| |
| |||||||
Log-Analyse und Auswertung: HTML:Bankfraud-BYL durch Avast gefundenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
23.10.2013, 12:35
| #1 |
| |  HTML:Bankfraud-BYL durch Avast gefunden Als ich eben mit meinem Internet Explorer 11 auf meine GMails zugreifen wollte (Ich benutze eigentlich Chrome, verwende aber für ein zweites GMail-Konto den IE um parallel die Mails abzurufen), meldete mir Avast einen Trojaner gefunden zu haben. Und zwar HTML:Bankfraud-BYL. defogger: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:39 on 23/10/2013 (Garcia)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-10-23 13:02:41
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST500DM002-1BD142 rev.KC45 465,76GB
Running: ue0dlzgo.exe; Driver: C:\Users\Garcia\AppData\Local\Temp\fwldapow.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\wininit.exe[576] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\services.exe[636] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\winlogon.exe[732] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[816] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\atiesrxx.exe[1004] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[284] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[392] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[520] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[628] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1216] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\System32\spoolsv.exe[1640] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1672] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1804] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007710a30a 1 byte [62]
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1848] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007710a30a 1 byte [62]
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 00000001001f075c
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001001f03a4
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 00000001001f0b14
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 00000001001f0ecc
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 00000001001f163c
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 00000001001f1284
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001001f19f4
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Program Files\Bonjour\mDNSResponder.exe[2044] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 000000010021075c
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001002103a4
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 0000000100210b14
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 0000000100210ecc
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 000000010021163c
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 0000000100211284
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001002119f4
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2056] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\system32\svchost.exe[2536] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Windows\System32\WUDFHost.exe[2608] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\System32\WUDFHost.exe[2608] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\System32\WUDFHost.exe[2608] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\System32\WUDFHost.exe[2608] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\System32\WUDFHost.exe[2608] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\System32\WUDFHost.exe[2608] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\System32\WUDFHost.exe[2608] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\System32\WUDFHost.exe[2608] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 00000001003a075c
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001003a03a4
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 00000001003a0b14
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 00000001003a0ecc
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 00000001003a163c
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 00000001003a1284
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001003a19f4
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\system32\SearchIndexer.exe[2676] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2744] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2744] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2744] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2744] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2744] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2744] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2744] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2744] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 000000010042075c
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001004203a4
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 0000000100420b14
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 0000000100420ecc
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 000000010042163c
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 0000000100421284
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001004219f4
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\System32\svchost.exe[1176] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2476] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 00000001003a075c
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001003a03a4
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 00000001003a0b14
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 00000001003a0ecc
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 00000001003a163c
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 00000001003a1284
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001003a19f4
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\system32\svchost.exe[2656] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 000000010051075c
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001005103a4
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 0000000100510b14
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 0000000100510ecc
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 000000010051163c
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 0000000100511284
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001005119f4
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\system32\taskhost.exe[2356] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 00000001001f075c
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001001f03a4
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 00000001001f0b14
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 00000001001f0ecc
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 00000001001f163c
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 00000001001f1284
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001001f19f4
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\system32\Dwm.exe[1684] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 000000010033075c
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001003303a4
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 0000000100330b14
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 0000000100330ecc
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 000000010033163c
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 0000000100331284
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001003319f4
.text C:\Windows\Explorer.EXE[2280] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\Explorer.EXE[2280] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 00000001002d075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001002d03a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 00000001002d0b14
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 00000001002d0ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 00000001002d163c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 00000001002d1284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001002d19f4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2932] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 00000000776afaa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 00000000776afb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 00000000776afc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 00000000776b0018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000776b1900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000776cc45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000776d1217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\syswow64\KERNEL32.dll!SetUnhandledExceptionFilter 00000000770e87b1 5 bytes [33, C0, C2, 04, 00]
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007710a30a 1 byte [62]
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075b35181 5 bytes JMP 0000000100251014
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075b35254 5 bytes JMP 0000000100250804
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 0000000075b353d5 5 bytes JMP 0000000100250a08
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 0000000075b354c2 5 bytes JMP 0000000100250c0c
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 0000000075b355e2 5 bytes JMP 0000000100250e10
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 0000000075b3567c 5 bytes JMP 00000001002501f8
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 0000000075b3589f 5 bytes JMP 00000001002503fc
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075b35a22 5 bytes JMP 0000000100250600
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\syswow64\USER32.dll!SetWinEventHook 00000000762aee09 5 bytes JMP 00000001002601f8
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 00000000762b3982 5 bytes JMP 00000001002603fc
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 00000000762b7603 5 bytes JMP 0000000100260804
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 00000000762b835c 5 bytes JMP 0000000100260600
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 00000000762cf52b 5 bytes JMP 0000000100260a08
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000756d1465 2 bytes [6D, 75]
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000756d14bb 2 bytes [6D, 75]
.text ... * 2
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 00000000776afaa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 00000000776afb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 00000000776afc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 00000000776b0018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000776b1900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000776cc45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000776d1217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007710a30a 1 byte [62]
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\syswow64\USER32.dll!SetWinEventHook 00000000762aee09 5 bytes JMP 00000001001d01f8
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 00000000762b3982 5 bytes JMP 00000001001d03fc
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 00000000762b7603 5 bytes JMP 00000001001d0804
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 00000000762b835c 5 bytes JMP 00000001001d0600
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 00000000762cf52b 5 bytes JMP 00000001001d0a08
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075b35181 5 bytes JMP 00000001001e1014
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075b35254 5 bytes JMP 00000001001e0804
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 0000000075b353d5 5 bytes JMP 00000001001e0a08
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 0000000075b354c2 5 bytes JMP 00000001001e0c0c
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 0000000075b355e2 5 bytes JMP 00000001001e0e10
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 0000000075b3567c 5 bytes JMP 00000001001e01f8
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 0000000075b3589f 5 bytes JMP 00000001001e03fc
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe[1692] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075b35a22 5 bytes JMP 00000001001e0600
.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[3192] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007710a30a 1 byte [62]
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 00000000776afaa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 00000000776afb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 00000000776afc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 00000000776b0018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000776b1900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000776cc45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000776d1217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007710a30a 1 byte [62]
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075b35181 5 bytes JMP 0000000100101014
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075b35254 5 bytes JMP 0000000100100804
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 0000000075b353d5 5 bytes JMP 0000000100100a08
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 0000000075b354c2 5 bytes JMP 0000000100100c0c
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 0000000075b355e2 5 bytes JMP 0000000100100e10
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 0000000075b3567c 5 bytes JMP 00000001001001f8
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 0000000075b3589f 5 bytes JMP 00000001001003fc
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075b35a22 5 bytes JMP 0000000100100600
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\syswow64\USER32.dll!SetWinEventHook 00000000762aee09 5 bytes JMP 00000001001101f8
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 00000000762b3982 5 bytes JMP 00000001001103fc
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 00000000762b7603 5 bytes JMP 0000000100110804
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 00000000762b835c 5 bytes JMP 0000000100110600
.text C:\Program Files (x86)\iTunes\iTunesHelper.exe[3248] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 00000000762cf52b 5 bytes JMP 0000000100110a08
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 00000000776afaa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 00000000776afb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 00000000776afc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 00000000776b0018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 00000000776b1900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 00000000776cc45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 00000000776d1217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 000000007710a30a 1 byte [62]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075b35181 5 bytes JMP 0000000100251014
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075b35254 5 bytes JMP 0000000100250804
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 0000000075b353d5 5 bytes JMP 0000000100250a08
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 0000000075b354c2 5 bytes JMP 0000000100250c0c
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 0000000075b355e2 5 bytes JMP 0000000100250e10
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 0000000075b3567c 5 bytes JMP 00000001002501f8
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 0000000075b3589f 5 bytes JMP 00000001002503fc
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075b35a22 5 bytes JMP 0000000100250600
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\syswow64\USER32.dll!SetWinEventHook 00000000762aee09 5 bytes JMP 00000001002601f8
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 00000000762b3982 5 bytes JMP 00000001002603fc
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 00000000762b7603 5 bytes JMP 0000000100260804
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 00000000762b835c 5 bytes JMP 0000000100260600
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3388] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 00000000762cf52b 5 bytes JMP 0000000100260a08
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 000000010036075c
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001003603a4
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 0000000100360b14
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 0000000100360ecc
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 000000010036163c
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 0000000100361284
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001003619f4
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3420] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 000000010045075c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001004503a4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 0000000100450b14
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 0000000100450ecc
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 000000010045163c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 0000000100451284
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3428] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001004519f4
.text C:\Windows\System32\svchost.exe[4080] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\System32\svchost.exe[4080] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\System32\svchost.exe[4080] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\System32\svchost.exe[4080] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\System32\svchost.exe[4080] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\System32\svchost.exe[4080] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\System32\svchost.exe[4080] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\System32\svchost.exe[4080] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 00000001002c075c
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001002c03a4
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 00000001002c0b14
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 00000001002c0ecc
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 00000001002c163c
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 00000001002c1284
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001002c19f4
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Program Files\iPod\bin\iPodService.exe[1416] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 000000010015075c
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001001503a4
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 0000000100150b14
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 0000000100150ecc
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 000000010015163c
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 0000000100151284
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001001519f4
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\system32\wuauclt.exe[2988] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3808] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 000000010040075c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3808] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001004003a4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3808] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 0000000100400b14
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3808] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 0000000100400ecc
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3808] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 000000010040163c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3808] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 0000000100401284
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe[3808] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001004019f4
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 000000010019075c
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001001903a4
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 0000000100190b14
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 0000000100190ecc
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 000000010019163c
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 0000000100191284
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001001919f4
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\system32\svchost.exe[5856] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 00000000774d3ae0 5 bytes JMP 000000010033075c
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 00000000774d7a90 5 bytes JMP 00000001003303a4
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077501490 5 bytes JMP 0000000100330b14
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000775014f0 5 bytes JMP 0000000100330ecc
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000775015d0 5 bytes JMP 000000010033163c
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077501810 5 bytes JMP 0000000100331284
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077502840 5 bytes JMP 00000001003319f4
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefe566e00 5 bytes JMP 000007ff7e581dac
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefe566f2c 5 bytes JMP 000007ff7e580ecc
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefe567220 5 bytes JMP 000007ff7e581284
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefe56739c 5 bytes JMP 000007ff7e58163c
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefe567538 5 bytes JMP 000007ff7e5819f4
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefe5675e8 5 bytes JMP 000007ff7e5803a4
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefe56790c 5 bytes JMP 000007ff7e58075c
.text C:\Windows\system32\NOTEPAD.EXE[3308] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefe567ab4 5 bytes JMP 000007ff7e580b14
.text C:\Windows\system32\AUDIODG.EXE[4260] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189 00000000772eeecd 1 byte [62]
.text C:\Users\Garcia\Downloads\Chrome Downloads\ue0dlzgo.exe[5820] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007710a30a 1 byte [62]
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [1176:2636] 000007fef6bd9688
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Tag 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@DisplayName aswRvrt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Description avast! Revert
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@BootCounter 170
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@TickCounter 2883459
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Tag 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@BehavShield 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@NoWelcomeScreen 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DisplayName avast! Network Shield Support
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Description avast! Network Shield TDI driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Tag 9
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@DisplayName aswVmm
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Type 32
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Description Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Tag 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@DisplayName aswRvrt
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Description avast! Revert
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@BootCounter 170
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@TickCounter 2883459
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Tag 2
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@BehavShield 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@NoWelcomeScreen 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DisplayName avast! Network Shield Support
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Description avast! Network Shield TDI driver
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Tag 9
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@DisplayName aswVmm
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Type 32
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Description Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.
---- EOF - GMER 2.1 ----
Wäre super wenn mir auch jemand erläutern könnte was genau ich mir da eingefangen habe. Laut meiner kleinen Recherchen habe ich, oder jemand in meinem Netzwerk, mir das ganze über Mails eingefangen. Ich bekomme schon länger eine Menge Spam an meine eMail-Adresse. Sollte ich mich von dem Konto verabschieden? |
| Themen zu HTML:Bankfraud-BYL durch Avast gefunden |
| .dll, adobe, antivirus, avast, bankfraud-byl, bonjour, explorer, hook, internet, internet explorer, internet explorer 11, netzwerk, ntdll.dll, programm, realtek, registry, rojaner gefunden, scan, security, services.exe, software, spam, super, svchost.exe, system, taskhost.exe, temp, trojaner, winlogon.exe, wmp, wuauclt.exe |
Baum-Darstellung