Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar

System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar


Log-Analyse und Auswertung: System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Seite 1 von 2 1 2
Alt 15.09.2013, 13:43   #1
flummy1978
 
System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar - Standard

System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar


Hallo zusammen,

jetzt hat es mich nach einigen Jahren doch erwischt. Die kleineren Problemchen konnte ich bisher lösen. Bei dem ClickCompare bin ich irgendwie doch überfordert.

Problem:
- Teilweise unterstrichene Links im Browser die dann auf compare.... Seiten gehen, Werbung hervorrufen etc.
- Bitdefender Echtzeitschutz und Antispyschutz lässt sich nicht aktivieren

Was ich bisher gemacht habe:

- Netzwerkeinstellungen DNS geändert ( angegeben waren irgendwelche wirren IPs )
- Die erforderlichen Logs erstellt
- Versucht mit Win Wiederherstellung etc das Ganze in den Griff zu bekommen ( leider erfolgslos )

Da es mein erster Post in der Form ist und ebenso mein erstes Problem wo ich mit Hilfe von Google etc nicht weiterkomme, bitte bescheid geben, falls da noch was fehlt. Die meiner Meinung nach erforderlichen Logs befinden sich im Anhang (Gmer.txt war leider zu groß und musste gezippt werden )

Für jegliche Tips + Hilfe, danke bereits im Vorraus

Grüße
Andreas
Geändert von flummy1978 (15.09.2013 um 13:58 Uhr)

Alt 15.09.2013, 14:36   #2
schrauber
/// the machine
/// TB-Ausbilder
 
System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar - Standard

System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar


hi,

Logs zur Not teilen.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________

__________________
Alt 15.09.2013, 14:52   #3
flummy1978
 
System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar - Standard

System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar


Das mit dem Code Tag hab ich irgendwie dezent überlesen. Sorry.

Hatte nur irgendwo gelesen, dass man es lieber zippen soll, wenn die Datei sonst zu groß ist.

Wenn ich allerdings versuche das Ganze als Code einzufügen bekomme ich folgende Meldung:

Der Text, den Sie eingegeben haben, besteht aus 254873 Zeichen und ist damit zu lang. Bitte kürzen Sie den Text auf die maximale Länge von 120000 Zeichen.

Als Alternative bekomme ich lediglich die ZIP Variante angeboten
__________________
Alt 15.09.2013, 16:17   #4
schrauber
/// the machine
/// TB-Ausbilder
 
System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar - Standard

System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar


Teile das Log in Stücke, kannst auch mehrere Posts benutzen
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 15.09.2013, 16:29   #5
flummy1978
 
System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar - Standard

System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar


Hmmm manchmal sieht man vor lauter Bäumen den Wald nicht

Ok aller guten Dinge sind 3

Code:
ATTFilter
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-15 14:27:35
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000072 NVIDIA__ rev. 596,18GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Andreas\AppData\Local\Temp\uxlorpob.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\BUFFALO\NASNAVI\NasNavi.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                        00000000759e1465 2 bytes [9E, 75]
.text  C:\Program Files (x86)\BUFFALO\NASNAVI\NasNavi.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                       00000000759e14bb 2 bytes [9E, 75]
.text  ...                                                                                                                                                     * 2
.text  C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                     00000000759e1465 2 bytes [9E, 75]
.text  C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[3844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                    00000000759e14bb 2 bytes [9E, 75]
.text  ...                                                                                                                                                     * 2
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!RtlExitUserProcess + 1                                                              0000000077804121 11 bytes [B8, 59, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 1                                                                      0000000077807ac1 11 bytes [B8, F7, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1                                                    00000000778192d1 5 bytes [B8, E3, 74, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7                                                    00000000778192d7 5 bytes [00, 00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParameters + 1                                                      000000007782de21 8 bytes [B8, 2B, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParameters + 10                                                     000000007782de2a 2 bytes [50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile                                                                          0000000077831310 6 bytes [48, B8, 81, 76, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile + 8                                                                      0000000077831318 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile                                                                         0000000077831330 6 bytes [48, B8, C9, 75, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8                                                                     0000000077831338 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtClose                                                                             00000000778313a0 6 bytes [48, B8, 00, 73, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8                                                                         00000000778313a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                           00000000778313d0 6 bytes [48, B8, C3, 77, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 8                                                                       00000000778313d8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess                                                             0000000077831470 6 bytes [48, B8, 11, 75, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8                                                         0000000077831478 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                         0000000077831480 6 bytes [48, B8, AC, 77, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 8                                                                     0000000077831488 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                       0000000077831510 6 bytes [48, B8, 50, 77, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                                                                   0000000077831518 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                0000000077831520 6 bytes [48, B8, 6A, 76, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8                                                            0000000077831528 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                  0000000077831530 6 bytes [48, B8, 45, 73, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8                                                              0000000077831538 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                                0000000077831550 4 bytes [48, B8, 5C, 73]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 5                                                            0000000077831555 1 byte [6F]
.text  ...                                                                                                                                                     * 2
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                  0000000077831570 6 bytes [48, B8, 53, 76, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8                                                              0000000077831578 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                          00000000778315e0 6 bytes [48, B8, C6, 76, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8                                                                      00000000778315e8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                       0000000077831620 6 bytes [48, B8, 2E, 73, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8                                                                   0000000077831628 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                0000000077831650 6 bytes [48, B8, 22, 77, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8                                                            0000000077831658 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                   0000000077831670 6 bytes [48, B8, E0, 75, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8                                                               0000000077831678 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                    0000000077831700 6 bytes [48, B8, 7E, 77, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8                                                                0000000077831708 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                       0000000077831730 6 bytes [48, B8, 9E, 74, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent + 8                                                                   0000000077831738 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                     0000000077831750 6 bytes [48, B8, 17, 73, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8                                                                 0000000077831758 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx                                                                   0000000077831780 6 bytes [48, B8, CF, 73, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8                                                               0000000077831788 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                      0000000077831790 6 bytes [48, B8, DD, 76, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8                                                                  0000000077831798 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                        0000000077831800 6 bytes [48, B8, 73, 73, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                                                                    0000000077831808 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                       00000000778318b0 6 bytes [48, B8, E6, 73, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8                                                                   00000000778318b8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                      0000000077831c80 6 bytes [48, B8, B5, 74, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8                                                                  0000000077831c88 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess                                                                     0000000077831cd0 6 bytes [48, B8, 67, 77, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8                                                                 0000000077831cd8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                    0000000077831d30 6 bytes [48, B8, F4, 76, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8                                                                0000000077831d38 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                         0000000077831e10 6 bytes [48, B8, AF, 76, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 8                                                                     0000000077831e18 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                    0000000077831e40 6 bytes [48, B8, 98, 76, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 8                                                                0000000077831e48 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                        00000000778320a0 6 bytes [48, B8, 87, 74, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8                                                                    00000000778320a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                              00000000778329a0 6 bytes [48, B8, 92, 78, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8                                                          00000000778329a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                    0000000077832a80 6 bytes [48, B8, 1F, 78, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess + 8                                                                0000000077832a88 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                0000000077832aa0 6 bytes [48, B8, A9, 78, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8                                                            0000000077832aa8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot                                                         00000000775c21e0 12 bytes [48, B8, 95, 77, 27, 6F, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!SetThreadContext + 1                                                             00000000775c2f11 8 bytes [B8, 39, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!SetThreadContext + 10                                                            00000000775c2f1a 2 bytes [50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!AssignProcessToJobObject + 1                                                     00000000775ca4a1 8 bytes [B8, 7B, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!AssignProcessToJobObject + 10                                                    00000000775ca4aa 2 bytes [50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!CreateFileW + 1                                                                  00000000775d1871 11 bytes [B8, 70, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!CopyFileExW + 1                                                                  00000000775d23d1 11 bytes [B8, A1, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!CreateThread + 1                                                                 00000000775d6581 11 bytes [B8, F1, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                           00000000775de750 12 bytes [48, B8, FA, 74, 27, 6F, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1                                                              00000000775e1e31 11 bytes [B8, FD, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!CloseHandle                                                                      00000000775e2f10 7 bytes [48, B8, 8A, 73, 27, 6F, 00]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!CloseHandle + 9                                                                  00000000775e2f19 3 bytes [00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!WriteProcessMemory + 1                                                           000000007760bad1 11 bytes [B8, DA, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!VirtualProtectEx + 1                                                             000000007760bb71 11 bytes [B8, 36, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!VirtualAllocEx + 1                                                               000000007760bbd1 11 bytes [B8, 4D, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!CreateRemoteThread + 1                                                           000000007760c511 8 bytes [B8, 0B, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!CreateRemoteThread + 10                                                          000000007760c51a 2 bytes [50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!CheckRemoteDebuggerPresent + 1                                                   0000000077610e11 11 bytes [B8, CC, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1                                                            0000000077615011 11 bytes [B8, 3F, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1                                                            0000000077615031 11 bytes [B8, 28, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!ReadConsoleW                                                                     000000007762a560 12 bytes [48, B8, 6D, 75, 27, 6F, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!ReadConsoleA                                                                     000000007762a670 12 bytes [48, B8, 56, 75, 27, 6F, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!CreateDirectoryExW                                                               0000000077649150 12 bytes [48, B8, 3C, 76, 27, 6F, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\kernel32.dll!MoveFileWithProgressW + 1                                                        000000007764f6c1 11 bytes [B8, B8, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\KERNELBASE.dll!SleepEx                                                                        000007fefd8f1150 12 bytes [48, B8, 42, 74, 27, 6F, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1                                                                000007fefd8f2db1 11 bytes [B8, C0, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW + 1                                                           000007fefd8f37d1 11 bytes [B8, 84, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\KERNELBASE.dll!QueueUserAPC                                                                   000007fefd8f3d40 12 bytes [48, B8, 64, 78, 27, 6F, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\KERNELBASE.dll!SuspendThread + 1                                                              000007fefd8f68c1 11 bytes [B8, 08, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\KERNELBASE.dll!CreateDirectoryW + 1                                                           000007fefd8f8101 11 bytes [B8, 25, 76, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                 000007fefd8f8ef0 12 bytes [48, B8, B2, 75, 27, 6F, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\KERNELBASE.dll!GetStartupInfoW                                                                000007fefd8fde80 6 bytes [48, B8, 14, 74, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\KERNELBASE.dll!GetStartupInfoW + 9                                                            000007fefd8fde89 3 bytes [00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\KERNELBASE.dll!DeleteFileW + 1                                                                000007fefd905131 5 bytes [B8, 0E, 76, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\KERNELBASE.dll!DeleteFileW + 7                                                                000007fefd905137 5 bytes [00, 00, 00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\KERNELBASE.dll!SetFileAttributesW                                                             000007fefd907640 6 bytes [48, B8, 9B, 75, 27, 6F]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\KERNELBASE.dll!SetFileAttributesW + 9                                                         000007fefd907649 3 bytes [00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\KERNELBASE.dll!PulseEvent + 1                                                                 000007fefd923cb1 11 bytes [B8, D7, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\msvcrt.dll!calloc + 333                                                                       000007fefdb71b21 11 bytes [B8, EE, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1                                                                000007feff61642d 11 bytes [B8, BD, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW                                                                      000007feff616484 12 bytes [48, B8, 4A, 79, 27, 6F, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA                                                                      000007feff616c34 12 bytes [48, B8, 61, 79, 27, 6F, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1                                                                 000007feff617ab5 11 bytes [B8, 78, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1                                                             000007feff618b01 11 bytes [B8, 8F, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1                                                             000007feff618c39 11 bytes [B8, A6, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\ole32.dll!CoCreateInstanceEx + 1                                                              000007feff63de91 11 bytes [B8, 2A, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\ole32.dll!CLSIDFromProgID + 1                                                                 000007feff649981 11 bytes [B8, 13, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\WS2_32.dll!WSASend + 1                                                                        000007feff8413b1 11 bytes [B8, 6F, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\WS2_32.dll!closesocket                                                                        000007feff8418e0 12 bytes [48, B8, CB, 7C, 27, 6F, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\WS2_32.dll!WSASocketW + 1                                                                     000007feff841bd1 11 bytes [B8, B4, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\WS2_32.dll!GetAddrInfoW                                                                       000007feff8423c0 12 bytes [48, B8, 86, 7C, 27, 6F, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\WS2_32.dll!connect                                                                            000007feff8445c0 12 bytes [48, B8, E2, 7C, 27, 6F, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\WS2_32.dll!WSAStartup + 1                                                                     000007feff844981 11 bytes [B8, F9, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\WS2_32.dll!send + 1                                                                           000007feff848001 11 bytes [B8, 58, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\WS2_32.dll!gethostbyname                                                                      000007feff848df0 7 bytes [48, B8, 9D, 7C, 27, 6F, 00]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\WS2_32.dll!gethostbyname + 9                                                                  000007feff848df9 3 bytes [00, 50, C3]
.text  C:\Windows\system32\svchost.exe[4940] C:\Windows\system32\WS2_32.dll!WSAIoctl + 1                                                                       000007feff84d621 11 bytes [B8, 10, 7D, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!RtlExitUserProcess + 1                                                             0000000077804121 11 bytes [B8, 59, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 1                                                                     0000000077807ac1 11 bytes [B8, F7, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1                                                   00000000778192d1 5 bytes [B8, E3, 74, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7                                                   00000000778192d7 5 bytes [00, 00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParameters + 1                                                     000000007782de21 8 bytes [B8, 2B, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParameters + 10                                                    000000007782de2a 2 bytes [50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile                                                                         0000000077831310 6 bytes [48, B8, 81, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile + 8                                                                     0000000077831318 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile                                                                        0000000077831330 6 bytes [48, B8, C9, 75, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8                                                                    0000000077831338 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtClose                                                                            00000000778313a0 6 bytes [48, B8, 00, 73, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8                                                                        00000000778313a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                          00000000778313d0 6 bytes [48, B8, C3, 77, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 8                                                                      00000000778313d8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess                                                            0000000077831470 6 bytes [48, B8, 11, 75, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8                                                        0000000077831478 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                        0000000077831480 6 bytes [48, B8, AC, 77, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 8                                                                    0000000077831488 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                      0000000077831510 6 bytes [48, B8, 50, 77, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                                                                  0000000077831518 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                               0000000077831520 6 bytes [48, B8, 6A, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8                                                           0000000077831528 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                 0000000077831530 6 bytes [48, B8, 45, 73, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8                                                             0000000077831538 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                               0000000077831550 4 bytes [48, B8, 5C, 73]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 5                                                           0000000077831555 1 byte [6F]
.text  ...                                                                                                                                                     * 2
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                 0000000077831570 6 bytes [48, B8, 53, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8                                                             0000000077831578 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                         00000000778315e0 6 bytes [48, B8, C6, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8                                                                     00000000778315e8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                      0000000077831620 6 bytes [48, B8, 2E, 73, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8                                                                  0000000077831628 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                               0000000077831650 6 bytes [48, B8, 22, 77, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8                                                           0000000077831658 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                  0000000077831670 6 bytes [48, B8, E0, 75, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8                                                              0000000077831678 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                   0000000077831700 6 bytes [48, B8, 7E, 77, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8                                                               0000000077831708 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                      0000000077831730 6 bytes [48, B8, 9E, 74, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent + 8                                                                  0000000077831738 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                    0000000077831750 6 bytes [48, B8, 17, 73, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8                                                                0000000077831758 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx                                                                  0000000077831780 6 bytes [48, B8, CF, 73, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8                                                              0000000077831788 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                     0000000077831790 6 bytes [48, B8, DD, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8                                                                 0000000077831798 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                       0000000077831800 6 bytes [48, B8, 73, 73, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                                                                   0000000077831808 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                      00000000778318b0 6 bytes [48, B8, E6, 73, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8                                                                  00000000778318b8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                     0000000077831c80 6 bytes [48, B8, B5, 74, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8                                                                 0000000077831c88 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess                                                                    0000000077831cd0 6 bytes [48, B8, 67, 77, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8                                                                0000000077831cd8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                   0000000077831d30 6 bytes [48, B8, F4, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8                                                               0000000077831d38 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                        0000000077831e10 6 bytes [48, B8, AF, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 8                                                                    0000000077831e18 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                   0000000077831e40 6 bytes [48, B8, 98, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 8                                                               0000000077831e48 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                       00000000778320a0 6 bytes [48, B8, 87, 74, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8                                                                   00000000778320a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                             00000000778329a0 6 bytes [48, B8, 92, 78, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8                                                         00000000778329a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                   0000000077832a80 6 bytes [48, B8, 1F, 78, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess + 8                                                               0000000077832a88 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                               0000000077832aa0 6 bytes [48, B8, A9, 78, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8                                                           0000000077832aa8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot                                                        00000000775c21e0 12 bytes [48, B8, 95, 77, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!SetThreadContext + 1                                                            00000000775c2f11 8 bytes [B8, 39, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!SetThreadContext + 10                                                           00000000775c2f1a 2 bytes [50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!AssignProcessToJobObject + 1                                                    00000000775ca4a1 8 bytes [B8, 7B, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!AssignProcessToJobObject + 10                                                   00000000775ca4aa 2 bytes [50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!CreateFileW + 1                                                                 00000000775d1871 11 bytes [B8, 70, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!CopyFileExW + 1                                                                 00000000775d23d1 11 bytes [B8, A1, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!CreateThread + 1                                                                00000000775d6581 11 bytes [B8, F1, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                          00000000775de750 12 bytes [48, B8, FA, 74, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1                                                             00000000775e1e31 11 bytes [B8, FD, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!CloseHandle                                                                     00000000775e2f10 7 bytes [48, B8, 8A, 73, 27, 6F, 00]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!CloseHandle + 9                                                                 00000000775e2f19 3 bytes [00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!WriteProcessMemory + 1                                                          000000007760bad1 11 bytes [B8, DA, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!VirtualProtectEx + 1                                                            000000007760bb71 11 bytes [B8, 36, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!VirtualAllocEx + 1                                                              000000007760bbd1 11 bytes [B8, 4D, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!CreateRemoteThread + 1                                                          000000007760c511 8 bytes [B8, 0B, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!CreateRemoteThread + 10                                                         000000007760c51a 2 bytes [50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!CheckRemoteDebuggerPresent + 1                                                  0000000077610e11 11 bytes [B8, CC, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1                                                           0000000077615011 11 bytes [B8, 3F, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1                                                           0000000077615031 11 bytes [B8, 28, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!ReadConsoleW                                                                    000000007762a560 12 bytes [48, B8, 6D, 75, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!ReadConsoleA                                                                    000000007762a670 12 bytes [48, B8, 56, 75, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!CreateDirectoryExW                                                              0000000077649150 12 bytes [48, B8, 3C, 76, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\kernel32.dll!MoveFileWithProgressW + 1                                                       000000007764f6c1 11 bytes [B8, B8, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\KERNELBASE.dll!SleepEx                                                                       000007fefd8f1150 12 bytes [48, B8, 42, 74, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1                                                               000007fefd8f2db1 11 bytes [B8, C0, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW + 1                                                          000007fefd8f37d1 11 bytes [B8, 84, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\KERNELBASE.dll!QueueUserAPC                                                                  000007fefd8f3d40 12 bytes [48, B8, 64, 78, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\KERNELBASE.dll!SuspendThread + 1                                                             000007fefd8f68c1 11 bytes [B8, 08, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\KERNELBASE.dll!CreateDirectoryW + 1                                                          000007fefd8f8101 11 bytes [B8, 25, 76, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                000007fefd8f8ef0 12 bytes [48, B8, B2, 75, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\KERNELBASE.dll!GetStartupInfoW                                                               000007fefd8fde80 6 bytes [48, B8, 14, 74, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\KERNELBASE.dll!GetStartupInfoW + 9                                                           000007fefd8fde89 3 bytes [00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\KERNELBASE.dll!DeleteFileW + 1                                                               000007fefd905131 5 bytes [B8, 0E, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\KERNELBASE.dll!DeleteFileW + 7                                                               000007fefd905137 5 bytes [00, 00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\KERNELBASE.dll!SetFileAttributesW                                                            000007fefd907640 6 bytes [48, B8, 9B, 75, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\KERNELBASE.dll!SetFileAttributesW + 9                                                        000007fefd907649 3 bytes [00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\KERNELBASE.dll!PulseEvent + 1                                                                000007fefd923cb1 11 bytes [B8, D7, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\msvcrt.dll!calloc + 333                                                                      000007fefdb71b21 11 bytes [B8, 05, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1                                                               000007feff61642d 11 bytes [B8, EB, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW                                                                     000007feff616484 12 bytes [48, B8, 78, 79, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA                                                                     000007feff616c34 12 bytes [48, B8, 8F, 79, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1                                                                000007feff617ab5 11 bytes [B8, A6, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1                                                            000007feff618b01 11 bytes [B8, BD, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1                                                            000007feff618c39 11 bytes [B8, D4, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\ole32.dll!CoCreateInstanceEx + 1                                                             000007feff63de91 11 bytes [B8, 2A, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5108] C:\Windows\system32\ole32.dll!CLSIDFromProgID + 1                                                                000007feff649981 11 bytes [B8, 13, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!RtlExitUserProcess + 1                                                        0000000077804121 11 bytes [B8, 59, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 1                                                                0000000077807ac1 11 bytes [B8, F7, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1                                              00000000778192d1 5 bytes [B8, E3, 74, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7                                              00000000778192d7 5 bytes [00, 00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParameters + 1                                                000000007782de21 8 bytes [B8, 2B, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParameters + 10                                               000000007782de2a 2 bytes [50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile                                                                    0000000077831310 6 bytes [48, B8, 81, 76, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile + 8                                                                0000000077831318 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile                                                                   0000000077831330 6 bytes [48, B8, C9, 75, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8                                                               0000000077831338 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtClose                                                                       00000000778313a0 6 bytes [48, B8, 00, 73, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8                                                                   00000000778313a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                     00000000778313d0 6 bytes [48, B8, C3, 77, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 8                                                                 00000000778313d8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess                                                       0000000077831470 6 bytes [48, B8, 11, 75, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8                                                   0000000077831478 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                   0000000077831480 6 bytes [48, B8, AC, 77, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 8                                                               0000000077831488 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                 0000000077831510 6 bytes [48, B8, 50, 77, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                                                             0000000077831518 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                          0000000077831520 6 bytes [48, B8, 6A, 76, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8                                                      0000000077831528 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                            0000000077831530 6 bytes [48, B8, 45, 73, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8                                                        0000000077831538 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                          0000000077831550 4 bytes [48, B8, 5C, 73]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 5                                                      0000000077831555 1 byte [6F]
.text  ...                                                                                                                                                     * 2
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                            0000000077831570 6 bytes [48, B8, 53, 76, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8                                                        0000000077831578 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                    00000000778315e0 6 bytes [48, B8, C6, 76, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8                                                                00000000778315e8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                 0000000077831620 6 bytes [48, B8, 2E, 73, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8                                                             0000000077831628 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                          0000000077831650 6 bytes [48, B8, 22, 77, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8                                                      0000000077831658 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                             0000000077831670 6 bytes [48, B8, E0, 75, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8                                                         0000000077831678 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                              0000000077831700 6 bytes [48, B8, 7E, 77, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8                                                          0000000077831708 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                 0000000077831730 6 bytes [48, B8, 9E, 74, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent + 8                                                             0000000077831738 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                               0000000077831750 6 bytes [48, B8, 17, 73, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8                                                           0000000077831758 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx                                                             0000000077831780 6 bytes [48, B8, CF, 73, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8                                                         0000000077831788 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                0000000077831790 6 bytes [48, B8, DD, 76, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8                                                            0000000077831798 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                  0000000077831800 6 bytes [48, B8, 73, 73, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                                                              0000000077831808 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                 00000000778318b0 6 bytes [48, B8, E6, 73, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8                                                             00000000778318b8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                0000000077831c80 6 bytes [48, B8, B5, 74, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8                                                            0000000077831c88 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess                                                               0000000077831cd0 6 bytes [48, B8, 67, 77, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8                                                           0000000077831cd8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                              0000000077831d30 6 bytes [48, B8, F4, 76, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8                                                          0000000077831d38 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                   0000000077831e10 6 bytes [48, B8, AF, 76, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 8                                                               0000000077831e18 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                              0000000077831e40 6 bytes [48, B8, 98, 76, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 8                                                          0000000077831e48 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                  00000000778320a0 6 bytes [48, B8, 87, 74, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8                                                              00000000778320a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                        00000000778329a0 6 bytes [48, B8, 92, 78, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8                                                    00000000778329a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                              0000000077832a80 6 bytes [48, B8, 1F, 78, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess + 8                                                          0000000077832a88 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                          0000000077832aa0 6 bytes [48, B8, A9, 78, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8                                                      0000000077832aa8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot                                                   00000000775c21e0 12 bytes [48, B8, 95, 77, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!SetThreadContext + 1                                                       00000000775c2f11 8 bytes [B8, 39, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!SetThreadContext + 10                                                      00000000775c2f1a 2 bytes [50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!AssignProcessToJobObject + 1                                               00000000775ca4a1 8 bytes [B8, 7B, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!AssignProcessToJobObject + 10                                              00000000775ca4aa 2 bytes [50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!CreateFileW + 1                                                            00000000775d1871 11 bytes [B8, 70, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!CopyFileExW + 1                                                            00000000775d23d1 11 bytes [B8, A1, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!CreateThread + 1                                                           00000000775d6581 11 bytes [B8, F1, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                     00000000775de750 12 bytes [48, B8, FA, 74, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1                                                        00000000775e1e31 11 bytes [B8, FD, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!CloseHandle                                                                00000000775e2f10 7 bytes [48, B8, 8A, 73, 27, 6F, 00]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!CloseHandle + 9                                                            00000000775e2f19 3 bytes [00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!WriteProcessMemory + 1                                                     000000007760bad1 11 bytes [B8, DA, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!VirtualProtectEx + 1                                                       000000007760bb71 11 bytes [B8, 36, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!VirtualAllocEx + 1                                                         000000007760bbd1 11 bytes [B8, 4D, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!CreateRemoteThread + 1                                                     000000007760c511 8 bytes [B8, 0B, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!CreateRemoteThread + 10                                                    000000007760c51a 2 bytes [50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!CheckRemoteDebuggerPresent + 1                                             0000000077610e11 11 bytes [B8, CC, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1                                                      0000000077615011 11 bytes [B8, 3F, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1                                                      0000000077615031 11 bytes [B8, 28, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!ReadConsoleW                                                               000000007762a560 12 bytes [48, B8, 6D, 75, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!ReadConsoleA                                                               000000007762a670 12 bytes [48, B8, 56, 75, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!CreateDirectoryExW                                                         0000000077649150 12 bytes [48, B8, 3C, 76, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\kernel32.dll!MoveFileWithProgressW + 1                                                  000000007764f6c1 11 bytes [B8, B8, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\KERNELBASE.dll!SleepEx                                                                  000007fefd8f1150 12 bytes [48, B8, 42, 74, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1                                                          000007fefd8f2db1 11 bytes [B8, C0, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW + 1                                                     000007fefd8f37d1 11 bytes [B8, 84, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\KERNELBASE.dll!QueueUserAPC                                                             000007fefd8f3d40 12 bytes [48, B8, 64, 78, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\KERNELBASE.dll!SuspendThread + 1                                                        000007fefd8f68c1 11 bytes [B8, 08, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\KERNELBASE.dll!CreateDirectoryW + 1                                                     000007fefd8f8101 11 bytes [B8, 25, 76, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                           000007fefd8f8ef0 12 bytes [48, B8, B2, 75, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\KERNELBASE.dll!GetStartupInfoW                                                          000007fefd8fde80 6 bytes [48, B8, 14, 74, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\KERNELBASE.dll!GetStartupInfoW + 9                                                      000007fefd8fde89 3 bytes [00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\KERNELBASE.dll!DeleteFileW + 1                                                          000007fefd905131 5 bytes [B8, 0E, 76, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\KERNELBASE.dll!DeleteFileW + 7                                                          000007fefd905137 5 bytes [00, 00, 00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\KERNELBASE.dll!SetFileAttributesW                                                       000007fefd907640 6 bytes [48, B8, 9B, 75, 27, 6F]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\KERNELBASE.dll!SetFileAttributesW + 9                                                   000007fefd907649 3 bytes [00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\KERNELBASE.dll!PulseEvent + 1                                                           000007fefd923cb1 11 bytes [B8, D7, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\ADVAPI32.dll!IsTextUnicode + 65                                                         000007feff8b0761 11 bytes [B8, EE, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\ADVAPI32.dll!CreateServiceW                                                             000007feff8b3b44 12 bytes [48, B8, 78, 79, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\ADVAPI32.dll!CreateServiceA                                                             000007feff8cb704 12 bytes [48, B8, 61, 79, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\ADVAPI32.dll!ChangeServiceConfigW                                                       000007feff8cb870 12 bytes [48, B8, 19, 7A, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\ADVAPI32.dll!ChangeServiceConfigA                                                       000007feff8cb8dc 12 bytes [48, B8, 30, 7A, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\msvcrt.dll!calloc + 333                                                                 000007fefdb71b21 11 bytes [B8, 05, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1                                                          000007feff61642d 11 bytes [B8, 02, 7A, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW                                                                000007feff616484 12 bytes [48, B8, 8F, 79, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA                                                                000007feff616c34 12 bytes [48, B8, A6, 79, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1                                                           000007feff617ab5 11 bytes [B8, BD, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1                                                       000007feff618b01 11 bytes [B8, D4, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1                                                       000007feff618c39 11 bytes [B8, EB, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\ole32.dll!CoCreateInstanceEx + 1                                                        000007feff63de91 11 bytes [B8, 41, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\ole32.dll!CLSIDFromProgID + 1                                                           000007feff649981 11 bytes [B8, 2A, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\WS2_32.dll!WSASend + 1                                                                  000007feff8413b1 11 bytes [B8, 6F, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\WS2_32.dll!closesocket                                                                  000007feff8418e0 12 bytes [48, B8, CB, 7C, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\WS2_32.dll!WSASocketW + 1                                                               000007feff841bd1 11 bytes [B8, B4, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\WS2_32.dll!GetAddrInfoW                                                                 000007feff8423c0 12 bytes [48, B8, 86, 7C, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\WS2_32.dll!connect                                                                      000007feff8445c0 12 bytes [48, B8, E2, 7C, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\WS2_32.dll!WSAStartup + 1                                                               000007feff844981 11 bytes [B8, F9, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\WS2_32.dll!send + 1                                                                     000007feff848001 11 bytes [B8, 58, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\WS2_32.dll!gethostbyname                                                                000007feff848df0 7 bytes [48, B8, 9D, 7C, 27, 6F, 00]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\WS2_32.dll!gethostbyname + 9                                                            000007feff848df9 3 bytes [00, 50, C3]
.text  C:\Windows\system32\wbem\wmiprvse.exe[3904] C:\Windows\system32\WS2_32.dll!WSAIoctl + 1                                                                 000007feff84d621 11 bytes [B8, 10, 7D, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!RtlExitUserProcess + 1                                                             0000000077804121 11 bytes [B8, 59, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 1                                                                     0000000077807ac1 11 bytes [B8, F7, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1                                                   00000000778192d1 5 bytes [B8, E3, 74, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7                                                   00000000778192d7 5 bytes [00, 00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParameters + 1                                                     000000007782de21 8 bytes [B8, 2B, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParameters + 10                                                    000000007782de2a 2 bytes [50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile                                                                         0000000077831310 6 bytes [48, B8, 81, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile + 8                                                                     0000000077831318 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile                                                                        0000000077831330 6 bytes [48, B8, C9, 75, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8                                                                    0000000077831338 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtClose                                                                            00000000778313a0 6 bytes [48, B8, 00, 73, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8                                                                        00000000778313a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                          00000000778313d0 6 bytes [48, B8, C3, 77, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 8                                                                      00000000778313d8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess                                                            0000000077831470 6 bytes [48, B8, 11, 75, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8                                                        0000000077831478 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                        0000000077831480 6 bytes [48, B8, AC, 77, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 8                                                                    0000000077831488 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                      0000000077831510 6 bytes [48, B8, 50, 77, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                                                                  0000000077831518 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                               0000000077831520 6 bytes [48, B8, 6A, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8                                                           0000000077831528 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                 0000000077831530 6 bytes [48, B8, 45, 73, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8                                                             0000000077831538 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                               0000000077831550 4 bytes [48, B8, 5C, 73]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 5                                                           0000000077831555 1 byte [6F]
.text  ...                                                                                                                                                     * 2
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                 0000000077831570 6 bytes [48, B8, 53, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8                                                             0000000077831578 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                         00000000778315e0 6 bytes [48, B8, C6, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8                                                                     00000000778315e8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                      0000000077831620 6 bytes [48, B8, 2E, 73, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8                                                                  0000000077831628 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                               0000000077831650 6 bytes [48, B8, 22, 77, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8                                                           0000000077831658 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                  0000000077831670 6 bytes [48, B8, E0, 75, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8                                                              0000000077831678 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                   0000000077831700 6 bytes [48, B8, 7E, 77, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8                                                               0000000077831708 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                      0000000077831730 6 bytes [48, B8, 9E, 74, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent + 8                                                                  0000000077831738 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                    0000000077831750 6 bytes [48, B8, 17, 73, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8                                                                0000000077831758 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx                                                                  0000000077831780 6 bytes [48, B8, CF, 73, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8                                                              0000000077831788 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                     0000000077831790 6 bytes [48, B8, DD, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8                                                                 0000000077831798 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                       0000000077831800 6 bytes [48, B8, 73, 73, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                                                                   0000000077831808 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                      00000000778318b0 6 bytes [48, B8, E6, 73, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8                                                                  00000000778318b8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                     0000000077831c80 6 bytes [48, B8, B5, 74, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8                                                                 0000000077831c88 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess                                                                    0000000077831cd0 6 bytes [48, B8, 67, 77, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8                                                                0000000077831cd8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                   0000000077831d30 6 bytes [48, B8, F4, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8                                                               0000000077831d38 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                        0000000077831e10 6 bytes [48, B8, AF, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 8                                                                    0000000077831e18 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                   0000000077831e40 6 bytes [48, B8, 98, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 8                                                               0000000077831e48 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                       00000000778320a0 6 bytes [48, B8, 87, 74, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8                                                                   00000000778320a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                             00000000778329a0 6 bytes [48, B8, 92, 78, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8                                                         00000000778329a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                   0000000077832a80 6 bytes [48, B8, 1F, 78, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess + 8                                                               0000000077832a88 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                               0000000077832aa0 6 bytes [48, B8, A9, 78, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8                                                           0000000077832aa8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot                                                        00000000775c21e0 12 bytes [48, B8, 95, 77, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!SetThreadContext + 1                                                            00000000775c2f11 8 bytes [B8, 39, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!SetThreadContext + 10                                                           00000000775c2f1a 2 bytes [50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!AssignProcessToJobObject + 1                                                    00000000775ca4a1 8 bytes [B8, 7B, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!AssignProcessToJobObject + 10                                                   00000000775ca4aa 2 bytes [50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!CreateFileW + 1                                                                 00000000775d1871 11 bytes [B8, 70, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!CopyFileExW + 1                                                                 00000000775d23d1 11 bytes [B8, A1, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!CreateThread + 1                                                                00000000775d6581 11 bytes [B8, F1, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                          00000000775de750 12 bytes [48, B8, FA, 74, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1                                                             00000000775e1e31 11 bytes [B8, FD, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!CloseHandle                                                                     00000000775e2f10 7 bytes [48, B8, 8A, 73, 27, 6F, 00]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!CloseHandle + 9                                                                 00000000775e2f19 3 bytes [00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!WriteProcessMemory + 1                                                          000000007760bad1 11 bytes [B8, DA, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!VirtualProtectEx + 1                                                            000000007760bb71 11 bytes [B8, 36, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!VirtualAllocEx + 1                                                              000000007760bbd1 11 bytes [B8, 4D, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!CreateRemoteThread + 1                                                          000000007760c511 8 bytes [B8, 0B, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!CreateRemoteThread + 10                                                         000000007760c51a 2 bytes [50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!CheckRemoteDebuggerPresent + 1                                                  0000000077610e11 11 bytes [B8, CC, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1                                                           0000000077615011 11 bytes [B8, 3F, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1                                                           0000000077615031 11 bytes [B8, 28, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!ReadConsoleW                                                                    000000007762a560 12 bytes [48, B8, 6D, 75, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!ReadConsoleA                                                                    000000007762a670 12 bytes [48, B8, 56, 75, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!CreateDirectoryExW                                                              0000000077649150 12 bytes [48, B8, 3C, 76, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\kernel32.dll!MoveFileWithProgressW + 1                                                       000000007764f6c1 11 bytes [B8, B8, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\KERNELBASE.dll!SleepEx                                                                       000007fefd8f1150 12 bytes [48, B8, 42, 74, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1                                                               000007fefd8f2db1 11 bytes [B8, C0, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW + 1                                                          000007fefd8f37d1 11 bytes [B8, 84, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\KERNELBASE.dll!QueueUserAPC                                                                  000007fefd8f3d40 12 bytes [48, B8, 64, 78, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\KERNELBASE.dll!SuspendThread + 1                                                             000007fefd8f68c1 11 bytes [B8, 08, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\KERNELBASE.dll!CreateDirectoryW + 1                                                          000007fefd8f8101 11 bytes [B8, 25, 76, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                000007fefd8f8ef0 12 bytes [48, B8, B2, 75, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\KERNELBASE.dll!GetStartupInfoW                                                               000007fefd8fde80 6 bytes [48, B8, 14, 74, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\KERNELBASE.dll!GetStartupInfoW + 9                                                           000007fefd8fde89 3 bytes [00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\KERNELBASE.dll!DeleteFileW + 1                                                               000007fefd905131 5 bytes [B8, 0E, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\KERNELBASE.dll!DeleteFileW + 7                                                               000007fefd905137 5 bytes [00, 00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\KERNELBASE.dll!SetFileAttributesW                                                            000007fefd907640 6 bytes [48, B8, 9B, 75, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\KERNELBASE.dll!SetFileAttributesW + 9                                                        000007fefd907649 3 bytes [00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\KERNELBASE.dll!PulseEvent + 1                                                                000007fefd923cb1 11 bytes [B8, D7, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\msvcrt.dll!calloc + 333                                                                      000007fefdb71b21 11 bytes [B8, 05, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1                                                               000007feff61642d 11 bytes [B8, EB, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW                                                                     000007feff616484 12 bytes [48, B8, 78, 79, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA                                                                     000007feff616c34 12 bytes [48, B8, 8F, 79, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1                                                                000007feff617ab5 11 bytes [B8, A6, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1                                                            000007feff618b01 11 bytes [B8, BD, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1                                                            000007feff618c39 11 bytes [B8, D4, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\ole32.dll!CoCreateInstanceEx + 1                                                             000007feff63de91 11 bytes [B8, 2A, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[4892] C:\Windows\system32\ole32.dll!CLSIDFromProgID + 1                                                                000007feff649981 11 bytes [B8, 13, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!RtlExitUserProcess + 1                                                             0000000077804121 11 bytes [B8, 59, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 1                                                                     0000000077807ac1 11 bytes [B8, F7, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1                                                   00000000778192d1 5 bytes [B8, E3, 74, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7                                                   00000000778192d7 5 bytes [00, 00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParameters + 1                                                     000000007782de21 8 bytes [B8, 2B, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParameters + 10                                                    000000007782de2a 2 bytes [50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile                                                                         0000000077831310 6 bytes [48, B8, 81, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile + 8                                                                     0000000077831318 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile                                                                        0000000077831330 6 bytes [48, B8, C9, 75, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8                                                                    0000000077831338 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtClose                                                                            00000000778313a0 6 bytes [48, B8, 00, 73, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8                                                                        00000000778313a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                          00000000778313d0 6 bytes [48, B8, C3, 77, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 8                                                                      00000000778313d8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess                                                            0000000077831470 6 bytes [48, B8, 11, 75, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8                                                        0000000077831478 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                        0000000077831480 6 bytes [48, B8, AC, 77, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 8                                                                    0000000077831488 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                      0000000077831510 6 bytes [48, B8, 50, 77, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                                                                  0000000077831518 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                               0000000077831520 6 bytes [48, B8, 6A, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8                                                           0000000077831528 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                 0000000077831530 6 bytes [48, B8, 45, 73, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8                                                             0000000077831538 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                               0000000077831550 4 bytes [48, B8, 5C, 73]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 5                                                           0000000077831555 1 byte [6F]
.text  ...


Alt 15.09.2013, 16:31   #6
flummy1978
 
System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar - Standard

System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar


2. Teil:

Code:
ATTFilter
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                 0000000077831570 6 bytes [48, B8, 53, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8                                                             0000000077831578 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                         00000000778315e0 6 bytes [48, B8, C6, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8                                                                     00000000778315e8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                      0000000077831620 6 bytes [48, B8, 2E, 73, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8                                                                  0000000077831628 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                               0000000077831650 6 bytes [48, B8, 22, 77, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8                                                           0000000077831658 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                  0000000077831670 6 bytes [48, B8, E0, 75, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8                                                              0000000077831678 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                   0000000077831700 6 bytes [48, B8, 7E, 77, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8                                                               0000000077831708 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                      0000000077831730 6 bytes [48, B8, 9E, 74, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent + 8                                                                  0000000077831738 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                    0000000077831750 6 bytes [48, B8, 17, 73, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8                                                                0000000077831758 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx                                                                  0000000077831780 6 bytes [48, B8, CF, 73, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8                                                              0000000077831788 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                     0000000077831790 6 bytes [48, B8, DD, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8                                                                 0000000077831798 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                       0000000077831800 6 bytes [48, B8, 73, 73, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                                                                   0000000077831808 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                      00000000778318b0 6 bytes [48, B8, E6, 73, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8                                                                  00000000778318b8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                     0000000077831c80 6 bytes [48, B8, B5, 74, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8                                                                 0000000077831c88 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess                                                                    0000000077831cd0 6 bytes [48, B8, 67, 77, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8                                                                0000000077831cd8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                   0000000077831d30 6 bytes [48, B8, F4, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8                                                               0000000077831d38 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                        0000000077831e10 6 bytes [48, B8, AF, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 8                                                                    0000000077831e18 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                   0000000077831e40 6 bytes [48, B8, 98, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 8                                                               0000000077831e48 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                       00000000778320a0 6 bytes [48, B8, 87, 74, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8                                                                   00000000778320a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                             00000000778329a0 6 bytes [48, B8, 92, 78, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8                                                         00000000778329a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                   0000000077832a80 6 bytes [48, B8, 1F, 78, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess + 8                                                               0000000077832a88 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                               0000000077832aa0 6 bytes [48, B8, A9, 78, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8                                                           0000000077832aa8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot                                                        00000000775c21e0 12 bytes [48, B8, 95, 77, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!SetThreadContext + 1                                                            00000000775c2f11 8 bytes [B8, 39, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!SetThreadContext + 10                                                           00000000775c2f1a 2 bytes [50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!AssignProcessToJobObject + 1                                                    00000000775ca4a1 8 bytes [B8, 7B, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!AssignProcessToJobObject + 10                                                   00000000775ca4aa 2 bytes [50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!CreateFileW + 1                                                                 00000000775d1871 11 bytes [B8, 70, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!CopyFileExW + 1                                                                 00000000775d23d1 11 bytes [B8, A1, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!CreateThread + 1                                                                00000000775d6581 11 bytes [B8, F1, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                          00000000775de750 12 bytes [48, B8, FA, 74, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1                                                             00000000775e1e31 11 bytes [B8, FD, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!CloseHandle                                                                     00000000775e2f10 7 bytes [48, B8, 8A, 73, 27, 6F, 00]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!CloseHandle + 9                                                                 00000000775e2f19 3 bytes [00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!WriteProcessMemory + 1                                                          000000007760bad1 11 bytes [B8, DA, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!VirtualProtectEx + 1                                                            000000007760bb71 11 bytes [B8, 36, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!VirtualAllocEx + 1                                                              000000007760bbd1 11 bytes [B8, 4D, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!CreateRemoteThread + 1                                                          000000007760c511 8 bytes [B8, 0B, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!CreateRemoteThread + 10                                                         000000007760c51a 2 bytes [50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!CheckRemoteDebuggerPresent + 1                                                  0000000077610e11 11 bytes [B8, CC, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1                                                           0000000077615011 11 bytes [B8, 3F, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1                                                           0000000077615031 11 bytes [B8, 28, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!ReadConsoleW                                                                    000000007762a560 12 bytes [48, B8, 6D, 75, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!ReadConsoleA                                                                    000000007762a670 12 bytes [48, B8, 56, 75, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!CreateDirectoryExW                                                              0000000077649150 12 bytes [48, B8, 3C, 76, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\kernel32.dll!MoveFileWithProgressW + 1                                                       000000007764f6c1 11 bytes [B8, B8, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\KERNELBASE.dll!SleepEx                                                                       000007fefd8f1150 12 bytes [48, B8, 42, 74, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1                                                               000007fefd8f2db1 11 bytes [B8, C0, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW + 1                                                          000007fefd8f37d1 11 bytes [B8, 84, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\KERNELBASE.dll!QueueUserAPC                                                                  000007fefd8f3d40 12 bytes [48, B8, 64, 78, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\KERNELBASE.dll!SuspendThread + 1                                                             000007fefd8f68c1 11 bytes [B8, 08, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\KERNELBASE.dll!CreateDirectoryW + 1                                                          000007fefd8f8101 11 bytes [B8, 25, 76, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                000007fefd8f8ef0 12 bytes [48, B8, B2, 75, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\KERNELBASE.dll!GetStartupInfoW                                                               000007fefd8fde80 6 bytes [48, B8, 14, 74, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\KERNELBASE.dll!GetStartupInfoW + 9                                                           000007fefd8fde89 3 bytes [00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\KERNELBASE.dll!DeleteFileW + 1                                                               000007fefd905131 5 bytes [B8, 0E, 76, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\KERNELBASE.dll!DeleteFileW + 7                                                               000007fefd905137 5 bytes [00, 00, 00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\KERNELBASE.dll!SetFileAttributesW                                                            000007fefd907640 6 bytes [48, B8, 9B, 75, 27, 6F]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\KERNELBASE.dll!SetFileAttributesW + 9                                                        000007fefd907649 3 bytes [00, 50, C3]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\KERNELBASE.dll!PulseEvent + 1                                                                000007fefd923cb1 11 bytes [B8, D7, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\msvcrt.dll!calloc + 333                                                                      000007fefdb71b21 11 bytes [B8, 05, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1                                                               000007feff61642d 11 bytes [B8, EB, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW                                                                     000007feff616484 12 bytes [48, B8, 78, 79, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA                                                                     000007feff616c34 12 bytes [48, B8, 8F, 79, 27, 6F, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1                                                                000007feff617ab5 11 bytes [B8, A6, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1                                                            000007feff618b01 11 bytes [B8, BD, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1                                                            000007feff618c39 11 bytes [B8, D4, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\ole32.dll!CoCreateInstanceEx + 1                                                             000007feff63de91 11 bytes [B8, 2A, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\WUDFHost.exe[5256] C:\Windows\system32\ole32.dll!CLSIDFromProgID + 1                                                                000007feff649981 11 bytes [B8, 13, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlExitUserProcess + 1                                                        0000000077804121 11 bytes [B8, 59, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 1                                                                0000000077807ac1 11 bytes [B8, F7, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1                                              00000000778192d1 5 bytes [B8, E3, 74, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7                                              00000000778192d7 5 bytes [00, 00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParameters + 1                                                000000007782de21 8 bytes [B8, 2B, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParameters + 10                                               000000007782de2a 2 bytes [50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile                                                                    0000000077831310 6 bytes [48, B8, 81, 76, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile + 8                                                                0000000077831318 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile                                                                   0000000077831330 6 bytes [48, B8, C9, 75, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8                                                               0000000077831338 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtClose                                                                       00000000778313a0 6 bytes [48, B8, 00, 73, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8                                                                   00000000778313a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                     00000000778313d0 6 bytes [48, B8, C3, 77, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 8                                                                 00000000778313d8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess                                                       0000000077831470 6 bytes [48, B8, 11, 75, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8                                                   0000000077831478 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                   0000000077831480 6 bytes [48, B8, AC, 77, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 8                                                               0000000077831488 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                 0000000077831510 6 bytes [48, B8, 50, 77, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                                                             0000000077831518 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                          0000000077831520 6 bytes [48, B8, 6A, 76, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8                                                      0000000077831528 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                            0000000077831530 6 bytes [48, B8, 45, 73, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8                                                        0000000077831538 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                          0000000077831550 4 bytes [48, B8, 5C, 73]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 5                                                      0000000077831555 1 byte [6F]
.text  ...                                                                                                                                                     * 2
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                            0000000077831570 6 bytes [48, B8, 53, 76, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8                                                        0000000077831578 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                    00000000778315e0 6 bytes [48, B8, C6, 76, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8                                                                00000000778315e8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                 0000000077831620 6 bytes [48, B8, 2E, 73, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8                                                             0000000077831628 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                          0000000077831650 6 bytes [48, B8, 22, 77, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8                                                      0000000077831658 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                             0000000077831670 6 bytes [48, B8, E0, 75, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8                                                         0000000077831678 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                              0000000077831700 6 bytes [48, B8, 7E, 77, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8                                                          0000000077831708 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                 0000000077831730 6 bytes [48, B8, 9E, 74, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent + 8                                                             0000000077831738 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                               0000000077831750 6 bytes [48, B8, 17, 73, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8                                                           0000000077831758 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx                                                             0000000077831780 6 bytes [48, B8, CF, 73, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8                                                         0000000077831788 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                0000000077831790 6 bytes [48, B8, DD, 76, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8                                                            0000000077831798 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                  0000000077831800 6 bytes [48, B8, 73, 73, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                                                              0000000077831808 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                 00000000778318b0 6 bytes [48, B8, E6, 73, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8                                                             00000000778318b8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                0000000077831c80 6 bytes [48, B8, B5, 74, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8                                                            0000000077831c88 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess                                                               0000000077831cd0 6 bytes [48, B8, 67, 77, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8                                                           0000000077831cd8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                              0000000077831d30 6 bytes [48, B8, F4, 76, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8                                                          0000000077831d38 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                   0000000077831e10 6 bytes [48, B8, AF, 76, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 8                                                               0000000077831e18 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                              0000000077831e40 6 bytes [48, B8, 98, 76, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 8                                                          0000000077831e48 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                  00000000778320a0 6 bytes [48, B8, 87, 74, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8                                                              00000000778320a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                        00000000778329a0 6 bytes [48, B8, 92, 78, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8                                                    00000000778329a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                              0000000077832a80 6 bytes [48, B8, 1F, 78, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess + 8                                                          0000000077832a88 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                          0000000077832aa0 6 bytes [48, B8, A9, 78, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8                                                      0000000077832aa8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot                                                   00000000775c21e0 12 bytes [48, B8, 95, 77, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!SetThreadContext + 1                                                       00000000775c2f11 8 bytes [B8, 39, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!SetThreadContext + 10                                                      00000000775c2f1a 2 bytes [50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!AssignProcessToJobObject + 1                                               00000000775ca4a1 8 bytes [B8, 7B, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!AssignProcessToJobObject + 10                                              00000000775ca4aa 2 bytes [50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!CreateFileW + 1                                                            00000000775d1871 11 bytes [B8, 70, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!CopyFileExW + 1                                                            00000000775d23d1 11 bytes [B8, A1, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!CreateThread + 1                                                           00000000775d6581 11 bytes [B8, F1, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                     00000000775de750 12 bytes [48, B8, FA, 74, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1                                                        00000000775e1e31 11 bytes [B8, FD, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!CloseHandle                                                                00000000775e2f10 7 bytes [48, B8, 8A, 73, 27, 6F, 00]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!CloseHandle + 9                                                            00000000775e2f19 3 bytes [00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!WriteProcessMemory + 1                                                     000000007760bad1 11 bytes [B8, DA, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!VirtualProtectEx + 1                                                       000000007760bb71 11 bytes [B8, 36, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!VirtualAllocEx + 1                                                         000000007760bbd1 11 bytes [B8, 4D, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!CreateRemoteThread + 1                                                     000000007760c511 8 bytes [B8, 0B, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!CreateRemoteThread + 10                                                    000000007760c51a 2 bytes [50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!CheckRemoteDebuggerPresent + 1                                             0000000077610e11 11 bytes [B8, CC, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1                                                      0000000077615011 11 bytes [B8, 3F, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1                                                      0000000077615031 11 bytes [B8, 28, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!ReadConsoleW                                                               000000007762a560 12 bytes [48, B8, 6D, 75, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!ReadConsoleA                                                               000000007762a670 12 bytes [48, B8, 56, 75, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!CreateDirectoryExW                                                         0000000077649150 12 bytes [48, B8, 3C, 76, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\kernel32.dll!MoveFileWithProgressW + 1                                                  000000007764f6c1 11 bytes [B8, B8, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\KERNELBASE.dll!SleepEx                                                                  000007fefd8f1150 12 bytes [48, B8, 42, 74, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1                                                          000007fefd8f2db1 11 bytes [B8, C0, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW + 1                                                     000007fefd8f37d1 11 bytes [B8, 84, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\KERNELBASE.dll!QueueUserAPC                                                             000007fefd8f3d40 12 bytes [48, B8, 64, 78, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\KERNELBASE.dll!SuspendThread + 1                                                        000007fefd8f68c1 11 bytes [B8, 08, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\KERNELBASE.dll!CreateDirectoryW + 1                                                     000007fefd8f8101 11 bytes [B8, 25, 76, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                           000007fefd8f8ef0 12 bytes [48, B8, B2, 75, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\KERNELBASE.dll!GetStartupInfoW                                                          000007fefd8fde80 6 bytes [48, B8, 14, 74, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\KERNELBASE.dll!GetStartupInfoW + 9                                                      000007fefd8fde89 3 bytes [00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\KERNELBASE.dll!DeleteFileW + 1                                                          000007fefd905131 5 bytes [B8, 0E, 76, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\KERNELBASE.dll!DeleteFileW + 7                                                          000007fefd905137 5 bytes [00, 00, 00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\KERNELBASE.dll!SetFileAttributesW                                                       000007fefd907640 6 bytes [48, B8, 9B, 75, 27, 6F]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\KERNELBASE.dll!SetFileAttributesW + 9                                                   000007fefd907649 3 bytes [00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\KERNELBASE.dll!PulseEvent + 1                                                           000007fefd923cb1 11 bytes [B8, D7, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\msvcrt.dll!calloc + 333                                                                 000007fefdb71b21 11 bytes [B8, EE, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\ole32.dll!CoCreateInstanceEx + 1                                                        000007feff63de91 11 bytes [B8, 44, 7B, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\ole32.dll!CLSIDFromProgID + 1                                                           000007feff649981 11 bytes [B8, 2D, 7B, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\WS2_32.dll!WSASend + 1                                                                  000007feff8413b1 11 bytes [B8, 72, 7B, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\WS2_32.dll!closesocket                                                                  000007feff8418e0 12 bytes [48, B8, CE, 7B, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\WS2_32.dll!WSASocketW + 1                                                               000007feff841bd1 11 bytes [B8, B7, 7B, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\WS2_32.dll!GetAddrInfoW                                                                 000007feff8423c0 12 bytes [48, B8, 89, 7B, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\WS2_32.dll!connect                                                                      000007feff8445c0 12 bytes [48, B8, E5, 7B, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\WS2_32.dll!WSAStartup + 1                                                               000007feff844981 11 bytes [B8, FC, 7B, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\WS2_32.dll!send + 1                                                                     000007feff848001 11 bytes [B8, 5B, 7B, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\WS2_32.dll!gethostbyname                                                                000007feff848df0 7 bytes [48, B8, A0, 7B, 27, 6F, 00]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\WS2_32.dll!gethostbyname + 9                                                            000007feff848df9 3 bytes [00, 50, C3]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\system32\WS2_32.dll!WSAIoctl + 1                                                                 000007feff84d621 11 bytes [B8, 13, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1                                                          000007feff61642d 11 bytes [B8, E2, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW                                                                000007feff616484 12 bytes [48, B8, 6F, 7C, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA                                                                000007feff616c34 12 bytes [48, B8, 86, 7C, 27, 6F, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1                                                           000007feff617ab5 11 bytes [B8, 9D, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1                                                       000007feff618b01 11 bytes [B8, B4, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\wbem\unsecapp.exe[5812] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1                                                       000007feff618c39 11 bytes [B8, CB, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!RtlExitUserProcess + 1                                                   0000000077804121 11 bytes [B8, 59, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 1                                                           0000000077807ac1 11 bytes [B8, F7, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1                                         00000000778192d1 5 bytes [B8, E3, 74, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7                                         00000000778192d7 5 bytes [00, 00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParameters + 1                                           000000007782de21 8 bytes [B8, 2B, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParameters + 10                                          000000007782de2a 2 bytes [50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile                                                               0000000077831310 6 bytes [48, B8, 81, 76, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile + 8                                                           0000000077831318 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile                                                              0000000077831330 6 bytes [48, B8, C9, 75, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8                                                          0000000077831338 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtClose                                                                  00000000778313a0 6 bytes [48, B8, 00, 73, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8                                                              00000000778313a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                00000000778313d0 6 bytes [48, B8, C3, 77, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 8                                                            00000000778313d8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess                                                  0000000077831470 6 bytes [48, B8, 11, 75, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8                                              0000000077831478 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                              0000000077831480 6 bytes [48, B8, AC, 77, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 8                                                          0000000077831488 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                            0000000077831510 6 bytes [48, B8, 50, 77, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                                                        0000000077831518 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                     0000000077831520 6 bytes [48, B8, 6A, 76, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8                                                 0000000077831528 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                       0000000077831530 6 bytes [48, B8, 45, 73, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8                                                   0000000077831538 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                     0000000077831550 4 bytes [48, B8, 5C, 73]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 5                                                 0000000077831555 1 byte [6F]
.text  ...                                                                                                                                                     * 2
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                       0000000077831570 6 bytes [48, B8, 53, 76, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8                                                   0000000077831578 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                               00000000778315e0 6 bytes [48, B8, C6, 76, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8                                                           00000000778315e8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                            0000000077831620 6 bytes [48, B8, 2E, 73, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8                                                        0000000077831628 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                     0000000077831650 6 bytes [48, B8, 22, 77, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8                                                 0000000077831658 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                        0000000077831670 6 bytes [48, B8, E0, 75, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8                                                    0000000077831678 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                         0000000077831700 6 bytes [48, B8, 7E, 77, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8                                                     0000000077831708 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                            0000000077831730 6 bytes [48, B8, 9E, 74, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent + 8                                                        0000000077831738 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                          0000000077831750 6 bytes [48, B8, 17, 73, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8                                                      0000000077831758 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx                                                        0000000077831780 6 bytes [48, B8, CF, 73, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8                                                    0000000077831788 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                           0000000077831790 6 bytes [48, B8, DD, 76, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8                                                       0000000077831798 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                             0000000077831800 6 bytes [48, B8, 73, 73, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                                                         0000000077831808 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                            00000000778318b0 6 bytes [48, B8, E6, 73, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8                                                        00000000778318b8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                           0000000077831c80 6 bytes [48, B8, B5, 74, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8                                                       0000000077831c88 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess                                                          0000000077831cd0 6 bytes [48, B8, 67, 77, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8                                                      0000000077831cd8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                         0000000077831d30 6 bytes [48, B8, F4, 76, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8                                                     0000000077831d38 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                              0000000077831e10 6 bytes [48, B8, AF, 76, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 8                                                          0000000077831e18 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                         0000000077831e40 6 bytes [48, B8, 98, 76, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 8                                                     0000000077831e48 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                             00000000778320a0 6 bytes [48, B8, 87, 74, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8                                                         00000000778320a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                   00000000778329a0 6 bytes [48, B8, 92, 78, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8                                               00000000778329a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                         0000000077832a80 6 bytes [48, B8, 1F, 78, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess + 8                                                     0000000077832a88 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                     0000000077832aa0 6 bytes [48, B8, A9, 78, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8                                                 0000000077832aa8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot                                              00000000775c21e0 12 bytes [48, B8, 95, 77, 27, 6F, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!SetThreadContext + 1                                                  00000000775c2f11 8 bytes [B8, 39, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!SetThreadContext + 10                                                 00000000775c2f1a 2 bytes [50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!AssignProcessToJobObject + 1                                          00000000775ca4a1 8 bytes [B8, 7B, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!AssignProcessToJobObject + 10                                         00000000775ca4aa 2 bytes [50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!CreateFileW + 1                                                       00000000775d1871 11 bytes [B8, 70, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!CopyFileExW + 1                                                       00000000775d23d1 11 bytes [B8, A1, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!CreateThread + 1                                                      00000000775d6581 11 bytes [B8, F1, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                00000000775de750 12 bytes [48, B8, FA, 74, 27, 6F, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1                                                   00000000775e1e31 11 bytes [B8, FD, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!CloseHandle                                                           00000000775e2f10 7 bytes [48, B8, 8A, 73, 27, 6F, 00]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!CloseHandle + 9                                                       00000000775e2f19 3 bytes [00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!WriteProcessMemory + 1                                                000000007760bad1 11 bytes [B8, DA, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!VirtualProtectEx + 1                                                  000000007760bb71 11 bytes [B8, 36, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!VirtualAllocEx + 1                                                    000000007760bbd1 11 bytes [B8, 4D, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!CreateRemoteThread + 1                                                000000007760c511 8 bytes [B8, 0B, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!CreateRemoteThread + 10                                               000000007760c51a 2 bytes [50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!CheckRemoteDebuggerPresent + 1                                        0000000077610e11 11 bytes [B8, CC, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1                                                 0000000077615011 11 bytes [B8, 3F, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1                                                 0000000077615031 11 bytes [B8, 28, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!ReadConsoleW                                                          000000007762a560 12 bytes [48, B8, 6D, 75, 27, 6F, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!ReadConsoleA                                                          000000007762a670 12 bytes [48, B8, 56, 75, 27, 6F, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!CreateDirectoryExW                                                    0000000077649150 12 bytes [48, B8, 3C, 76, 27, 6F, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\kernel32.dll!MoveFileWithProgressW + 1                                             000000007764f6c1 11 bytes [B8, B8, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\KERNELBASE.dll!SleepEx                                                             000007fefd8f1150 12 bytes [48, B8, 42, 74, 27, 6F, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1                                                     000007fefd8f2db1 11 bytes [B8, C0, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW + 1                                                000007fefd8f37d1 11 bytes [B8, 84, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\KERNELBASE.dll!QueueUserAPC                                                        000007fefd8f3d40 12 bytes [48, B8, 64, 78, 27, 6F, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\KERNELBASE.dll!SuspendThread + 1                                                   000007fefd8f68c1 11 bytes [B8, 08, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\KERNELBASE.dll!CreateDirectoryW + 1                                                000007fefd8f8101 11 bytes [B8, 25, 76, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                      000007fefd8f8ef0 12 bytes [48, B8, B2, 75, 27, 6F, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\KERNELBASE.dll!GetStartupInfoW                                                     000007fefd8fde80 6 bytes [48, B8, 14, 74, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\KERNELBASE.dll!GetStartupInfoW + 9                                                 000007fefd8fde89 3 bytes [00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\KERNELBASE.dll!DeleteFileW + 1                                                     000007fefd905131 5 bytes [B8, 0E, 76, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\KERNELBASE.dll!DeleteFileW + 7                                                     000007fefd905137 5 bytes [00, 00, 00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\KERNELBASE.dll!SetFileAttributesW                                                  000007fefd907640 6 bytes [48, B8, 9B, 75, 27, 6F]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\KERNELBASE.dll!SetFileAttributesW + 9                                              000007fefd907649 3 bytes [00, 50, C3]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\KERNELBASE.dll!PulseEvent + 1                                                      000007fefd923cb1 11 bytes [B8, D7, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\msvcrt.dll!calloc + 333                                                            000007fefdb71b21 11 bytes [B8, 05, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1                                                     000007feff61642d 11 bytes [B8, EB, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW                                                           000007feff616484 12 bytes [48, B8, 78, 79, 27, 6F, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA                                                           000007feff616c34 12 bytes [48, B8, 8F, 79, 27, 6F, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1                                                      000007feff617ab5 11 bytes [B8, A6, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1                                                  000007feff618b01 11 bytes [B8, BD, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1                                                  000007feff618c39 11 bytes [B8, D4, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\ole32.dll!CoCreateInstanceEx + 1                                                   000007feff63de91 11 bytes [B8, 2A, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\SearchProtocolHost.exe[5920] C:\Windows\system32\ole32.dll!CLSIDFromProgID + 1                                                      000007feff649981 11 bytes [B8, 13, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!RtlExitUserProcess + 1                                                              0000000077804121 11 bytes [B8, 59, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 1                                                                      0000000077807ac1 11 bytes [B8, F7, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1                                                    00000000778192d1 5 bytes [B8, E3, 74, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7                                                    00000000778192d7 5 bytes [00, 00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParameters + 1                                                      000000007782de21 8 bytes [B8, 2B, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParameters + 10                                                     000000007782de2a 2 bytes [50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile                                                                          0000000077831310 6 bytes [48, B8, 81, 76, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile + 8                                                                      0000000077831318 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile                                                                         0000000077831330 6 bytes [48, B8, C9, 75, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8                                                                     0000000077831338 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtClose                                                                             00000000778313a0 6 bytes [48, B8, 00, 73, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8                                                                         00000000778313a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                           00000000778313d0 6 bytes [48, B8, C3, 77, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 8                                                                       00000000778313d8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess                                                             0000000077831470 6 bytes [48, B8, 11, 75, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8                                                         0000000077831478 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                         0000000077831480 6 bytes [48, B8, AC, 77, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 8                                                                     0000000077831488 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                       0000000077831510 6 bytes [48, B8, 50, 77, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                                                                   0000000077831518 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                0000000077831520 6 bytes [48, B8, 6A, 76, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8                                                            0000000077831528 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                  0000000077831530 6 bytes [48, B8, 45, 73, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8                                                              0000000077831538 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                                0000000077831550 4 bytes [48, B8, 5C, 73]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 5                                                            0000000077831555 1 byte [6F]
.text  ...                                                                                                                                                     * 2
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                  0000000077831570 6 bytes [48, B8, 53, 76, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8                                                              0000000077831578 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                          00000000778315e0 6 bytes [48, B8, C6, 76, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8                                                                      00000000778315e8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                       0000000077831620 6 bytes [48, B8, 2E, 73, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8                                                                   0000000077831628 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                0000000077831650 6 bytes [48, B8, 22, 77, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8                                                            0000000077831658 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                   0000000077831670 6 bytes [48, B8, E0, 75, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8                                                               0000000077831678 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                    0000000077831700 6 bytes [48, B8, 7E, 77, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8                                                                0000000077831708 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                       0000000077831730 6 bytes [48, B8, 9E, 74, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent + 8                                                                   0000000077831738 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                     0000000077831750 6 bytes [48, B8, 17, 73, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8                                                                 0000000077831758 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx                                                                   0000000077831780 6 bytes [48, B8, CF, 73, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8                                                               0000000077831788 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                      0000000077831790 6 bytes [48, B8, DD, 76, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8                                                                  0000000077831798 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                        0000000077831800 6 bytes [48, B8, 73, 73, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                                                                    0000000077831808 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                       00000000778318b0 6 bytes [48, B8, E6, 73, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8                                                                   00000000778318b8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                      0000000077831c80 6 bytes [48, B8, B5, 74, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8                                                                  0000000077831c88 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess                                                                     0000000077831cd0 6 bytes [48, B8, 67, 77, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8                                                                 0000000077831cd8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                    0000000077831d30 6 bytes [48, B8, F4, 76, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8                                                                0000000077831d38 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                         0000000077831e10 6 bytes [48, B8, AF, 76, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 8                                                                     0000000077831e18 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                    0000000077831e40 6 bytes [48, B8, 98, 76, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 8                                                                0000000077831e48 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                        00000000778320a0 6 bytes [48, B8, 87, 74, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8                                                                    00000000778320a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                              00000000778329a0 6 bytes [48, B8, 92, 78, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8                                                          00000000778329a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                    0000000077832a80 6 bytes [48, B8, 1F, 78, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess + 8                                                                0000000077832a88 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                0000000077832aa0 6 bytes [48, B8, A9, 78, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8                                                            0000000077832aa8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot                                                         00000000775c21e0 12 bytes [48, B8, 95, 77, 27, 6F, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!SetThreadContext + 1                                                             00000000775c2f11 8 bytes [B8, 39, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!SetThreadContext + 10                                                            00000000775c2f1a 2 bytes [50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!AssignProcessToJobObject + 1                                                     00000000775ca4a1 8 bytes [B8, 7B, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!AssignProcessToJobObject + 10                                                    00000000775ca4aa 2 bytes [50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!CreateFileW + 1                                                                  00000000775d1871 11 bytes [B8, 70, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!CopyFileExW + 1                                                                  00000000775d23d1 11 bytes [B8, A1, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!CreateThread + 1                                                                 00000000775d6581 11 bytes [B8, F1, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                           00000000775de750 12 bytes [48, B8, FA, 74, 27, 6F, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1                                                              00000000775e1e31 11 bytes [B8, FD, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!CloseHandle                                                                      00000000775e2f10 7 bytes [48, B8, 8A, 73, 27, 6F, 00]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!CloseHandle + 9                                                                  00000000775e2f19 3 bytes [00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!WriteProcessMemory + 1                                                           000000007760bad1 11 bytes [B8, DA, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!VirtualProtectEx + 1                                                             000000007760bb71 11 bytes [B8, 36, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!VirtualAllocEx + 1                                                               000000007760bbd1 11 bytes [B8, 4D, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!CreateRemoteThread + 1                                                           000000007760c511 8 bytes [B8, 0B, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!CreateRemoteThread + 10                                                          000000007760c51a 2 bytes [50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!CheckRemoteDebuggerPresent + 1                                                   0000000077610e11 11 bytes [B8, CC, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1                                                            0000000077615011 11 bytes [B8, 3F, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1                                                            0000000077615031 11 bytes [B8, 28, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!ReadConsoleW                                                                     000000007762a560 12 bytes [48, B8, 6D, 75, 27, 6F, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!ReadConsoleA                                                                     000000007762a670 12 bytes [48, B8, 56, 75, 27, 6F, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!CreateDirectoryExW                                                               0000000077649150 12 bytes [48, B8, 3C, 76, 27, 6F, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\kernel32.dll!MoveFileWithProgressW + 1                                                        000000007764f6c1 11 bytes [B8, B8, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\KERNELBASE.dll!SleepEx                                                                        000007fefd8f1150 12 bytes [48, B8, 42, 74, 27, 6F, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1                                                                000007fefd8f2db1 11 bytes [B8, C0, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW + 1                                                           000007fefd8f37d1 11 bytes [B8, 84, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\KERNELBASE.dll!QueueUserAPC                                                                   000007fefd8f3d40 12 bytes [48, B8, 64, 78, 27, 6F, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\KERNELBASE.dll!SuspendThread + 1                                                              000007fefd8f68c1 11 bytes [B8, 08, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\KERNELBASE.dll!CreateDirectoryW + 1                                                           000007fefd8f8101 11 bytes [B8, 25, 76, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                 000007fefd8f8ef0 12 bytes [48, B8, B2, 75, 27, 6F, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\KERNELBASE.dll!GetStartupInfoW                                                                000007fefd8fde80 6 bytes [48, B8, 14, 74, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\KERNELBASE.dll!GetStartupInfoW + 9                                                            000007fefd8fde89 3 bytes [00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\KERNELBASE.dll!DeleteFileW + 1                                                                000007fefd905131 5 bytes [B8, 0E, 76, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\KERNELBASE.dll!DeleteFileW + 7                                                                000007fefd905137 5 bytes [00, 00, 00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\KERNELBASE.dll!SetFileAttributesW                                                             000007fefd907640 6 bytes [48, B8, 9B, 75, 27, 6F]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\KERNELBASE.dll!SetFileAttributesW + 9                                                         000007fefd907649 3 bytes [00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\KERNELBASE.dll!PulseEvent + 1                                                                 000007fefd923cb1 11 bytes [B8, D7, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\msvcrt.dll!calloc + 333                                                                       000007fefdb71b21 11 bytes [B8, EE, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1                                                                000007feff61642d 11 bytes [B8, 9D, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW                                                                      000007feff616484 12 bytes [48, B8, 2A, 7C, 27, 6F, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA                                                                      000007feff616c34 12 bytes [48, B8, 41, 7C, 27, 6F, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1                                                                 000007feff617ab5 11 bytes [B8, 58, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1                                                             000007feff618b01 11 bytes [B8, 6F, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1                                                             000007feff618c39 11 bytes [B8, 86, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\WS2_32.dll!WSASend + 1                                                                        000007feff8413b1 11 bytes [B8, 33, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\WS2_32.dll!closesocket                                                                        000007feff8418e0 12 bytes [48, B8, 8F, 79, 27, 6F, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\WS2_32.dll!WSASocketW + 1                                                                     000007feff841bd1 11 bytes [B8, 78, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\WS2_32.dll!GetAddrInfoW                                                                       000007feff8423c0 12 bytes [48, B8, 4A, 79, 27, 6F, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\WS2_32.dll!connect                                                                            000007feff8445c0 12 bytes [48, B8, A6, 79, 27, 6F, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\WS2_32.dll!WSAStartup + 1                                                                     000007feff844981 11 bytes [B8, BD, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\WS2_32.dll!send + 1                                                                           000007feff848001 11 bytes [B8, 1C, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\WS2_32.dll!gethostbyname                                                                      000007feff848df0 7 bytes [48, B8, 61, 79, 27, 6F, 00]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\WS2_32.dll!gethostbyname + 9                                                                  000007feff848df9 3 bytes [00, 50, C3]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\WS2_32.dll!WSAIoctl + 1                                                                       000007feff84d621 11 bytes [B8, D4, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\ADVAPI32.dll!IsTextUnicode + 65                                                               000007feff8b0761 11 bytes [B8, E5, 7B, 27, 6F, 00, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\ADVAPI32.dll!CreateServiceW                                                                   000007feff8b3b44 12 bytes [48, B8, 13, 7C, 27, 6F, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\ADVAPI32.dll!CreateServiceA                                                                   000007feff8cb704 12 bytes [48, B8, FC, 7B, 27, 6F, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\ADVAPI32.dll!ChangeServiceConfigW                                                             000007feff8cb870 12 bytes [48, B8, B4, 7C, 27, 6F, 00, ...]
.text  C:\Windows\System32\svchost.exe[5836] C:\Windows\system32\ADVAPI32.dll!ChangeServiceConfigA                                                             000007feff8cb8dc 12 bytes [48, B8, CB, 7C, 27, 6F, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!RtlExitUserProcess + 1                                                              0000000077804121 11 bytes [B8, 59, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll + 1                                                                      0000000077807ac1 11 bytes [B8, F7, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 1                                                    00000000778192d1 5 bytes [B8, E3, 74, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParametersEx + 7                                                    00000000778192d7 5 bytes [00, 00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParameters + 1                                                      000000007782de21 8 bytes [B8, 2B, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateProcessParameters + 10                                                     000000007782de2a 2 bytes [50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile                                                                          0000000077831310 6 bytes [48, B8, 81, 76, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtReadFile + 8                                                                      0000000077831318 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile                                                                         0000000077831330 6 bytes [48, B8, C9, 75, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWriteFile + 8                                                                     0000000077831338 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtClose                                                                             00000000778313a0 6 bytes [48, B8, 00, 73, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtClose + 8                                                                         00000000778313a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                           00000000778313d0 6 bytes [48, B8, C3, 77, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 8                                                                       00000000778313d8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess                                                             0000000077831470 6 bytes [48, B8, 11, 75, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationProcess + 8                                                         0000000077831478 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                         0000000077831480 6 bytes [48, B8, AC, 77, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 8                                                                     0000000077831488 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                       0000000077831510 6 bytes [48, B8, 50, 77, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                                                                   0000000077831518 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                0000000077831520 6 bytes [48, B8, 6A, 76, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8                                                            0000000077831528 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                  0000000077831530 6 bytes [48, B8, 45, 73, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8                                                              0000000077831538 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                                                                0000000077831550 4 bytes [48, B8, 5C, 73]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 5

Alt 15.09.2013, 16:32   #7
flummy1978
 
System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar - Standard

System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar


3. und letzter Teil

Code:
ATTFilter
.text  ...                                                                                                                                                     * 2
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                  0000000077831570 6 bytes [48, B8, 53, 76, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 8                                                              0000000077831578 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                          00000000778315e0 6 bytes [48, B8, C6, 76, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8                                                                      00000000778315e8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                       0000000077831620 6 bytes [48, B8, 2E, 73, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection + 8                                                                   0000000077831628 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                0000000077831650 6 bytes [48, B8, 22, 77, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory + 8                                                            0000000077831658 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                   0000000077831670 6 bytes [48, B8, E0, 75, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject + 8                                                               0000000077831678 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                    0000000077831700 6 bytes [48, B8, 7E, 77, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread + 8                                                                0000000077831708 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                       0000000077831730 6 bytes [48, B8, 9E, 74, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent + 8                                                                   0000000077831738 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                     0000000077831750 6 bytes [48, B8, 17, 73, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection + 8                                                                 0000000077831758 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx                                                                   0000000077831780 6 bytes [48, B8, CF, 73, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcessEx + 8                                                               0000000077831788 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                      0000000077831790 6 bytes [48, B8, DD, 76, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread + 8                                                                  0000000077831798 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                        0000000077831800 6 bytes [48, B8, 73, 73, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                                                                    0000000077831808 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                       00000000778318b0 6 bytes [48, B8, E6, 73, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 8                                                                   00000000778318b8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                      0000000077831c80 6 bytes [48, B8, B5, 74, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant + 8                                                                  0000000077831c88 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess                                                                     0000000077831cd0 6 bytes [48, B8, 67, 77, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateProcess + 8                                                                 0000000077831cd8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                    0000000077831d30 6 bytes [48, B8, F4, 76, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx + 8                                                                0000000077831d38 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                         0000000077831e10 6 bytes [48, B8, AF, 76, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 8                                                                     0000000077831e18 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                    0000000077831e40 6 bytes [48, B8, 98, 76, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 8                                                                0000000077831e48 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                        00000000778320a0 6 bytes [48, B8, 87, 74, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver + 8                                                                    00000000778320a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                              00000000778329a0 6 bytes [48, B8, 92, 78, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation + 8                                                          00000000778329a8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                    0000000077832a80 6 bytes [48, B8, 1F, 78, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess + 8                                                                0000000077832a88 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                0000000077832aa0 6 bytes [48, B8, A9, 78, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl + 8                                                            0000000077832aa8 4 bytes [00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!CreateToolhelp32Snapshot                                                         00000000775c21e0 12 bytes [48, B8, 95, 77, 27, 6F, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!SetThreadContext + 1                                                             00000000775c2f11 8 bytes [B8, 39, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!SetThreadContext + 10                                                            00000000775c2f1a 2 bytes [50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!AssignProcessToJobObject + 1                                                     00000000775ca4a1 8 bytes [B8, 7B, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!AssignProcessToJobObject + 10                                                    00000000775ca4aa 2 bytes [50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!CreateFileW + 1                                                                  00000000775d1871 11 bytes [B8, 70, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!CopyFileExW + 1                                                                  00000000775d23d1 11 bytes [B8, A1, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!CreateThread + 1                                                                 00000000775d6581 11 bytes [B8, F1, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!CreateProcessInternalW                                                           00000000775de750 12 bytes [48, B8, FA, 74, 27, 6F, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!GetStartupInfoA + 1                                                              00000000775e1e31 11 bytes [B8, FD, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!CloseHandle                                                                      00000000775e2f10 7 bytes [48, B8, 8A, 73, 27, 6F, 00]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!CloseHandle + 9                                                                  00000000775e2f19 3 bytes [00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!WriteProcessMemory + 1                                                           000000007760bad1 11 bytes [B8, DA, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!VirtualProtectEx + 1                                                             000000007760bb71 11 bytes [B8, 36, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!VirtualAllocEx + 1                                                               000000007760bbd1 11 bytes [B8, 4D, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!CreateRemoteThread + 1                                                           000000007760c511 8 bytes [B8, 0B, 77, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!CreateRemoteThread + 10                                                          000000007760c51a 2 bytes [50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!CheckRemoteDebuggerPresent + 1                                                   0000000077610e11 11 bytes [B8, CC, 74, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!ReadConsoleInputW + 1                                                            0000000077615011 11 bytes [B8, 3F, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!ReadConsoleInputA + 1                                                            0000000077615031 11 bytes [B8, 28, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!ReadConsoleW                                                                     000000007762a560 12 bytes [48, B8, 6D, 75, 27, 6F, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!ReadConsoleA                                                                     000000007762a670 12 bytes [48, B8, 56, 75, 27, 6F, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!CreateDirectoryExW                                                               0000000077649150 12 bytes [48, B8, 3C, 76, 27, 6F, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\kernel32.dll!MoveFileWithProgressW + 1                                                        000000007764f6c1 11 bytes [B8, B8, 73, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\KERNELBASE.dll!SleepEx                                                                        000007fefd8f1150 12 bytes [48, B8, 42, 74, 27, 6F, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\KERNELBASE.dll!FreeLibrary + 1                                                                000007fefd8f2db1 11 bytes [B8, C0, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW + 1                                                           000007fefd8f37d1 11 bytes [B8, 84, 75, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\KERNELBASE.dll!QueueUserAPC                                                                   000007fefd8f3d40 12 bytes [48, B8, 64, 78, 27, 6F, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\KERNELBASE.dll!SuspendThread + 1                                                              000007fefd8f68c1 11 bytes [B8, 08, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\KERNELBASE.dll!CreateDirectoryW + 1                                                           000007fefd8f8101 11 bytes [B8, 25, 76, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                 000007fefd8f8ef0 12 bytes [48, B8, B2, 75, 27, 6F, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\KERNELBASE.dll!GetStartupInfoW                                                                000007fefd8fde80 6 bytes [48, B8, 14, 74, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\KERNELBASE.dll!GetStartupInfoW + 9                                                            000007fefd8fde89 3 bytes [00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\KERNELBASE.dll!DeleteFileW + 1                                                                000007fefd905131 5 bytes [B8, 0E, 76, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\KERNELBASE.dll!DeleteFileW + 7                                                                000007fefd905137 5 bytes [00, 00, 00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\KERNELBASE.dll!SetFileAttributesW                                                             000007fefd907640 6 bytes [48, B8, 9B, 75, 27, 6F]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\KERNELBASE.dll!SetFileAttributesW + 9                                                         000007fefd907649 3 bytes [00, 50, C3]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\KERNELBASE.dll!PulseEvent + 1                                                                 000007fefd923cb1 11 bytes [B8, D7, 78, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\msvcrt.dll!calloc + 333                                                                       000007fefdb71b21 11 bytes [B8, 05, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\sechost.dll!ControlService + 1                                                                000007feff61642d 11 bytes [B8, EB, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\sechost.dll!OpenServiceW                                                                      000007feff616484 12 bytes [48, B8, 78, 79, 27, 6F, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\sechost.dll!OpenServiceA                                                                      000007feff616c34 12 bytes [48, B8, 8F, 79, 27, 6F, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\sechost.dll!DeleteService + 1                                                                 000007feff617ab5 11 bytes [B8, A6, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExA + 1                                                             000007feff618b01 11 bytes [B8, BD, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\SYSTEM32\sechost.dll!ControlServiceExW + 1                                                             000007feff618c39 11 bytes [B8, D4, 79, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\ole32.dll!CoCreateInstanceEx + 1                                                              000007feff63de91 11 bytes [B8, 58, 7C, 27, 6F, 00, 00, ...]
.text  C:\Windows\system32\taskmgr.exe[2444] C:\Windows\system32\ole32.dll!CLSIDFromProgID + 1                                                                 000007feff649981 11 bytes [B8, 41, 7C, 27, 6F, 00, 00, ...]
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtReadFile                                                            00000000779df8f0 5 bytes JMP 000000016eca81aa
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtWriteFile                                                           00000000779df928 5 bytes JMP 000000016eca8150
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtClose                                                               00000000779df9e0 5 bytes JMP 000000016eca7fc0
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtOpenKey                                                             00000000779dfa28 5 bytes JMP 000000016eca822c
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationProcess                                               00000000779dfb28 5 bytes JMP 000000016eca810a
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtCreateKey                                                           00000000779dfb40 5 bytes JMP 000000016eca8222
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess                                                         00000000779dfc20 5 bytes JMP 000000016eca8204
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile                                                  00000000779dfc38 5 bytes JMP 000000016eca8196
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection                                                    00000000779dfc50 5 bytes JMP 000000016eca7fde
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtUnmapViewOfSection                                                  00000000779dfc80 5 bytes JMP 000000016eca7fe8
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                    00000000779dfcb0 5 bytes JMP 000000016eca818c
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile                                                            00000000779dfd64 5 bytes JMP 000000016eca81c8
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtOpenSection                                                         00000000779dfdc8 5 bytes JMP 000000016eca7fd4
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory                                                  00000000779dfe14 5 bytes JMP 000000016eca81f0
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtDuplicateObject                                                     00000000779dfe44 5 bytes JMP 000000016eca815a
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtQueueApcThread                                                      00000000779dff24 5 bytes JMP 000000016eca8218
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtCreateEvent                                                         00000000779dff74 5 bytes JMP 000000016eca80d8
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtCreateSection                                                       00000000779dffa4 5 bytes JMP 000000016eca7fca
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtCreateProcessEx                                                     00000000779dffec 5 bytes JMP 000000016eca801a
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtCreateThread                                                        00000000779e0004 5 bytes JMP 000000016eca81d2
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile                                                          00000000779e00b4 5 bytes JMP 000000016eca7ff2
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey                                                         00000000779e01c4 5 bytes JMP 000000016eca8024
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtCreateMutant                                                        00000000779e079c 5 bytes JMP 000000016eca80e2
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtCreateProcess                                                       00000000779e0814 5 bytes JMP 000000016eca820e
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtCreateThreadEx                                                      00000000779e08a4 5 bytes JMP 000000016eca81dc
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtDeleteKey                                                           00000000779e09fc 5 bytes JMP 000000016eca81be
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey                                                      00000000779e0a44 5 bytes JMP 000000016eca81b4
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtLoadDriver                                                          00000000779e0df4 5 bytes JMP 000000016eca80ce
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtSetSystemInformation                                                00000000779e1be4 5 bytes JMP 000000016eca8286
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtSuspendProcess                                                      00000000779e1d54 5 bytes JMP 000000016eca8254
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtSystemDebugControl                                                  00000000779e1d8c 5 bytes JMP 000000016eca8290
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!NtVdmControl                                                          00000000779e1ee8 5 bytes JMP 000000016eca81a0
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                            00000000779fc4dd 5 bytes JMP 000000016eca8164
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!RtlCreateProcessParametersEx                                          0000000077a20d3b 5 bytes JMP 000000016eca80f6
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\SysWOW64\ntdll.dll!RtlCreateProcessParameters                                            0000000077a6e8ab 5 bytes JMP 000000016eca806a
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!GetStartupInfoA                                                    0000000076200e00 5 bytes JMP 000000016eca8056
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!Sleep                                                              00000000762010ff 5 bytes JMP 000000016eca8088
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!SleepEx                                                            0000000076201215 5 bytes JMP 000000016eca8074
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!GetProcAddress                                                     0000000076201222 5 bytes JMP 000000016eca8092
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!GetModuleHandleA                                                   0000000076201245 5 bytes JMP 000000016eca802e
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!CloseHandle                                                        00000000762013e0 5 bytes JMP 000000016eca7ffc
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!QueryPerformanceCounter                                            00000000762016f5 5 bytes JMP 000000016eca804c
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!GetModuleHandleW                                                   0000000076203450 5 bytes JMP 000000016eca8038
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!FreeLibrary                                                        0000000076203468 5 bytes JMP 000000016eca829a
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!CreateThread                                                       0000000076203475 5 bytes JMP 000000016eca8240
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!GetSystemTimeAsFileTime                                            00000000762034a9 5 bytes JMP 000000016eca8042
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!CreateFileW                                                        0000000076203efc 5 bytes JMP 000000016eca80c4
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!CreateDirectoryW                                                   00000000762041f9 5 bytes JMP 000000016eca8178
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!LoadLibraryExW                                                     00000000762048fd 5 bytes JMP 000000016eca8146
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!LoadLibraryA                                                       0000000076204977 5 bytes JMP 000000016eca809c
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!GetStartupInfoW                                                    0000000076204ce0 5 bytes JMP 000000016eca8060
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!CreateFileA                                                        0000000076205366 5 bytes JMP 000000016eca80b0
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!ExitProcess                                                        00000000762079b0 5 bytes JMP 000000016eca807e
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!DeleteFileW                                                        0000000076208953 5 bytes JMP 000000016eca816e
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW                                             0000000076213b93 5 bytes JMP 000000016eca8100
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!MoveFileWithProgressW                                              0000000076219a6c 5 bytes JMP 000000016eca8010
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!SetFileAttributesW                                                 000000007621d48f 5 bytes JMP 000000016eca813c
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!VirtualAllocEx                                                     000000007621d948 5 bytes JMP 000000016eca8268
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!WriteProcessMemory                                                 000000007621d978 5 bytes JMP 000000016eca8236
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!CopyFileExW                                                        0000000076223b2a 5 bytes JMP 000000016eca8006
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!CreateToolhelp32Snapshot                                           00000000762272f7 5 bytes JMP 000000016eca80a6
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!SuspendThread                                                      0000000076227d16 5 bytes JMP 000000016eca824a
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!QueueUserAPC                                                       0000000076229ef5 5 bytes JMP 000000016eca8272
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!CheckRemoteDebuggerPresent                                         000000007622b096 5 bytes JMP 000000016eca80ec
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!AssignProcessToJobObject                                           000000007622c802 5 bytes JMP 000000016eca827c
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!CreateDirectoryExW                                                 0000000076278599 5 bytes JMP 000000016eca8182
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!WinExec                                                            0000000076282c51 5 bytes JMP 000000016eca80ba
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!CreateRemoteThread                                                 000000007628419b 5 bytes JMP 000000016eca81e6
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!PulseEvent                                                         00000000762844bf 5 bytes JMP 000000016eca82a4
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!VirtualProtectEx                                                   00000000762845ef 5 bytes JMP 000000016eca825e
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!SetThreadContext                                                   00000000762853c3 5 bytes JMP 000000016eca81fa
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!ReadConsoleInputA                                                  00000000762a6f2b 5 bytes JMP 000000016eca8114
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!ReadConsoleInputW                                                  00000000762a6f4e 5 bytes JMP 000000016eca811e
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!ReadConsoleA                                                       00000000762a72f9 5 bytes JMP 000000016eca8128
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\kernel32.dll!ReadConsoleW                                                       00000000762a7372 5 bytes JMP 000000016eca8132
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceW                                                       000000007656ca4c 5 bytes JMP 000000016eca82f4
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\ADVAPI32.dll!OpenServiceA                                                       0000000076572bf0 5 bytes JMP 000000016eca82fe
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\ADVAPI32.dll!RegOpenKeyExA + 222                                                00000000765749e5 5 bytes JMP 000000016eca82ae
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW                                                     000000007658712c 5 bytes JMP 000000016eca82ea
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\ADVAPI32.dll!ControlService                                                     0000000076587144 5 bytes JMP 000000016eca8326
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\ADVAPI32.dll!DeleteService                                                      000000007658715c 5 bytes JMP 000000016eca8308
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigA                                               00000000765a30e8 5 bytes JMP 000000016eca833a
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\ADVAPI32.dll!ChangeServiceConfigW                                               00000000765a30f8 5 bytes JMP 000000016eca8330
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\ADVAPI32.dll!ControlServiceExA                                                  00000000765a3108 5 bytes JMP 000000016eca8312
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\ADVAPI32.dll!ControlServiceExW                                                  00000000765a3118 1 byte JMP 000000016eca831c
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\ADVAPI32.dll!ControlServiceExW + 2                                              00000000765a311a 3 bytes {CALL QWORD [RCX+0x70]}
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA                                                     00000000765a3158 5 bytes JMP 000000016eca82e0
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\msvcrt.dll!_lock + 41                                                           00000000756da472 5 bytes JMP 000000016eca82b8
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\msvcrt.dll!__p__fmode                                                           00000000756e27ce 5 bytes JMP 000000016eca82d6
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\msvcrt.dll!__p__environ                                                         00000000756ee6cf 5 bytes JMP 000000016eca82cc
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!GetMessageW                                                          00000000758c78e2 5 bytes JMP 000000016eca834e
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!GetMessageA                                                          00000000758c7bd3 5 bytes JMP 000000016eca8344
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!SendMessageW                                                         00000000758c9679 5 bytes JMP 000000016eca8394
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!UserClientDllInitialize                                              00000000758cb6ed 5 bytes JMP 000000016eca82c2
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                                      00000000758cee09 5 bytes JMP 000000016eca8380
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!PeekMessageW                                                         00000000758d05ba 5 bytes JMP 000000016eca8362
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!PostMessageW                                                         00000000758d12a5 5 bytes JMP 000000016eca83a8
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!GetKeyState                                                          00000000758d291f 5 bytes JMP 000000016eca83e4
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!PostMessageA                                                         00000000758d3baa 5 bytes JMP 000000016eca839e
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!PeekMessageA                                                         00000000758d5f74 5 bytes JMP 000000016eca8358
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!SendMessageA                                                         00000000758d612e 5 bytes JMP 000000016eca838a
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                                    00000000758d7603 5 bytes JMP 000000016eca836c
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!SendNotifyMessageW                                                   00000000758d7668 5 bytes JMP 000000016eca83d0
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!SendMessageCallbackW                                                 00000000758d76e0 5 bytes JMP 000000016eca83bc
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                                    00000000758d835c 5 bytes JMP 000000016eca8376
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!GetAsyncKeyState                                                     00000000758eeb96 5 bytes JMP 000000016eca83ee
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!GetKeyboardState                                                     00000000758eec68 5 bytes JMP 000000016eca83f8
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!AttachThreadInput                                                    00000000758ef188 5 bytes JMP 000000016eca8402
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!DdeConnect                                                           000000007590eb7f 5 bytes JMP 000000016eca83da
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!SendMessageCallbackA                                                 0000000075926cfc 5 bytes JMP 000000016eca83b2
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!SendNotifyMessageA                                                   0000000075926d5d 5 bytes JMP 000000016eca83c6
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!RegisterRawInputDevices                                              00000000759288eb 5 bytes JMP 000000016eca8416
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\USER32.dll!EndTask                                                              000000007592a7ee 5 bytes JMP 000000016eca840c
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\ole32.dll!CLSIDFromProgID                                                       0000000075a7503c 5 bytes JMP 000000016eca843e
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\ole32.dll!CoCreateInstanceEx                                                    0000000075a99d4e 5 bytes JMP 000000016eca8448
.text  C:\Users\Andreas\Downloads\gmer_2.1.19163.exe[6040] C:\Windows\syswow64\ole32.dll!CoFreeUnusedLibrariesEx + 988                                         0000000075a9ba3d 5 bytes JMP 000000016eca8434

---- EOF - GMER 2.1 ----

Alt 15.09.2013, 20:12   #8
schrauber
/// the machine
/// TB-Ausbilder
 
System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar - Standard

System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar


Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!
Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 16.09.2013, 15:33   #9
flummy1978
 
System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar - Standard

System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar


Hallo,

vielen Dank schon vorab für die Hilfe. War gestern leider schon auf dem Weg zur Nachtschicht sonst wäre die Antwort noch vorabgekommen.

Die Combofix.txt ist im Anhang.

Grüße
Andreas

Alt 16.09.2013, 19:44   #10
schrauber
/// the machine
/// TB-Ausbilder
 
System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar - Standard

System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar


So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 16.09.2013, 20:01   #11
flummy1978
 
System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar - Standard

System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar


Mhmmm die harten Regeln waren mir vorher nie so bewusst.... Sorry dafür:

Der Log besagt zwar, dass Bitdefender an war, war er aber nur beim ersten Einschalten. Danach kam eine erneute Abfrage und war abgeschaltet, die Meldung konnte ich dann auch bestätigen.

Code:
ATTFilter
ComboFix 13-09-14.01 - Andreas 16.09.2013  15:59:44.1.2 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.6143.2681 [GMT 2:00]
ausgeführt von:: c:\users\Andreas\Downloads\ComboFix.exe
AV: BitDefender Antivirus *Enabled/Updated* {50909708-FF80-02AF-F814-B28405891E92}
FW: BitDefender Firewall *Enabled* {68AB162D-B5EF-03F7-D34B-1BB1FB5A59E9}
SP: BitDefender AntiSpyware *Enabled/Updated* {EBF176EC-D9BA-0D21-C2A4-89F67E0E542F}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\users\Andreas\AppData\Roaming\moka
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\(Default)\AddressBook.sqlitedb
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\(Default)\AddressBookImages.sqlitedb
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\(Default)\Calendar.sqlitedb
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\(Default)\call_history.db
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\(Default)\Info.plist
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\(Default)\notes.db
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\(Default)\sms.db
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\2011-07-01  10.28  (Andreas iPhone via iTunes)\AddressBook.sqlitedb
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\2011-07-01  10.28  (Andreas iPhone via iTunes)\AddressBookImages.sqlitedb
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\2011-07-01  10.28  (Andreas iPhone via iTunes)\Calendar.sqlitedb
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\2011-07-01  10.28  (Andreas iPhone via iTunes)\call_history.db
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\2011-07-01  10.28  (Andreas iPhone via iTunes)\com.apple.mobilephone.speeddial.plist
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\2011-07-01  10.28  (Andreas iPhone via iTunes)\Info.plist
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\2011-07-01  10.28  (Andreas iPhone via iTunes)\Manifest.mbdb
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\2011-07-01  10.28  (Andreas iPhone via iTunes)\Manifest.mbdx
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\2011-07-01  10.28  (Andreas iPhone via iTunes)\notes.sqlite
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\2011-07-01  10.28  (Andreas iPhone via iTunes)\Parts\1b\14\526-0.jpg
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\2011-07-01  10.28  (Andreas iPhone via iTunes)\Parts\50\00\2688-0.3gp
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\2011-07-01  10.28  (Andreas iPhone via iTunes)\Parts\50\04\2708-0.3gp
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\2011-07-01  10.28  (Andreas iPhone via iTunes)\Parts\50\07\2807-0.3gp
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\2011-07-01  10.28  (Andreas iPhone via iTunes)\Parts\50\08\1816-0.3gp
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\2011-07-01  10.28  (Andreas iPhone via iTunes)\Parts\50\10\890-0.gif
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\2011-07-01  10.28  (Andreas iPhone via iTunes)\Parts\50\12\1212-0.gif
c:\users\Andreas\AppData\Roaming\moka\iTwin\data\2011-07-01  10.28  (Andreas iPhone via iTunes)\sms.db
c:\windows\IsUn0407.exe
c:\windows\msvcr71.dll
c:\windows\wininit.ini
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-08-16 bis 2013-09-16  ))))))))))))))))))))))))))))))
.
.
2013-09-16 14:18 . 2013-09-16 14:18	--------	d-----w-	c:\users\hedev\AppData\Local\temp
2013-09-16 14:18 . 2013-09-16 14:18	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-09-16 14:18 . 2013-09-16 14:18	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2013-09-15 17:54 . 2012-09-12 18:19	120064	----a-w-	c:\windows\system32\drivers\SbFwIm.sys
2013-09-15 17:54 . 2012-09-20 03:11	258848	----a-w-	c:\windows\system32\drivers\SbFw.sys
2013-09-15 17:47 . 2013-09-15 17:47	--------	d-----w-	c:\users\Andreas\AppData\Roaming\ParetoLogic
2013-09-15 17:47 . 2013-09-15 17:47	--------	d-----w-	c:\users\Andreas\AppData\Roaming\DriverCure
2013-09-15 17:46 . 2013-09-15 17:59	--------	d-----w-	c:\programdata\ParetoLogic
2013-09-15 17:46 . 2013-09-15 17:59	--------	d-----w-	c:\program files (x86)\ParetoLogic
2013-09-15 17:39 . 2013-09-15 17:39	--------	d-----w-	c:\users\Andreas\AppData\Roaming\Malwarebytes
2013-09-15 17:39 . 2013-09-15 17:39	--------	d-----w-	c:\programdata\Malwarebytes
2013-09-15 17:39 . 2013-09-15 17:39	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2013-09-15 17:39 . 2013-04-04 12:50	25928	----a-w-	c:\windows\system32\drivers\mbam.sys
2013-09-15 12:10 . 2013-09-15 12:10	--------	d-----w-	C:\FRST
2013-09-12 16:19 . 2013-09-15 17:41	--------	d-----w-	c:\program files (x86)\hdvidcodec.com
2013-09-12 12:39 . 2013-08-05 02:25	155584	----a-w-	c:\windows\system32\drivers\ataport.sys
2013-09-03 13:53 . 2013-09-03 13:53	187248	----a-w-	c:\program files (x86)\Mozilla Firefox\plugins\nppdf32.dll
2013-08-17 17:18 . 2013-08-17 17:18	--------	d-----w-	c:\program files\iPod
2013-08-17 17:18 . 2013-08-17 17:20	--------	d-----w-	c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-08-17 17:18 . 2013-08-17 17:20	--------	d-----w-	c:\program files\iTunes
2013-08-17 17:18 . 2013-08-17 17:20	--------	d-----w-	c:\program files (x86)\iTunes
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-14 08:56 . 2012-03-28 08:50	692616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-09-14 08:56 . 2011-05-27 19:47	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-09-12 13:29 . 2010-04-22 16:42	79143768	----a-w-	c:\windows\system32\MRT.exe
2013-08-05 15:13 . 2013-08-05 15:07	16	----a-w-	c:\users\Andreas\AppData\Roaming\msregsvv.dll
2013-08-02 01:48 . 2013-09-12 12:39	44032	----a-w-	c:\windows\apppatch\acwow64.dll
2013-07-26 03:13 . 2013-08-15 08:27	1767936	----a-w-	c:\windows\SysWow64\wininet(71).dll
2013-07-26 03:13 . 2013-08-15 08:27	1141248	----a-w-	c:\windows\SysWow64\urlmon(70).dll
2013-07-25 09:25 . 2013-08-14 13:42	1888768	----a-w-	c:\windows\system32\WMVDECOD.DLL
2013-07-25 08:57 . 2013-08-14 13:42	1620992	----a-w-	c:\windows\SysWow64\WMVDECOD.DLL
2013-07-19 01:58 . 2013-08-14 13:42	2048	----a-w-	c:\windows\system32\tzres.dll
2013-07-19 01:41 . 2013-08-14 13:42	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2013-07-09 05:52 . 2013-08-14 13:42	224256	----a-w-	c:\windows\system32\wintrust.dll
2013-07-09 05:51 . 2013-08-14 13:42	1217024	----a-w-	c:\windows\system32\rpcrt4.dll
2013-07-09 05:46 . 2013-08-14 13:42	184320	----a-w-	c:\windows\system32\cryptsvc.dll
2013-07-09 05:46 . 2013-08-14 13:42	1472512	----a-w-	c:\windows\system32\crypt32.dll
2013-07-09 05:46 . 2013-08-14 13:42	139776	----a-w-	c:\windows\system32\cryptnet.dll
2013-07-09 04:52 . 2013-08-14 13:42	663552	----a-w-	c:\windows\SysWow64\rpcrt4.dll
2013-07-09 04:52 . 2013-08-14 13:42	175104	----a-w-	c:\windows\SysWow64\wintrust.dll
2013-07-09 04:46 . 2013-08-14 13:42	140288	----a-w-	c:\windows\SysWow64\cryptsvc.dll
2013-07-09 04:46 . 2013-08-14 13:42	1166848	----a-w-	c:\windows\SysWow64\crypt32.dll
2013-07-09 04:46 . 2013-08-14 13:42	103936	----a-w-	c:\windows\SysWow64\cryptnet.dll
2013-07-06 06:03 . 2013-08-14 13:42	1910208	----a-w-	c:\windows\system32\drivers\tcpip.sys
2013-06-26 05:59 . 2013-06-26 05:59	96168	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-06-26 05:59 . 2012-06-19 13:51	867240	----a-w-	c:\windows\SysWow64\npdeployJava1.dll
2013-06-26 05:59 . 2010-05-16 14:28	789416	----a-w-	c:\windows\SysWow64\deployJava1.dll
2010-07-08 08:37 . 2010-07-08 08:37	101544	----a-w-	c:\program files\Common Files\LinkInstaller.exe
2007-03-12 17:59 . 2007-03-12 17:59	299008	----a-w-	c:\program files\navigram_register.exe
2009-09-27 07:39	369152	--sh--w-	c:\windows\SysWOW64\avisynth.dll
2005-07-14 10:31	32256	--sh--w-	c:\windows\SysWOW64\AVSredirect.dll
2006-05-03 09:06	163328	--sha-r-	c:\windows\SysWOW64\flvDX.dll
2004-01-24 22:00	70656	--sh--w-	c:\windows\SysWOW64\i420vfw.dll
2007-02-21 10:47	31232	--sha-r-	c:\windows\SysWOW64\msfDX.dll
2008-03-16 12:30	216064	--sha-r-	c:\windows\SysWOW64\nbDX.dll
2010-01-06 21:00	107520	--sha-r-	c:\windows\SysWOW64\TAKDSDecoder.dll
2012-10-05 17:54	188416	--sha-r-	c:\windows\SysWOW64\winDCE32.dll
2004-01-24 22:00	70656	--sh--w-	c:\windows\SysWOW64\yv12vfw.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-06-21 19875432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2011\Antispam32\ieshow.exe" [2011-06-02 92352]
"EEventManager"="c:\program files (x86)\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-08-16 152392]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"{91120000-001A-0000-0000-0000000FF1CE}"="del" [X]
"{91120000-002F-0000-0000-0000000FF1CE}"="del" [X]
.
c:\users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
BUFFALO NAS Navigator2.lnk - c:\program files (x86)\BUFFALO\NASNAVI\NasNavi.exe /startup [2010-1-26 1897952]
NAS Scheduler.lnk - c:\program files (x86)\BUFFALO\NASNAVI\nassche.exe [2011-2-5 206128]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2010-5-6 113664]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2010-4-24 1207312]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux4"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0\0sdnclean64.exe
.
R0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys;c:\windows\SYSNATIVE\DRIVERS\Lbd.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 GigasetGenericUSB_x64;GigasetGenericUSB_x64;c:\windows\system32\DRIVERS\GigasetGenericUSB_x64.sys;c:\windows\SYSNATIVE\DRIVERS\GigasetGenericUSB_x64.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 MSI_MSIBIOS_010507;MSI_MSIBIOS_010507;c:\program files (x86)\MSI\Live Update 5\msibios64_100507.sys;c:\program files (x86)\MSI\Live Update 5\msibios64_100507.sys [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]
R3 NTIOLib_1_0_4;NTIOLib_1_0_4;c:\program files (x86)\MSI\Live Update 5\NTIOLib_X64.sys;c:\program files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [x]
R3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys;c:\windows\SYSNATIVE\pwdrvio.sys [x]
R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys;c:\windows\SYSNATIVE\pwdspio.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SBFWIMCL;GFI Software Firewall NDIS IM Filter Service;c:\windows\system32\DRIVERS\sbfwim.sys;c:\windows\SYSNATIVE\DRIVERS\sbfwim.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 Update Server;BitDefender Update Server v2;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys;c:\windows\SYSNATIVE\DRIVERS\avc3.sys [x]
R4 avckf;avckf;c:\windows\system32\DRIVERS\avckf.sys;c:\windows\SYSNATIVE\DRIVERS\avckf.sys [x]
R4 Hidfpfrud;Hidfpfrud; [x]
S1 Bdfndisf;BitDefender Firewall NDIS 6 Filter Driver;c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys;c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [x]
S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\BitDefender\BitDefender Firewall\bdfwfpf.sys;c:\program files\Common Files\BitDefender\BitDefender Firewall\bdfwfpf.sys [x]
S1 SbFw;SbFw;c:\windows\system32\drivers\SbFw.sys;c:\windows\SYSNATIVE\drivers\SbFw.sys [x]
S2 almservice;Automation License Manager Service;c:\program files\Common Files\Siemens\sws\almsrv\almsrv64x.exe;c:\program files\Common Files\Siemens\sws\almsrv\almsrv64x.exe [x]
S2 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE [x]
S2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [x]
S2 NasPmService;NAS PM Service;\EXTHD\info\English\NasNavi2\Windows\nassvc.exe;\EXTHD\info\English\NasNavi2\Windows\nassvc.exe [x]
S2 s7hspsvx;S7 HSP Service;c:\program files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe;c:\program files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe [x]
S2 s7oiehsx64;SIMATIC IEPG Help Service;c:\program files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe;c:\program files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe [x]
S2 s7ousbu64x;SIMATIC USB Service;c:\windows\system32\DRIVERS\s7ousbu64x.sys;c:\windows\SYSNATIVE\DRIVERS\s7ousbu64x.sys [x]
S2 s7sn2srtx;PROFINET IO RT-Protocol V2.0;c:\windows\system32\DRIVERS\s7sn2srtx.sys;c:\windows\SYSNATIVE\DRIVERS\s7sn2srtx.sys [x]
S2 S7TraceServiceX;S7TraceServiceX;c:\program files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe;c:\program files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S2 Updatesrv;BitDefender Desktop Update Service;c:\program files\BitDefender\BitDefender 2011\updatesrv.exe;c:\program files\BitDefender\BitDefender 2011\updatesrv.exe [x]
S3 BDFM;BDFM;c:\windows\system32\DRIVERS\bdfm.sys;c:\windows\SYSNATIVE\DRIVERS\bdfm.sys [x]
S3 dpmconv;SIMATIC NET DP Driver;c:\windows\system32\DRIVERS\dpmconv.sys;c:\windows\SYSNATIVE\DRIVERS\dpmconv.sys [x]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys;c:\windows\SYSNATIVE\drivers\LGBusEnum.sys [x]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys;c:\windows\SYSNATIVE\drivers\LGVirHid.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 s7odpx2x64;SIMATIC Knotentaufe;c:\windows\system32\DRIVERS\s7odpx2x64.sys;c:\windows\SYSNATIVE\DRIVERS\s7odpx2x64.sys [x]
S3 s7oppinx64;SIMATIC PPI Transport;c:\windows\system32\DRIVERS\s7oppinx64.sys;c:\windows\SYSNATIVE\DRIVERS\s7oppinx64.sys [x]
S3 s7oserix64;Siemens PC Serial Cable;c:\windows\system32\Drivers\s7oserix64.sys;c:\windows\SYSNATIVE\Drivers\s7oserix64.sys [x]
S3 s7osmcax64;SIMATIC PC Adapter RS232;c:\windows\system32\DRIVERS\s7osmcax64.sys;c:\windows\SYSNATIVE\DRIVERS\s7osmcax64.sys [x]
S3 s7osobux64;SIMATIC SoftBus;c:\windows\system32\DRIVERS\s7osobux64.sys;c:\windows\SYSNATIVE\DRIVERS\s7osobux64.sys [x]
S3 s7otmcd64x;SIMATIC Memory Cards;c:\windows\system32\Drivers\s7otmcd64x.sys;c:\windows\SYSNATIVE\Drivers\s7otmcd64x.sys [x]
S3 s7otranx64;SIMATIC Transport;c:\windows\system32\DRIVERS\s7otranx64.sys;c:\windows\SYSNATIVE\DRIVERS\s7otranx64.sys [x]
S3 s7otsadx64;SIMATIC TS Adapter RS232;c:\windows\system32\DRIVERS\s7otsadx64.sys;c:\windows\SYSNATIVE\DRIVERS\s7otsadx64.sys [x]
S3 TTUSB2BDA_NTAMD64;TTUSB2BDA USB 2.0 Driver AMD64;c:\windows\system32\DRIVERS\ttusb2bda_amd64.sys;c:\windows\SYSNATIVE\DRIVERS\ttusb2bda_amd64.sys [x]
S3 vsnl2ada;SIMATIC NET FDL Driver;c:\windows\system32\DRIVERS\vsnl2ada.sys;c:\windows\SYSNATIVE\DRIVERS\vsnl2ada.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-09-04 07:55	1177552	----a-w-	c:\program files (x86)\Google\Chrome\Application\29.0.1547.66\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-09-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-28 08:56]
.
2013-09-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-16 16:18]
.
2013-09-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-16 16:18]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Launch LgDeviceAgent"="c:\program files\Logitech\GamePanel Software\LgDevAgt.exe" [2010-02-18 415816]
"Launch LCDMon"="c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2010-02-18 2093128]
"Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2010-02-18 4271688]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 130576]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2011\ieshow.exe" [2011-06-02 109344]
"BDAgent"="c:\program files\BitDefender\BitDefender 2011\bdagent.exe" [2011-07-11 2026680]
"NVRaidService"="c:\program files\NVIDIA Corporation\Raid\nvraidservice.exe" [2010-04-09 291944]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-06-11 12503184]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube Download - c:\users\Andreas\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: Interfaces\{05A5E494-8E32-4D4E-851B-235A5CE9415A}: NameServer = 192.168.2.1
FF - ProfilePath - c:\users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\jugf7uli.default-1360422309596\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/
FF - prefs.js: network.proxy.type - 0
FF - user.js: extensions.autoDisableScopes - 10
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-MobileDocuments - c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-1ClickDownload - c:\program files (x86)\hdvidcodec.com\uninst.exe
AddRemove-Free Video Dub_is1 - c:\program files (x86)\Common Files\DVDVideoSoft\Uninstall.exe
AddRemove-HomeSite 4.0.1 - c:\windows\IsUn0407.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_174_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_174_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_174_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_174_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_174.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_174.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_174.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_174.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Windows CE Services]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-09-16  16:29:47
ComboFix-quarantined-files.txt  2013-09-16 14:29
.
Vor Suchlauf: 10 Verzeichnis(se), 125.133.484.032 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 163.700.330.496 Bytes frei
.
- - End Of File - - 463B99DC17A920C471ECA6F0E04445F8
A36C5E4F47E84449FF07ED3517B43A31

Alt 17.09.2013, 08:01   #12
schrauber
/// the machine
/// TB-Ausbilder
 
System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar - Standard

System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar


Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 17.09.2013, 14:34   #13
flummy1978
 
System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar - Standard

System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar


Hey,

ich hoffe mal ich hab jetzt alles zusammen. Insg. sieht es so aus, als ob die Symptome verschwunden sind. Ob das System jetzt allerdings sauber ist, ist eine andere Sache

Malwarebytes Log:
Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.09.17.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16686
Andreas :: SERVER-WIN7 [Administrator]

Schutz: Deaktiviert

17.09.2013 10:36:08
mbam-log-2013-09-17 (10-36-08).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 656984
Laufzeit: 2 Stunde(n), 11 Minute(n), 25 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Program Files (x86)\RealArcade\Installer\bin\OCSetupHlp.dll (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
AdwCleaner Log:
Code:
ATTFilter
# AdwCleaner v3.004 - Bericht erstellt am 17/09/2013 um 13:01:07
# Updated 15/09/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Andreas - SERVER-WIN7
# Gestartet von : C:\Users\Andreas\Downloads\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\ParetoLogic
Ordner Gelöscht : C:\Program Files (x86)\HDvidCodec.com
Ordner Gelöscht : C:\Program Files (x86)\Iminent
Ordner Gelöscht : C:\Program Files (x86)\ParetoLogic
Ordner Gelöscht : C:\Users\Andreas\AppData\LocalLow\pdfforge
Ordner Gelöscht : C:\Users\Andreas\AppData\LocalLow\Search Settings
Ordner Gelöscht : C:\Users\Andreas\AppData\Roaming\DriverCure
Ordner Gelöscht : C:\Users\Andreas\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Andreas\AppData\Roaming\ParetoLogic
Ordner Gelöscht : C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\jugf7uli.default-1360422309596\jetpack
Ordner Gelöscht : C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpkbnefaikfaeadgidhpoanckoiaheli
Datei Gelöscht : C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\cnlvj2zc.default\Extensions\pdfforge@mybrowserbar.com
Datei Gelöscht : C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\cnlvj2zc.default\Extensions\wtxpcom@mybrowserbar.com
Datei Gelöscht : C:\Users\Andreas\Desktop\HDVidCodec.lnk
Datei Gelöscht : C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\jugf7uli.default-1360422309596\user.js
Datei Gelöscht : C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\kpkbnefaikfaeadgidhpoanckoiaheli
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\pricegong_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\pricegong_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader19825_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader19825_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_anti-twin_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_anti-twin_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\Iminent
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\ParetoLogic
Schlüssel Gelöscht : HKCU\Software\pdfforge
Schlüssel Gelöscht : HKCU\Software\powerpack
Schlüssel Gelöscht : HKCU\Software\Search Settings
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\pdfforge
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Search Settings
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\Iminent
Schlüssel Gelöscht : HKLM\Software\ParetoLogic
Schlüssel Gelöscht : HKLM\Software\pdfforge
Schlüssel Gelöscht : HKLM\Software\Search Settings
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16686


-\\ Mozilla Firefox v23.0.1 (de)

[ Datei : C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\cnlvj2zc.default\prefs.js ]


[ Datei : C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\jugf7uli.default-1360422309596\prefs.js ]


*************************

AdwCleaner[R0].txt - [10614 octets] - [17/09/2013 12:58:03]
AdwCleaner[S0].txt - [10080 octets] - [17/09/2013 13:01:07]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [10141 octets] ##########
JRT log:
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.1 (09.15.2013:1)
OS: Windows 7 Professional x64
Ran by Andreas on 17.09.2013 at 13:10:07,15
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3574495096-608085143-2982597859-1001\Software\SweetIM



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 17.09.2013 at 15:02:32,65
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Log


FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-09-2013 03
Ran by Andreas (administrator) on SERVER-WIN7 on 17-09-2013 15:16:49
Running from C:\Users\Andreas\Downloads
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(BitDefender S.R.L.) C:\Program Files\BitDefender\BitDefender 2011\vsserv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\sws\almsrv\almsrv64x.exe
(BitDefender S.R.L.) C:\Program Files\BitDefender\BitDefender 2011\bdagent.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(BitDefender S.R.L.) C:\Program Files\BitDefender\BitDefender 2011\pchooklaunch64.exe
(BitDefender S.R.L.) C:\Program Files\BitDefender\BitDefender 2011\Antispam32\pchooklaunch32.exe
(BUFFALO INC.) \\EXTHD\info\English\NasNavi2\Windows\nassvc.exe
(SIEMENS AG) C:\Program Files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\PNIOMGR.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Raid\nvraidservice.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(BitDefender S.R.L.) C:\Program Files\BitDefender\BitDefender 2011\updatesrv.exe
(SIEMENS AG) C:\Windows\SysWOW64\pniopcac.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(BUFFALO INC.) C:\Program Files (x86)\BUFFALO\NASNAVI\NasNavi.exe
(BUFFALO INC.) C:\Program Files (x86)\BUFFALO\NASNAVI\nassche.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7epasrv64x.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Launch LgDeviceAgent] - C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe [415816 2010-02-18] (Logitech Inc.)
HKLM\...\Run: [Launch LCDMon] - C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe [2093128 2010-02-18] (Logitech Inc.)
HKLM\...\Run: [Launch LGDCore] - C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe [4271688 2010-02-18] (Logitech Inc.)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] - C:\Windows\KHALMNPR.EXE [130576 2009-06-17] (Logitech, Inc.)
HKLM\...\Run: [BitDefender Antiphishing Helper] - C:\Program Files\BitDefender\BitDefender 2011\ieshow.exe [109344 2011-06-02] (BitDefender S.R.L.)
HKLM\...\Run: [BDAgent] - C:\Program Files\BitDefender\BitDefender 2011\bdagent.exe [2026680 2011-07-11] (BitDefender S.R.L.)
HKLM\...\Run: [NVRaidService] - C:\Program Files\NVIDIA Corporation\Raid\nvraidservice.exe [291944 2010-04-09] (NVIDIA Corporation)
HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-09-27] (Apple Inc.)
HKLM-x32\...\Run: [BitDefender Antiphishing Helper] - C:\Program Files\BitDefender\BitDefender 2011\Antispam32\ieshow.exe [92352 2011-06-02] (BitDefender S.R.L.)
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)
HKU\UpdatusUser\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKU\UpdatusUser\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
Startup: C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BUFFALO NAS Navigator2.lnk
ShortcutTarget: BUFFALO NAS Navigator2.lnk -> C:\Program Files (x86)\BUFFALO\NASNAVI\NasNavi.exe (BUFFALO INC.)
Startup: C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NAS Scheduler.lnk
ShortcutTarget: NAS Scheduler.lnk -> C:\Program Files (x86)\BUFFALO\NASNAVI\nassche.exe (BUFFALO INC.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x309B1F7D97CECB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {CE6E18AF-205F-421B-8C80-E0C312E9D734} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=302398&p={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Bitdefender Toolbar - {381FFDE8-2394-4F90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2011\IEToolbar.dll (BitDefender S.R.L.)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM-x32 - Bitdefender Toolbar - {381FFDE8-2394-4F90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2011\Antispam32\IEToolbar.dll (BitDefender S.R.L.)
DPF: HKLM {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex64-2.2.5.7.cab
DPF: HKLM {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://navigram.com/engine/v1026/Navigram.cab
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM {E9B39AC7-B9FB-48CA-84A0-1659A05C0008} hxxp://www.wohnmoebel.de/priess/install/KPSA-home%20Priess.cab
DPF: HKLM-x32 {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{05A5E494-8E32-4D4E-851B-235A5CE9415A}: [NameServer]192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\jugf7uli.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF HKLM\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\BitDefender\BitDefender 2011\bdtbext\
FF Extension: No Name - C:\Program Files\BitDefender\BitDefender 2011\bdtbext\
FF HKLM-x32\...\Firefox\Extensions: [FFToolbar@bitdefender.com] - C:\Program Files\BitDefender\BitDefender 2011\bdaphffext\
FF Extension: No Name - C:\Program Files\BitDefender\BitDefender 2011\bdaphffext\
FF HKLM-x32\...\Firefox\Extensions: [fmconverter@gmail.com] - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\
FF Extension: Freemake Video Converter Plugin - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\
FF HKLM-x32\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\BitDefender\BitDefender 2011\bdtbext\
FF Extension: No Name - C:\Program Files\BitDefender\BitDefender 2011\bdtbext\
FF StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Freemake Video Converter) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbolfgndggfhhpbnkgnpjkfhinclbigj\1.0.0_1
CHR Extension: (Skype Click to Call) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.10.0.9560_1
CHR Extension: (Chrome In-App Payments service) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR HKLM-x32\...\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Chrome\Freemake.Plugin.Chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx

==================== Services (Whitelisted) =================

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [68096 2010-05-06] ()
R2 almservice; C:\Program Files\Common Files\Siemens\sws\almsrv\almsrv64x.exe [1532040 2011-06-19] (SIEMENS AG)
S3 FileZilla Server; C:\Program Files (x86)\FileZilla Server\FileZilla Server.exe [742912 2010-10-17] (FileZilla Project)
S3 Macromedia Licensing Service; C:\Program Files (x86)\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe [68096 2010-05-05] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 s7hspsvx; C:\Program Files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe [61493 2011-05-30] (SIEMENS AG)
R2 s7oiehsx64; C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe [139864 2011-06-22] (SIEMENS AG)
R2 S7TraceServiceX; C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe [229976 2011-06-22] (SIEMENS AG)
S3 Update Server; C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe [467248 2011-02-23] (BitDefender)
R2 Updatesrv; C:\Program Files\BitDefender\BitDefender 2011\updatesrv.exe [53224 2011-06-02] (BitDefender S.R.L.)
R2 VSSERV; C:\Program Files\BitDefender\BitDefender 2011\vsserv.exe [2660624 2011-07-11] (BitDefender S.R.L.)
S4 Hidfpfrud; 
R2 NasPmService; \\EXTHD\info\English\NasNavi2\Windows\nassvc.exe -Service_Execute -dcyc=60 -dto=3 -dluc=0 -dmin=1 -dmax=60 -dflc=0 -apc=0 -log=0 -pm=1 -pall=1 -phttp=0 -pbc=0 -ppro=0 -pcyc=0 -pmin=1 -pmax=60 -pflc=0 [x]

==================== Drivers (Whitelisted) ====================

S4 avc3; C:\Windows\System32\DRIVERS\avc3.sys [692816 2010-06-28] (BitDefender)
S4 avckf; C:\Windows\System32\DRIVERS\avckf.sys [1040976 2010-06-28] (BitDefender)
R3 BDFM; C:\Windows\System32\DRIVERS\bdfm.sys [162896 2010-05-13] (BitDefender S.R.L. Bucharest, ROMANIA)
R1 Bdfndisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [88144 2010-11-13] (BitDefender)
R0 bdfsfltr; C:\Windows\System32\DRIVERS\bdfsfltr.sys [431176 2011-04-01] (BitDefender)
R1 bdfwfpf; C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdfwfpf.sys [99408 2010-11-13] (BitDefender)
R3 dpmconv; C:\Windows\System32\DRIVERS\dpmconv.sys [259072 2011-04-19] (SIEMENS AG)
S3 GigasetGenericUSB_x64; C:\Windows\System32\DRIVERS\GigasetGenericUSB_x64.sys [54272 2009-02-20] (Siemens Home and Office Communication Devices GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R0 nvrd64; C:\Windows\System32\DRIVERS\nvrd64.sys [175720 2010-04-09] (NVIDIA Corporation)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2010-08-16] ()
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2010-08-16] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2010-08-16] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2010-08-16] ()
R3 s7odpx2x64; C:\Windows\System32\DRIVERS\s7odpx2x64.sys [71168 2011-05-06] (SIEMENS AG)
R3 s7oppinx64; C:\Windows\System32\DRIVERS\s7oppinx64.sys [107008 2011-05-06] (SIEMENS AG)
R3 s7oserix64; C:\Windows\System32\Drivers\s7oserix64.sys [121344 2011-05-06] (SIEMENS AG)
R3 s7osmcax64; C:\Windows\System32\DRIVERS\s7osmcax64.sys [195584 2011-05-06] (SIEMENS AG)
R3 s7osobux64; C:\Windows\System32\DRIVERS\s7osobux64.sys [152576 2011-05-06] (SIEMENS AG)
R3 s7otmcd64x; C:\Windows\System32\Drivers\s7otmcd64x.sys [199680 2011-05-06] (SIEMENS AG)
R3 s7otranx64; C:\Windows\System32\DRIVERS\s7otranx64.sys [260096 2011-05-06] (SIEMENS AG)
R3 s7otsadx64; C:\Windows\System32\DRIVERS\s7otsadx64.sys [192000 2011-05-06] (SIEMENS AG)
R2 s7ousbu64x; C:\Windows\System32\DRIVERS\s7ousbu64x.sys [190464 2011-05-06] (SIEMENS AG)
R2 s7sn2srtx; C:\Windows\System32\DRIVERS\s7sn2srtx.sys [83032 2011-06-16] (SIEMENS AG)
R2 SNTIE; C:\Windows\System32\DRIVERS\sntie.sys [179288 2011-05-31] (SIEMENS AG)
R3 TTUSB2BDA_NTAMD64; C:\Windows\System32\DRIVERS\ttusb2bda_amd64.sys [743808 2012-05-24] (TechnoTrend Goerler GmbH)
R3 vsnl2ada; C:\Windows\System32\DRIVERS\vsnl2ada.sys [120832 2011-04-19] (SIEMENS AG)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S0 Lbd; system32\DRIVERS\Lbd.sys [x]
S3 MSI_MSIBIOS_010507; \??\C:\Program Files (x86)\MSI\Live Update 5\msibios64_100507.sys [x]
S3 NTIOLib_1_0_4; \??\C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-17 15:16 - 2013-09-17 15:16 - 01950524 _____ (Farbar) C:\Users\Andreas\Downloads\FRST64.exe
2013-09-17 15:02 - 2013-09-17 15:13 - 00000816 _____ C:\Users\Andreas\Desktop\JRT.txt
2013-09-17 13:10 - 2013-09-17 13:10 - 00000000 ____D C:\Windows\ERUNT
2013-09-17 13:06 - 2013-09-17 13:07 - 01029675 _____ (Thisisu) C:\Users\Andreas\Downloads\JRT.exe
2013-09-17 13:04 - 2013-09-17 13:04 - 00010222 _____ C:\Users\Andreas\Desktop\AdwCleaner[S0].txt
2013-09-17 12:57 - 2013-09-17 13:01 - 00000000 ____D C:\AdwCleaner
2013-09-17 12:57 - 2013-09-17 12:57 - 01039554 _____ C:\Users\Andreas\Downloads\adwcleaner.exe
2013-09-16 16:29 - 2013-09-16 16:29 - 00027176 _____ C:\ComboFix.txt
2013-09-16 15:54 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-16 15:54 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-16 15:54 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-16 15:54 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-16 15:54 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-16 15:54 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-16 15:54 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-16 15:54 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-16 15:50 - 2013-09-16 16:30 - 00000000 ____D C:\Qoobox
2013-09-16 15:50 - 2013-09-16 16:21 - 00000000 ____D C:\Windows\erdnt
2013-09-16 15:49 - 2013-09-16 15:49 - 05126233 ____R (Swearware) C:\Users\Andreas\Downloads\ComboFix.exe
2013-09-15 19:54 - 2012-09-20 05:11 - 00258848 _____ (GFI Software) C:\Windows\system32\Drivers\SbFw.sys
2013-09-15 19:54 - 2012-09-12 20:19 - 00120064 _____ (GFI Software) C:\Windows\system32\Drivers\SbFwIm.sys
2013-09-15 19:52 - 2013-09-15 19:52 - 10728088 _____ (ParetoLogic, Inc.) C:\Users\Andreas\Downloads\XoftSpy_AV_Setup.exe
2013-09-15 19:45 - 2013-09-15 19:46 - 05893760 _____ (ParetoLogic, Inc.) C:\Users\Andreas\Downloads\RegCureProSetup_bing.exe
2013-09-15 19:44 - 2013-09-15 19:45 - 00001205 _____ C:\Users\Andreas\Downloads\FixNCR.reg
2013-09-15 19:39 - 2013-09-15 19:39 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-15 19:39 - 2013-09-15 19:39 - 00000000 ____D C:\Users\Andreas\AppData\Roaming\Malwarebytes
2013-09-15 19:39 - 2013-09-15 19:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-15 19:39 - 2013-09-15 19:39 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-15 19:39 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-15 19:38 - 2013-09-15 19:38 - 00614816 _____ C:\Users\Andreas\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2013-09-15 14:42 - 2013-09-15 15:00 - 00013279 _____ C:\Users\Andreas\Desktop\Gmer.zip
2013-09-15 14:29 - 2013-09-15 14:09 - 00000476 _____ C:\Users\Andreas\Desktop\defogger_disable.txt
2013-09-15 14:27 - 2013-09-15 14:58 - 00254657 _____ C:\Users\Andreas\Desktop\Gmer.txt
2013-09-15 14:15 - 2013-09-15 14:15 - 00377856 _____ C:\Users\Andreas\Downloads\gmer_2.1.19163.exe
2013-09-15 14:14 - 2013-09-15 14:59 - 00037759 _____ C:\Users\Andreas\Desktop\Addition.txt
2013-09-15 14:14 - 2013-09-15 14:14 - 00050547 _____ C:\Users\Andreas\Desktop\FRST.txt
2013-09-15 14:12 - 2013-09-15 14:13 - 00038325 _____ C:\Users\Andreas\Downloads\Addition.txt
2013-09-15 14:10 - 2013-09-15 14:10 - 00000000 ____D C:\FRST
2013-09-15 14:09 - 2013-09-15 14:09 - 00000476 _____ C:\Users\Andreas\Downloads\defogger_disable.log
2013-09-15 14:09 - 2013-09-15 14:09 - 00000000 _____ C:\Users\Andreas\defogger_reenable
2013-09-15 14:08 - 2013-09-15 14:08 - 00050477 _____ C:\Users\Andreas\Downloads\Defogger.exe
2013-09-13 11:45 - 2013-09-13 11:45 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635146695188970000
2013-09-12 15:34 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-12 15:34 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-12 15:34 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-12 15:34 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-12 15:34 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-12 15:34 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-12 15:34 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-12 15:34 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-12 15:34 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-12 15:34 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-12 15:34 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-12 15:34 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-12 15:34 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-12 15:34 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-12 15:34 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-12 15:34 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml(45).dll
2013-09-12 15:34 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9(44).dll
2013-09-12 15:34 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-12 15:34 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-12 15:34 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-12 15:34 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-12 15:34 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-12 14:39 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 14:39 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 14:39 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-12 14:39 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-12 14:39 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-12 14:39 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-12 14:39 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-12 14:39 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 14:39 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-12 14:39 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 14:39 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-12 14:39 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-12 14:39 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 14:39 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-12 14:39 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-12 14:39 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-12 14:39 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32(49).dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0(40).dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0(42).dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0(41).dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 14:39 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-12 14:39 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-12 14:39 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16(47).exe
2013-09-12 14:39 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-12 14:39 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-12 14:39 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-12 14:39 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-12 14:39 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 14:39 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 14:39 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-12 14:39 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-06 19:56 - 2013-09-06 19:56 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635140942066082000
2013-09-04 13:02 - 2013-09-04 13:02 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635138965727498000
2013-09-04 13:00 - 2013-09-04 13:00 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635138964591628000
2013-09-04 12:55 - 2013-09-04 12:55 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635138961233728000
2013-09-04 12:15 - 2013-09-04 12:15 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635138937493438000
2013-09-04 11:09 - 2013-09-04 11:09 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635138897621198000
2013-09-01 16:19 - 2013-09-01 16:19 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635136491809920000
2013-08-26 18:25 - 2013-08-26 18:25 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635131383440760000
2013-08-18 14:30 - 2013-08-18 14:30 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635124330283588000

==================== One Month Modified Files and Folders =======

2013-09-17 15:16 - 2013-09-17 15:16 - 01950524 _____ (Farbar) C:\Users\Andreas\Downloads\FRST64.exe
2013-09-17 15:13 - 2013-09-17 15:02 - 00000816 _____ C:\Users\Andreas\Desktop\JRT.txt
2013-09-17 15:10 - 2010-04-22 22:39 - 00000000 ____D C:\Users\Andreas\AppData\Roaming\Skype
2013-09-17 14:56 - 2012-03-28 10:50 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-17 14:55 - 2010-05-16 18:18 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-17 13:10 - 2013-09-17 13:10 - 00000000 ____D C:\Windows\ERUNT
2013-09-17 13:10 - 2009-07-14 06:45 - 00015184 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-17 13:10 - 2009-07-14 06:45 - 00015184 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-17 13:07 - 2013-09-17 13:06 - 01029675 _____ (Thisisu) C:\Users\Andreas\Downloads\JRT.exe
2013-09-17 13:07 - 2010-04-22 17:49 - 01882437 _____ C:\Windows\WindowsUpdate.log
2013-09-17 13:04 - 2013-09-17 13:04 - 00010222 _____ C:\Users\Andreas\Desktop\AdwCleaner[S0].txt
2013-09-17 13:03 - 2010-05-16 18:18 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-17 13:02 - 2010-04-22 18:09 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-17 13:02 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-17 13:02 - 2009-07-14 06:51 - 00156397 _____ C:\Windows\setupact.log
2013-09-17 13:01 - 2013-09-17 12:57 - 00000000 ____D C:\AdwCleaner
2013-09-17 12:57 - 2013-09-17 12:57 - 01039554 _____ C:\Users\Andreas\Downloads\adwcleaner.exe
2013-09-17 12:50 - 2010-04-22 18:20 - 02258372 _____ C:\Windows\PFRO.log
2013-09-16 16:30 - 2013-09-16 15:50 - 00000000 ____D C:\Qoobox
2013-09-16 16:30 - 2010-04-22 20:37 - 00000000 ____D C:\Users\Andreas\AppData\Local\Apps\2.0
2013-09-16 16:30 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-09-16 16:29 - 2013-09-16 16:29 - 00027176 _____ C:\ComboFix.txt
2013-09-16 16:21 - 2013-09-16 15:50 - 00000000 ____D C:\Windows\erdnt
2013-09-16 16:20 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-09-16 15:49 - 2013-09-16 15:49 - 05126233 ____R (Swearware) C:\Users\Andreas\Downloads\ComboFix.exe
2013-09-16 13:39 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-09-16 12:50 - 2009-07-14 19:58 - 00750600 _____ C:\Windows\system32\perfh007.dat
2013-09-16 12:50 - 2009-07-14 19:58 - 00166170 _____ C:\Windows\system32\perfc007.dat
2013-09-16 12:50 - 2009-07-14 07:13 - 01746140 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-16 12:01 - 2011-05-01 13:05 - 00000000 ____D C:\Users\Andreas\Downloads\WinRAR.4.00.x86.Incl.Keygen-FFF
2013-09-15 19:52 - 2013-09-15 19:52 - 10728088 _____ (ParetoLogic, Inc.) C:\Users\Andreas\Downloads\XoftSpy_AV_Setup.exe
2013-09-15 19:46 - 2013-09-15 19:45 - 05893760 _____ (ParetoLogic, Inc.) C:\Users\Andreas\Downloads\RegCureProSetup_bing.exe
2013-09-15 19:45 - 2013-09-15 19:44 - 00001205 _____ C:\Users\Andreas\Downloads\FixNCR.reg
2013-09-15 19:39 - 2013-09-15 19:39 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-15 19:39 - 2013-09-15 19:39 - 00000000 ____D C:\Users\Andreas\AppData\Roaming\Malwarebytes
2013-09-15 19:39 - 2013-09-15 19:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-15 19:39 - 2013-09-15 19:39 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-15 19:38 - 2013-09-15 19:38 - 00614816 _____ C:\Users\Andreas\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2013-09-15 15:31 - 2012-11-17 21:16 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-09-15 15:00 - 2013-09-15 14:42 - 00013279 _____ C:\Users\Andreas\Desktop\Gmer.zip
2013-09-15 14:59 - 2013-09-15 14:14 - 00037759 _____ C:\Users\Andreas\Desktop\Addition.txt
2013-09-15 14:58 - 2013-09-15 14:27 - 00254657 _____ C:\Users\Andreas\Desktop\Gmer.txt
2013-09-15 14:39 - 2011-11-06 14:36 - 00000000 ____D C:\Windows\system32\Macromed
2013-09-15 14:39 - 2010-10-05 14:03 - 00000000 ____D C:\Program Files (x86)\PKR
2013-09-15 14:39 - 2010-04-22 17:56 - 00000000 ___RD C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-15 14:39 - 2010-04-22 17:56 - 00000000 ___RD C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-15 14:39 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-15 14:39 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-09-15 14:39 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\AppCompat
2013-09-15 14:39 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-09-15 14:37 - 2013-05-29 21:15 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-09-15 14:15 - 2013-09-15 14:15 - 00377856 _____ C:\Users\Andreas\Downloads\gmer_2.1.19163.exe
2013-09-15 14:14 - 2013-09-15 14:14 - 00050547 _____ C:\Users\Andreas\Desktop\FRST.txt
2013-09-15 14:13 - 2013-09-15 14:12 - 00038325 _____ C:\Users\Andreas\Downloads\Addition.txt
2013-09-15 14:10 - 2013-09-15 14:10 - 00000000 ____D C:\FRST
2013-09-15 14:09 - 2013-09-15 14:29 - 00000476 _____ C:\Users\Andreas\Desktop\defogger_disable.txt
2013-09-15 14:09 - 2013-09-15 14:09 - 00000476 _____ C:\Users\Andreas\Downloads\defogger_disable.log
2013-09-15 14:09 - 2013-09-15 14:09 - 00000000 _____ C:\Users\Andreas\defogger_reenable
2013-09-15 14:09 - 2010-04-22 17:56 - 00000000 ____D C:\Users\Andreas
2013-09-15 14:08 - 2013-09-15 14:08 - 00050477 _____ C:\Users\Andreas\Downloads\Defogger.exe
2013-09-15 10:07 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA(50).DAT
2013-09-14 10:56 - 2012-03-28 10:50 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-14 10:56 - 2012-03-28 10:50 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-14 10:56 - 2011-05-27 21:47 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-13 11:45 - 2013-09-13 11:45 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635146695188970000
2013-09-13 09:52 - 2010-04-22 18:44 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-12 16:07 - 2010-04-22 19:31 - 00000376 _____ C:\Users\Andreas\AppData\Roamingprivacy.xml
2013-09-12 16:06 - 2009-07-14 06:45 - 00311192 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-12 15:34 - 2013-07-21 11:03 - 00000000 ____D C:\Windows\system32\MRT
2013-09-12 15:29 - 2010-04-22 18:42 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-06 19:56 - 2013-09-06 19:56 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635140942066082000
2013-09-05 11:46 - 2012-03-29 18:55 - 00000000 ____D C:\Users\Andreas\AppData\Roaming\vlc
2013-09-04 13:02 - 2013-09-04 13:02 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635138965727498000
2013-09-04 13:00 - 2013-09-04 13:00 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635138964591628000
2013-09-04 12:55 - 2013-09-04 12:55 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635138961233728000
2013-09-04 12:15 - 2013-09-04 12:15 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635138937493438000
2013-09-04 11:09 - 2013-09-04 11:09 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635138897621198000
2013-09-04 10:03 - 2010-05-16 18:19 - 00002147 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-09-01 16:19 - 2013-09-01 16:19 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635136491809920000
2013-08-30 10:09 - 2010-08-16 06:55 - 00002240 ____H C:\Users\Andreas\Documents\Default.rdp
2013-08-26 18:25 - 2013-08-26 18:25 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635131383440760000
2013-08-26 18:19 - 2010-04-22 20:51 - 00000000 ____D C:\Users\Andreas\AppData\Roaming\Adobe
2013-08-26 18:05 - 2010-04-25 10:56 - 00000000 ____D C:\ProgramData\Adobe
2013-08-25 18:40 - 2012-12-09 16:10 - 00001054 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk
2013-08-24 13:18 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-08-21 19:57 - 2011-02-04 16:18 - 00007680 _____ C:\Users\Andreas\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-08-19 11:57 - 2012-04-25 09:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-18 14:30 - 2013-08-18 14:30 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635124330283588000

Some content of TEMP:
====================
C:\Users\Andreas\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-11 17:15

==================== End Of Log ============================
--- --- ---

--- --- ---


Auch wenn ich das schon mal gesagt habe: Vielen Dank für Deine Mühen

Alt 17.09.2013, 16:09   #14
schrauber
/// the machine
/// TB-Ausbilder
 
System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar - Standard

System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 18.09.2013, 12:23   #15
flummy1978
 
System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar - Standard

System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar


Zitat:
Zitat von schrauber Beitrag anzeigen
Noch Probleme?
Wie ich schon im Posting davor sagte: Symptome sind weg, nur ob das System sauber ist, ist eine andere Sache

Eset:

Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=034b31c861e03d4ab3184b5b197ea195
# engine=15165
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-09-18 09:23:30
# local_time=2013-09-18 11:23:30 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 5974024 131126060 0 0
# scanned=719995
# found=2
# cleaned=0
# scan_time=63410
sh=A804A276D9352A76162B26D6E61F47257801F993 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.Agent.NPJ trojan" ac=I fn="C:\Dokumente und Einstellungen\Andreas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22\68045496-5a638ceb"
sh=A804A276D9352A76162B26D6E61F47257801F993 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.Agent.NPJ trojan" ac=I fn="C:\Users\Andreas\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22\68045496-5a638ceb"
SecCheck:

Code:
ATTFilter
  Results of screen317's Security Check version 0.99.73  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:`````````````` 
BitDefender Antivirus   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Ad-Aware 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 Java 7 Update 25  
 Adobe Flash Player 11.8.800.168  
 Adobe Reader 10.1.8 Adobe Reader out of Date!  
 Mozilla Firefox (23.0.1) 
 Google Chrome 29.0.1547.62  
 Google Chrome 29.0.1547.66  
````````Process Check: objlist.exe by Laurent````````  
 Ad-Aware AAWService.exe is disabled! 
 Ad-Aware AAWTray.exe is disabled! 
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbamgui.exe  
 Malwarebytes' Anti-Malware mbamscheduler.exe   
 BitDefender BitDefender 2011 vsserv.exe  
 BitDefender BitDefender 2011 bdagent.exe  
 BitDefender BitDefender 2011 pchooklaunch64.exe  
 BitDefender BitDefender 2011 Antispam32 pchooklaunch32.exe 
 BitDefender BitDefender 2011 updatesrv.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
FRST:


FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-09-2013 03
Ran by Andreas (administrator) on SERVER-WIN7 on 18-09-2013 13:12:53
Running from C:\Users\Andreas\Downloads
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(BitDefender S.R.L.) C:\Program Files\BitDefender\BitDefender 2011\vsserv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\sws\almsrv\almsrv64x.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(BitDefender S.R.L.) C:\Program Files\BitDefender\BitDefender 2011\bdagent.exe
(BitDefender S.R.L.) C:\Program Files\BitDefender\BitDefender 2011\pchooklaunch64.exe
(BitDefender S.R.L.) C:\Program Files\BitDefender\BitDefender 2011\Antispam32\pchooklaunch32.exe
(BUFFALO INC.) \\EXTHD\info\English\NasNavi2\Windows\nassvc.exe
(SIEMENS AG) C:\Program Files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\PNIOMGR.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
(Logitech Inc.) C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Raid\nvraidservice.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(SIEMENS AG) C:\Windows\SysWOW64\pniopcac.exe
(BitDefender S.R.L.) C:\Program Files\BitDefender\BitDefender 2011\updatesrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(BUFFALO INC.) C:\Program Files (x86)\BUFFALO\NASNAVI\NasNavi.exe
(BUFFALO INC.) C:\Program Files (x86)\BUFFALO\NASNAVI\nassche.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7epasrv64x.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\ehome\ehRecvr.exe
(Microsoft Corporation) C:\Windows\ehome\mcGlidHost.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Launch LgDeviceAgent] - C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe [415816 2010-02-18] (Logitech Inc.)
HKLM\...\Run: [Launch LCDMon] - C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe [2093128 2010-02-18] (Logitech Inc.)
HKLM\...\Run: [Launch LGDCore] - C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe [4271688 2010-02-18] (Logitech Inc.)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] - C:\Windows\KHALMNPR.EXE [130576 2009-06-17] (Logitech, Inc.)
HKLM\...\Run: [BitDefender Antiphishing Helper] - C:\Program Files\BitDefender\BitDefender 2011\ieshow.exe [109344 2011-06-02] (BitDefender S.R.L.)
HKLM\...\Run: [BDAgent] - C:\Program Files\BitDefender\BitDefender 2011\bdagent.exe [2026680 2011-07-11] (BitDefender S.R.L.)
HKLM\...\Run: [NVRaidService] - C:\Program Files\NVIDIA Corporation\Raid\nvraidservice.exe [291944 2010-04-09] (NVIDIA Corporation)
HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-09-27] (Apple Inc.)
HKLM-x32\...\Run: [BitDefender Antiphishing Helper] - C:\Program Files\BitDefender\BitDefender 2011\Antispam32\ieshow.exe [92352 2011-06-02] (BitDefender S.R.L.)
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)
HKU\UpdatusUser\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKU\UpdatusUser\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
Startup: C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BUFFALO NAS Navigator2.lnk
ShortcutTarget: BUFFALO NAS Navigator2.lnk -> C:\Program Files (x86)\BUFFALO\NASNAVI\NasNavi.exe (BUFFALO INC.)
Startup: C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NAS Scheduler.lnk
ShortcutTarget: NAS Scheduler.lnk -> C:\Program Files (x86)\BUFFALO\NASNAVI\nassche.exe (BUFFALO INC.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x309B1F7D97CECB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {CE6E18AF-205F-421B-8C80-E0C312E9D734} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=302398&p={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Bitdefender Toolbar - {381FFDE8-2394-4F90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2011\IEToolbar.dll (BitDefender S.R.L.)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM-x32 - Bitdefender Toolbar - {381FFDE8-2394-4F90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2011\Antispam32\IEToolbar.dll (BitDefender S.R.L.)
DPF: HKLM {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex64-2.2.5.7.cab
DPF: HKLM {6E718D87-6909-4FCE-92D4-EDCB2F725727} hxxp://navigram.com/engine/v1026/Navigram.cab
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM {E9B39AC7-B9FB-48CA-84A0-1659A05C0008} hxxp://www.wohnmoebel.de/priess/install/KPSA-home%20Priess.cab
DPF: HKLM-x32 {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{05A5E494-8E32-4D4E-851B-235A5CE9415A}: [NameServer]192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Andreas\AppData\Roaming\Mozilla\Firefox\Profiles\jugf7uli.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF HKLM\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\BitDefender\BitDefender 2011\bdtbext\
FF Extension: No Name - C:\Program Files\BitDefender\BitDefender 2011\bdtbext\
FF HKLM-x32\...\Firefox\Extensions: [FFToolbar@bitdefender.com] - C:\Program Files\BitDefender\BitDefender 2011\bdaphffext\
FF Extension: No Name - C:\Program Files\BitDefender\BitDefender 2011\bdaphffext\
FF HKLM-x32\...\Firefox\Extensions: [fmconverter@gmail.com] - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\
FF Extension: Freemake Video Converter Plugin - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\
FF HKLM-x32\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\BitDefender\BitDefender 2011\bdtbext\
FF Extension: No Name - C:\Program Files\BitDefender\BitDefender 2011\bdtbext\
FF StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Freemake Video Converter) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbolfgndggfhhpbnkgnpjkfhinclbigj\1.0.0_1
CHR Extension: (Skype Click to Call) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.10.0.9560_1
CHR Extension: (Chrome In-App Payments service) - C:\Users\Andreas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR HKLM-x32\...\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Chrome\Freemake.Plugin.Chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx

==================== Services (Whitelisted) =================

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [68096 2010-05-06] ()
R2 almservice; C:\Program Files\Common Files\Siemens\sws\almsrv\almsrv64x.exe [1532040 2011-06-19] (SIEMENS AG)
S3 FileZilla Server; C:\Program Files (x86)\FileZilla Server\FileZilla Server.exe [742912 2010-10-17] (FileZilla Project)
S3 Macromedia Licensing Service; C:\Program Files (x86)\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe [68096 2010-05-05] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 s7hspsvx; C:\Program Files (x86)\Siemens\Step7\s7bin\s7hspsvx.exe [61493 2011-05-30] (SIEMENS AG)
R2 s7oiehsx64; C:\Program Files\Common Files\Siemens\Automation\Simatic OAM\bin\s7oiehsx64.exe [139864 2011-06-22] (SIEMENS AG)
R2 S7TraceServiceX; C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceService64x.exe [229976 2011-06-22] (SIEMENS AG)
S3 Update Server; C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe [467248 2011-02-23] (BitDefender)
R2 Updatesrv; C:\Program Files\BitDefender\BitDefender 2011\updatesrv.exe [53224 2011-06-02] (BitDefender S.R.L.)
R2 VSSERV; C:\Program Files\BitDefender\BitDefender 2011\vsserv.exe [2660624 2011-07-11] (BitDefender S.R.L.)
S4 Hidfpfrud; 
R2 NasPmService; \\EXTHD\info\English\NasNavi2\Windows\nassvc.exe -Service_Execute -dcyc=60 -dto=3 -dluc=0 -dmin=1 -dmax=60 -dflc=0 -apc=0 -log=0 -pm=1 -pall=1 -phttp=0 -pbc=0 -ppro=0 -pcyc=0 -pmin=1 -pmax=60 -pflc=0 [x]

==================== Drivers (Whitelisted) ====================

S4 avc3; C:\Windows\System32\DRIVERS\avc3.sys [692816 2010-06-28] (BitDefender)
S4 avckf; C:\Windows\System32\DRIVERS\avckf.sys [1040976 2010-06-28] (BitDefender)
R3 BDFM; C:\Windows\System32\DRIVERS\bdfm.sys [162896 2010-05-13] (BitDefender S.R.L. Bucharest, ROMANIA)
R1 Bdfndisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [88144 2010-11-13] (BitDefender)
R0 bdfsfltr; C:\Windows\System32\DRIVERS\bdfsfltr.sys [431176 2011-04-01] (BitDefender)
R1 bdfwfpf; C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdfwfpf.sys [99408 2010-11-13] (BitDefender)
R3 dpmconv; C:\Windows\System32\DRIVERS\dpmconv.sys [259072 2011-04-19] (SIEMENS AG)
S3 GigasetGenericUSB_x64; C:\Windows\System32\DRIVERS\GigasetGenericUSB_x64.sys [54272 2009-02-20] (Siemens Home and Office Communication Devices GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R0 nvrd64; C:\Windows\System32\DRIVERS\nvrd64.sys [175720 2010-04-09] (NVIDIA Corporation)
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2010-08-16] ()
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2010-08-16] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2010-08-16] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2010-08-16] ()
R3 s7odpx2x64; C:\Windows\System32\DRIVERS\s7odpx2x64.sys [71168 2011-05-06] (SIEMENS AG)
R3 s7oppinx64; C:\Windows\System32\DRIVERS\s7oppinx64.sys [107008 2011-05-06] (SIEMENS AG)
R3 s7oserix64; C:\Windows\System32\Drivers\s7oserix64.sys [121344 2011-05-06] (SIEMENS AG)
R3 s7osmcax64; C:\Windows\System32\DRIVERS\s7osmcax64.sys [195584 2011-05-06] (SIEMENS AG)
R3 s7osobux64; C:\Windows\System32\DRIVERS\s7osobux64.sys [152576 2011-05-06] (SIEMENS AG)
R3 s7otmcd64x; C:\Windows\System32\Drivers\s7otmcd64x.sys [199680 2011-05-06] (SIEMENS AG)
R3 s7otranx64; C:\Windows\System32\DRIVERS\s7otranx64.sys [260096 2011-05-06] (SIEMENS AG)
R3 s7otsadx64; C:\Windows\System32\DRIVERS\s7otsadx64.sys [192000 2011-05-06] (SIEMENS AG)
R2 s7ousbu64x; C:\Windows\System32\DRIVERS\s7ousbu64x.sys [190464 2011-05-06] (SIEMENS AG)
R2 s7sn2srtx; C:\Windows\System32\DRIVERS\s7sn2srtx.sys [83032 2011-06-16] (SIEMENS AG)
R2 SNTIE; C:\Windows\System32\DRIVERS\sntie.sys [179288 2011-05-31] (SIEMENS AG)
R3 TTUSB2BDA_NTAMD64; C:\Windows\System32\DRIVERS\ttusb2bda_amd64.sys [743808 2012-05-24] (TechnoTrend Goerler GmbH)
R3 vsnl2ada; C:\Windows\System32\DRIVERS\vsnl2ada.sys [120832 2011-04-19] (SIEMENS AG)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S0 Lbd; system32\DRIVERS\Lbd.sys [x]
S3 MSI_MSIBIOS_010507; \??\C:\Program Files (x86)\MSI\Live Update 5\msibios64_100507.sys [x]
S3 NTIOLib_1_0_4; \??\C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-18 13:12 - 2013-09-18 13:12 - 00001286 _____ C:\Users\Andreas\Desktop\SECcheckup.txt
2013-09-18 13:06 - 2013-09-18 13:06 - 00891144 _____ C:\Users\Andreas\Downloads\SecurityCheck.exe
2013-09-17 17:44 - 2013-09-17 17:44 - 00000000 ____D C:\Program Files (x86)\ESET
2013-09-17 17:43 - 2013-09-17 17:43 - 02347384 _____ (ESET) C:\Users\Andreas\Downloads\esetsmartinstaller_enu.exe
2013-09-17 15:16 - 2013-09-17 15:16 - 01950524 _____ (Farbar) C:\Users\Andreas\Downloads\FRST64.exe
2013-09-17 15:02 - 2013-09-17 15:13 - 00000816 _____ C:\Users\Andreas\Desktop\JRT.txt
2013-09-17 13:10 - 2013-09-17 13:10 - 00000000 ____D C:\Windows\ERUNT
2013-09-17 13:06 - 2013-09-17 13:07 - 01029675 _____ (Thisisu) C:\Users\Andreas\Downloads\JRT.exe
2013-09-17 13:04 - 2013-09-17 13:04 - 00010222 _____ C:\Users\Andreas\Desktop\AdwCleaner[S0].txt
2013-09-17 12:57 - 2013-09-17 13:01 - 00000000 ____D C:\AdwCleaner
2013-09-17 12:57 - 2013-09-17 12:57 - 01039554 _____ C:\Users\Andreas\Downloads\adwcleaner.exe
2013-09-16 16:29 - 2013-09-16 16:29 - 00027176 _____ C:\ComboFix.txt
2013-09-16 15:54 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-16 15:54 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-16 15:54 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-16 15:54 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-16 15:54 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-16 15:54 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-16 15:54 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-16 15:54 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-16 15:50 - 2013-09-16 16:30 - 00000000 ____D C:\Qoobox
2013-09-16 15:50 - 2013-09-16 16:21 - 00000000 ____D C:\Windows\erdnt
2013-09-16 15:49 - 2013-09-16 15:49 - 05126233 ____R (Swearware) C:\Users\Andreas\Downloads\ComboFix.exe
2013-09-15 19:54 - 2012-09-20 05:11 - 00258848 _____ (GFI Software) C:\Windows\system32\Drivers\SbFw.sys
2013-09-15 19:54 - 2012-09-12 20:19 - 00120064 _____ (GFI Software) C:\Windows\system32\Drivers\SbFwIm.sys
2013-09-15 19:52 - 2013-09-15 19:52 - 10728088 _____ (ParetoLogic, Inc.) C:\Users\Andreas\Downloads\XoftSpy_AV_Setup.exe
2013-09-15 19:45 - 2013-09-15 19:46 - 05893760 _____ (ParetoLogic, Inc.) C:\Users\Andreas\Downloads\RegCureProSetup_bing.exe
2013-09-15 19:44 - 2013-09-15 19:45 - 00001205 _____ C:\Users\Andreas\Downloads\FixNCR.reg
2013-09-15 19:39 - 2013-09-15 19:39 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-15 19:39 - 2013-09-15 19:39 - 00000000 ____D C:\Users\Andreas\AppData\Roaming\Malwarebytes
2013-09-15 19:39 - 2013-09-15 19:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-15 19:39 - 2013-09-15 19:39 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-15 19:39 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-15 19:38 - 2013-09-15 19:38 - 00614816 _____ C:\Users\Andreas\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2013-09-15 14:42 - 2013-09-15 15:00 - 00013279 _____ C:\Users\Andreas\Desktop\Gmer.zip
2013-09-15 14:29 - 2013-09-15 14:09 - 00000476 _____ C:\Users\Andreas\Desktop\defogger_disable.txt
2013-09-15 14:27 - 2013-09-15 14:58 - 00254657 _____ C:\Users\Andreas\Desktop\Gmer.txt
2013-09-15 14:15 - 2013-09-15 14:15 - 00377856 _____ C:\Users\Andreas\Downloads\gmer_2.1.19163.exe
2013-09-15 14:14 - 2013-09-17 15:33 - 00050196 _____ C:\Users\Andreas\Desktop\FRST.txt
2013-09-15 14:14 - 2013-09-15 14:59 - 00037759 _____ C:\Users\Andreas\Desktop\Addition.txt
2013-09-15 14:12 - 2013-09-15 14:13 - 00038325 _____ C:\Users\Andreas\Downloads\Addition.txt
2013-09-15 14:10 - 2013-09-15 14:10 - 00000000 ____D C:\FRST
2013-09-15 14:09 - 2013-09-15 14:09 - 00000476 _____ C:\Users\Andreas\Downloads\defogger_disable.log
2013-09-15 14:09 - 2013-09-15 14:09 - 00000000 _____ C:\Users\Andreas\defogger_reenable
2013-09-15 14:08 - 2013-09-15 14:08 - 00050477 _____ C:\Users\Andreas\Downloads\Defogger.exe
2013-09-13 11:45 - 2013-09-13 11:45 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635146695188970000
2013-09-12 15:34 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-12 15:34 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-12 15:34 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-12 15:34 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-12 15:34 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-12 15:34 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-12 15:34 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-12 15:34 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-12 15:34 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-12 15:34 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-12 15:34 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-12 15:34 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-12 15:34 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-12 15:34 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-12 15:34 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-12 15:34 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml(45).dll
2013-09-12 15:34 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9(44).dll
2013-09-12 15:34 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-12 15:34 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-12 15:34 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-12 15:34 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-12 15:34 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-12 15:34 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-12 14:39 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 14:39 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 14:39 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-12 14:39 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-12 14:39 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-12 14:39 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-12 14:39 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-12 14:39 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 14:39 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-12 14:39 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 14:39 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-12 14:39 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-12 14:39 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 14:39 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-12 14:39 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-12 14:39 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-12 14:39 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32(49).dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0(40).dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0(42).dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0(41).dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 14:39 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-12 14:39 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-12 14:39 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16(47).exe
2013-09-12 14:39 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-12 14:39 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-12 14:39 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-12 14:39 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 14:39 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-12 14:39 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 14:39 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 14:39 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-12 14:39 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-06 19:56 - 2013-09-06 19:56 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635140942066082000
2013-09-04 13:02 - 2013-09-04 13:02 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635138965727498000
2013-09-04 13:00 - 2013-09-04 13:00 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635138964591628000
2013-09-04 12:55 - 2013-09-04 12:55 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635138961233728000
2013-09-04 12:15 - 2013-09-04 12:15 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635138937493438000
2013-09-04 11:09 - 2013-09-04 11:09 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635138897621198000
2013-09-01 16:19 - 2013-09-01 16:19 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635136491809920000
2013-08-26 18:25 - 2013-08-26 18:25 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635131383440760000

==================== One Month Modified Files and Folders =======

2013-09-18 13:12 - 2013-09-18 13:12 - 00001286 _____ C:\Users\Andreas\Desktop\SECcheckup.txt
2013-09-18 13:06 - 2013-09-18 13:06 - 00891144 _____ C:\Users\Andreas\Downloads\SecurityCheck.exe
2013-09-18 12:56 - 2012-03-28 10:50 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-18 12:55 - 2010-05-16 18:18 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-18 12:39 - 2010-04-22 22:39 - 00000000 ____D C:\Users\Andreas\AppData\Roaming\Skype
2013-09-17 20:55 - 2010-05-16 18:18 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-17 20:50 - 2010-04-25 10:56 - 00000000 ____D C:\ProgramData\Adobe
2013-09-17 20:50 - 2010-04-22 20:51 - 00000000 ____D C:\Users\Andreas\AppData\Roaming\Adobe
2013-09-17 17:44 - 2013-09-17 17:44 - 00000000 ____D C:\Program Files (x86)\ESET
2013-09-17 17:43 - 2013-09-17 17:43 - 02347384 _____ (ESET) C:\Users\Andreas\Downloads\esetsmartinstaller_enu.exe
2013-09-17 15:46 - 2009-07-14 06:45 - 00015184 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-17 15:46 - 2009-07-14 06:45 - 00015184 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-17 15:39 - 2010-04-22 18:09 - 00000000 ____D C:\ProgramData\NVIDIA
2013-09-17 15:39 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-17 15:39 - 2009-07-14 06:51 - 00156453 _____ C:\Windows\setupact.log
2013-09-17 15:37 - 2010-04-22 17:49 - 01895464 _____ C:\Windows\WindowsUpdate.log
2013-09-17 15:33 - 2013-09-15 14:14 - 00050196 _____ C:\Users\Andreas\Desktop\FRST.txt
2013-09-17 15:16 - 2013-09-17 15:16 - 01950524 _____ (Farbar) C:\Users\Andreas\Downloads\FRST64.exe
2013-09-17 15:13 - 2013-09-17 15:02 - 00000816 _____ C:\Users\Andreas\Desktop\JRT.txt
2013-09-17 13:10 - 2013-09-17 13:10 - 00000000 ____D C:\Windows\ERUNT
2013-09-17 13:07 - 2013-09-17 13:06 - 01029675 _____ (Thisisu) C:\Users\Andreas\Downloads\JRT.exe
2013-09-17 13:04 - 2013-09-17 13:04 - 00010222 _____ C:\Users\Andreas\Desktop\AdwCleaner[S0].txt
2013-09-17 13:01 - 2013-09-17 12:57 - 00000000 ____D C:\AdwCleaner
2013-09-17 12:57 - 2013-09-17 12:57 - 01039554 _____ C:\Users\Andreas\Downloads\adwcleaner.exe
2013-09-17 12:50 - 2010-04-22 18:20 - 02258372 _____ C:\Windows\PFRO.log
2013-09-16 16:30 - 2013-09-16 15:50 - 00000000 ____D C:\Qoobox
2013-09-16 16:30 - 2010-04-22 20:37 - 00000000 ____D C:\Users\Andreas\AppData\Local\Apps\2.0
2013-09-16 16:30 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-09-16 16:29 - 2013-09-16 16:29 - 00027176 _____ C:\ComboFix.txt
2013-09-16 16:21 - 2013-09-16 15:50 - 00000000 ____D C:\Windows\erdnt
2013-09-16 16:20 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-09-16 15:49 - 2013-09-16 15:49 - 05126233 ____R (Swearware) C:\Users\Andreas\Downloads\ComboFix.exe
2013-09-16 13:39 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-09-16 12:50 - 2009-07-14 19:58 - 00750600 _____ C:\Windows\system32\perfh007.dat
2013-09-16 12:50 - 2009-07-14 19:58 - 00166170 _____ C:\Windows\system32\perfc007.dat
2013-09-16 12:50 - 2009-07-14 07:13 - 01746140 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-16 12:01 - 2011-05-01 13:05 - 00000000 ____D C:\Users\Andreas\Downloads\WinRAR.4.00.x86.Incl.Keygen-FFF
2013-09-15 19:52 - 2013-09-15 19:52 - 10728088 _____ (ParetoLogic, Inc.) C:\Users\Andreas\Downloads\XoftSpy_AV_Setup.exe
2013-09-15 19:46 - 2013-09-15 19:45 - 05893760 _____ (ParetoLogic, Inc.) C:\Users\Andreas\Downloads\RegCureProSetup_bing.exe
2013-09-15 19:45 - 2013-09-15 19:44 - 00001205 _____ C:\Users\Andreas\Downloads\FixNCR.reg
2013-09-15 19:39 - 2013-09-15 19:39 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-15 19:39 - 2013-09-15 19:39 - 00000000 ____D C:\Users\Andreas\AppData\Roaming\Malwarebytes
2013-09-15 19:39 - 2013-09-15 19:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-15 19:39 - 2013-09-15 19:39 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-15 19:38 - 2013-09-15 19:38 - 00614816 _____ C:\Users\Andreas\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2013-09-15 15:31 - 2012-11-17 21:16 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-09-15 15:00 - 2013-09-15 14:42 - 00013279 _____ C:\Users\Andreas\Desktop\Gmer.zip
2013-09-15 14:59 - 2013-09-15 14:14 - 00037759 _____ C:\Users\Andreas\Desktop\Addition.txt
2013-09-15 14:58 - 2013-09-15 14:27 - 00254657 _____ C:\Users\Andreas\Desktop\Gmer.txt
2013-09-15 14:39 - 2011-11-06 14:36 - 00000000 ____D C:\Windows\system32\Macromed
2013-09-15 14:39 - 2010-10-05 14:03 - 00000000 ____D C:\Program Files (x86)\PKR
2013-09-15 14:39 - 2010-04-22 17:56 - 00000000 ___RD C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-15 14:39 - 2010-04-22 17:56 - 00000000 ___RD C:\Users\Andreas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-15 14:39 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-15 14:39 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-09-15 14:39 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\AppCompat
2013-09-15 14:39 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-09-15 14:37 - 2013-05-29 21:15 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-09-15 14:15 - 2013-09-15 14:15 - 00377856 _____ C:\Users\Andreas\Downloads\gmer_2.1.19163.exe
2013-09-15 14:13 - 2013-09-15 14:12 - 00038325 _____ C:\Users\Andreas\Downloads\Addition.txt
2013-09-15 14:10 - 2013-09-15 14:10 - 00000000 ____D C:\FRST
2013-09-15 14:09 - 2013-09-15 14:29 - 00000476 _____ C:\Users\Andreas\Desktop\defogger_disable.txt
2013-09-15 14:09 - 2013-09-15 14:09 - 00000476 _____ C:\Users\Andreas\Downloads\defogger_disable.log
2013-09-15 14:09 - 2013-09-15 14:09 - 00000000 _____ C:\Users\Andreas\defogger_reenable
2013-09-15 14:09 - 2010-04-22 17:56 - 00000000 ____D C:\Users\Andreas
2013-09-15 14:08 - 2013-09-15 14:08 - 00050477 _____ C:\Users\Andreas\Downloads\Defogger.exe
2013-09-15 10:07 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA(50).DAT
2013-09-14 10:56 - 2012-03-28 10:50 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-14 10:56 - 2012-03-28 10:50 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-14 10:56 - 2011-05-27 21:47 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-13 11:45 - 2013-09-13 11:45 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635146695188970000
2013-09-13 09:52 - 2010-04-22 18:44 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-12 16:07 - 2010-04-22 19:31 - 00000376 _____ C:\Users\Andreas\AppData\Roamingprivacy.xml
2013-09-12 16:06 - 2009-07-14 06:45 - 00311192 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-12 15:34 - 2013-07-21 11:03 - 00000000 ____D C:\Windows\system32\MRT
2013-09-12 15:29 - 2010-04-22 18:42 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-06 19:56 - 2013-09-06 19:56 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635140942066082000
2013-09-05 11:46 - 2012-03-29 18:55 - 00000000 ____D C:\Users\Andreas\AppData\Roaming\vlc
2013-09-04 13:02 - 2013-09-04 13:02 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635138965727498000
2013-09-04 13:00 - 2013-09-04 13:00 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635138964591628000
2013-09-04 12:55 - 2013-09-04 12:55 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635138961233728000
2013-09-04 12:15 - 2013-09-04 12:15 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635138937493438000
2013-09-04 11:09 - 2013-09-04 11:09 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635138897621198000
2013-09-04 10:03 - 2010-05-16 18:19 - 00002147 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-09-01 16:19 - 2013-09-01 16:19 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635136491809920000
2013-08-30 10:09 - 2010-08-16 06:55 - 00002240 ____H C:\Users\Andreas\Documents\Default.rdp
2013-08-26 18:25 - 2013-08-26 18:25 - 00000000 ___HD C:\Users\Andreas\Documents\Freemake_do_not_remove_this_folder635131383440760000
2013-08-25 18:40 - 2012-12-09 16:10 - 00001054 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk
2013-08-24 13:18 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-08-21 19:57 - 2011-02-04 16:18 - 00007680 _____ C:\Users\Andreas\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-08-19 11:57 - 2012-04-25 09:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

Some content of TEMP:
====================
C:\Users\Andreas\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-11 17:15

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---


Viele Grüße
Andreas

p.s. Kann ich gar nicht oft genug erwähnen:

Antwort
Seite 1 von 2 1 2

Themen zu System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar
aktiviere, anhang, befallen, befinden, bitdefender, browser, defender, dns, echtzeitschutz, geändert, google, griff, hallo zusammen, hijack, jahre, links, problemchen, schutz, seite, seiten, system, versucht, werbung, win, zusammen


« Win 7: "Ein kritischer Fehler ist aufgetreten. Windows wird in einer Minute neu gestartet" | Windows 7, HEUR:Trojan.Win32.Generic »


Ähnliche Themen: System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar


  1. Avira Browser Schutz meldet Fund: HTML/Infected.WebPage.Gen2
    Plagegeister aller Art und deren Bekämpfung - 10.05.2015 (11)
  2. Schutz vor Freak Attack: Diese Browser sind betroffen
    Nachrichten - 05.03.2015 (0)
  3. Welchen Schutz für den Browser wählen?
    Antiviren-, Firewall- und andere Schutzprogramme - 28.01.2015 (4)
  4. Alle installierten Browser mit Werbebannern und Popups befallen - lassen sich nicht entfernen
    Log-Analyse und Auswertung - 22.10.2014 (14)
  5. Windows 7/Avira Firewall nicht aktivierbar, Programme funktionieren nicht. Trojanerbefall?
    Log-Analyse und Auswertung - 23.09.2014 (14)
  6. HTML/Crypted.Gen durch Avira Antivir Browser Schutz gefunden
    Plagegeister aller Art und deren Bekämpfung - 02.06.2014 (7)
  7. Selbständiges deaktivieren von Avira Echtzeitscanner, Firewall, Browser-Schutz und E-Mail-Schutz
    Plagegeister aller Art und deren Bekämpfung - 28.01.2014 (10)
  8. Computer verlangsamt ("zu wenig Arbeitsspeicher"), AV Browser-Schutz lässt sich nicht aktivieren
    Log-Analyse und Auswertung - 16.11.2013 (11)
  9. Avira Antivir Antivirus Browser Schutz nicht installiert
    Antiviren-, Firewall- und andere Schutzprogramme - 22.10.2011 (16)
  10. Sicherheitscenter nicht aktivierbar / Google leitet um / AVIRA nicht updatebar / Rechner langsam
    Log-Analyse und Auswertung - 19.07.2011 (43)
  11. Firewall nicht mehr aktivierbar
    Antiviren-, Firewall- und andere Schutzprogramme - 27.01.2011 (26)
  12. Winxp-Firewall nicht aktivierbar
    Antiviren-, Firewall- und andere Schutzprogramme - 15.12.2009 (1)
  13. Computer befallen? (inkl. Hijack-Log)
    Plagegeister aller Art und deren Bekämpfung - 25.11.2009 (6)
  14. Browser startet verdächtige Websites, Schutz-Programme können nicht ausgeführt werden
    Plagegeister aller Art und deren Bekämpfung - 16.11.2009 (6)
  15. Mac-Browser Camino mit Phishing-Schutz
    Nachrichten - 18.08.2009 (0)
  16. System befallen oder nicht?
    Log-Analyse und Auswertung - 05.06.2008 (5)
  17. Browser Hijack - ich krieg ihn nicht weg
    Log-Analyse und Auswertung - 11.08.2004 (9)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar - Hallo zusammen, jetzt hat es mich nach einigen Jahren doch erwischt. Die kleineren Problemchen konnte ich bisher lösen. Bei dem ClickCompare bin ich irgendwie doch überfordert. Problem: - Teilweise unterstrichene - System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar...
Archiv
Du betrachtest: System mit ClickCompare Browser Hijack befallen + AV-Schutz nicht aktivierbar auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131