08
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 0000000100090c0c
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 0000000100090e10
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001000901f8
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001000903fc
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 0000000100090600
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001000a01f8
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001000a03fc
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 00000001000a0804
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 00000001000a0600
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3556] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 00000001000a0a08
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010040075c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001004003a4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100400b14
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100400ecc
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010040163c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100401284
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001004019f4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010046075c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100461284
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100460ecc
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001004603a4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[5156] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100460b14
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010020075c
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001002003a4
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100200b14
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100200ecc
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010020163c
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100201284
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001002019f4
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010036075c
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100361284
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100360ecc
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001003603a4
.text C:\Program Files\iPod\bin\iPodService.exe[5180] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100360b14
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010018075c
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001001803a4
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100180b14
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100180ecc
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010018163c
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100181284
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001001819f4
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 000000010028075c
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 0000000100281284
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 0000000100280ecc
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001002803a4
.text C:\Windows\System32\svchost.exe[5752] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 0000000100280b14
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 00000001001d075c
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001001d03a4
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 00000001001d0b14
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 00000001001d0ecc
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 00000001001d163c
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 00000001001d1284
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001001d19f4
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\system32\USER32.dll!UnhookWinEvent 0000000077648550 5 bytes JMP 00000001002f075c
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000000007764d440 5 bytes JMP 00000001002f1284
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000000007764f874 5 bytes JMP 00000001002f0ecc
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\system32\USER32.dll!SetWinEventHook 0000000077654d4c 5 bytes JMP 00000001002f03a4
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\system32\USER32.dll!SetWindowsHookExA 0000000077668c20 5 bytes JMP 00000001002f0b14
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Windows\system32\DllHost.exe[6676] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001002401f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001002403fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 0000000100240804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 0000000100240600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 0000000100240a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 0000000100251014
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 0000000100250804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 0000000100250a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 0000000100250c0c
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 0000000100250e10
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001002501f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001002503fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 0000000100250600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000075751465 2 bytes [75, 75]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[9348] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000757514bb 2 bytes [75, 75]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001002301f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001002303fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 0000000100230804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 0000000100230600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 0000000100230a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 0000000100241014
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 0000000100240804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 0000000100240a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 0000000100240c0c
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 0000000100240e10
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001002401f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001002403fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 0000000100240600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000075751465 2 bytes [75, 75]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[6848] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000757514bb 2 bytes [75, 75]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001000901f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001000903fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 0000000100090804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 0000000100090600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 0000000100090a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 00000001000a1014
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 00000001000a0804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 00000001000a0a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 00000001000a0c0c
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 00000001000a0e10
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001000a01f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001000a03fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe[5528] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 00000001000a0600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007793faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007793fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007793fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077940018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077941900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007795c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077961217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\USER32.dll!SetWinEventHook 000000007743ee09 5 bytes JMP 00000001002c01f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000077443982 5 bytes JMP 00000001002c03fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000077447603 5 bytes JMP 00000001002c0804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 000000007744835c 5 bytes JMP 00000001002c0600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 000000007745f52b 5 bytes JMP 00000001002c0a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075735181 5 bytes JMP 00000001002d1014
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075735254 5 bytes JMP 00000001002d0804
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000757353d5 5 bytes JMP 00000001002d0a08
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000757354c2 5 bytes JMP 00000001002d0c0c
|
|
31.08.2013, 14:05
| #2 |
| | 2ter Rechner mit Win32.downloader.gen (Win 7) Gmer Teil 3:
__________________Code:
ATTFilter .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000757355e2 5 bytes JMP 00000001002d0e10
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007573567c 5 bytes JMP 00000001002d01f8
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007573589f 5 bytes JMP 00000001002d03fc
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075735a22 5 bytes JMP 00000001002d0600
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075751465 2 bytes [75, 75]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe[7224] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000757514bb 2 bytes [75, 75]
.text ... * 2
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010038075c
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001003803a4
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100380b14
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100380ecc
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010038163c
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100381284
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001003819f4
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Windows\system32\taskhost.exe[3212] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077763ae0 5 bytes JMP 000000010027075c
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077767a90 5 bytes JMP 00000001002703a4
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077791490 5 bytes JMP 0000000100270b14
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000777914f0 5 bytes JMP 0000000100270ecc
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000777915d0 5 bytes JMP 000000010027163c
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077791810 5 bytes JMP 0000000100271284
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077792840 5 bytes JMP 00000001002719f4
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe596e00 5 bytes JMP 000007ff7e5b1dac
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe596f2c 5 bytes JMP 000007ff7e5b0ecc
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe597220 5 bytes JMP 000007ff7e5b1284
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe59739c 5 bytes JMP 000007ff7e5b163c
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe597538 5 bytes JMP 000007ff7e5b19f4
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5975e8 5 bytes JMP 000007ff7e5b03a4
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe59790c 5 bytes JMP 000007ff7e5b075c
.text C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE[10100] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe597ab4 5 bytes JMP 000007ff7e5b0b14
.text C:\Windows\system32\AUDIODG.EXE[8284] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189 000000007757eecd 1 byte [62]
.text C:\Users\Bernhard Speiser\Desktop\gmer_2.1.19163.exe[1492] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007734a30a 1 byte [62]
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [4248:4860] 000007fef0c59688
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Tag 3
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@DisableAutostart 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@MSIgnoreLSPDefault
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@DisplayName aswRvrt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Description avast! Revert
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@BootCounter 51
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@TickCounter 308742
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Tag 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@BehavShield 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@GadgetFolder \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@NoWelcomeScreen 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DisplayName avast! Network Shield Support
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Description avast! Network Shield TDI driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Tag 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi\Parameters@DisableAutostart 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi\Parameters@ProviderStart 3
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@DisplayName aswVmm
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Type 32
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Description Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Tag 3
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@DisableAutostart 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@MSIgnoreLSPDefault
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@DisplayName aswRvrt
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Description avast! Revert
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@BootCounter 51
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@TickCounter 308742
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Tag 2
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@BehavShield 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@GadgetFolder \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DisplayName avast! Network Shield Support
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Description avast! Network Shield TDI driver
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Tag 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi\Parameters@DisableAutostart 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi\Parameters@ProviderStart 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@DisplayName aswVmm
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Type 32
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Description Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Vielen Dank |
|
| Themen zu 2ter Rechner mit Win32.downloader.gen (Win 7) |
| dateien, files, helft, hoffe, infiziert., kriege, rechner, sauber, win, win 7, win32.downloader.gen, wisst, zweiter |
Hybrid-Darstellung
