| |
| |||||||
Log-Analyse und Auswertung: Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle??Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
29.01.2014, 14:14
| #1 |
 |  Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Liebe Helfer, bei der versuchten Reparatur meines Systems habe ich nach ersten Fortschritten naiverweise den PCSmartFixer heruntergeladen  und einen Scan durchgeführt. Nach kurzer Recherche sofort das Programm beendet und mit Spybot S&D das System bereinigen lassen. Soweit zur Vorgeschichte..FRST gibt folgende Fehlermeldungen aus: Error saving files: C:\FRST\Hives\BCD [.. weiter mit HIVES\system, software, default, security, sam, Users\00000001\NTuser.dat, Users\00000002\Usrclass.dat] Continue with the next file? RegCreateKeyEx: 5 Zugriff verweigert Ja, ich habe die 64-bit-Version heruntergeladen  Beim zweiten Klick auf Scan geht der Scan dann los (..?!?) und funktioniert ab da immer. Mein System: Win 7 64 bit, Avast free Virenschutz - findet regelmäßig nichts, außer den Bedrohungen, die sofort geblockt werden. Logs gibt es noch von Spybot, wegen Unterbrechungen sind es mehrere Checks und Fixes, ein paar sind möglicherweise zu lang für hier.. FRST.txt hat 11 Seiten, Gmer.txt ist nicht viel kleiner .. doch lieber als Anhang posten?) Was passiert eigentlich, wenn man im Defogger nicht re-enabled? Gruß und Dank im Voraus Jo07 Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 09:33 on 29/01/2014 (Admin)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
|
|
29.01.2014, 14:53
| #2 | |
| /// the machine /// TB-Ausbilder    |  Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? hi,
__________________Zitat:
Jetzt die Logs bitte posten, in Codetags, ruhig mehrere Antworten benutzen und die Logs aufteilen.
__________________ |
|
29.01.2014, 15:16
| #3 |
| | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Hallo Schrauber,
__________________in Ordnung, dann erstmal die größte, Gmer Teil1 (2 und 3 folgen) Code:
ATTFilter GMER 2.1.19355 - hxxp://www.gmer.net
Rootkit scan 2014-01-29 13:17:28
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD16 rev.11.0 149,05GB
Running: gmer.exe; Driver: C:\Users\Admin\AppData\Local\Temp\pwdirfow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800033f8000 63 bytes [00, 00, 15, 02, 46, 69, 6C, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 592 fffff800033f8040 1 byte [01]
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 000000014a280460
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 000000014a280450
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 000000014a280370
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 000000014a280470
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 000000014a2803e0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 000000014a280320
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 000000014a2803b0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 000000014a280390
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 000000014a2802e0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 000000014a2802d0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 000000014a280310
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 000000014a2803c0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 000000014a2803f0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 000000014a280230
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 000000014a280480
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 000000014a2803a0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 000000014a2802f0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 000000014a280350
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 000000014a280290
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 000000014a2802b0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 000000014a2803d0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 000000014a280330
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 000000014a280410
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 000000014a280240
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 000000014a2801e0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 000000014a280250
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 000000014a280490
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 000000014a2804a0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 000000014a280300
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 000000014a280360
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 000000014a2802a0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 000000014a2802c0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 000000014a280380
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 000000014a280340
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 000000014a280440
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 000000014a280260
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 000000014a280270
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 000000014a280400
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 000000014a2801f0
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 000000014a280210
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 000000014a280200
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 000000014a280420
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 000000014a280430
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 000000014a280220
.text C:\Windows\system32\csrss.exe[452] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 000000014a280280
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 000000014a280460
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 000000014a280450
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 000000014a280370
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 000000014a280470
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 000000014a2803e0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 000000014a280320
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 000000014a2803b0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 000000014a280390
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 000000014a2802e0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 000000014a2802d0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 000000014a280310
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 000000014a2803c0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 000000014a2803f0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 000000014a280230
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 000000014a280480
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 000000014a2803a0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 000000014a2802f0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 000000014a280350
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 000000014a280290
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 000000014a2802b0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 000000014a2803d0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 000000014a280330
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 000000014a280410
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 000000014a280240
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 000000014a2801e0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 000000014a280250
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 000000014a280490
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 000000014a2804a0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 000000014a280300
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 000000014a280360
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 000000014a2802a0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 000000014a2802c0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 000000014a280380
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 000000014a280340
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 000000014a280440
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 000000014a280260
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 000000014a280270
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 000000014a280400
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 000000014a2801f0
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 000000014a280210
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 000000014a280200
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 000000014a280420
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 000000014a280430
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 000000014a280220
.text C:\Windows\system32\csrss.exe[516] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 000000014a280280
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\services.exe[608] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\services.exe[608] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\lsass.exe[624] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\lsm.exe[632] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\svchost.exe[748] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\svchost.exe[748] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000100070460
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000100070450
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000100070370
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000100070470
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000001000703e0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000100070320
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000001000703b0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000100070390
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000001000702e0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000001000702d0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000100070310
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000001000703c0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000001000703f0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000100070230
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000100070480
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000001000703a0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000001000702f0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000100070350
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000100070290
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000001000702b0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000001000703d0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000100070330
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000100070410
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000100070240
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000001000701e0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000100070250
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000100070490
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000001000704a0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000100070300
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000100070360
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000001000702a0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000001000702c0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000100070380
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000100070340
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000100070440
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000100070260
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000100070270
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000100070400
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000001000701f0
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000100070210
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000100070200
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000100070420
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000100070430
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000100070220
.text C:\Windows\system32\svchost.exe[832] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000100070280
.text C:\Windows\system32\svchost.exe[832] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000100070460
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000100070450
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000100070370
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000100070470
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000001000703e0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000100070320
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000001000703b0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000100070390
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000001000702e0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000001000702d0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000100070310
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000001000703c0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000001000703f0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000100070230
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000100070480
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000001000703a0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000001000702f0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000100070350
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000100070290
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000001000702b0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000001000703d0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000100070330
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000100070410
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000100070240
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000001000701e0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000100070250
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000100070490
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000001000704a0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000100070300
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000100070360
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000001000702a0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000001000702c0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000100070380
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000100070340
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000100070440
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000100070260
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000100070270
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000100070400
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000001000701f0
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000100070210
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000100070200
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000100070420
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000100070430
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000100070220
.text C:\Windows\System32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000100070280
.text C:\Windows\System32\svchost.exe[984] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\System32\svchost.exe[352] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\System32\svchost.exe[352] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000100070460
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000100070450
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000100070370
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000100070470
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000001000703e0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000100070320
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000001000703b0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000100070390
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000001000702e0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000001000702d0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000100070310
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000001000703c0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000001000703f0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000100070230
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000100070480
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000001000703a0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000001000702f0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000100070350
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000100070290
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000001000702b0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000001000703d0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000100070330
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000100070410
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000100070240
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000001000701e0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000100070250
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000100070490
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000001000704a0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000100070300
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000100070360
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000001000702a0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000001000702c0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000100070380
|
|
29.01.2014, 15:24
| #4 |
| | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Gmer Teil2 [CODE] .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000100070340 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000100070440 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000100070260 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000100070270 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000100070400 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000001000701f0 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000100070210 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000100070200 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000100070420 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000100070430 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000100070220 .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000100070280 .text C:\Windows\system32\svchost.exe[472] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220 .text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280 .text C:\Windows\system32\svchost.exe[372] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280 .text C:\Windows\system32\svchost.exe[1192] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280 .text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000100070460 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000100070450 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000100070370 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000100070470 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000001000703e0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000100070320 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000001000703b0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000100070390 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000001000702e0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000001000702d0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000100070310 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000001000703c0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000001000703f0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000100070230 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000100070480 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000001000703a0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000001000702f0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000100070350 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000100070290 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000001000702b0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000001000703d0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000100070330 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000100070410 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000100070240 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000001000701e0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000100070250 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000100070490 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000001000704a0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000100070300 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000100070360 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000001000702a0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000001000702c0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000100070380 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000100070340 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000100070440 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000100070260 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000100070270 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000100070400 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000001000701f0 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000100070210 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000100070200 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000100070420 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000100070430 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000100070220 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000100070280 .text C:\Windows\system32\svchost.exe[1400] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280 .text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text C:\Program Files (x86)\Acer\Registration\GregHSRW.exe[1720] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62] .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280 .text C:\Windows\system32\taskhost.exe[1872] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280 .text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220 .text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280 .text C:\Windows\Explorer.EXE[2380] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000100070460 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000100070450 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000100070370 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000100070470 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000001000703e0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000100070320 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000001000703b0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000100070390 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000001000702e0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000001000702d0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000100070310 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000001000703c0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000001000703f0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000100070230 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000100070480 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000001000703a0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000001000702f0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000100070350 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000100070290 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000001000702b0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000001000703d0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000100070330 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000100070410 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000100070240 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000001000701e0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000100070250 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000100070490 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000001000704a0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000100070300 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000100070360 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000001000702a0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000001000702c0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000100070380 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000100070340 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000100070440 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000100070260 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000100070270 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000100070400 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000001000701f0 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000100070210 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000100070200 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000100070420 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000100070430 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000100070220 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000100070280 .text C:\Windows\System32\svchost.exe[2540] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe[2576] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62] .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280 .text C:\Windows\system32\svchost.exe[2940] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62] .text C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe[3792] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62] .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000100070460 .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000100070450 .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000100070370 .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000100070470 .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000001000703e0 .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000100070320 |
|
29.01.2014, 15:31
| #5 |
| | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Nochmal Teil 2 mit vollständigen Code-Tags  Code:
ATTFilter .text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000100070340
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000100070440
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000100070260
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000100070270
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000100070400
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000001000701f0
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000100070210
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000100070200
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000100070420
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000100070430
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000100070220
.text C:\Windows\system32\svchost.exe[472] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000100070280
.text C:\Windows\system32\svchost.exe[472] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\svchost.exe[372] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\svchost.exe[372] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\svchost.exe[1192] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\System32\spoolsv.exe[1364] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000100070460
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000100070450
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000100070370
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000100070470
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000001000703e0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000100070320
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000001000703b0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000100070390
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000001000702e0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000001000702d0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000100070310
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000001000703c0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000001000703f0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000100070230
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000100070480
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000001000703a0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000001000702f0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000100070350
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000100070290
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000001000702b0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000001000703d0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000100070330
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000100070410
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000100070240
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000001000701e0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000100070250
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000100070490
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000001000704a0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000100070300
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000100070360
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000001000702a0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000001000702c0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000100070380
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000100070340
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000100070440
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000100070260
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000100070270
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000100070400
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000001000701f0
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000100070210
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000100070200
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000100070420
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000100070430
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000100070220
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000100070280
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Program Files\Acer\Empowering Technology\Service\ETService.exe[1680] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files (x86)\Acer\Registration\GregHSRW.exe[1720] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\taskhost.exe[1872] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe[2164] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\Explorer.EXE[2380] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\Explorer.EXE[2380] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000100070460
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000100070450
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000100070370
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000100070470
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000001000703e0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000100070320
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000001000703b0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000100070390
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000001000702e0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000001000702d0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000100070310
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000001000703c0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000001000703f0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000100070230
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000100070480
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000001000703a0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000001000702f0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000100070350
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000100070290
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000001000702b0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000001000703d0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000100070330
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000100070410
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000100070240
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000001000701e0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000100070250
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000100070490
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000001000704a0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000100070300
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000100070360
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000001000702a0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000001000702c0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000100070380
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000100070340
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000100070440
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000100070260
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000100070270
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000100070400
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000001000701f0
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000100070210
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000100070200
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000100070420
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000100070430
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000100070220
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000100070280
.text C:\Windows\System32\svchost.exe[2540] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe[2576] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\svchost.exe[2940] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe[3792] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000100070460
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000100070450
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000100070370
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000100070470
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000001000703e0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000100070320
|
|
29.01.2014, 15:38
| #6 |
| | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Gmer Teil 3 Code:
ATTFilter .text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000100070390
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000001000702e0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000001000702d0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000100070310
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000001000703c0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000001000703f0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000100070230
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000100070480
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000001000703a0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000001000702f0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000100070350
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000100070290
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000001000702b0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000001000703d0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000100070330
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000100070410
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000100070240
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000001000701e0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000100070250
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000100070490
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000001000704a0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000100070300
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000100070360
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000001000702a0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000001000702c0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000100070380
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000100070340
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000100070440
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000100070260
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000100070270
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000100070400
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000001000701f0
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000100070210
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000100070200
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000100070420*
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000100070430
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000100070220
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000100070280
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[2892] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\SearchIndexer.exe[1852] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\taskhost.exe[2120] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[800] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[800] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000765e1465 2 bytes [5E, 76]
.text C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[800] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000765e14bb 2 bytes [5E, 76]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[848] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[2340] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3296] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\System32\igfxtray.exe[2288] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\System32\hkcmd.exe[2708] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\System32\igfxpers.exe[760] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4072] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4072] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000765e1465 2 bytes [5E, 76]
.text C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[4072] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000765e14bb 2 bytes [5E, 76]
.text ... * 2
.text C:\Program Files\Avast5\AvastUI.exe[3688] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\igfxsrvc.exe[1568] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\ProgramData\FLEXnet\Connect\11\agent.exe[2536] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000100070460
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000100070450
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000100070370
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000100070470
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000001000703e0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000100070320
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000001000703b0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000100070390
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000001000702e0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000001000702d0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000100070310
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000001000703c0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000001000703f0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000100070230
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000100070480
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000001000703a0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000001000702f0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000100070350
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000100070290
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000001000702b0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000001000703d0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000100070330
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000100070410
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000100070240
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000001000701e0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000100070250
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000100070490
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000001000704a0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000100070300
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000100070360
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000001000702a0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000001000702c0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000100070380
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000100070340
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000100070440
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000100070260
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000100070270
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000100070400
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000001000701f0
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000100070210
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000100070200
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000100070420
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000100070430
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000100070220
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000100070280
.text C:\Windows\system32\wbem\unsecapp.exe[2252] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files\Apoint2K\Apntex.exe[1012] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\conhost.exe[1248] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Program Files\Apoint2K\HidFind.exe[2888] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\System32\svchost.exe[4780] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\taskmgr.exe[3420] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
|
|
29.01.2014, 15:41
| #7 |
| | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Gmer Teil 4.. Code:
ATTFilter .text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000100040460
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000100040450
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000100040370
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000100040470
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000001000403e0
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000100040320
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000001000403b0
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000100040390
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000001000402e0
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000001000402d0
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000100040310
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000001000403c0
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000001000403f0
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000100040230
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000100040480
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000001000403a0
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000001000402f0
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000100040350
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000100040290
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000001000402b0
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000001000403d0
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000100040330
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000100040410
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000100040240
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000001000401e0
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000100040250
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000100040490
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000001000404a0
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000100040300
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000100040360
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000001000402a0
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000001000402c0
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000100040380
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000100040340
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000100040440
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000100040260
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000100040270
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000100040400
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000001000401f0
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000100040210
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000100040200
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000100040420
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000100040430
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000100040220
.text C:\Windows\system32\csrss.exe[4384] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000100040280
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\winlogon.exe[4520] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\taskhost.exe[4220] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\Explorer.EXE[4992] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\Explorer.EXE[4992] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\Dwm.exe[4036] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe[2792] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe[4948] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3904] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files\Apoint2K\Apoint.exe[3488] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\wbem\unsecapp.exe[2408] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files\Apoint2K\ApMsgFwd.exe[4004] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\System32\hkcmd.exe[4332] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\conhost.exe[2096] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\System32\igfxpers.exe[4620] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076f11360 5 bytes JMP 0000000077070460
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076f113b0 5 bytes JMP 0000000077070450
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076f11510 5 bytes JMP 0000000077070370
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076f11560 5 bytes JMP 0000000077070470
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076f11570 5 bytes JMP 00000000770703e0
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076f11620 5 bytes JMP 0000000077070320
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076f11650 5 bytes JMP 00000000770703b0
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076f11670 5 bytes JMP 0000000077070390
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076f116b0 5 bytes JMP 00000000770702e0
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076f11730 5 bytes JMP 00000000770702d0
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076f11750 5 bytes JMP 0000000077070310
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076f11790 5 bytes JMP 00000000770703c0
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076f117e0 5 bytes JMP 00000000770703f0
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076f11940 5 bytes JMP 0000000077070230
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076f11b00 5 bytes JMP 0000000077070480
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076f11b30 5 bytes JMP 00000000770703a0
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076f11c10 5 bytes JMP 00000000770702f0
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076f11c20 5 bytes JMP 0000000077070350
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076f11c80 5 bytes JMP 0000000077070290
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076f11d10 5 bytes JMP 00000000770702b0
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076f11d30 5 bytes JMP 00000000770703d0
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076f11d40 5 bytes JMP 0000000077070330
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076f11db0 5 bytes JMP 0000000077070410
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076f11de0 5 bytes JMP 0000000077070240
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076f120a0 5 bytes JMP 00000000770701e0
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076f12160 5 bytes JMP 0000000077070250
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076f12190 5 bytes JMP 0000000077070490
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076f121a0 5 bytes JMP 00000000770704a0
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076f121d0 5 bytes JMP 0000000077070300
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076f121e0 5 bytes JMP 0000000077070360
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076f12240 5 bytes JMP 00000000770702a0
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076f12290 5 bytes JMP 00000000770702c0
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076f122c0 5 bytes JMP 0000000077070380
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076f122d0 5 bytes JMP 0000000077070340
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076f125c0 5 bytes JMP 0000000077070440
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076f127c0 5 bytes JMP 0000000077070260
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076f127d0 5 bytes JMP 0000000077070270
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076f127e0 5 bytes JMP 0000000077070400
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076f129a0 5 bytes JMP 00000000770701f0
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076f129b0 5 bytes JMP 0000000077070210
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076f12a20 5 bytes JMP 0000000077070200
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076f12a80 5 bytes JMP 0000000077070420
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076f12a90 5 bytes JMP 0000000077070430
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076f12aa0 5 bytes JMP 0000000077070220
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076f12b80 5 bytes JMP 0000000077070280
.text C:\Windows\system32\igfxsrvc.exe[1420] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files\Apoint2K\HidFind.exe[3588] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\Program Files\Avast5\AvastUI.exe[1148] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[5176] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[5176] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000765e1465 2 bytes [5E, 76]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[5176] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000765e14bb 2 bytes [5E, 76]
.text ... * 2
.text C:\Program Files (x86)\Brownie\brstsw64.exe[5444] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3056] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Windows\SysWOW64\ctfmon.exe[5284] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Windows\system32\AUDIODG.EXE[4352] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189 0000000076dfeecd 1 byte [62]
.text C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3428] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
.text C:\Users\****\AppData\Local\Temp\Temp1_gmer_2.1.19355.zip\gmer.exe[3412] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 0000000076b6a2ba 1 byte [62]
---- Threads - GMER 2.1 ----
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:1820] 00000000770f3e85
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:1836] 00000000770f2e65
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:1956] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:1964] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:1976] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:1980] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:1100] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:1128] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:1152] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:1220] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:1280] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:1424] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:1444] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:376] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:1296] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:1288] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:1276] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:1272] 00000000770f3e85
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:1584] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:4744] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:5464] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:2924] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:4144] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:3168] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:5820] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:3752] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:3160] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:5924] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:4448] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:4052] 0000000071af29e1
Thread c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [1804:5008] 0000000071af29e1
Thread C:\Windows\system32\taskhost.exe [1872:2400] 000007fefa721010
Thread C:\Windows\System32\svchost.exe [2540:3364] 000007fef3309688
Thread C:\Windows\system32\taskhost.exe [2120:708] 000007fef312ef24
---- Processes - GMER 2.1 ----
Process C:\ProgramData\FLEXnet\Connect\11\agent.exe (*** suspicious ***) @ C:\ProgramData\FLEXnet\Connect\11\agent.exe [2536] 0000000001310000
Process C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (*** suspicious ***) @ C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [3056] 0000000001320000
Process C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (*** suspicious ***) @ C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [3428] 0000000001320000
Process C:\Users\****\AppData\Local\Temp\Temp1_gmer_2.1.19355.zip\gmer.exe (*** suspicious ***) @ C:\Users\****\AppData\Local\Temp\Temp1_gmer_2.1.19355.zip\gmer.exe [3412](2014-01-21 20:56:24) 0000000000400000
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
 |
|
29.01.2014, 15:47
| #8 |
| | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? FRST.txt FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014
Ran by **** (ATTENTION: The logged in user is not administrator) on ****-PC on 29-01-2014 10:24:31
Running from C:\Users\****\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Acer Inc.) C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Hidfind.exe
(AVAST Software) C:\Program Files\Avast5\AvastUI.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Flexera Software LLC.) C:\ProgramData\FLEXnet\Connect\11\agent.exe
(Flexera Software LLC.) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [ePower_DMC] - C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe [492032 2009-07-21] (Acer Inc.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8060960 2009-08-06] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [295936 2009-05-22] (Alps Electric Co., Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\\isuspm.exe [2068856 2011-10-12] (Flexera Software LLC.)
HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\Avast5\AvastUI.exe [3764024 2013-12-27] (AVAST Software)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\RunOnce: [20131224] - C:\Program Files\Avast5\setup\emupdate\49be1b18-4145-4f23-bf60-3ef26720389f.exe /check [181136 2014-01-29] (AVAST Software)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKtray.exe [619216 2009-05-18] (Expert System S.p.A.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18642024 2013-02-28] (Skype Technologies S.A.)
HKCU\...\Run: [AutoStart-Manager 2006] - C:\Program Files (x86)\Tools&More\Autostart-Manager\AutoStart-Manager.exe [397312 2005-12-23] (Wirth New Media Sarl )
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
MountPoints2: {8075ca8c-9c30-11de-a849-806e6f6e6963} - D:\SETUP.EXE /AUTORUN
Startup: C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.bing.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=extensa_5230&r=27361109a116l0308z185i4751t287
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
URLSearchHook: HKCU - (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKLM-x32 - {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_de
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_de
SearchScopes: HKCU - {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Avast5\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Avast5\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: No Name - {1ED16E0A-E8C4-40A0-8BC2-79485D21F796} - No File
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Avast5\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Avast5\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\Avast5\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - No Name - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - No File
Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\Avast5\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No File
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default
FF user.js: detected! => C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\user.js
FF NewTab: hxxp://www2.delta-search.com/?affID=119777&tt=gc_&babsrc=NT_ss&mntrId=04DC0017C4AFA9FC
FF DefaultSearchEngine: benefind
FF SearchEngineOrder.1: Delta Search
FF SelectedSearchEngine: benefind
FF Homepage: hxxp://www.benefind.de
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.13.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.13.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8064.0206 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: nuance.com/DragonRIAPlugin - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\npDgnRia.dll (Nuance Communications Inc.)
FF Plugin HKCU: @citrixonline.com/appdetectorplugin - C:\Users\****\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\searchplugins\100-search-engines.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\searchplugins\benefind.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\searchplugins\ecosia.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\searchplugins\scroogle-ssl-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: RequestPolicy - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\Extensions\requestpolicy@requestpolicy.com.xpi [2013-01-29]
FF Extension: NoScript - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-01-28]
FF Extension: Google Privacy - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\Extensions\{ea61041c-1e22-4400-99a0-aea461e69d04}.xpi [2013-01-28]
FF HKLM-x32\...\Firefox\Extensions: [jid0-lmZNVK7a82O8cufhdfB9dUDfA2w@jetpack] - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\ffShim.xpi
FF Extension: No Name - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\ffShim.xpi [2012-07-13]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Avast5\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Avast5\WebRep\FF [2011-04-25]
==================== Services (Whitelisted) =================
R2 ABBYY.Licensing.FineReader.Professional.11.0; C:\Program Files (x86)\ABBYY FineReader 11\NetworkLicenseServer.exe [819976 2011-09-22] (ABBYY)
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759072 2008-10-09] (ABBYY (BIT Software))
R2 avast! Antivirus; C:\Program Files\Avast5\AvastSvc.exe [50344 2013-12-27] (AVAST Software)
R2 ETService; C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [24576 2009-08-12] ()
R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 MSSQL$MSSMLBIZ; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S2 NewServiceInstall1; C:\Program Files (x86)\SDL International\T2007_FL\TT\Lng\Dialogs1031.lng [11264 2007-04-23] ()
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated)
S2 LEC TranslateDotNet Server; "C:\Program Files (x86)\Power Translator 12\LogoMedia TranslateDotNet Server.exe" [x]
==================== Drivers (Whitelisted) ====================
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2013-10-23] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2013-12-27] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-10-23] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-10-23] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1034464 2013-12-27] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422216 2013-12-27] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [79672 2013-12-27] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2013-12-27] ()
R3 bbcap; C:\Windows\System32\DRIVERS\bbcap.sys [4608 2010-12-23] (Windows (R) Codename Longhorn DDK provider)
S3 O2MDRDR; C:\Windows\system32\DRIVERS\o2mdx64.sys [63264 2009-05-07] (O2Micro )
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-29 10:24 - 2014-01-29 10:24 - 00018385 _____ C:\Users\****\Downloads\FRST.txt
2014-01-29 10:06 - 2014-01-29 10:24 - 00000000 ____D C:\FRST
2014-01-29 09:33 - 2014-01-29 09:33 - 00000000 _____ C:\Users\Admin\defogger_reenable
2014-01-29 09:29 - 2014-01-29 09:29 - 00370971 _____ C:\Users\****\Downloads\gmer_2.1.19355.zip
2014-01-29 09:23 - 2014-01-29 09:24 - 02079744 _____ (Farbar) C:\Users\****\Downloads\FRST64.exe
2014-01-29 09:23 - 2014-01-29 09:23 - 00050477 _____ C:\Users\****\Downloads\Defogger(1).exe
2014-01-28 23:39 - 2014-01-28 23:40 - 00002210 _____ C:\Windows\wininit.ini
2014-01-28 21:17 - 2014-01-28 21:17 - 00000000 ____D C:\Program Files\Common Files\Apple
2014-01-28 20:39 - 2014-01-28 22:54 - 00359656 _____ (Microsoft Corporation) C:\Users\Admin\Downloads\msicuu2.exe
2014-01-28 14:23 - 2014-01-28 14:23 - 00283096 _____ (Mozilla) C:\Users\****\Downloads\Firefox Setup Stub 26.0.exe
2014-01-27 16:46 - 2014-01-27 16:48 - 90578216 _____ (AVAST Software) C:\Users\****\Downloads\avast_free_antivirus_setup.exe
2014-01-26 12:43 - 2014-01-26 12:43 - 00000000 ____D C:\.jes
2014-01-24 23:40 - 2014-01-24 23:40 - 01069512 _____ (Solid State Networks) C:\Users\****\Downloads\install_flashplayer12x32au_mssd_aaa_aih(1).exe
2014-01-24 22:11 - 2014-01-24 22:11 - 00000000 ____D C:\ProgramData\Oracle
2014-01-24 22:10 - 2014-01-24 22:10 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-01-24 22:10 - 2014-01-24 22:10 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-01-24 22:10 - 2014-01-24 22:10 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-01-24 22:10 - 2014-01-24 22:10 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-01-24 22:06 - 2014-01-24 22:06 - 00000000 ____D C:\ProgramData\Uniblue
2014-01-24 21:56 - 2014-01-24 21:56 - 00000000 ____D C:\Users\Admin\AppData\Roaming\AVAST Software
2014-01-24 21:48 - 2014-01-24 21:51 - 00000000 ____D C:\Users\Desktop\Dragon NaturallySpeaking 11 Home
2014-01-24 21:48 - 2013-03-04 11:09 - 00005757 _____ C:\Users\Desktop\ADMIN-Aktionen ab 28-01-13.doc - Verknüpfung.lnk
2014-01-24 21:48 - 2013-02-04 18:21 - 00001042 _____ C:\Users\Desktop\ProjectX.jar - Verknüpfung.lnk
2014-01-24 21:48 - 2013-02-04 18:11 - 00208384 _____ (Imago) C:\Users\Desktop\ImagoMPEG-Muxer.exe
2014-01-24 21:48 - 2012-10-09 13:55 - 00001014 _____ C:\Users\Desktop\kreawi Prüfungstrainer (Demo).lnk
2014-01-24 21:48 - 2012-05-05 20:14 - 00001380 _____ C:\Users\Desktop\CopyTrans Control Center.lnk
2014-01-24 21:48 - 2011-09-22 10:05 - 00001172 _____ C:\Users\Desktop\WavePad Sound Editor.lnk
2014-01-24 21:48 - 2011-09-01 07:08 - 00000977 _____ C:\Users\Desktop\Juice.lnk
2014-01-24 21:48 - 2011-05-16 06:41 - 00006332 _____ C:\Users\Desktop\Router_Setup.html
2014-01-24 21:48 - 2011-04-07 13:35 - 00001304 _____ C:\Users\Desktop\Audio Converter.lnk
2014-01-24 21:48 - 2011-03-26 12:29 - 00001402 _____ C:\Users\Desktop\YouTube to MP3 Converter.lnk
2014-01-24 21:48 - 2011-03-26 12:29 - 00001243 _____ C:\Users\Desktop\DVDVideoSoft Studio.lnk
2014-01-24 21:48 - 2009-05-20 22:32 - 00000172 ____R C:\Users\Desktop\Router Login.url
2014-01-24 21:42 - 2014-01-24 21:42 - 00000667 _____ C:\Besitz übernehmen.reg
2014-01-24 21:36 - 2014-01-24 21:36 - 01069512 _____ (Solid State Networks) C:\Users\****\Downloads\install_flashplayer12x32au_mssd_aaa_aih.exe
2014-01-23 12:44 - 2014-01-23 12:44 - 00001781 _____ C:\Users\Public\Desktop\f4.lnk
2014-01-23 12:43 - 2014-01-23 12:43 - 00006906 _____ C:\Windows\SysWOW64\jupdate-1.6.0_07-b06.log
2014-01-23 12:42 - 2014-01-23 12:44 - 00000000 ____D C:\Program Files (x86)\f4
2014-01-15 14:26 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 14:26 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 14:26 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 14:26 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 14:26 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 14:26 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 14:26 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 14:26 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 14:26 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-09 15:09 - 2014-01-09 18:12 - 00000000 ____D C:\Users\****\Documents\Family Tree Maker
2014-01-09 15:09 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\AppData\Local\IsolatedStorage
2014-01-09 15:09 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\AppData\Local\Ancestry.com
2014-01-09 14:49 - 2014-01-09 14:49 - 00000000 ____D C:\IExp1.tmp
2014-01-09 14:48 - 2014-01-09 14:49 - 00000000 ___HD C:\Windows\msdownld.tmp
2014-01-09 14:48 - 2014-01-09 14:48 - 00002043 _____ C:\Users\Public\Desktop\Family Tree Maker 2010 (DE).lnk
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Windows\RegisteredPackages
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft WSE 3.0
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Program Files (x86)\Microsoft WSE
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\IExp0.tmp
2014-01-09 14:43 - 2014-01-09 14:48 - 00000000 ____D C:\Program Files (x86)\Family Tree Maker 2010 (DE)
2014-01-09 14:43 - 2014-01-09 14:48 - 00000000 ____D C:\Program Files (x86)\BCL Technologies
2014-01-09 14:34 - 2014-01-09 14:34 - 00000000 ____D C:\Users\****\AppData\Roaming\YORAKO
2014-01-09 14:31 - 2014-01-09 14:31 - 00000000 ____D C:\Program Files (x86)\Namenslexikon
==================== One Month Modified Files and Folders =======
2014-01-29 10:24 - 2014-01-29 10:24 - 00018385 _____ C:\Users\****\Downloads\FRST.txt
2014-01-29 10:24 - 2014-01-29 10:06 - 00000000 ____D C:\FRST
2014-01-29 10:19 - 2009-09-08 05:37 - 01327666 _____ C:\Windows\WindowsUpdate.log
2014-01-29 10:14 - 2013-01-28 11:45 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-29 09:49 - 2013-08-01 11:34 - 00000000 ____D C:\pending
2014-01-29 09:43 - 2010-04-05 13:46 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-29 09:33 - 2014-01-29 09:33 - 00000000 _____ C:\Users\Admin\defogger_reenable
2014-01-29 09:33 - 2013-05-07 18:29 - 00000472 _____ C:\Users\****\Downloads\defogger_disable.log
2014-01-29 09:33 - 2010-06-20 22:32 - 00000000 ____D C:\Users\Admin
2014-01-29 09:29 - 2014-01-29 09:29 - 00370971 _____ C:\Users\****\Downloads\gmer_2.1.19355.zip
2014-01-29 09:24 - 2014-01-29 09:23 - 02079744 _____ (Farbar) C:\Users\****\Downloads\FRST64.exe
2014-01-29 09:23 - 2014-01-29 09:23 - 00050477 _____ C:\Users\****\Downloads\Defogger(1).exe
2014-01-29 07:56 - 2010-04-05 13:37 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-29 07:14 - 2012-02-17 20:49 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2014-01-28 23:51 - 2009-07-14 05:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-28 23:51 - 2009-07-14 05:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-28 23:42 - 2013-05-07 09:36 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Yontoo
2014-01-28 23:42 - 2011-11-13 17:03 - 00095814 _____ C:\Windows\PFRO.log
2014-01-28 23:42 - 2011-09-22 18:24 - 00042108 _____ C:\Windows\setupact.log
2014-01-28 23:42 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-28 23:40 - 2014-01-28 23:39 - 00002210 _____ C:\Windows\wininit.ini
2014-01-28 23:11 - 2012-02-17 20:49 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy
2014-01-28 23:10 - 2011-10-28 02:28 - 00000000 ____D C:\Program Files (x86)\Power Translator 12
2014-01-28 22:54 - 2014-01-28 20:39 - 00359656 _____ (Microsoft Corporation) C:\Users\Admin\Downloads\msicuu2.exe
2014-01-28 22:03 - 2013-06-11 12:23 - 00000000 ____D C:\Program Files\WinRAR
2014-01-28 21:17 - 2014-01-28 21:17 - 00000000 ____D C:\Program Files\Common Files\Apple
2014-01-28 20:17 - 2013-11-17 21:07 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-28 20:17 - 2012-05-05 21:43 - 00000000 ____D C:\Program Files (x86)\iTunes
2014-01-28 20:14 - 2011-11-13 15:37 - 00000000 ____D C:\Program Files (x86)\QuickTime
2014-01-28 20:11 - 2011-01-02 21:41 - 00000000 ____D C:\ProgramData\Apple
2014-01-28 19:50 - 2010-05-14 22:01 - 00000404 _____ C:\Windows\Brownie.ini
2014-01-28 19:44 - 2009-08-26 06:16 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2014-01-28 19:44 - 2009-08-22 11:23 - 00000000 ____D C:\Windows\ShellNew
2014-01-28 19:27 - 2009-08-26 06:16 - 00000000 ____D C:\ProgramData\Microsoft Help
2014-01-28 19:27 - 2009-07-14 03:34 - 00000449 _____ C:\Windows\win.ini
2014-01-28 18:12 - 2011-10-29 23:34 - 00000000 ____D C:\Program Files (x86)\ABBYY FineReader 11
2014-01-28 14:23 - 2014-01-28 14:23 - 00283096 _____ (Mozilla) C:\Users\****\Downloads\Firefox Setup Stub 26.0.exe
2014-01-28 11:34 - 2009-08-22 10:33 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2014-01-28 11:32 - 2013-10-22 10:58 - 00000000 ____D C:\ProgramData\SYSTRAN
2014-01-27 16:48 - 2014-01-27 16:46 - 90578216 _____ (AVAST Software) C:\Users\****\Downloads\avast_free_antivirus_setup.exe
2014-01-26 19:15 - 2010-08-05 10:27 - 00000000 ____D C:\Users\****\AppData\Roaming\FileZilla
2014-01-26 13:57 - 2009-11-16 20:36 - 00115976 _____ C:\Users\****\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-26 13:55 - 2009-07-14 05:45 - 00453088 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-26 13:48 - 2010-07-06 09:38 - 00115976 _____ C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-26 12:50 - 2009-11-29 16:01 - 00000633 _____ C:\Windows\ODBC.INI
2014-01-26 12:49 - 2010-07-06 09:38 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-26 12:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system
2014-01-26 12:43 - 2014-01-26 12:43 - 00000000 ____D C:\.jes
2014-01-26 10:51 - 2011-10-28 20:16 - 00002315 _____ C:\Users\****\AppData\Roaming\SAS7_000.DAT
2014-01-25 10:46 - 2011-11-05 14:56 - 00000000 ____D C:\Users\****\Downloads\F4 installationsordner
2014-01-24 23:52 - 2013-10-22 13:47 - 00000000 ____D C:\Users\****\AppData\Roaming\SYSTRAN
2014-01-24 23:52 - 2013-10-22 13:47 - 00000000 ____D C:\Users\****\AppData\Local\SYSTRAN
2014-01-24 23:40 - 2014-01-24 23:40 - 01069512 _____ (Solid State Networks) C:\Users\****\Downloads\install_flashplayer12x32au_mssd_aaa_aih(1).exe
2014-01-24 22:13 - 2010-07-06 09:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Mozilla
2014-01-24 22:11 - 2014-01-24 22:11 - 00000000 ____D C:\ProgramData\Oracle
2014-01-24 22:10 - 2014-01-24 22:10 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-01-24 22:10 - 2014-01-24 22:10 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-01-24 22:10 - 2014-01-24 22:10 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-01-24 22:10 - 2014-01-24 22:10 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-01-24 22:10 - 2010-06-29 13:48 - 00000000 ____D C:\Program Files (x86)\Java
2014-01-24 22:06 - 2014-01-24 22:06 - 00000000 ____D C:\ProgramData\Uniblue
2014-01-24 21:56 - 2014-01-24 21:56 - 00000000 ____D C:\Users\Admin\AppData\Roaming\AVAST Software
2014-01-24 21:56 - 2010-07-06 09:38 - 00001425 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-01-24 21:56 - 2010-07-06 09:38 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-01-24 21:56 - 2010-07-06 09:37 - 00000000 ____D C:\Users\Admin\AppData\Local\VirtualStore
2014-01-24 21:51 - 2014-01-24 21:48 - 00000000 ____D C:\Users\Desktop\Dragon NaturallySpeaking 11 Home
2014-01-24 21:42 - 2014-01-24 21:42 - 00000667 _____ C:\Besitz übernehmen.reg
2014-01-24 21:36 - 2014-01-24 21:36 - 01069512 _____ (Solid State Networks) C:\Users\****\Downloads\install_flashplayer12x32au_mssd_aaa_aih.exe
2014-01-24 06:51 - 2010-05-14 22:04 - 00000432 _____ C:\Windows\BRWMARK.INI
2014-01-24 04:39 - 2011-12-18 18:23 - 00000000 ____D C:\Users\****\AppData\Local\.elfohilfe
2014-01-23 13:08 - 2009-09-08 15:27 - 00754068 _____ C:\Windows\system32\perfh007.dat
2014-01-23 13:08 - 2009-09-08 15:27 - 00171888 _____ C:\Windows\system32\perfc007.dat
2014-01-23 13:08 - 2009-07-14 06:13 - 01760852 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-23 12:44 - 2014-01-23 12:44 - 00001781 _____ C:\Users\Public\Desktop\f4.lnk
2014-01-23 12:44 - 2014-01-23 12:42 - 00000000 ____D C:\Program Files (x86)\f4
2014-01-23 12:43 - 2014-01-23 12:43 - 00006906 _____ C:\Windows\SysWOW64\jupdate-1.6.0_07-b06.log
2014-01-23 01:17 - 2010-08-04 21:37 - 00000000 ____D C:\Users\****\AppData\Roaming\vlc
2014-01-23 01:12 - 2012-04-19 18:52 - 00000000 ____D C:\Users\****\AppData\Roaming\dvdcss
2014-01-22 15:22 - 2013-03-27 19:49 - 00030863 _____ C:\Users\****\Downloads\Feiertage_2009-2013_DE.ics
2014-01-15 18:11 - 2013-07-27 10:08 - 00000000 ____D C:\Windows\system32\MRT
2014-01-15 18:07 - 2010-05-09 20:43 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-09 18:12 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\Documents\Family Tree Maker
2014-01-09 15:09 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\AppData\Local\IsolatedStorage
2014-01-09 15:09 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\AppData\Local\Ancestry.com
2014-01-09 14:49 - 2014-01-09 14:49 - 00000000 ____D C:\IExp1.tmp
2014-01-09 14:49 - 2014-01-09 14:48 - 00000000 ___HD C:\Windows\msdownld.tmp
2014-01-09 14:48 - 2014-01-09 14:48 - 00002043 _____ C:\Users\Public\Desktop\Family Tree Maker 2010 (DE).lnk
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Windows\RegisteredPackages
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft WSE 3.0
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Program Files (x86)\Microsoft WSE
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\IExp0.tmp
2014-01-09 14:48 - 2014-01-09 14:43 - 00000000 ____D C:\Program Files (x86)\Family Tree Maker 2010 (DE)
2014-01-09 14:48 - 2014-01-09 14:43 - 00000000 ____D C:\Program Files (x86)\BCL Technologies
2014-01-09 14:34 - 2014-01-09 14:34 - 00000000 ____D C:\Users\****\AppData\Roaming\YORAKO
2014-01-09 14:31 - 2014-01-09 14:31 - 00000000 ____D C:\Program Files (x86)\Namenslexikon
Files to move or delete:
====================
C:\Users\Desktop\ImagoMPEG-Muxer.exe
C:\Users\****\FineCount.reg
Some content of TEMP:
====================
C:\Users\****\AppData\Local\Temp\DivXSetup.exe
C:\Users\****\AppData\Local\Temp\DWPUpgradeInstaller.exe
C:\Users\****\AppData\Local\Temp\ffmpeg13.exe
C:\Users\****\AppData\Local\Temp\jna666123695494861687.dll
C:\Users\****\AppData\Local\Temp\RSPUpgradeInstaller.exe
C:\Users\****\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== End Of Log ============================
--- --- --- Addition.txt Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-01-2014
Ran by **** at 2014-01-29 10:26:24
Running from C:\Users\****\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
3ivx MPEG-4 5.0.4 (remove only) (x32 Version: 5.0.4 - 3ivx Technologies, Pty. Ltd.)
7-Zip 4.65 (x64 edition) (Version: 4.65.00.0 - Igor Pavlov)
ABBYY FineReader 11 (x32 Version: 11.0.338 - ABBYY)
ABBYY FineReader 5.0 Sprint (x32 Version: 5.0.0.33417 - ABBYY Software House)
ABBYY FineReader 6.0 Professional (x32 Version: 6.0.1091.4031 - ABBYY Software House)
ABBYY FotoReader (x32 Version: 9.00.146.5844 - ABBYY)
ABBYY FotoReader (x32 Version: 9.00.146.5844 - ABBYY) Hidden
Acer Empowering Technology (x32 Version: 3.0.3016 - Acer Incorporated)
Acer ePower Management (x32 Version: 3.0.3019 - Acer Incorporated)
Acer eRecovery Management (x32 Version: 4.05.3002 - Acer Incorporated)
Acer GameZone Console (x32 Version: 5.1.0.2 - Oberon Media, Inc.)
Acer GridVista (x32 Version: 3.01.0730 - Acer Inc.)
Acer Registration (x32 Version: 1.02.3004 - Acer Incorporated)
Acer ScreenSaver (x32 Version: 1.4.0812 - Acer Incorporated)
Acer Updater (x32 Version: 1.01.3014 - Acer Incorporated)
Acer VCM (x32 Version: 4.05.3000 - Acer Incorporated)
Acrobat.com (x32 Version: 1.6.65 - Adobe Systems Incorporated)
Action Puzzle (Classic) (x32 Version: - Byteberry)
Adobe Acrobat 4.0 (x32 Version: 4.0 - Adobe Systems, Inc.)
Adobe AIR (x32 Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 1.5.0.7220 - Adobe Systems Inc.) Hidden
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader 9.5.5 MUI (x32 Version: 9.5.5 - Adobe Systems Incorporated)
AGFEO TK-Com (x32 Version: 3.06.2001 - AGFEO Kommunikationstechnik GmbH)
AGFEO TK-Com (x32 Version: 3.06.2001 - AGFEO Kommunikationstechnik GmbH) Hidden
AGFEO TK-Soft 32 (x32 Version: - AGFEO)
ALPS Touch Pad Driver (Version: 7.105.2015.1103 - Alps Electric)
Amazon MP3-Downloader 1.0.9 (x32 Version: - )
Amazonia (x32 Version: - Oberon Media)
AnyBizSoft PDF to Word (Build 3.0.0) (x32 Version: - AnyBizSoft Software)
Apple Mobile Device Support (Version: 7.0.0.117 - Apple Inc.)
Audacity 1.2.6 (x32 Version: - )
Autostart-Manager 2006 (x32 Version: 6.00.0000 - Wirth New Media Sarl)
avast! Pro Antivirus (x32 Version: 9.0.2011 - Avast Software)
BB FlashBack Express (x32 Version: 2.8.0.1734 - Blueberry)
Broadcom Gigabit Integrated Controller (Version: 12.24.02 - Broadcom Corporation)
Brother HL-2030 (x32 Version: 1.00 - Brother)
Chicken Invaders 2 (x32 Version: - Oberon Media)
Choice Guard (x32 Version: 1.2.87.0 - Microsoft Corporation) Hidden
Citrix Online Launcher (x32 Version: 1.0.153 - Citrix)
Compatibility Pack für 2007 Office System (x32 Version: 12.0.6612.1000 - Microsoft Corporation)
Dairy Dash (x32 Version: - Oberon Media)
DivX-Setup (x32 Version: 2.6.1.84 - DivX, LLC)
Dragon NaturallySpeaking 12 (x32 Version: 12.00.100 - Nuance Communications Inc.)
Dream Day First Home (x32 Version: - Oberon Media)
Duden Korrektor kompakt (x32 Version: 6.00.00 - Bibliographisches Institut & F.A. Brockhaus AG)
Duden Korrektor Patch 012009 (x32 Version: 6.00.1000 - Bibliographisches Institut & F.A. Brockhaus AG)
ElsterFormular-Upgrade (x32 Version: 14.4.12044 - Landesfinanzdirektion Thüringen)
EPSON Copy Utility (x32 Version: - )
Epson Copy Utility 3.5 (x32 Version: 3.5.0.0 - )
EPSON Photo Print (x32 Version: - )
EPSON Scan (x32 Version: - )
EPSON Smart Panel (x32 Version: - )
Eraser 6.0.8.2273 (Version: 6.0.2273 - The Eraser Project)
f4 3.1.0 (x32 Version: 3.1.0 - MAXqda)
Family Tree Maker 2010 (DE) (x32 Version: 19.0.357 - Ancestry.com)
Family Tree Maker 2010 (DE) (x32 Version: 19.0.357 - Ancestry.com) Hidden
Farm Frenzy 2 (x32 Version: - Oberon Media)
FileZilla Client 3.4.0 (x32 Version: 3.4.0 - )
FineCount 2.6 (x32 Version: - Tilti Systems Ltd.)
Fragenkatalog (HKCU Version: 1.0.0.53 - Fragenkatalog)
Free Video to Flash Converter version 5.0.22.128 (x32 Version: 5.0.22.128 - DVDVideoSoft Ltd.)
FreeFileSync 5.11 (x32 Version: 5.11 - Zenju)
gbrainy 2.06 (x32 Version: 2.06 - )
GIMP 2.6.10 (x32 Version: 2.6.10 - The GIMP Team)
Google Earth Plug-in (x32 Version: 7.1.1.1888 - Google)
Google Earth Plug-in (x32 Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
GoToMeeting 6.0.0.1259 (HKCU Version: 6.0.0.1259 - CitrixOnline)
HP Deskjet 2050 J510 series - Grundlegende Software für das Gerät (Version: 22.50.231.0 - Hewlett-Packard Co.)
HP Deskjet 2050 J510 series Hilfe (x32 Version: 140.0.61.61 - Hewlett Packard)
HP Photo Creations (x32 Version: 1.0.0.3781 - HP Photo Creations Powered by RocketLife)
Identity Card (x32 Version: 1.00.3001 - Acer Incorporated)
Intel(R) Graphics Media Accelerator Driver (Version: 8.15.10.1892 - Intel Corporation)
Intel® Matrix Storage Manager (Version: - Intel Corporation)
InterVideo WinDVD 8 (x32 Version: 8.5.10.39 - InterVideo Inc.)
InterVideo WinDVD 8 (x32 Version: 8.5.10.39 - InterVideo Inc.) Hidden
ISScript (x32 Version: 3.00.185 - InstallShield Software Corp.) Hidden
Java 7 Update 13 (64-bit) (Version: 7.0.130 - Oracle)
Java 7 Update 51 (x32 Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Junk Mail filter update (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
kreawi Prüfungstrainer (Demo) (HKCU Version: - )
L&H TTS3000 Deutsch (x32 Version: - )
Launch Manager (x32 Version: 3.0.01 - Acer Inc.)
Lernout & Hauspie TruVoice American English TTS Engine (x32 Version: - )
LogoMaker 2.0 (x32 Version: - Studio V5)
Merriam Websters Spell Jam (x32 Version: - Oberon Media)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Primary Interoperability Assemblies 2005 (x32 Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 (x32 Version: - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2005 Express Edition (MSSMLBIZ) (x32 Version: 9.4.5000.00 - Microsoft Corporation) Hidden
Microsoft SQL Server Compact 3.5 SP2 DEU (x32 Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 DEU (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Native Client (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable - KB2467175 (x32 Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual Studio 2005 Tools for Office Runtime (x32 Version: 8.0.60816.0 - Microsoft Corporation) Hidden
Microsoft WSE 3.0 (x32 Version: 3.0.5305.0 - Microsoft Corporation)
MindExplorer SW 3.8 (x32 Version: - TC-SoftWorks)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
Mozilla Thunderbird 17.0.5 (x86 de) (x32 Version: 17.0.5 - Mozilla)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (x32 Version: 4.20.9818.0 - Microsoft Corporation)
Multifultor (HKCU Version: 1.0.0.3 - ****)
Namenslexikon (x32 Version: 2.00 - YORAKO)
NETGEAR Live Parental Controls Management Utility 2.1 (x32 Version: 2.1 - )
Notepad++ (x32 Version: 5.8.5 - )
NTI Media Maker 8 (x32 Version: 8.0.12.6619 - NewTech Infosystems)
NTI Media Maker 8 (x32 Version: 8.0.12.6619 - NewTech Infosystems) Hidden
NTI Shadow (x32 Version: 3.7.6.56 - NewTech Infosystems)
NTI Shadow (x32 Version: 3.7.6.56 - NewTech Infosystems) Hidden
Nur Deinstallierung der CopyTrans Suite möglich. (HKCU Version: 2.27 - WindSolutions)
Octava SD4 (x32 Version: 5.01 - Obtiv)
OLYMPUS DSS Player-Lite (x32 Version: - )
OpenOffice.org 3.4.1 (x32 Version: 3.41.9593 - Apache Software Foundation)
P1670 Referenzhandbuch (x32 Version: - )
Paragon Software Langenscheidt 7 (x32 Version: - )
PDFCreator (x32 Version: 1.0.2 - Frank Heindörfer, Philip Chinery)
Presto! BizCard 4.1 (Deutsch Version) (x32 Version: - )
Realtek High Definition Audio Driver (x32 Version: 6.0.1.5911 - Realtek Semiconductor Corp.)
Recuva (Version: 1.45 - Piriform)
Revo Uninstaller 1.94 (x32 Version: 1.94 - VS Revo Group)
SAMSUNG Mobile Composite Device Software (Version: - )
SAMSUNG Mobile Modem Driver Set (Version: - )
Samsung Mobile phone USB driver Drive Software (Version: - )
SAMSUNG Mobile USB Modem 1.0 Software (Version: - )
SAMSUNG Mobile USB Modem Software (Version: - )
SDL Trados 2007 Freelance (x32 Version: 8.2.835 - SDL International)
SDL Trados Synergy 2007 (x32 Version: 2.1.132.0 - SDL International)
SDLX (x32 Version: 9.2.7035 - )
SDLX (x32 Version: 9.2.7035 - SDL International) Hidden
Skype™ 6.3 (x32 Version: 6.3.105 - Skype Technologies S.A.)
Spybot - Search & Destroy (x32 Version: 1.6.2 - Safer Networking Limited)
Switch Sound File Converter (HKCU Version: - NCH Software)
TIPP10 Version 2.0.3 (x32 Version: - (c) 2006-2008, Tom Thielicke)
TK - Service Provider 2.0 (03) (x32 Version: - )
TomTom HOME (x32 Version: 2.9.7 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (x32 Version: 1.0.2 - TomTom International B.V.)
Transit XV (x32 Version: 1.00.0000 - STAR Deutschland GmbH)
Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) (x32 Version: 9.00.5000.00 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
Visual C++ 9.0 Runtime for Dragon NaturallySpeaking 64bit (x64) (Version: 11.0.0 - Nuance Communications Inc.)
Visual Studio 2005 Tools for Office Second Edition Runtime (x32 Version: - Microsoft Corporation)
VLC media player 2.0.5 (x32 Version: 2.0.5 - VideoLAN)
WavePad Sound Editor (HKCU Version: - NCH Software)
Welcome Center (x32 Version: 1.00.3005 - Acer Incorporated)
Windows Live Anmelde-Assistent (x32 Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Call (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 14.0.8064.0206 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Sync (x32 Version: 14.0.8064.206 - Microsoft Corporation)
Windows Live Writer (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Media Encoder 9 Series (x32 Version: - )
Windows Media Encoder 9 Series (x32 Version: 9.00.2980 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8 - Microsoft Corp)
==================== Restore Points =========================
Could not list Restore Points. Check WMI.
==================== Hosts content: ==========================
2009-07-14 03:34 - 2014-01-29 07:12 - 00450660 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.***[Kommentar: piep..wo kommt das denn her???]links.com
127.0.0.1 100***links.com
127.0.0.1 www.10sek.com
127.0.0.1 10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 www.123f****.info
127.0.0.1 123f****(piep).info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
There are 1000 more lines.
==================== Scheduled Tasks (whitelisted) =============
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => ?
==================== Loaded Modules (whitelisted) =============
2010-01-02 15:42 - 2010-01-02 15:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2010-11-08 16:15 - 2010-11-08 16:15 - 00301568 _____ () C:\Program Files (x86)\Notepad++\NppShell_04.dll
2009-08-26 06:21 - 2009-08-26 06:21 - 00036864 _____ () C:\Windows\assembly\GAC_MSIL\Framework.Utility\3.0.3016.0__4df5dcab8860d239\Framework.Utility.dll
2009-08-26 06:21 - 2009-08-26 06:21 - 00061440 _____ () C:\Windows\assembly\GAC_MSIL\Framework.Library\3.0.3016.0__3036420f80dd6947\Framework.Library.dll
2009-08-26 06:21 - 2009-08-26 06:21 - 00020480 _____ () C:\Windows\assembly\GAC_MSIL\Framework.Model.ControllerInterface\3.0.3016.0__d842b71b4d6ed079\Framework.Model.ControllerInterface.dll
2013-10-23 08:24 - 2013-10-23 08:24 - 19336120 _____ () C:\Program Files\Avast5\libcef.dll
2012-08-10 16:51 - 2012-08-10 16:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2013-03-27 23:58 - 2013-04-05 10:56 - 02243480 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2013-03-27 23:58 - 2013-04-05 10:56 - 00158104 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2013-03-27 23:58 - 2013-04-05 10:56 - 00022424 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2013-12-20 22:19 - 2013-12-20 22:20 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\TEMP:0B9176C0
AlternateDataStreams: C:\ProgramData\TEMP:0FF263E8
AlternateDataStreams: C:\ProgramData\TEMP:1D32EC29
AlternateDataStreams: C:\ProgramData\TEMP:4CF61E54
AlternateDataStreams: C:\ProgramData\TEMP:4D066AD2
AlternateDataStreams: C:\ProgramData\TEMP:93DE1838
AlternateDataStreams: C:\ProgramData\TEMP:AB689DEA
AlternateDataStreams: C:\ProgramData\TEMP:ABE89FFE
AlternateDataStreams: C:\ProgramData\TEMP:E1F04E8D
AlternateDataStreams: C:\ProgramData\TEMP:E3C56885
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (01/29/2014 02:46:17 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.
Error: (01/29/2014 02:45:26 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (01/28/2014 11:41:17 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_stisvc, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc3c1
Name des fehlerhaften Moduls: esxwia30.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x452f3a4d
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000507651
ID des fehlerhaften Prozesses: 0xcc8
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_stisvc0
Pfad der fehlerhaften Anwendung: svchost.exe_stisvc1
Pfad des fehlerhaften Moduls: svchost.exe_stisvc2
Berichtskennung: svchost.exe_stisvc3
Error: (01/28/2014 11:38:13 PM) (Source: Application Hang) (User: )
Description: Programm IEXPLORE.EXE, Version 11.0.9600.16428 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 340
Startzeit: 01cf1c798fae802a
Endzeit: 13
Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Berichts-ID:
Error: (01/28/2014 11:11:00 PM) (Source: Microsoft-Windows-RestartManager) (User: ****-PC)
Description: Die Anwendung oder der Dienst "LEC TranslateDotNet Server" konnte nicht neu gestartet werden.
Error: (01/28/2014 11:00:25 PM) (Source: Application Hang) (User: )
Description: Programm IEXPLORE.EXE, Version 11.0.9600.16428 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 15c0
Startzeit: 01cf1c73365ab06b
Endzeit: 10
Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Berichts-ID: 1e907836-8867-11e3-9fff-001f16c79198
Error: (01/28/2014 10:53:54 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: ISUSPM.exe, Version: 13.0.0.43575, Zeitstempel: 0x4e9664be
Name des fehlerhaften Moduls: ISUSPM.exe, Version: 13.0.0.43575, Zeitstempel: 0x4e9664be
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000ab4b
ID des fehlerhaften Prozesses: 0xaf4
Startzeit der fehlerhaften Anwendung: 0xISUSPM.exe0
Pfad der fehlerhaften Anwendung: ISUSPM.exe1
Pfad des fehlerhaften Moduls: ISUSPM.exe2
Berichtskennung: ISUSPM.exe3
Error: (01/28/2014 10:52:07 PM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 11.0.9600.16428 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1564
Startzeit: 01cf1c6ce86e80ec
Endzeit: 0
Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe
Berichts-ID: 8cbfceaf-8865-11e3-9fff-001f16c79198
Error: (01/28/2014 10:36:21 PM) (Source: Application Hang) (User: )
Description: Programm IEXPLORE.EXE, Version 11.0.9600.16428 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1268
Startzeit: 01cf1c7090c29c82
Endzeit: 102
Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Berichts-ID:
Error: (01/28/2014 09:20:30 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.16428, Zeitstempel: 0x525b664c
Name des fehlerhaften Moduls: gdiplus.dll, Version: 6.1.7601.18120, Zeitstempel: 0x515bb50a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00042882
ID des fehlerhaften Prozesses: 0x854
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3
System errors:
=============
Error: (01/29/2014 07:49:06 AM) (Source: DCOM) (User: )
Description: C:\PROGRA~2\COMMON~1\INSTAL~1\engine\6\INTEL3~1\iKernel.exe -Embedding740{91814EC0-B5F0-11D2-80B9-00104B1F6CEA}
Error: (01/28/2014 11:43:00 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
StarOpen
Error: (01/28/2014 11:42:41 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "NewServiceInstall1" wurde aufgrund folgenden Fehlers nicht gestartet:
%%193
Error: (01/28/2014 11:42:41 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "LEC TranslateDotNet Server" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (01/28/2014 11:42:40 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (01/28/2014 11:42:40 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Apple Mobile Device erreicht.
Error: (01/28/2014 11:42:09 PM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (01/28/2014 11:40:06 PM) (Source: Service Control Manager) (User: )
Description: Dienst "Yontoo Desktop Updater" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (01/28/2014 11:11:00 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "LEC TranslateDotNet Server" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (01/28/2014 10:04:59 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
StarOpen
Microsoft Office Sessions:
=========================
Error: (01/29/2014 02:46:17 AM) (Source: SideBySide)(User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3
Error: (01/29/2014 02:45:26 AM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\dragon_support_packager.exe
Error: (01/28/2014 11:41:17 PM) (Source: Application Error)(User: )
Description: svchost.exe_stisvc6.1.7600.163854a5bc3c1esxwia30.dll_unloaded0.0.0.0452f3a4dc00000050000000000507651cc801cf1c6c9981e0d6C:\Windows\system32\svchost.exeesxwia30.dll4c654f41-886d-11e3-9fff-001f16c79198
Error: (01/28/2014 11:38:13 PM) (Source: Application Hang)(User: )
Description: IEXPLORE.EXE11.0.9600.1642834001cf1c798fae802a13C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Error: (01/28/2014 11:11:00 PM) (Source: Microsoft-Windows-RestartManager)(User: ****-PC)
Description: 0LogoMedia TranslateDotNet Server.exeLEC TranslateDotNet Server03026217812840
Error: (01/28/2014 11:00:25 PM) (Source: Application Hang)(User: )
Description: IEXPLORE.EXE11.0.9600.1642815c001cf1c73365ab06b10C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE1e907836-8867-11e3-9fff-001f16c79198
Error: (01/28/2014 10:53:54 PM) (Source: Application Error)(User: )
Description: ISUSPM.exe13.0.0.435754e9664beISUSPM.exe13.0.0.435754e9664bec00000050000ab4baf401cf1c6c8d0c2ce7C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exeC:\ProgramData\FLEXnet\Connect\11\ISUSPM.exeadb3423f-8866-11e3-9fff-001f16c79198
Error: (01/28/2014 10:52:07 PM) (Source: Application Hang)(User: )
Description: iexplore.exe11.0.9600.16428156401cf1c6ce86e80ec0C:\Program Files\Internet Explorer\iexplore.exe8cbfceaf-8865-11e3-9fff-001f16c79198
Error: (01/28/2014 10:36:21 PM) (Source: Application Hang)(User: )
Description: IEXPLORE.EXE11.0.9600.16428126801cf1c7090c29c82102C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Error: (01/28/2014 09:20:30 PM) (Source: Application Error)(User: )
Description: IEXPLORE.EXE11.0.9600.16428525b664cgdiplus.dll6.1.7601.18120515bb50ac00000050004288285401cf1c5f98706ef7C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18120_none_72d2e82386681b36\gdiplus.dlla1a4a89d-8859-11e3-9316-001f16c79198
==================== Memory info ===========================
Percentage of memory in use: 72%
Total physical RAM: 3000.96 MB
Available physical RAM: 838.32 MB
Total Pagefile: 6336.1 MB
Available Pagefile: 527.85 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: (ACER) (Fixed) (Total:137.23 GB) (Free:27.65 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
==================== End Of Log ============================
|
|
29.01.2014, 16:00
| #9 |
| | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Spybot CheckDateien Code:
ATTFilter 28.01.2014 23:14:26 - ##### check started #####
28.01.2014 23:14:26 - ### Version: 1.6.2
28.01.2014 23:14:26 - ### Date: 28.01.2014 23:14:26
28.01.2014 23:14:33 - ##### checking bots #####
28.01.2014 23:14:41 - found: Babylon.Toolbar Root class
28.01.2014 23:14:41 - found: Babylon.Toolbar Root class
28.01.2014 23:14:41 - found: Babylon.Toolbar Browser helper object
28.01.2014 23:14:41 - found: Babylon.Toolbar Root class
28.01.2014 23:14:41 - found: Babylon.Toolbar Root class
28.01.2014 23:14:41 - found: Babylon.Toolbar Interface
28.01.2014 23:14:41 - found: Babylon.Toolbar Interface
28.01.2014 23:14:41 - found: Babylon.Toolbar Type library
28.01.2014 23:14:41 - found: Babylon.Toolbar Type library
28.01.2014 23:14:41 - found: Babylon.Toolbar Root class
28.01.2014 23:14:41 - found: Babylon.Toolbar Root class
28.01.2014 23:14:41 - found: Babylon.Toolbar Class ID
28.01.2014 23:14:41 - found: Babylon.Toolbar Root class
28.01.2014 23:14:41 - found: Babylon.Toolbar Root class
28.01.2014 23:14:41 - found: Babylon.Toolbar Interface
28.01.2014 23:14:41 - found: Babylon.Toolbar Interface
28.01.2014 23:14:41 - found: Babylon.Toolbar Interface
28.01.2014 23:14:41 - found: Babylon.Toolbar Interface
28.01.2014 23:14:41 - found: Babylon.Toolbar Type library
28.01.2014 23:14:41 - found: Babylon.Toolbar Type library
28.01.2014 23:14:41 - found: Babylon.Toolbar Root class
28.01.2014 23:14:41 - found: Babylon.Toolbar Root class
28.01.2014 23:14:41 - found: Babylon.Toolbar Class ID
28.01.2014 23:14:41 - found: Babylon.Toolbar Root class
28.01.2014 23:14:41 - found: Babylon.Toolbar Root class
28.01.2014 23:14:41 - found: Babylon.Toolbar Interface
28.01.2014 23:14:41 - found: Babylon.Toolbar Interface
28.01.2014 23:14:41 - found: Babylon.Toolbar Type library
28.01.2014 23:14:41 - found: Babylon.Toolbar Type library
28.01.2014 23:14:41 - found: Babylon.Toolbar Programm-Verzeichnis
28.01.2014 23:14:41 - found: Babylon.Toolbar Programm-Verzeichnis
28.01.2014 23:14:42 - found: Babylon.Toolbar Programm-Verzeichnis
28.01.2014 23:14:42 - found: Babylon.Toolbar Daten
28.01.2014 23:14:42 - found: Babylon.Toolbar Daten
28.01.2014 23:14:42 - found: Babylon.Toolbar Daten
28.01.2014 23:14:42 - found: Babylon.Toolbar Daten
28.01.2014 23:14:42 - found: Babylon.Toolbar Programm-Verzeichnis
28.01.2014 23:14:42 - found: Babylon.Toolbar Programm-Verzeichnis
28.01.2014 23:14:42 - found: Babylon.Toolbar Daten
28.01.2014 23:14:42 - found: Babylon.Toolbar Daten
28.01.2014 23:14:42 - found: Babylon.Toolbar Daten
28.01.2014 23:14:42 - found: Babylon.Toolbar Daten
28.01.2014 23:14:42 - found: Babylon.Toolbar Daten
28.01.2014 23:14:42 - found: Babylon.Toolbar Programm-Verzeichnis
28.01.2014 23:14:42 - found: Babylon.Toolbar Bild
28.01.2014 23:14:42 - found: Babylon.Toolbar Daten
28.01.2014 23:14:42 - found: Babylon.Toolbar Programm-Verzeichnis
28.01.2014 23:14:42 - found: Babylon.Toolbar Programm-Verzeichnis
28.01.2014 23:14:42 - found: Babylon.Toolbar Programm-Verzeichnis
28.01.2014 23:14:42 - found: Babylon.Toolbar Daten
28.01.2014 23:14:42 - found: Babylon.Toolbar Daten
28.01.2014 23:14:42 - found: Babylon.Toolbar Einstellungen
28.01.2014 23:14:42 - found: Babylon.Toolbar Einstellungen
28.01.2014 23:14:42 - found: Babylon.Toolbar Einstellungen
28.01.2014 23:14:42 - found: Babylon.Toolbar Einstellungen
28.01.2014 23:14:42 - found: Babylon.Toolbar Einstellungen
28.01.2014 23:14:42 - found: Babylon.Toolbar Einstellungen
28.01.2014 23:14:42 - found: Babylon.Toolbar Einstellungen
28.01.2014 23:14:42 - found: Babylon.Toolbar Einstellungen
28.01.2014 23:14:42 - found: Babylon.Toolbar Root class
28.01.2014 23:14:42 - found: Babylon.Toolbar Root class
28.01.2014 23:14:42 - found: Babylon.Toolbar Root class
28.01.2014 23:14:42 - found: Babylon.Toolbar Root class
28.01.2014 23:14:42 - found: Babylon.Toolbar Root class
28.01.2014 23:14:42 - found: Babylon.Toolbar Root class
28.01.2014 23:14:42 - found: Babylon.Toolbar Interface
28.01.2014 23:14:42 - found: Babylon.Toolbar Interface
28.01.2014 23:14:42 - found: Babylon.Toolbar Interface
28.01.2014 23:14:42 - found: Babylon.Toolbar Interface
28.01.2014 23:14:42 - found: Babylon.Toolbar Interface
28.01.2014 23:14:42 - found: Babylon.Toolbar Interface
28.01.2014 23:14:43 - found: Babylon.Toolbar Interface
28.01.2014 23:14:43 - found: Babylon.Toolbar Interface
28.01.2014 23:14:43 - found: Babylon.Toolbar Interface
28.01.2014 23:14:43 - found: Babylon.Toolbar Interface
28.01.2014 23:14:43 - found: Babylon.Toolbar Type library
28.01.2014 23:14:43 - found: Babylon.Toolbar Type library
28.01.2014 23:14:43 - found: Babylon.Toolbar Einstellungen
28.01.2014 23:14:43 - found: Babylon.Toolbar Einstellungen
28.01.2014 23:14:43 - found: Babylon.Toolbar Einstellungen
28.01.2014 23:14:43 - found: Babylon.Toolbar Benutzereinstellungen
28.01.2014 23:14:43 - found: Babylon.Toolbar Benutzereinstellungen
28.01.2014 23:14:43 - found: Babylon.Toolbar Benutzereinstellungen
28.01.2014 23:14:43 - found: Babylon.Toolbar Benutzereinstellungen
28.01.2014 23:14:43 - found: Babylon.Toolbar Einstellungen
28.01.2014 23:14:43 - found: Babylon.Toolbar Benutzereinstellungen
28.01.2014 23:15:14 - found: Delta.Toolbar Benutzereinstellungen
28.01.2014 23:15:14 - found: Delta.Toolbar Einstellungen
28.01.2014 23:15:14 - found: Delta.Toolbar Benutzereinstellungen
28.01.2014 23:15:14 - found: Delta.Toolbar Benutzereinstellungen
28.01.2014 23:15:14 - found: Delta.Toolbar Benutzereinstellungen
28.01.2014 23:15:14 - found: Delta.Toolbar Benutzereinstellungen
28.01.2014 23:15:14 - found: Delta.Toolbar Konfigurations-Datei
28.01.2014 23:15:14 - found: Delta.Toolbar Daten
28.01.2014 23:15:47 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:15:47 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:15:47 - found: Yontoo.Pagerage Uninstall-Einstellung
28.01.2014 23:15:47 - found: Yontoo.Pagerage Autorun-Einstellungen (Yontoo Desktop)
28.01.2014 23:15:47 - found: Yontoo.Pagerage Programmdatei
28.01.2014 23:15:47 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:15:47 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:15:47 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:15:47 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:15:47 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:15:47 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:15:47 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:15:47 - found: Yontoo.Pagerage Root class
28.01.2014 23:15:47 - found: Yontoo.Pagerage Root class
28.01.2014 23:15:47 - found: Yontoo.Pagerage Class ID
28.01.2014 23:15:47 - found: Yontoo.Pagerage Browser helper object
28.01.2014 23:15:47 - found: Yontoo.Pagerage Root class
28.01.2014 23:15:47 - found: Yontoo.Pagerage Root class
28.01.2014 23:15:47 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:15:47 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:15:47 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:15:47 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:15:47 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:15:47 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:15:47 - found: Yontoo.Pagerage Root class
28.01.2014 23:15:47 - found: Yontoo.Pagerage Root class
28.01.2014 23:15:47 - found: Yontoo.Pagerage Class ID
28.01.2014 23:15:47 - found: Yontoo.Pagerage Root class
28.01.2014 23:15:47 - found: Yontoo.Pagerage Root class
28.01.2014 23:15:47 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:15:47 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:15:47 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:15:47 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:15:47 - found: Yontoo.Pagerage Programm-Verzeichnis
28.01.2014 23:15:48 - found: Yontoo.Pagerage Programm-Verzeichnis
28.01.2014 23:15:48 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:15:48 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:15:52 - found: 1ClickDownload Einstellungen
28.01.2014 23:15:52 - found: 1ClickDownload Uninstall-Einstellung
28.01.2014 23:15:57 - found: Delta.Toolbar Einstellungen
28.01.2014 23:15:57 - found: Delta.Toolbar Daten
28.01.2014 23:15:58 - found: WebCake.BHO Programm-Verzeichnis
28.01.2014 23:15:58 - found: WebCake.BHO Bibliothek
28.01.2014 23:15:58 - found: WebCake.BHO Bibliothek
28.01.2014 23:15:58 - found: WebCake.BHO Daten
28.01.2014 23:15:58 - found: WebCake.BHO Ausführbare Datei
28.01.2014 23:15:58 - found: WebCake.BHO Bild
28.01.2014 23:26:01 - found: Win32.Downloader.gen Daten
28.01.2014 23:27:23 - found: DownloadSponsor Einstellungen
28.01.2014 23:27:23 - found: DownloadSponsor Einstellungen
Code:
ATTFilter --- Report generated: 2014-01-28 23:39 ---
Babylon.Toolbar: [SBI $D38EAB50] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonIEPI.BabylonIEBho
Babylon.Toolbar: [SBI $D38EAB50] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonIEPI.BabylonIEBho.1
Babylon.Toolbar: [SBI $D38EAB50] Browser helper object (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9CFACCB6-2F3F-4177-94EA-0D2B72D384C1}
Babylon.Toolbar: [SBI $D38EAB50] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonIEPI.BabylonIEBho.1
Babylon.Toolbar: [SBI $D38EAB50] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonIEPI.BabylonIEBho
Babylon.Toolbar: [SBI $29AE2B9C] Interface (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{5F339F0B-716F-408F-A627-DEEB5DEB4020}
Babylon.Toolbar: [SBI $29AE2B9C] Interface (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{5F339F0B-716F-408F-A627-DEEB5DEB4020}
Babylon.Toolbar: [SBI $F71D8013] Type library (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{A1489C85-4F6F-48C4-AC9E-18B63AF4703E}
Babylon.Toolbar: [SBI $F71D8013] Type library (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{A1489C85-4F6F-48C4-AC9E-18B63AF4703E}
Babylon.Toolbar: [SBI $B78C9286] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonTC.GingerApplication
Babylon.Toolbar: [SBI $B78C9286] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonTC.GingerApplication.1
Babylon.Toolbar: [SBI $B78C9286] Class ID (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF390AA1-1E65-4825-B8E7-BE6B47BD56B8}
Babylon.Toolbar: [SBI $B78C9286] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonTC.GingerApplication.1
Babylon.Toolbar: [SBI $B78C9286] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonTC.GingerApplication
Babylon.Toolbar: [SBI $D5B3BDB3] Interface (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{95734BDE-B702-45B9-86E5-27676729F904}
Babylon.Toolbar: [SBI $D5B3BDB3] Interface (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{95734BDE-B702-45B9-86E5-27676729F904}
Babylon.Toolbar: [SBI $C4D83F28] Interface (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{D0482C8E-BAEA-4943-911A-B661060F56A7}
Babylon.Toolbar: [SBI $C4D83F28] Interface (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{D0482C8E-BAEA-4943-911A-B661060F56A7}
Babylon.Toolbar: [SBI $A580934F] Type library (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{0C2E529C-A82C-4AC6-8807-0B51F7AD7BB2}
Babylon.Toolbar: [SBI $A580934F] Type library (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{0C2E529C-A82C-4AC6-8807-0B51F7AD7BB2}
Babylon.Toolbar: [SBI $D3F051C5] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonOfficeAddin.OfficeAddin
Babylon.Toolbar: [SBI $D3F051C5] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonOfficeAddin.OfficeAddin.1
Babylon.Toolbar: [SBI $D3F051C5] Class ID (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6AC0BB10-C922-45e2-857D-2A368FE749E5}
Babylon.Toolbar: [SBI $D3F051C5] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonOfficeAddin.OfficeAddin.1
Babylon.Toolbar: [SBI $D3F051C5] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonOfficeAddin.OfficeAddin
Babylon.Toolbar: [SBI $78209C48] Interface (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{B7EA2226-F876-4BE4-B478-76EBAE2A668A}
Babylon.Toolbar: [SBI $78209C48] Interface (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{B7EA2226-F876-4BE4-B478-76EBAE2A668A}
Babylon.Toolbar: [SBI $37F4A137] Type library (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{F310F027-15CB-4A7F-B10D-3A4AFB5013A5}
Babylon.Toolbar: [SBI $37F4A137] Type library (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{F310F027-15CB-4A7F-B10D-3A4AFB5013A5}
Babylon.Toolbar: [SBI $DEB52F26] Programm-Verzeichnis (Verzeichnis, nothing done)
C:\ProgramData\Babylon\
Babylon.Toolbar: [SBI $5AB447BB] Programm-Verzeichnis (Verzeichnis, nothing done)
C:\Users\Admin\AppData\Roaming\Babylon\
Babylon.Toolbar: [SBI $412C008F] Programm-Verzeichnis (Verzeichnis, nothing done)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\
Babylon.Toolbar: [SBI $CE671685] Daten (Datei, nothing done)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\adapter@gingersoftware.conf
Properties.size=40
Properties.md5=0F3C6CB3C2B37D3F741206506EC2E461
Properties.filedate=1304584716
Properties.filedatetext=2011-05-05 09:38:36
Babylon.Toolbar: [SBI $D4EFC7FB] Daten (Datei, nothing done)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome.manifest
Properties.size=321
Properties.md5=0A17E22251032CC2B84750749C9B01F8
Properties.filedate=1304584698
Properties.filedatetext=2011-05-05 09:38:18
Babylon.Toolbar: [SBI $511F2520] Daten (Datei, nothing done)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\install.js
Properties.size=3651
Properties.md5=A16D43867E23A073F9E1DE8640179CC8
Properties.filedate=1304584698
Properties.filedatetext=2011-05-05 09:38:18
Babylon.Toolbar: [SBI $23E95F55] Daten (Datei, nothing done)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\install.rdf
Properties.size=1449
Properties.md5=568ECFC959234910816A8F0DCC8794AC
Properties.filedate=1304584698
Properties.filedatetext=2011-05-05 09:38:18
Babylon.Toolbar: [SBI $4E3A325A] Programm-Verzeichnis (Verzeichnis, nothing done)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome\
Babylon.Toolbar: [SBI $29CFF1C4] Programm-Verzeichnis (Verzeichnis, nothing done)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome\content\
Babylon.Toolbar: [SBI $2D7FE41F] Daten (Datei, nothing done)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome\content\about.xul
Properties.size=1425
Properties.md5=DA7803A11B66D1A4DC8B7255DA6B436E
Properties.filedate=1304584698
Properties.filedatetext=2011-05-05 09:38:18
Babylon.Toolbar: [SBI $50EE7AF4] Daten (Datei, nothing done)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome\content\contents.rdf
Properties.size=1052
Properties.md5=22D4495B96C04177A066808E90805C1A
Properties.filedate=1304584698
Properties.filedatetext=2011-05-05 09:38:18
Babylon.Toolbar: [SBI $94D72843] Daten (Datei, nothing done)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome\content\gingerAPI.js
Properties.size=10866
Properties.md5=FCD16C0D0C601DD9693967E3F8EEEA88
Properties.filedate=1304584698
Properties.filedatetext=2011-05-05 09:38:18
Babylon.Toolbar: [SBI $6EF93362] Daten (Datei, nothing done)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome\content\gingerOverlay.js
Properties.size=28649
Properties.md5=6D13DE8B27755418667730E55349C2F9
Properties.filedate=1304584698
Properties.filedatetext=2011-05-05 09:38:18
Babylon.Toolbar: [SBI $D51125CF] Daten (Datei, nothing done)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome\content\gingerOverlay.xul
Properties.size=356
Properties.md5=1E7D24E6D509F07B47A71FEF655E8558
Properties.filedate=1304584698
Properties.filedatetext=2011-05-05 09:38:18
Babylon.Toolbar: [SBI $A3C0635E] Programm-Verzeichnis (Verzeichnis, nothing done)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome\skin\
Babylon.Toolbar: [SBI $F0DFFEBF] Bild (Datei, nothing done)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome\skin\gingerb.gif
Properties.size=3927
Properties.md5=CE94B9573D5A090C28306AAAAA47874B
Properties.filedate=1304584698
Properties.filedatetext=2011-05-05 09:38:18
Babylon.Toolbar: [SBI $E737F68D] Daten (Datei, nothing done)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome\skin\gingers.png
Properties.size=2712
Properties.md5=4A22F008B3235FB76D8F6D5715C0F1D7
Properties.filedate=1304584698
Properties.filedatetext=2011-05-05 09:38:18
Babylon.Toolbar: [SBI $43087DA2] Programm-Verzeichnis (Verzeichnis, nothing done)
C:\Program Files (x86)\Mozilla Firefox\extensions\ocr@babylon.com\
Babylon.Toolbar: [SBI $C9A43556] Programm-Verzeichnis (Verzeichnis, nothing done)
C:\Program Files (x86)\Mozilla Firefox\extensions\ocr@babylon.com\chrome\
Babylon.Toolbar: [SBI $9F6DC1B4] Programm-Verzeichnis (Verzeichnis, nothing done)
C:\Program Files (x86)\Mozilla Firefox\extensions\ocr@babylon.com\chrome\content\
Babylon.Toolbar: [SBI $A17EC3B7] Daten (Datei, nothing done)
C:\Program Files (x86)\Mozilla Firefox\extensions\ocr@babylon.com\chrome\content\overlay.js
Properties.size=17834
Properties.md5=E2239D307E33BF044735C8E6A6E94CEB
Properties.filedate=1310300020
Properties.filedatetext=2011-07-10 13:13:39
Babylon.Toolbar: [SBI $5E8F1A00] Daten (Datei, nothing done)
C:\Program Files (x86)\Mozilla Firefox\extensions\ocr@babylon.com\chrome\content\overlay.xul
Properties.size=278
Properties.md5=ADAFE347F2BD35D8035FA258728C9756
Properties.filedate=1307349354
Properties.filedatetext=2011-06-06 09:35:53
Babylon.Toolbar: [SBI $A209F3A6] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\AppID\{B16632F1-24E0-4D99-A68D-70BFB6447C48}
Babylon.Toolbar: [SBI $A209F3A6] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\AppID\{B16632F1-24E0-4D99-A68D-70BFB6447C48}
Babylon.Toolbar: [SBI $6E59B901] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\AppID\{C0CEA572-2978-4DFC-A672-8100FF0E276A}
Babylon.Toolbar: [SBI $6E59B901] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\AppID\{C0CEA572-2978-4DFC-A672-8100FF0E276A}
Babylon.Toolbar: [SBI $FEF58AA2] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\AppID\BabylonIEPI.DLL
Babylon.Toolbar: [SBI $FEF58AA2] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\AppID\BabylonIEPI.DLL
Babylon.Toolbar: [SBI $7FCAFBEE] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\AppID\BabylonTC.EXE
Babylon.Toolbar: [SBI $7FCAFBEE] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\AppID\BabylonTC.EXE
Babylon.Toolbar: [SBI $1D44F4BC] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabyDict
Babylon.Toolbar: [SBI $1D44F4BC] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabyDict
Babylon.Toolbar: [SBI $67E52DCC] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabyGloss
Babylon.Toolbar: [SBI $67E52DCC] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabyGloss
Babylon.Toolbar: [SBI $984850BB] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabyOptFile
Babylon.Toolbar: [SBI $984850BB] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabyOptFile
Babylon.Toolbar: [SBI $EF9F91BD] Interface (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{431FB0E5-2CBB-4602-9FE6-F1D64488ADD7}
Babylon.Toolbar: [SBI $EF9F91BD] Interface (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{431FB0E5-2CBB-4602-9FE6-F1D64488ADD7}
Babylon.Toolbar: [SBI $CB12A362] Interface (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{5C9A230D-70A5-11D5-AFB0-0050DAC67890}
Babylon.Toolbar: [SBI $CB12A362] Interface (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{5C9A230D-70A5-11D5-AFB0-0050DAC67890}
Babylon.Toolbar: [SBI $BA2C56C1] Interface (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{8911483C-C00A-4183-9FBC-6C9C00946C15}
Babylon.Toolbar: [SBI $BA2C56C1] Interface (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{8911483C-C00A-4183-9FBC-6C9C00946C15}
Babylon.Toolbar: [SBI $37834D71] Interface (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{C3F058A9-407D-4CD1-8F66-B75605B54B69}
Babylon.Toolbar: [SBI $37834D71] Interface (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{C3F058A9-407D-4CD1-8F66-B75605B54B69}
Babylon.Toolbar: [SBI $5A2CDEF9] Interface (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{EFDCAF05-D29C-4D4D-9836-8CDCD606A6B2}
Babylon.Toolbar: [SBI $5A2CDEF9] Interface (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{EFDCAF05-D29C-4D4D-9836-8CDCD606A6B2}
Babylon.Toolbar: [SBI $0F92EB5E] Type library (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{5C9A2304-70A5-11D5-AFB0-0050DAC67890}
Babylon.Toolbar: [SBI $0F92EB5E] Type library (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{5C9A2304-70A5-11D5-AFB0-0050DAC67890}
Babylon.Toolbar: [SBI $D1EDD9CA] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Babylon
Babylon.Toolbar: [SBI $263D482A] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Babylon.exe
Babylon.Toolbar: [SBI $263D482A] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Babylon.exe
Babylon.Toolbar: [SBI $17EC4174] Benutzereinstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\Microsoft\Internet Explorer\MenuExt\Translate this web page with Babylon
Babylon.Toolbar: [SBI $71605A8D] Benutzereinstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\Microsoft\Internet Explorer\MenuExt\Translate with Babylon
Babylon.Toolbar: [SBI $E7C4E204] Benutzereinstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\Microsoft\Office\PowerPoint\Addins\BabylonOfficeAddin.OfficeAddin
Babylon.Toolbar: [SBI $EA382E69] Benutzereinstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\Microsoft\Office\Word\Addins\BabylonOfficeAddin.OfficeAddin
Babylon.Toolbar: [SBI $CABFC738] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478}
Babylon.Toolbar: [SBI $F8D06006] Benutzereinstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\BabylonToolbar
Delta.Toolbar: [SBI $20319BF7] Benutzereinstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\DataMngr
Delta.Toolbar: [SBI $15E43F9C] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\DataMngr
Delta.Toolbar: [SBI $6BE91D8E] Benutzereinstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\DataMngr_Toolbar
Delta.Toolbar: [SBI $4FE1D2EF] Benutzereinstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
Delta.Toolbar: [SBI $04AEAE14] Benutzereinstellungen (Registrierungsdatenbank-Wert, nothing done)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\Microsoft\Internet Explorer\TabbedBrowsing\bProtectNewTabPageShow
Delta.Toolbar: [SBI $0760E887] Benutzereinstellungen (Registrierungsdatenbank-Wert, nothing done)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\Microsoft\Internet Explorer\TabbedBrowsing\bProtectShowTabsWelcome
Delta.Toolbar: [SBI $601A04F4] Konfigurations-Datei (Datei, nothing done)
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7k1i9pr.default\searchplugins\babylon.xml
Properties.size=6505
Properties.md5=53787669181D14859B6E06284308C7C3
Properties.filedate=1367915798
Properties.filedatetext=2013-05-07 09:36:37
Delta.Toolbar: [SBI $4169E8D4] Daten (Datei, nothing done)
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7k1i9pr.default\bProtector_extensions.rdf
Properties.size=2442
Properties.md5=802A612865DC74DCB581F43D138F57D9
Properties.filedate=1288967695
Properties.filedatetext=2010-11-05 15:34:54
Yontoo.Pagerage: [SBI $7B5B72A1] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Yontoo.Pagerage: [SBI $F328E28A] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Yontoo.Pagerage: [SBI $71FBD431] Uninstall-Einstellung (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Yontoo.Pagerage: [SBI $FCA7CE62] Autorun-Einstellungen (Yontoo Desktop) (Registrierungsdatenbank-Wert, nothing done)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yontoo Desktop
Yontoo.Pagerage: [SBI $FCA7CE62] Programmdatei (Datei, nothing done)
C:\Users\Admin\AppData\Roaming\Yontoo\YontooDesktop.exe
Properties.size=42784
Properties.md5=2A6C01BAC0F8AA9143D61AE1E28E263A
Properties.filedate=1367381468
Properties.filedatetext=2013-05-01 05:11:08
Yontoo.Pagerage: [SBI $7EA79EE0] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\CLSID\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}
Yontoo.Pagerage: [SBI $73A90B7D] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Yontoo.Pagerage: [SBI $73A90B7D] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Yontoo.Pagerage: [SBI $2DBD7A06] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\AppID\YontooIEClient.DLL
Yontoo.Pagerage: [SBI $2DBD7A06] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\AppID\YontooIEClient.DLL
Yontoo.Pagerage: [SBI $123F4BC9] Einstellungen (Registrierungsdatenbank-Wert, nothing done)
HKEY_CLASSES_ROOT\AppID\YontooIEClient.DLL\AppID
Yontoo.Pagerage: [SBI $123F4BC9] Einstellungen (Registrierungsdatenbank-Wert, nothing done)
HKEY_CLASSES_ROOT\AppID\YontooIEClient.DLL\AppID
Yontoo.Pagerage: [SBI $EFBC03B1] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\YontooIEClient.Layers
Yontoo.Pagerage: [SBI $EFBC03B1] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\YontooIEClient.Layers.1
Yontoo.Pagerage: [SBI $EFBC03B1] Class ID (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Yontoo.Pagerage: [SBI $EFBC03B1] Browser helper object (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Yontoo.Pagerage: [SBI $EFBC03B1] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\YontooIEClient.Layers.1
Yontoo.Pagerage: [SBI $EFBC03B1] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\YontooIEClient.Layers
Yontoo.Pagerage: [SBI $2ADF7DD5] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Yontoo.Pagerage: [SBI $2ADF7DD5] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Yontoo.Pagerage: [SBI $61D90200] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Yontoo.Pagerage: [SBI $61D90200] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Yontoo.Pagerage: [SBI $5CAD9242] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Yontoo.Pagerage: [SBI $5CAD9242] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Yontoo.Pagerage: [SBI $9297A7A9] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\YontooIEClient.Api
Yontoo.Pagerage: [SBI $9297A7A9] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\YontooIEClient.Api.1
Yontoo.Pagerage: [SBI $9297A7A9] Class ID (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Yontoo.Pagerage: [SBI $9297A7A9] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\YontooIEClient.Api.1
Yontoo.Pagerage: [SBI $9297A7A9] Root class (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\YontooIEClient.Api
Yontoo.Pagerage: [SBI $FC035EA7] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Yontoo Desktop Updater
Yontoo.Pagerage: [SBI $FC035EA7] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Yontoo Desktop Updater
Yontoo.Pagerage: [SBI $0EA27B0B] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Yontoo Desktop Updater
Yontoo.Pagerage: [SBI $0EA27B0B] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Yontoo Desktop Updater
Yontoo.Pagerage: [SBI $58D245DE] Programm-Verzeichnis (Verzeichnis, nothing done)
C:\Users\Admin\AppData\Roaming\Yontoo\
Yontoo.Pagerage: [SBI $B64479C2] Programm-Verzeichnis (Verzeichnis, nothing done)
C:\Program Files (x86)\Yontoo\
Yontoo.Pagerage: [SBI $8A37162B] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Yontoo.Pagerage: [SBI $879BC3EE] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\CLSID\{FE9271F2-6EFD-44b0-A826-84C829536E93}
1ClickDownload: [SBI $BC81CA90] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\1ClickDownload
1ClickDownload: [SBI $6FA3752D] Uninstall-Einstellung (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload
Delta.Toolbar: [SBI $924A2839] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Babylon\Babylon Client
Delta.Toolbar: [SBI $C87F6C5D] Daten (Datei, nothing done)
C:\Users\Admin\AppData\Roaming\Babylon\log_file.txt
Properties.size=10320
Properties.md5=A1C4645189E6D795686ED0C928407D17
Properties.filedate=1367915823
Properties.filedatetext=2013-05-07 09:37:03
WebCake.BHO: [SBI $2698E3E6] Programm-Verzeichnis (Verzeichnis, nothing done)
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\
WebCake.BHO: [SBI $885FF297] Bibliothek (Datei, nothing done)
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setup.dll
Properties.size=531968
Properties.md5=849F98092DFABECE6ABEB4E21A519A83
Properties.filedate=1363210987
Properties.filedatetext=2013-03-13 22:43:06
WebCake.BHO: [SBI $0A5B161A] Bibliothek (Datei, nothing done)
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll
Properties.size=436736
Properties.md5=AE5F4292BD15228853F65A1004517ADC
Properties.filedate=1363210985
Properties.filedatetext=2013-03-13 22:43:04
WebCake.BHO: [SBI $1107F102] Daten (Datei, nothing done)
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.dat
Properties.size=54842
Properties.md5=3FDD6151AA334E02784F608E97F3EC95
Properties.filedate=1367915780
Properties.filedatetext=2013-05-07 09:36:19
WebCake.BHO: [SBI $E98B8D0E] Ausführbare Datei (Datei, nothing done)
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe
Properties.size=227984
Properties.md5=5A8222C703B4A34F2227A652A49A2827
Properties.filedate=1299814153
Properties.filedatetext=2011-03-11 04:29:12
WebCake.BHO: [SBI $370B837B] Bild (Datei, nothing done)
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.ico
Properties.size=4846
Properties.md5=60E3EF9326E8C3F574A2C7B5A31FD895
Properties.filedate=1258611124
Properties.filedatetext=2009-11-19 07:12:03
Win32.Downloader.gen: [SBI $82F4FAFD] Daten (Datei, nothing done)
C:\END
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
Properties.filedate=1373143021
Properties.filedatetext=2013-07-06 21:37:00
DownloadSponsor: [SBI $CC437C6B] Einstellungen (Registrierungsdatenbank-Wert, nothing done)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\OCS\lastPID=...freewarede...
DownloadSponsor: [SBI $980DE8E4] Einstellungen (Registrierungsdatenbank-Wert, nothing done)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\OCS\PID=...freewarede...
--- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---
2009-01-26 blindman.exe (1.0.0.8)
2009-01-26 SDFiles.exe (1.6.1.7)
2009-01-26 SDMain.exe (1.0.0.6)
2009-01-26 SDShred.exe (1.0.2.5)
2009-01-26 SDUpdate.exe (1.6.0.12)
2009-01-26 SDWinSec.exe (1.0.0.12)
2009-01-26 SpybotSD.exe (1.6.2.46)
2009-03-05 TeaTimer.exe (1.6.6.32)
2012-02-17 unins000.exe (51.49.0.0)
2009-01-26 Update.exe (1.6.0.7)
2009-11-04 advcheck.dll (1.6.5.20)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2009-01-26 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2009-01-26 Tools.dll (2.1.6.10)
2009-01-16 UninsSrv.dll (1.0.0.0)
2014-01-08 Includes\Adware-000.sbi (*)
2014-01-08 Includes\Adware-001.sbi (*)
2014-01-22 Includes\Adware-C.sbi (*)
2014-01-08 Includes\Adware.sbi (*)
2014-01-13 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2014-01-08 Includes\Dialer-000.sbi (*)
2014-01-08 Includes\Dialer-001.sbi (*)
2014-01-08 Includes\Dialer-C.sbi (*)
2014-01-08 Includes\Dialer.sbi (*)
2014-01-13 Includes\DialerC.sbi (*)
2013-04-11 Includes\HeavyDuty.sbi (*)
2014-01-08 Includes\Hijackers-000.sbi (*)
2014-01-08 Includes\Hijackers-001.sbi (*)
2014-01-08 Includes\Hijackers-C.sbi (*)
2014-01-08 Includes\Hijackers.sbi (*)
2014-01-13 Includes\HijackersC.sbi (*)
2014-01-08 Includes\iPhone-000.sbi (*)
2014-01-08 Includes\iPhone.sbi (*)
2014-01-08 Includes\Keyloggers-000.sbi (*)
2014-01-08 Includes\Keyloggers-C.sbi (*)
2014-01-08 Includes\Keyloggers.sbi (*)
2014-01-13 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2014-01-09 Includes\Malware-000.sbi (*)
2014-01-09 Includes\Malware-001.sbi (*)
2014-01-09 Includes\Malware-002.sbi (*)
2014-01-09 Includes\Malware-003.sbi (*)
2014-01-09 Includes\Malware-004.sbi (*)
2014-01-09 Includes\Malware-005.sbi (*)
2014-01-09 Includes\Malware-006.sbi (*)
2014-01-09 Includes\Malware-007.sbi (*)
2014-01-14 Includes\Malware-C.sbi (*)
2014-01-13 Includes\Malware.sbi (*)
2014-01-13 Includes\MalwareC.sbi (*)
2014-01-15 Includes\PUPS-000.sbi (*)
2014-01-15 Includes\PUPS-001.sbi (*)
2014-01-15 Includes\PUPS-002.sbi (*)
2014-01-21 Includes\PUPS-C.sbi (*)
2014-01-13 Includes\PUPS.sbi (*)
2014-01-13 Includes\PUPSC.sbi (*)
2010-01-25 Includes\Revision.sbi (*)
2014-01-08 Includes\Security-000.sbi (*)
2014-01-08 Includes\Security-C.sbi (*)
2014-01-08 Includes\Security.sbi (*)
2014-01-13 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2014-01-08 Includes\Spyware-000.sbi (*)
2014-01-08 Includes\Spyware-001.sbi (*)
2014-01-08 Includes\Spyware-C.sbi (*)
2014-01-08 Includes\Spyware.sbi (*)
2014-01-08 Includes\SpywareC.sbi (*)
2012-11-19 Includes\Tracks.uti
2014-01-15 Includes\Trojans-000.sbi (*)
2014-01-15 Includes\Trojans-001.sbi (*)
2014-01-15 Includes\Trojans-002.sbi (*)
2014-01-15 Includes\Trojans-003.sbi (*)
2014-01-15 Includes\Trojans-004.sbi (*)
2014-01-15 Includes\Trojans-005.sbi (*)
2014-01-15 Includes\Trojans-006.sbi (*)
2014-01-15 Includes\Trojans-007.sbi (*)
2014-01-15 Includes\Trojans-008.sbi (*)
2014-01-15 Includes\Trojans-009.sbi (*)
2014-01-09 Includes\Trojans-020.sbi (*)
2014-01-09 Includes\Trojans-021.sbi (*)
2014-01-09 Includes\Trojans-022.sbi (*)
2014-01-09 Includes\Trojans-023.sbi (*)
2014-01-22 Includes\Trojans-C.sbi (*)
2014-01-15 Includes\Trojans-OG-000.sbi (*)
2014-01-15 Includes\Trojans-TD-000.sbi (*)
2014-01-15 Includes\Trojans-VM-000.sbi (*)
2014-01-15 Includes\Trojans-VM-001.sbi (*)
2014-01-15 Includes\Trojans-VM-002.sbi (*)
2014-01-15 Includes\Trojans-VM-003.sbi (*)
2014-01-15 Includes\Trojans-VM-004.sbi (*)
2014-01-15 Includes\Trojans-VM-005.sbi (*)
2014-01-15 Includes\Trojans-VM-006.sbi (*)
2014-01-15 Includes\Trojans-VM-007.sbi (*)
2014-01-15 Includes\Trojans-VM-008.sbi (*)
2014-01-15 Includes\Trojans-VM-009.sbi (*)
2014-01-15 Includes\Trojans-VM-010.sbi (*)
2014-01-15 Includes\Trojans-VM-011.sbi (*)
2014-01-15 Includes\Trojans-VM-012.sbi (*)
2014-01-15 Includes\Trojans-VM-013.sbi (*)
2014-01-15 Includes\Trojans-VM-014.sbi (*)
2014-01-15 Includes\Trojans-VM-015.sbi (*)
2014-01-15 Includes\Trojans-VM-016.sbi (*)
2014-01-15 Includes\Trojans-VM-017.sbi (*)
2014-01-15 Includes\Trojans-VM-018.sbi (*)
2014-01-15 Includes\Trojans-VM-019.sbi (*)
2014-01-15 Includes\Trojans-VM-020.sbi (*)
2014-01-15 Includes\Trojans-VM-021.sbi (*)
2014-01-15 Includes\Trojans-VM-022.sbi (*)
2014-01-15 Includes\Trojans-VM-023.sbi (*)
2014-01-15 Includes\Trojans-VM-024.sbi (*)
2014-01-13 Includes\Trojans-VM-025.sbi (*)
2014-01-13 Includes\Trojans-VM-026.sbi (*)
2014-01-15 Includes\Trojans-ZB-000.sbi (*)
2014-01-15 Includes\Trojans-ZL-000.sbi (*)
2014-01-09 Includes\Trojans.sbi (*)
2010-03-10 Includes\TrojansC-01.sbi (*)
2014-01-09 Includes\TrojansC-02.sbi (*)
2014-01-09 Includes\TrojansC-03.sbi (*)
2014-01-16 Includes\TrojansC-04.sbi (*)
2014-01-09 Includes\TrojansC-05.sbi (*)
2014-01-09 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll
Code:
ATTFilter 28.01.2014 23:44:12 - ##### check started #####
28.01.2014 23:44:12 - ### Version: 1.6.2
28.01.2014 23:44:12 - ### Date: 28.01.2014 23:44:12
28.01.2014 23:44:17 - ##### checking bots #####
28.01.2014 23:45:58 - found: Yontoo.Pagerage Einstellungen
28.01.2014 23:45:58 - found: Yontoo.Pagerage Programm-Verzeichnis
29.01.2014 02:26:32 - ##### check finished #####
Code:
ATTFilter --- Report generated: 2014-01-29 02:26 ---
Yontoo.Pagerage: [SBI $7EA79EE0] Einstellungen (Registrierungsdatenbank-Schlüssel, nothing done)
HKEY_CLASSES_ROOT\CLSID\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}
Yontoo.Pagerage: [SBI $B64479C2] Programm-Verzeichnis (Verzeichnis, nothing done)
C:\Program Files (x86)\Yontoo\
--- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---
2009-01-26 blindman.exe (1.0.0.8)
2009-01-26 SDFiles.exe (1.6.1.7)
2009-01-26 SDMain.exe (1.0.0.6)
2009-01-26 SDShred.exe (1.0.2.5)
2009-01-26 SDUpdate.exe (1.6.0.12)
2009-01-26 SDWinSec.exe (1.0.0.12)
2009-01-26 SpybotSD.exe (1.6.2.46)
2009-03-05 TeaTimer.exe (1.6.6.32)
2012-02-17 unins000.exe (51.49.0.0)
2009-01-26 Update.exe (1.6.0.7)
2009-11-04 advcheck.dll (1.6.5.20)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2009-01-26 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2009-01-26 Tools.dll (2.1.6.10)
2009-01-16 UninsSrv.dll (1.0.0.0)
2014-01-08 Includes\Adware-000.sbi (*)
2014-01-08 Includes\Adware-001.sbi (*)
2014-01-22 Includes\Adware-C.sbi (*)
2014-01-08 Includes\Adware.sbi (*)
2014-01-13 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2014-01-08 Includes\Dialer-000.sbi (*)
2014-01-08 Includes\Dialer-001.sbi (*)
2014-01-08 Includes\Dialer-C.sbi (*)
2014-01-08 Includes\Dialer.sbi (*)
2014-01-13 Includes\DialerC.sbi (*)
2013-04-11 Includes\HeavyDuty.sbi (*)
2014-01-08 Includes\Hijackers-000.sbi (*)
2014-01-08 Includes\Hijackers-001.sbi (*)
2014-01-08 Includes\Hijackers-C.sbi (*)
2014-01-08 Includes\Hijackers.sbi (*)
2014-01-13 Includes\HijackersC.sbi (*)
2014-01-08 Includes\iPhone-000.sbi (*)
2014-01-08 Includes\iPhone.sbi (*)
2014-01-08 Includes\Keyloggers-000.sbi (*)
2014-01-08 Includes\Keyloggers-C.sbi (*)
2014-01-08 Includes\Keyloggers.sbi (*)
2014-01-13 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2014-01-09 Includes\Malware-000.sbi (*)
2014-01-09 Includes\Malware-001.sbi (*)
2014-01-09 Includes\Malware-002.sbi (*)
2014-01-09 Includes\Malware-003.sbi (*)
2014-01-09 Includes\Malware-004.sbi (*)
2014-01-09 Includes\Malware-005.sbi (*)
2014-01-09 Includes\Malware-006.sbi (*)
2014-01-09 Includes\Malware-007.sbi (*)
2014-01-14 Includes\Malware-C.sbi (*)
2014-01-13 Includes\Malware.sbi (*)
2014-01-13 Includes\MalwareC.sbi (*)
2014-01-15 Includes\PUPS-000.sbi (*)
2014-01-15 Includes\PUPS-001.sbi (*)
2014-01-15 Includes\PUPS-002.sbi (*)
2014-01-21 Includes\PUPS-C.sbi (*)
2014-01-13 Includes\PUPS.sbi (*)
2014-01-13 Includes\PUPSC.sbi (*)
2010-01-25 Includes\Revision.sbi (*)
2014-01-08 Includes\Security-000.sbi (*)
2014-01-08 Includes\Security-C.sbi (*)
2014-01-08 Includes\Security.sbi (*)
2014-01-13 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2014-01-08 Includes\Spyware-000.sbi (*)
2014-01-08 Includes\Spyware-001.sbi (*)
2014-01-08 Includes\Spyware-C.sbi (*)
2014-01-08 Includes\Spyware.sbi (*)
2014-01-08 Includes\SpywareC.sbi (*)
2012-11-19 Includes\Tracks.uti
2014-01-15 Includes\Trojans-000.sbi (*)
2014-01-15 Includes\Trojans-001.sbi (*)
2014-01-15 Includes\Trojans-002.sbi (*)
2014-01-15 Includes\Trojans-003.sbi (*)
2014-01-15 Includes\Trojans-004.sbi (*)
2014-01-15 Includes\Trojans-005.sbi (*)
2014-01-15 Includes\Trojans-006.sbi (*)
2014-01-15 Includes\Trojans-007.sbi (*)
2014-01-15 Includes\Trojans-008.sbi (*)
2014-01-15 Includes\Trojans-009.sbi (*)
2014-01-09 Includes\Trojans-020.sbi (*)
2014-01-09 Includes\Trojans-021.sbi (*)
2014-01-09 Includes\Trojans-022.sbi (*)
2014-01-09 Includes\Trojans-023.sbi (*)
2014-01-22 Includes\Trojans-C.sbi (*)
2014-01-15 Includes\Trojans-OG-000.sbi (*)
2014-01-15 Includes\Trojans-TD-000.sbi (*)
2014-01-15 Includes\Trojans-VM-000.sbi (*)
2014-01-15 Includes\Trojans-VM-001.sbi (*)
2014-01-15 Includes\Trojans-VM-002.sbi (*)
2014-01-15 Includes\Trojans-VM-003.sbi (*)
2014-01-15 Includes\Trojans-VM-004.sbi (*)
2014-01-15 Includes\Trojans-VM-005.sbi (*)
2014-01-15 Includes\Trojans-VM-006.sbi (*)
2014-01-15 Includes\Trojans-VM-007.sbi (*)
2014-01-15 Includes\Trojans-VM-008.sbi (*)
2014-01-15 Includes\Trojans-VM-009.sbi (*)
2014-01-15 Includes\Trojans-VM-010.sbi (*)
2014-01-15 Includes\Trojans-VM-011.sbi (*)
2014-01-15 Includes\Trojans-VM-012.sbi (*)
2014-01-15 Includes\Trojans-VM-013.sbi (*)
2014-01-15 Includes\Trojans-VM-014.sbi (*)
2014-01-15 Includes\Trojans-VM-015.sbi (*)
2014-01-15 Includes\Trojans-VM-016.sbi (*)
2014-01-15 Includes\Trojans-VM-017.sbi (*)
2014-01-15 Includes\Trojans-VM-018.sbi (*)
2014-01-15 Includes\Trojans-VM-019.sbi (*)
2014-01-15 Includes\Trojans-VM-020.sbi (*)
2014-01-15 Includes\Trojans-VM-021.sbi (*)
2014-01-15 Includes\Trojans-VM-022.sbi (*)
2014-01-15 Includes\Trojans-VM-023.sbi (*)
2014-01-15 Includes\Trojans-VM-024.sbi (*)
2014-01-13 Includes\Trojans-VM-025.sbi (*)
2014-01-13 Includes\Trojans-VM-026.sbi (*)
2014-01-15 Includes\Trojans-ZB-000.sbi (*)
2014-01-15 Includes\Trojans-ZL-000.sbi (*)
2014-01-09 Includes\Trojans.sbi (*)
2010-03-10 Includes\TrojansC-01.sbi (*)
2014-01-09 Includes\TrojansC-02.sbi (*)
2014-01-09 Includes\TrojansC-03.sbi (*)
2014-01-16 Includes\TrojansC-04.sbi (*)
2014-01-09 Includes\TrojansC-05.sbi (*)
2014-01-09 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll
Code:
ATTFilter --- Report generated: 2014-01-28 23:40 ---
Babylon.Toolbar: [SBI $D38EAB50] Root class (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonIEPI.BabylonIEBho
Babylon.Toolbar: [SBI $D38EAB50] Root class (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonIEPI.BabylonIEBho.1
Babylon.Toolbar: [SBI $D38EAB50] Browser helper object (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9CFACCB6-2F3F-4177-94EA-0D2B72D384C1}
Babylon.Toolbar: [SBI $D38EAB50] Root class (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonIEPI.BabylonIEBho.1
Babylon.Toolbar: [SBI $D38EAB50] Root class (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonIEPI.BabylonIEBho
Babylon.Toolbar: [SBI $29AE2B9C] Interface (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{5F339F0B-716F-408F-A627-DEEB5DEB4020}
Babylon.Toolbar: [SBI $29AE2B9C] Interface (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{5F339F0B-716F-408F-A627-DEEB5DEB4020}
Babylon.Toolbar: [SBI $F71D8013] Type library (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\TypeLib\{A1489C85-4F6F-48C4-AC9E-18B63AF4703E}
Babylon.Toolbar: [SBI $F71D8013] Type library (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\TypeLib\{A1489C85-4F6F-48C4-AC9E-18B63AF4703E}
Babylon.Toolbar: [SBI $B78C9286] Root class (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonTC.GingerApplication
Babylon.Toolbar: [SBI $B78C9286] Root class (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonTC.GingerApplication.1
Babylon.Toolbar: [SBI $B78C9286] Class ID (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF390AA1-1E65-4825-B8E7-BE6B47BD56B8}
Babylon.Toolbar: [SBI $B78C9286] Root class (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonTC.GingerApplication.1
Babylon.Toolbar: [SBI $B78C9286] Root class (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonTC.GingerApplication
Babylon.Toolbar: [SBI $D5B3BDB3] Interface (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{95734BDE-B702-45B9-86E5-27676729F904}
Babylon.Toolbar: [SBI $D5B3BDB3] Interface (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{95734BDE-B702-45B9-86E5-27676729F904}
Babylon.Toolbar: [SBI $C4D83F28] Interface (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{D0482C8E-BAEA-4943-911A-B661060F56A7}
Babylon.Toolbar: [SBI $C4D83F28] Interface (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{D0482C8E-BAEA-4943-911A-B661060F56A7}
Babylon.Toolbar: [SBI $A580934F] Type library (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\TypeLib\{0C2E529C-A82C-4AC6-8807-0B51F7AD7BB2}
Babylon.Toolbar: [SBI $A580934F] Type library (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\TypeLib\{0C2E529C-A82C-4AC6-8807-0B51F7AD7BB2}
Babylon.Toolbar: [SBI $D3F051C5] Root class (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonOfficeAddin.OfficeAddin
Babylon.Toolbar: [SBI $D3F051C5] Root class (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonOfficeAddin.OfficeAddin.1
Babylon.Toolbar: [SBI $D3F051C5] Class ID (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6AC0BB10-C922-45e2-857D-2A368FE749E5}
Babylon.Toolbar: [SBI $D3F051C5] Root class (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonOfficeAddin.OfficeAddin.1
Babylon.Toolbar: [SBI $D3F051C5] Root class (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabylonOfficeAddin.OfficeAddin
Babylon.Toolbar: [SBI $78209C48] Interface (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{B7EA2226-F876-4BE4-B478-76EBAE2A668A}
Babylon.Toolbar: [SBI $78209C48] Interface (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{B7EA2226-F876-4BE4-B478-76EBAE2A668A}
Babylon.Toolbar: [SBI $37F4A137] Type library (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\TypeLib\{F310F027-15CB-4A7F-B10D-3A4AFB5013A5}
Babylon.Toolbar: [SBI $37F4A137] Type library (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\TypeLib\{F310F027-15CB-4A7F-B10D-3A4AFB5013A5}
Babylon.Toolbar: [SBI $DEB52F26] Programm-Verzeichnis (Verzeichnis, fixed)
C:\ProgramData\Babylon\
Babylon.Toolbar: [SBI $5AB447BB] Programm-Verzeichnis (Verzeichnis, fixed)
C:\Users\Admin\AppData\Roaming\Babylon\
Babylon.Toolbar: [SBI $412C008F] Programm-Verzeichnis (Verzeichnis, fixed)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\
Babylon.Toolbar: [SBI $CE671685] Daten (Datei, fixed)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\adapter@gingersoftware.conf
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
Babylon.Toolbar: [SBI $D4EFC7FB] Daten (Datei, fixed)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome.manifest
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
Babylon.Toolbar: [SBI $511F2520] Daten (Datei, fixed)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\install.js
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
Babylon.Toolbar: [SBI $23E95F55] Daten (Datei, fixed)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\install.rdf
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
Babylon.Toolbar: [SBI $4E3A325A] Programm-Verzeichnis (Verzeichnis, fixed)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome\
Babylon.Toolbar: [SBI $29CFF1C4] Programm-Verzeichnis (Verzeichnis, fixed)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome\content\
Babylon.Toolbar: [SBI $2D7FE41F] Daten (Datei, fixed)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome\content\about.xul
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
Babylon.Toolbar: [SBI $50EE7AF4] Daten (Datei, fixed)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome\content\contents.rdf
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
Babylon.Toolbar: [SBI $94D72843] Daten (Datei, fixed)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome\content\gingerAPI.js
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
Babylon.Toolbar: [SBI $6EF93362] Daten (Datei, fixed)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome\content\gingerOverlay.js
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
Babylon.Toolbar: [SBI $D51125CF] Daten (Datei, fixed)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome\content\gingerOverlay.xul
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
Babylon.Toolbar: [SBI $A3C0635E] Programm-Verzeichnis (Verzeichnis, fixed)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome\skin\
Babylon.Toolbar: [SBI $F0DFFEBF] Bild (Datei, fixed)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome\skin\gingerb.gif
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
Babylon.Toolbar: [SBI $E737F68D] Daten (Datei, fixed)
C:\Program Files (x86)\Mozilla Firefox\extensions\adapter@babylontc.com\chrome\skin\gingers.png
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
Babylon.Toolbar: [SBI $43087DA2] Programm-Verzeichnis (Verzeichnis, fixed)
C:\Program Files (x86)\Mozilla Firefox\extensions\ocr@babylon.com\
Babylon.Toolbar: [SBI $C9A43556] Programm-Verzeichnis (Verzeichnis, fixed)
C:\Program Files (x86)\Mozilla Firefox\extensions\ocr@babylon.com\chrome\
Babylon.Toolbar: [SBI $9F6DC1B4] Programm-Verzeichnis (Verzeichnis, fixed)
C:\Program Files (x86)\Mozilla Firefox\extensions\ocr@babylon.com\chrome\content\
Babylon.Toolbar: [SBI $A17EC3B7] Daten (Datei, fixed)
C:\Program Files (x86)\Mozilla Firefox\extensions\ocr@babylon.com\chrome\content\overlay.js
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
Babylon.Toolbar: [SBI $5E8F1A00] Daten (Datei, fixed)
C:\Program Files (x86)\Mozilla Firefox\extensions\ocr@babylon.com\chrome\content\overlay.xul
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
Babylon.Toolbar: [SBI $A209F3A6] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\AppID\{B16632F1-24E0-4D99-A68D-70BFB6447C48}
Babylon.Toolbar: [SBI $A209F3A6] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\AppID\{B16632F1-24E0-4D99-A68D-70BFB6447C48}
Babylon.Toolbar: [SBI $6E59B901] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\AppID\{C0CEA572-2978-4DFC-A672-8100FF0E276A}
Babylon.Toolbar: [SBI $6E59B901] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\AppID\{C0CEA572-2978-4DFC-A672-8100FF0E276A}
Babylon.Toolbar: [SBI $FEF58AA2] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\AppID\BabylonIEPI.DLL
Babylon.Toolbar: [SBI $FEF58AA2] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\AppID\BabylonIEPI.DLL
Babylon.Toolbar: [SBI $7FCAFBEE] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\AppID\BabylonTC.EXE
Babylon.Toolbar: [SBI $7FCAFBEE] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\AppID\BabylonTC.EXE
Babylon.Toolbar: [SBI $1D44F4BC] Root class (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabyDict
Babylon.Toolbar: [SBI $1D44F4BC] Root class (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabyDict
Babylon.Toolbar: [SBI $67E52DCC] Root class (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabyGloss
Babylon.Toolbar: [SBI $67E52DCC] Root class (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabyGloss
Babylon.Toolbar: [SBI $984850BB] Root class (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabyOptFile
Babylon.Toolbar: [SBI $984850BB] Root class (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BabyOptFile
Babylon.Toolbar: [SBI $EF9F91BD] Interface (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{431FB0E5-2CBB-4602-9FE6-F1D64488ADD7}
Babylon.Toolbar: [SBI $EF9F91BD] Interface (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{431FB0E5-2CBB-4602-9FE6-F1D64488ADD7}
Babylon.Toolbar: [SBI $CB12A362] Interface (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{5C9A230D-70A5-11D5-AFB0-0050DAC67890}
Babylon.Toolbar: [SBI $CB12A362] Interface (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{5C9A230D-70A5-11D5-AFB0-0050DAC67890}
Babylon.Toolbar: [SBI $BA2C56C1] Interface (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{8911483C-C00A-4183-9FBC-6C9C00946C15}
Babylon.Toolbar: [SBI $BA2C56C1] Interface (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{8911483C-C00A-4183-9FBC-6C9C00946C15}
Babylon.Toolbar: [SBI $37834D71] Interface (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{C3F058A9-407D-4CD1-8F66-B75605B54B69}
Babylon.Toolbar: [SBI $37834D71] Interface (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{C3F058A9-407D-4CD1-8F66-B75605B54B69}
Babylon.Toolbar: [SBI $5A2CDEF9] Interface (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{EFDCAF05-D29C-4D4D-9836-8CDCD606A6B2}
Babylon.Toolbar: [SBI $5A2CDEF9] Interface (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{EFDCAF05-D29C-4D4D-9836-8CDCD606A6B2}
Babylon.Toolbar: [SBI $0F92EB5E] Type library (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\TypeLib\{5C9A2304-70A5-11D5-AFB0-0050DAC67890}
Babylon.Toolbar: [SBI $0F92EB5E] Type library (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\TypeLib\{5C9A2304-70A5-11D5-AFB0-0050DAC67890}
Babylon.Toolbar: [SBI $D1EDD9CA] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Babylon
Babylon.Toolbar: [SBI $263D482A] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Babylon.exe
Babylon.Toolbar: [SBI $263D482A] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Babylon.exe
Babylon.Toolbar: [SBI $17EC4174] Benutzereinstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\Microsoft\Internet Explorer\MenuExt\Translate this web page with Babylon
Babylon.Toolbar: [SBI $71605A8D] Benutzereinstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\Microsoft\Internet Explorer\MenuExt\Translate with Babylon
Babylon.Toolbar: [SBI $E7C4E204] Benutzereinstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\Microsoft\Office\PowerPoint\Addins\BabylonOfficeAddin.OfficeAddin
Babylon.Toolbar: [SBI $EA382E69] Benutzereinstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\Microsoft\Office\Word\Addins\BabylonOfficeAddin.OfficeAddin
Babylon.Toolbar: [SBI $CABFC738] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478}
Babylon.Toolbar: [SBI $F8D06006] Benutzereinstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\BabylonToolbar
Delta.Toolbar: [SBI $20319BF7] Benutzereinstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\DataMngr
Delta.Toolbar: [SBI $15E43F9C] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\DataMngr
Delta.Toolbar: [SBI $6BE91D8E] Benutzereinstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\DataMngr_Toolbar
Delta.Toolbar: [SBI $4FE1D2EF] Benutzereinstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
Delta.Toolbar: [SBI $04AEAE14] Benutzereinstellungen (Registrierungsdatenbank-Wert, fixed)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\Microsoft\Internet Explorer\TabbedBrowsing\bProtectNewTabPageShow
Delta.Toolbar: [SBI $0760E887] Benutzereinstellungen (Registrierungsdatenbank-Wert, fixed)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\Microsoft\Internet Explorer\TabbedBrowsing\bProtectShowTabsWelcome
Delta.Toolbar: [SBI $601A04F4] Konfigurations-Datei (Datei, fixed)
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7k1i9pr.default\searchplugins\babylon.xml
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
Delta.Toolbar: [SBI $4169E8D4] Daten (Datei, fixed)
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7k1i9pr.default\bProtector_extensions.rdf
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
Yontoo.Pagerage: [SBI $7B5B72A1] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Yontoo.Pagerage: [SBI $F328E28A] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Yontoo.Pagerage: [SBI $71FBD431] Uninstall-Einstellung (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
Yontoo.Pagerage: [SBI $FCA7CE62] Autorun-Einstellungen (Yontoo Desktop) (Registrierungsdatenbank-Wert, fixed)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yontoo Desktop
Yontoo.Pagerage: [SBI $FCA7CE62] Programmdatei (Datei, fixed)
C:\Users\Admin\AppData\Roaming\Yontoo\YontooDesktop.exe
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
Yontoo.Pagerage: [SBI $7EA79EE0] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\CLSID\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}
Yontoo.Pagerage: [SBI $73A90B7D] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Yontoo.Pagerage: [SBI $73A90B7D] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Yontoo.Pagerage: [SBI $2DBD7A06] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\AppID\YontooIEClient.DLL
Yontoo.Pagerage: [SBI $2DBD7A06] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\AppID\YontooIEClient.DLL
Yontoo.Pagerage: [SBI $123F4BC9] Einstellungen (Registrierungsdatenbank-Wert, fixing failed)
HKEY_CLASSES_ROOT\AppID\YontooIEClient.DLL\AppID
Yontoo.Pagerage: [SBI $123F4BC9] Einstellungen (Registrierungsdatenbank-Wert, fixing failed)
HKEY_CLASSES_ROOT\AppID\YontooIEClient.DLL\AppID
Yontoo.Pagerage: [SBI $EFBC03B1] Root class (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\YontooIEClient.Layers
Yontoo.Pagerage: [SBI $EFBC03B1] Root class (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\YontooIEClient.Layers.1
Yontoo.Pagerage: [SBI $EFBC03B1] Class ID (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Yontoo.Pagerage: [SBI $EFBC03B1] Browser helper object (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Yontoo.Pagerage: [SBI $EFBC03B1] Root class (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\YontooIEClient.Layers.1
Yontoo.Pagerage: [SBI $EFBC03B1] Root class (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\YontooIEClient.Layers
Yontoo.Pagerage: [SBI $2ADF7DD5] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Yontoo.Pagerage: [SBI $2ADF7DD5] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Yontoo.Pagerage: [SBI $61D90200] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Yontoo.Pagerage: [SBI $61D90200] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Yontoo.Pagerage: [SBI $5CAD9242] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Yontoo.Pagerage: [SBI $5CAD9242] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Yontoo.Pagerage: [SBI $9297A7A9] Root class (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\YontooIEClient.Api
Yontoo.Pagerage: [SBI $9297A7A9] Root class (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\YontooIEClient.Api.1
Yontoo.Pagerage: [SBI $9297A7A9] Class ID (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Yontoo.Pagerage: [SBI $9297A7A9] Root class (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\YontooIEClient.Api.1
Yontoo.Pagerage: [SBI $9297A7A9] Root class (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\YontooIEClient.Api
Yontoo.Pagerage: [SBI $FC035EA7] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Yontoo Desktop Updater
Yontoo.Pagerage: [SBI $FC035EA7] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Yontoo Desktop Updater
Yontoo.Pagerage: [SBI $0EA27B0B] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Yontoo Desktop Updater
Yontoo.Pagerage: [SBI $0EA27B0B] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Yontoo Desktop Updater
Yontoo.Pagerage: [SBI $58D245DE] Programm-Verzeichnis (Verzeichnis, fixing failed)
C:\Users\Admin\AppData\Roaming\Yontoo\
Yontoo.Pagerage: [SBI $B64479C2] Programm-Verzeichnis (Verzeichnis, fixing failed)
C:\Program Files (x86)\Yontoo\
Yontoo.Pagerage: [SBI $8A37162B] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Yontoo.Pagerage: [SBI $879BC3EE] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\CLSID\{FE9271F2-6EFD-44b0-A826-84C829536E93}
1ClickDownload: [SBI $BC81CA90] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\1ClickDownload
1ClickDownload: [SBI $6FA3752D] Uninstall-Einstellung (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload
Delta.Toolbar: [SBI $924A2839] Einstellungen (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_LOCAL_MACHINE\SOFTWARE\Babylon\Babylon Client
Delta.Toolbar: [SBI $C87F6C5D] Daten (Datei, fixed)
C:\Users\Admin\AppData\Roaming\Babylon\log_file.txt
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
WebCake.BHO: [SBI $2698E3E6] Programm-Verzeichnis (Verzeichnis, fixed)
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\
WebCake.BHO: [SBI $885FF297] Bibliothek (Datei, fixed)
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setup.dll
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
WebCake.BHO: [SBI $0A5B161A] Bibliothek (Datei, fixed)
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
WebCake.BHO: [SBI $1107F102] Daten (Datei, fixed)
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.dat
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
WebCake.BHO: [SBI $E98B8D0E] Ausführbare Datei (Datei, fixed)
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
WebCake.BHO: [SBI $370B837B] Bild (Datei, fixed)
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.ico
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
Win32.Downloader.gen: [SBI $82F4FAFD] Daten (Datei, fixed)
C:\END
Properties.size=0
Properties.md5=D41D8CD98F00B204E9800998ECF8427E
DownloadSponsor: [SBI $CC437C6B] Einstellungen (Registrierungsdatenbank-Wert, fixed)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\OCS\lastPID=...freewarede...
DownloadSponsor: [SBI $980DE8E4] Einstellungen (Registrierungsdatenbank-Wert, fixed)
HKEY_USERS\S-1-5-21-739932340-378401146-3079080163-1005\Software\OCS\PID=...freewarede...
Benutzer-Abbruch: Überprüfung wurde nicht vollständig durchgeführt! (Status)
--- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---
2009-01-26 blindman.exe (1.0.0.8)
2009-01-26 SDFiles.exe (1.6.1.7)
2009-01-26 SDMain.exe (1.0.0.6)
2009-01-26 SDShred.exe (1.0.2.5)
2009-01-26 SDUpdate.exe (1.6.0.12)
2009-01-26 SDWinSec.exe (1.0.0.12)
2009-01-26 SpybotSD.exe (1.6.2.46)
2009-03-05 TeaTimer.exe (1.6.6.32)
2012-02-17 unins000.exe (51.49.0.0)
2009-01-26 Update.exe (1.6.0.7)
2009-11-04 advcheck.dll (1.6.5.20)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2009-01-26 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2009-01-26 Tools.dll (2.1.6.10)
2009-01-16 UninsSrv.dll (1.0.0.0)
2014-01-08 Includes\Adware-000.sbi (*)
2014-01-08 Includes\Adware-001.sbi (*)
2014-01-22 Includes\Adware-C.sbi (*)
2014-01-08 Includes\Adware.sbi (*)
2014-01-13 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2014-01-08 Includes\Dialer-000.sbi (*)
2014-01-08 Includes\Dialer-001.sbi (*)
2014-01-08 Includes\Dialer-C.sbi (*)
2014-01-08 Includes\Dialer.sbi (*)
2014-01-13 Includes\DialerC.sbi (*)
2013-04-11 Includes\HeavyDuty.sbi (*)
2014-01-08 Includes\Hijackers-000.sbi (*)
2014-01-08 Includes\Hijackers-001.sbi (*)
2014-01-08 Includes\Hijackers-C.sbi (*)
2014-01-08 Includes\Hijackers.sbi (*)
2014-01-13 Includes\HijackersC.sbi (*)
2014-01-08 Includes\iPhone-000.sbi (*)
2014-01-08 Includes\iPhone.sbi (*)
2014-01-08 Includes\Keyloggers-000.sbi (*)
2014-01-08 Includes\Keyloggers-C.sbi (*)
2014-01-08 Includes\Keyloggers.sbi (*)
2014-01-13 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2014-01-09 Includes\Malware-000.sbi (*)
2014-01-09 Includes\Malware-001.sbi (*)
2014-01-09 Includes\Malware-002.sbi (*)
2014-01-09 Includes\Malware-003.sbi (*)
2014-01-09 Includes\Malware-004.sbi (*)
2014-01-09 Includes\Malware-005.sbi (*)
2014-01-09 Includes\Malware-006.sbi (*)
2014-01-09 Includes\Malware-007.sbi (*)
2014-01-14 Includes\Malware-C.sbi (*)
2014-01-13 Includes\Malware.sbi (*)
2014-01-13 Includes\MalwareC.sbi (*)
2014-01-15 Includes\PUPS-000.sbi (*)
2014-01-15 Includes\PUPS-001.sbi (*)
2014-01-15 Includes\PUPS-002.sbi (*)
2014-01-21 Includes\PUPS-C.sbi (*)
2014-01-13 Includes\PUPS.sbi (*)
2014-01-13 Includes\PUPSC.sbi (*)
2010-01-25 Includes\Revision.sbi (*)
2014-01-08 Includes\Security-000.sbi (*)
2014-01-08 Includes\Security-C.sbi (*)
2014-01-08 Includes\Security.sbi (*)
2014-01-13 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2014-01-08 Includes\Spyware-000.sbi (*)
2014-01-08 Includes\Spyware-001.sbi (*)
2014-01-08 Includes\Spyware-C.sbi (*)
2014-01-08 Includes\Spyware.sbi (*)
2014-01-08 Includes\SpywareC.sbi (*)
2012-11-19 Includes\Tracks.uti
2014-01-15 Includes\Trojans-000.sbi (*)
2014-01-15 Includes\Trojans-001.sbi (*)
2014-01-15 Includes\Trojans-002.sbi (*)
2014-01-15 Includes\Trojans-003.sbi (*)
2014-01-15 Includes\Trojans-004.sbi (*)
2014-01-15 Includes\Trojans-005.sbi (*)
2014-01-15 Includes\Trojans-006.sbi (*)
2014-01-15 Includes\Trojans-007.sbi (*)
2014-01-15 Includes\Trojans-008.sbi (*)
2014-01-15 Includes\Trojans-009.sbi (*)
2014-01-09 Includes\Trojans-020.sbi (*)
2014-01-09 Includes\Trojans-021.sbi (*)
2014-01-09 Includes\Trojans-022.sbi (*)
2014-01-09 Includes\Trojans-023.sbi (*)
2014-01-22 Includes\Trojans-C.sbi (*)
2014-01-15 Includes\Trojans-OG-000.sbi (*)
2014-01-15 Includes\Trojans-TD-000.sbi (*)
2014-01-15 Includes\Trojans-VM-000.sbi (*)
2014-01-15 Includes\Trojans-VM-001.sbi (*)
2014-01-15 Includes\Trojans-VM-002.sbi (*)
2014-01-15 Includes\Trojans-VM-003.sbi (*)
2014-01-15 Includes\Trojans-VM-004.sbi (*)
2014-01-15 Includes\Trojans-VM-005.sbi (*)
2014-01-15 Includes\Trojans-VM-006.sbi (*)
2014-01-15 Includes\Trojans-VM-007.sbi (*)
2014-01-15 Includes\Trojans-VM-008.sbi (*)
2014-01-15 Includes\Trojans-VM-009.sbi (*)
2014-01-15 Includes\Trojans-VM-010.sbi (*)
2014-01-15 Includes\Trojans-VM-011.sbi (*)
2014-01-15 Includes\Trojans-VM-012.sbi (*)
2014-01-15 Includes\Trojans-VM-013.sbi (*)
2014-01-15 Includes\Trojans-VM-014.sbi (*)
2014-01-15 Includes\Trojans-VM-015.sbi (*)
2014-01-15 Includes\Trojans-VM-016.sbi (*)
2014-01-15 Includes\Trojans-VM-017.sbi (*)
2014-01-15 Includes\Trojans-VM-018.sbi (*)
2014-01-15 Includes\Trojans-VM-019.sbi (*)
2014-01-15 Includes\Trojans-VM-020.sbi (*)
2014-01-15 Includes\Trojans-VM-021.sbi (*)
2014-01-15 Includes\Trojans-VM-022.sbi (*)
2014-01-15 Includes\Trojans-VM-023.sbi (*)
2014-01-15 Includes\Trojans-VM-024.sbi (*)
2014-01-13 Includes\Trojans-VM-025.sbi (*)
2014-01-13 Includes\Trojans-VM-026.sbi (*)
2014-01-15 Includes\Trojans-ZB-000.sbi (*)
2014-01-15 Includes\Trojans-ZL-000.sbi (*)
2014-01-09 Includes\Trojans.sbi (*)
2010-03-10 Includes\TrojansC-01.sbi (*)
2014-01-09 Includes\TrojansC-02.sbi (*)
2014-01-09 Includes\TrojansC-03.sbi (*)
2014-01-16 Includes\TrojansC-04.sbi (*)
2014-01-09 Includes\TrojansC-05.sbi (*)
2014-01-09 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll
Code:
ATTFilter --- Report generated: 2014-01-29 07:11 ---
Yontoo.Pagerage: [SBI $7EA79EE0] Einstellungen (Registrierungsdatenbank-Schlüssel, fixed)
HKEY_CLASSES_ROOT\CLSID\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}
Yontoo.Pagerage: [SBI $B64479C2] Programm-Verzeichnis (Verzeichnis, fixed)
C:\Program Files (x86)\Yontoo\
--- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---
2009-01-26 blindman.exe (1.0.0.8)
2009-01-26 SDFiles.exe (1.6.1.7)
2009-01-26 SDMain.exe (1.0.0.6)
2009-01-26 SDShred.exe (1.0.2.5)
2009-01-26 SDUpdate.exe (1.6.0.12)
2009-01-26 SDWinSec.exe (1.0.0.12)
2009-01-26 SpybotSD.exe (1.6.2.46)
2009-03-05 TeaTimer.exe (1.6.6.32)
2012-02-17 unins000.exe (51.49.0.0)
2009-01-26 Update.exe (1.6.0.7)
2009-11-04 advcheck.dll (1.6.5.20)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2009-01-26 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2009-01-26 Tools.dll (2.1.6.10)
2009-01-16 UninsSrv.dll (1.0.0.0)
2014-01-08 Includes\Adware-000.sbi (*)
2014-01-08 Includes\Adware-001.sbi (*)
2014-01-22 Includes\Adware-C.sbi (*)
2014-01-08 Includes\Adware.sbi (*)
2014-01-13 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2014-01-08 Includes\Dialer-000.sbi (*)
2014-01-08 Includes\Dialer-001.sbi (*)
2014-01-08 Includes\Dialer-C.sbi (*)
2014-01-08 Includes\Dialer.sbi (*)
2014-01-13 Includes\DialerC.sbi (*)
2013-04-11 Includes\HeavyDuty.sbi (*)
2014-01-08 Includes\Hijackers-000.sbi (*)
2014-01-08 Includes\Hijackers-001.sbi (*)
2014-01-08 Includes\Hijackers-C.sbi (*)
2014-01-08 Includes\Hijackers.sbi (*)
2014-01-13 Includes\HijackersC.sbi (*)
2014-01-08 Includes\iPhone-000.sbi (*)
2014-01-08 Includes\iPhone.sbi (*)
2014-01-08 Includes\Keyloggers-000.sbi (*)
2014-01-08 Includes\Keyloggers-C.sbi (*)
2014-01-08 Includes\Keyloggers.sbi (*)
2014-01-13 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2014-01-09 Includes\Malware-000.sbi (*)
2014-01-09 Includes\Malware-001.sbi (*)
2014-01-09 Includes\Malware-002.sbi (*)
2014-01-09 Includes\Malware-003.sbi (*)
2014-01-09 Includes\Malware-004.sbi (*)
2014-01-09 Includes\Malware-005.sbi (*)
2014-01-09 Includes\Malware-006.sbi (*)
2014-01-09 Includes\Malware-007.sbi (*)
2014-01-14 Includes\Malware-C.sbi (*)
2014-01-13 Includes\Malware.sbi (*)
2014-01-13 Includes\MalwareC.sbi (*)
2014-01-15 Includes\PUPS-000.sbi (*)
2014-01-15 Includes\PUPS-001.sbi (*)
2014-01-15 Includes\PUPS-002.sbi (*)
2014-01-21 Includes\PUPS-C.sbi (*)
2014-01-13 Includes\PUPS.sbi (*)
2014-01-13 Includes\PUPSC.sbi (*)
2010-01-25 Includes\Revision.sbi (*)
2014-01-08 Includes\Security-000.sbi (*)
2014-01-08 Includes\Security-C.sbi (*)
2014-01-08 Includes\Security.sbi (*)
2014-01-13 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2014-01-08 Includes\Spyware-000.sbi (*)
2014-01-08 Includes\Spyware-001.sbi (*)
2014-01-08 Includes\Spyware-C.sbi (*)
2014-01-08 Includes\Spyware.sbi (*)
2014-01-08 Includes\SpywareC.sbi (*)
2012-11-19 Includes\Tracks.uti
2014-01-15 Includes\Trojans-000.sbi (*)
2014-01-15 Includes\Trojans-001.sbi (*)
2014-01-15 Includes\Trojans-002.sbi (*)
2014-01-15 Includes\Trojans-003.sbi (*)
2014-01-15 Includes\Trojans-004.sbi (*)
2014-01-15 Includes\Trojans-005.sbi (*)
2014-01-15 Includes\Trojans-006.sbi (*)
2014-01-15 Includes\Trojans-007.sbi (*)
2014-01-15 Includes\Trojans-008.sbi (*)
2014-01-15 Includes\Trojans-009.sbi (*)
2014-01-09 Includes\Trojans-020.sbi (*)
2014-01-09 Includes\Trojans-021.sbi (*)
2014-01-09 Includes\Trojans-022.sbi (*)
2014-01-09 Includes\Trojans-023.sbi (*)
2014-01-22 Includes\Trojans-C.sbi (*)
2014-01-15 Includes\Trojans-OG-000.sbi (*)
2014-01-15 Includes\Trojans-TD-000.sbi (*)
2014-01-15 Includes\Trojans-VM-000.sbi (*)
2014-01-15 Includes\Trojans-VM-001.sbi (*)
2014-01-15 Includes\Trojans-VM-002.sbi (*)
2014-01-15 Includes\Trojans-VM-003.sbi (*)
2014-01-15 Includes\Trojans-VM-004.sbi (*)
2014-01-15 Includes\Trojans-VM-005.sbi (*)
2014-01-15 Includes\Trojans-VM-006.sbi (*)
2014-01-15 Includes\Trojans-VM-007.sbi (*)
2014-01-15 Includes\Trojans-VM-008.sbi (*)
2014-01-15 Includes\Trojans-VM-009.sbi (*)
2014-01-15 Includes\Trojans-VM-010.sbi (*)
2014-01-15 Includes\Trojans-VM-011.sbi (*)
2014-01-15 Includes\Trojans-VM-012.sbi (*)
2014-01-15 Includes\Trojans-VM-013.sbi (*)
2014-01-15 Includes\Trojans-VM-014.sbi (*)
2014-01-15 Includes\Trojans-VM-015.sbi (*)
2014-01-15 Includes\Trojans-VM-016.sbi (*)
2014-01-15 Includes\Trojans-VM-017.sbi (*)
2014-01-15 Includes\Trojans-VM-018.sbi (*)
2014-01-15 Includes\Trojans-VM-019.sbi (*)
2014-01-15 Includes\Trojans-VM-020.sbi (*)
2014-01-15 Includes\Trojans-VM-021.sbi (*)
2014-01-15 Includes\Trojans-VM-022.sbi (*)
2014-01-15 Includes\Trojans-VM-023.sbi (*)
2014-01-15 Includes\Trojans-VM-024.sbi (*)
2014-01-13 Includes\Trojans-VM-025.sbi (*)
2014-01-13 Includes\Trojans-VM-026.sbi (*)
2014-01-15 Includes\Trojans-ZB-000.sbi (*)
2014-01-15 Includes\Trojans-ZL-000.sbi (*)
2014-01-09 Includes\Trojans.sbi (*)
2010-03-10 Includes\TrojansC-01.sbi (*)
2014-01-09 Includes\TrojansC-02.sbi (*)
2014-01-09 Includes\TrojansC-03.sbi (*)
2014-01-16 Includes\TrojansC-04.sbi (*)
2014-01-09 Includes\TrojansC-05.sbi (*)
2014-01-09 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll
|
|
30.01.2014, 14:37
| #10 |
| /// the machine /// TB-Ausbilder | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
30.01.2014, 20:33
| #11 |
| | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Nr. 1 Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.01.30.04 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 Admin :: *****-PC [Administrator] 30.01.2014 15:46:45 mbam-log-2014-01-30 (15-46-45).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 298744 Laufzeit: 8 Minute(n), 59 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 1 HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 6 C:\Users\Admin\AppData\Local\Temp\mt_ffx\Delta (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\mt_ffx\Delta\delta (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\mt_ffx\Delta\delta\1.8.16.16 (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\ct3288691 (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\ct3297265 (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Admin\AppData\Local\Temp\ct3297861 (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 4 C:\Users\*****\Downloads\cdbxp_setup_4.5.2.4214_minimal.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\*****\Downloads\FreeFileSync_5.11_setup.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\*****\Downloads\FreeFileSync_5.12_setup.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\*****\Downloads\FreeFileSync_5.15_Windows_Setup.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) FRST folgt. ..und >Hilfe< keine Thunderbird-Daten mehr vorhanden. Außer einer Adresse im Adressbuch. Code:
ATTFilter # AdwCleaner v3.018 - Bericht erstellt am 30/01/2014 um 16:42:03
# Updated 28/01/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Admin - ****-PC
# Gestartet von : C:\Users\****\Downloads\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\ProgramData\Uniblue\DriverScanner
Ordner Gelöscht : C:\Program Files (x86)\FTDownloader.com
Ordner Gelöscht : C:\Users\****\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\boost_interprocess
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\****\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\****\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\****\AppData\Local\Babylon
Ordner Gelöscht : C:\Users\****\AppData\Local\Temp\Babylon
Ordner Gelöscht : C:\Users\****\AppData\Local\Temp\boost_interprocess
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\ConduitEngine
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\DVDVideoSoftTB
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\****\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Admin\AppData\Local\PutLockerDownloader
Ordner Gelöscht : C:\Users\Admin\AppData\Local\Temp\Babylon
Ordner Gelöscht : C:\Users\Admin\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Admin\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Admin\AppData\Roaming\Yontoo
Ordner Gelöscht : C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FTDownloader.com
Ordner Gelöscht : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7k1i9pr.default\Extensions\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}
Datei Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\bprotector_extensions.sqlite
Datei Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\bprotector_prefs.js
Datei Gelöscht : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7k1i9pr.default\invalidprefs.js
Datei Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\user.js
Datei Gelöscht : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7k1i9pr.default\user.js
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bbffdhejhaoiflnpooogkckfdcmmjppn
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\.bdc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\.bgl
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\.bof
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\BabylonHelper.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Conduit.Engine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\driverscanner
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\FTDownloader
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabylonTC_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabylonTC_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\5b28a8abd39ea47
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2269050
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{6536801B-F50C-449B-9476-093DFD3789E3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0BF91075-F457-4A8B-99EF-140B52D2F22A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{37425600-CB21-49A0-8659-476FBAB0F8E8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1ED16E0A-E8C4-40A0-8BC2-79485D21F796}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{64B00DAC-870D-4E6A-8D34-3A6E3E427A30}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0BF91075-F457-4A8B-99EF-140B52D2F22A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{37425600-CB21-49A0-8659-476FBAB0F8E8}
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Tarma Installer
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\prefs.js ]
Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://www2.delta-search.com/?affID=119777&tt=gc_&babsrc=NT_ss&mntrId=04DC0017C4AFA9FC");
Zeile gelöscht : user_pref("browser.search.order.1", "Delta Search");
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\"I[...]
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*");
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.rambler.ru.style", ".WRCN {display:none} .search-results .title + .WRCN {display:inline !important; background: url(\"IMAGE\") right no-repeat}");
Zeile gelöscht : user_pref("extentions.y2layers.defaultEnableAppsList", "bestvideodownloader,brain/default2,easyinline/dock,superfish,superfishgoogleeil,yontooinstalled,yontoonewoffers,dropdowndeals");
Zeile gelöscht : user_pref("extentions.y2layers.installId", "c1580c3d-02ab-4ae9-b426-d870a07be818");
[ Datei : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\agw5p9qz.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #psa-teoma-result .ptbs .WRCN, #teoma-results .ptbs .WRCN {display:inline !important; background: url(\\\\\"IMAGE\\\\\") r[...]
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\\\\\\\:\\\\\\\\/\\\\\\\\/(.+\\\\\\\\.)?ask\\\\\\\\.com\\\\\\\\/.*");
[ Datei : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7k1i9pr.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\"I[...]
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*");
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.rambler.ru.style", ".WRCN {display:none} .search-results .title + .WRCN {display:inline !important; background: url(\"IMAGE\") right no-repeat}");
Zeile gelöscht : user_pref("extentions.y2layers.defaultEnableAppsList", "twittube,buzzdock,YontooNewOffers");
Zeile gelöscht : user_pref("extentions.y2layers.installId", "c1580c3d-02ab-4ae9-b426-d870a07be818");
[ Datei : C:\Users\******\AppData\Roaming\Mozilla\Firefox\Profiles\2eqwvwc3.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.style", ".WRCN {display:none} #yui-main .tsrc_vnru .title + .WRCN, #yui-main #teoma-results .title + .WRCN {display:inline !important; background: url(\"I[...]
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*");
Zeile gelöscht : user_pref("extensions.wrc.SearchRules.rambler.ru.style", ".WRCN {display:none} .search-results .title + .WRCN {display:inline !important; background: url(\"IMAGE\") right no-repeat}");
*************************
AdwCleaner[R0].txt - [8464 octets] - [30/01/2014 16:14:54]
AdwCleaner[S0].txt - [8321 octets] - [30/01/2014 16:42:03]
########## EOF - \AdwCleaner\AdwCleaner[S0].txt - [8381 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Home Premium x64
Ran by Admin on 30.01.2014 at 17:06:33,11
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-739932340-378401146-3079080163-1005\Software\sweetim
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Users\Admin\AppData\Roaming\getrighttogo"
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 30.01.2014 at 17:18:12,88
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014 Ran by **** (ATTENTION: The logged in user is not administrator) on ****-PC on 30-01-2014 19:42:33 Running from C:\Users\****\Downloads Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Acer Inc.) C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (AVAST Software) C:\Program Files\Avast5\AvastUI.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Hidfind.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation) HKLM\...\Run: [ePower_DMC] - C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe [492032 2009-07-21] (Acer Inc.) HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8060960 2009-08-06] (Realtek Semiconductor) HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [295936 2009-05-22] (Alps Electric Co., Ltd.) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated) HKLM-x32\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\\isuspm.exe [2068856 2011-10-12] (Flexera Software LLC.) HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\Avast5\AvastUI.exe [3764024 2013-12-27] (AVAST Software) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM-x32\...\RunOnce: [20131224] - C:\Program Files\Avast5\setup\emupdate\2c383f79-31d0-4459-a858-971cd985047c.exe /check [181136 2014-01-30] (AVAST Software) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] - rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript [1127496 2013-04-04] (Malwarebytes Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKCU\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKtray.exe [619216 2009-05-18] (Expert System S.p.A.) HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18642024 2013-02-28] (Skype Technologies S.A.) HKCU\...\Run: [AutoStart-Manager 2006] - C:\Program Files (x86)\Tools&More\Autostart-Manager\AutoStart-Manager.exe [397312 2005-12-23] (Wirth New Media Sarl ) HKCU\...\Policies\system: [LogonHoursAction] 2 HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1 Startup: C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.bing.com HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=extensa_5230&r=27361109a116l0308z185i4751t287 HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR URLSearchHook: HKCU - (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_de SearchScopes: HKCU - {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050 BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Avast5\aswWebRepIE64.dll (AVAST Software) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Avast5\aswWebRepIE64.dll (AVAST Software) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Avast5\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Avast5\aswWebRepIE64.dll (AVAST Software) Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\Avast5\aswWebRepIE64.dll (AVAST Software) Toolbar: HKLM-x32 - No Name - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - No File Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\Avast5\aswWebRepIE.dll (AVAST Software) Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No File DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - No File Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default FF DefaultSearchEngine: benefind FF SelectedSearchEngine: benefind FF Homepage: hxxp://www.benefind.de FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @java.com/DTPlugin,version=10.13.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.13.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll () FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC) FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8064.0206 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin-x32: nuance.com/DragonRIAPlugin - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\npDgnRia.dll (Nuance Communications Inc.) FF Plugin HKCU: @citrixonline.com/appdetectorplugin - C:\Users\****\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\searchplugins\100-search-engines.xml FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\searchplugins\benefind.xml FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\searchplugins\ecosia.xml FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\searchplugins\scroogle-ssl-search.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: RequestPolicy - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\Extensions\requestpolicy@requestpolicy.com.xpi [2013-01-29] FF Extension: NoScript - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-01-28] FF Extension: Google Privacy - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\Extensions\{ea61041c-1e22-4400-99a0-aea461e69d04}.xpi [2013-01-28] FF HKLM-x32\...\Firefox\Extensions: [jid0-lmZNVK7a82O8cufhdfB9dUDfA2w@jetpack] - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\ffShim.xpi FF Extension: Dragon NaturallySpeaking Rich Internet Application Support - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\ffShim.xpi [2012-07-13] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Avast5\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\Avast5\WebRep\FF [2011-04-25] ==================== Services (Whitelisted) ================= R2 ABBYY.Licensing.FineReader.Professional.11.0; C:\Program Files (x86)\ABBYY FineReader 11\NetworkLicenseServer.exe [819976 2011-09-22] (ABBYY) R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759072 2008-10-09] (ABBYY (BIT Software)) R2 avast! Antivirus; C:\Program Files\Avast5\AvastSvc.exe [50344 2013-12-27] (AVAST Software) R2 ETService; C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [24576 2009-08-12] () S2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 MSSQL$MSSMLBIZ; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation) S2 NewServiceInstall1; C:\Program Files (x86)\SDL International\T2007_FL\TT\Lng\Dialogs1031.lng [11264 2007-04-23] () R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated) S2 LEC TranslateDotNet Server; "C:\Program Files (x86)\Power Translator 12\LogoMedia TranslateDotNet Server.exe" [x] ==================== Drivers (Whitelisted) ==================== R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2013-10-23] (AVAST Software) R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2013-12-27] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-10-23] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-10-23] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1034464 2013-12-27] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422216 2013-12-27] (AVAST Software) R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [79672 2013-12-27] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2013-12-27] () R3 bbcap; C:\Windows\System32\DRIVERS\bbcap.sys [4608 2010-12-23] (Windows (R) Codename Longhorn DDK provider) S3 O2MDRDR; C:\Windows\system32\DRIVERS\o2mdx64.sys [63264 2009-05-07] (O2Micro ) S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] () S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-01-30 19:42 - 2014-01-30 19:42 - 00017732 _____ C:\Users\****\Downloads\FRST.txt 2014-01-30 18:11 - 2014-01-30 18:11 - 00000000 ____D C:\Windows\system32\%LOCALAPPDATA% 2014-01-30 17:18 - 2014-01-30 17:18 - 00000893 _____ C:\Users\Admin\Desktop\JRT.txt 2014-01-30 17:06 - 2014-01-30 17:06 - 00000000 ____D C:\Windows\ERUNT 2014-01-30 16:14 - 2014-01-30 16:42 - 00000000 ____D C:\AdwCleaner 2014-01-30 15:37 - 2014-01-30 15:37 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes 2014-01-30 15:34 - 2014-01-30 15:34 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-01-30 15:34 - 2014-01-30 15:34 - 00000000 ____D C:\ProgramData\Malwarebytes 2014-01-30 15:34 - 2014-01-30 15:34 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-01-30 15:34 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-01-30 15:25 - 2014-01-30 15:25 - 01037068 _____ (Thisisu) C:\Users\****\Downloads\JRT.exe 2014-01-30 15:19 - 2014-01-30 15:19 - 01166132 _____ C:\Users\****\Downloads\adwcleaner.exe 2014-01-30 15:17 - 2014-01-30 15:18 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\****\Downloads\mbam-setup-1.75.0.1300.exe 2014-01-29 14:28 - 2014-01-29 14:28 - 00000000 ____D C:\Users\*****\AppData\Roaming\AVAST Software 2014-01-29 13:17 - 2014-01-29 13:24 - 00462752 _____ C:\Users\****\Desktop\Gmer.txt 2014-01-29 13:16 - 2014-01-29 13:16 - 00462761 _____ C:\Users\Admin\Desktop\Gmer.log 2014-01-29 12:08 - 2014-01-29 12:08 - 00658328 _____ C:\Users\Admin\Desktop\Gmer.txt 2014-01-29 10:26 - 2014-01-29 11:07 - 00029581 _____ C:\Users\****\Desktop\Addition.txt 2014-01-29 10:24 - 2014-01-29 10:55 - 00034881 _____ C:\Users\****\Desktop\FRST.txt 2014-01-29 10:06 - 2014-01-30 19:42 - 00000000 ____D C:\FRST 2014-01-29 09:33 - 2014-01-29 09:33 - 00000000 _____ C:\Users\Admin\defogger_reenable 2014-01-29 09:29 - 2014-01-29 09:29 - 00370971 _____ C:\Users\****\Desktop\gmer_2.1.19355.zip 2014-01-29 09:23 - 2014-01-29 09:24 - 02079744 _____ (Farbar) C:\Users\****\Downloads\FRST64.exe 2014-01-29 09:23 - 2014-01-29 09:23 - 00050477 _____ C:\Users\****\Downloads\Defogger(1).exe 2014-01-28 23:39 - 2014-01-28 23:40 - 00002210 _____ C:\Windows\wininit.ini 2014-01-28 21:17 - 2014-01-28 21:17 - 00000000 ____D C:\Program Files\Common Files\Apple 2014-01-28 20:39 - 2014-01-28 22:54 - 00359656 _____ (Microsoft Corporation) C:\Users\Admin\Downloads\msicuu2.exe 2014-01-28 14:23 - 2014-01-28 14:23 - 00283096 _____ (Mozilla) C:\Users\****\Downloads\Firefox Setup Stub 26.0.exe 2014-01-27 16:46 - 2014-01-27 16:48 - 90578216 _____ (AVAST Software) C:\Users\****\Downloads\avast_free_antivirus_setup.exe 2014-01-26 12:43 - 2014-01-26 12:43 - 00000000 ____D C:\.jes 2014-01-24 23:40 - 2014-01-24 23:40 - 01069512 _____ (Solid State Networks) C:\Users\****\Downloads\install_flashplayer12x32au_mssd_aaa_aih(1).exe 2014-01-24 22:11 - 2014-01-24 22:11 - 00000000 ____D C:\ProgramData\Oracle 2014-01-24 22:10 - 2014-01-24 22:10 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-01-24 22:10 - 2014-01-24 22:10 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-01-24 22:10 - 2014-01-24 22:10 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-01-24 22:10 - 2014-01-24 22:10 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-01-24 22:06 - 2014-01-30 16:42 - 00000000 ____D C:\ProgramData\Uniblue 2014-01-24 21:56 - 2014-01-24 21:56 - 00000000 ____D C:\Users\Admin\AppData\Roaming\AVAST Software 2014-01-24 21:48 - 2014-01-24 21:51 - 00000000 ____D C:\Users\Desktop\Dragon NaturallySpeaking 11 Home 2014-01-24 21:48 - 2013-03-04 11:09 - 00005757 _____ C:\Users\Desktop\ADMIN-Aktionen ab 28-01-13.doc - Verknüpfung.lnk 2014-01-24 21:48 - 2013-02-04 18:21 - 00001042 _____ C:\Users\Desktop\ProjectX.jar - Verknüpfung.lnk 2014-01-24 21:48 - 2013-02-04 18:11 - 00208384 _____ (Imago) C:\Users\Desktop\ImagoMPEG-Muxer.exe 2014-01-24 21:48 - 2012-10-09 13:55 - 00001014 _____ C:\Users\Desktop\kreawi Prüfungstrainer (Demo).lnk 2014-01-24 21:48 - 2012-05-05 20:14 - 00001380 _____ C:\Users\Desktop\CopyTrans Control Center.lnk 2014-01-24 21:48 - 2011-09-22 10:05 - 00001172 _____ C:\Users\Desktop\WavePad Sound Editor.lnk 2014-01-24 21:48 - 2011-09-01 07:08 - 00000977 _____ C:\Users\Desktop\Juice.lnk 2014-01-24 21:48 - 2011-05-16 06:41 - 00006332 _____ C:\Users\Desktop\Router_Setup.html 2014-01-24 21:48 - 2011-04-07 13:35 - 00001304 _____ C:\Users\Desktop\Audio Converter.lnk 2014-01-24 21:48 - 2011-03-26 12:29 - 00001402 _____ C:\Users\Desktop\YouTube to MP3 Converter.lnk 2014-01-24 21:48 - 2011-03-26 12:29 - 00001243 _____ C:\Users\Desktop\DVDVideoSoft Studio.lnk 2014-01-24 21:48 - 2009-05-20 22:32 - 00000172 ____R C:\Users\Desktop\Router Login.url 2014-01-24 21:42 - 2014-01-24 21:42 - 00000667 _____ C:\Besitz übernehmen.reg 2014-01-24 21:36 - 2014-01-24 21:36 - 01069512 _____ (Solid State Networks) C:\Users\****\Downloads\install_flashplayer12x32au_mssd_aaa_aih.exe 2014-01-23 12:44 - 2014-01-23 12:44 - 00001781 _____ C:\Users\Public\Desktop\f4.lnk 2014-01-23 12:43 - 2014-01-23 12:43 - 00006906 _____ C:\Windows\SysWOW64\jupdate-1.6.0_07-b06.log 2014-01-23 12:42 - 2014-01-23 12:44 - 00000000 ____D C:\Program Files (x86)\f4 2014-01-15 14:26 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2014-01-15 14:26 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2014-01-15 14:26 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2014-01-15 14:26 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2014-01-15 14:26 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2014-01-15 14:26 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2014-01-15 14:26 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2014-01-15 14:26 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys 2014-01-15 14:26 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-01-09 15:09 - 2014-01-09 18:12 - 00000000 ____D C:\Users\****\Documents\Family Tree Maker 2014-01-09 15:09 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\AppData\Local\IsolatedStorage 2014-01-09 15:09 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\AppData\Local\Ancestry.com 2014-01-09 14:49 - 2014-01-09 14:49 - 00000000 ____D C:\IExp1.tmp 2014-01-09 14:48 - 2014-01-09 14:49 - 00000000 ___HD C:\Windows\msdownld.tmp 2014-01-09 14:48 - 2014-01-09 14:48 - 00002043 _____ C:\Users\Public\Desktop\Family Tree Maker 2010 (DE).lnk 2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Windows\RegisteredPackages 2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft WSE 3.0 2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Program Files (x86)\Microsoft WSE 2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\IExp0.tmp 2014-01-09 14:43 - 2014-01-09 14:48 - 00000000 ____D C:\Program Files (x86)\Family Tree Maker 2010 (DE) 2014-01-09 14:43 - 2014-01-09 14:48 - 00000000 ____D C:\Program Files (x86)\BCL Technologies 2014-01-09 14:34 - 2014-01-09 14:34 - 00000000 ____D C:\Users\****\AppData\Roaming\YORAKO 2014-01-09 14:31 - 2014-01-09 14:31 - 00000000 ____D C:\Program Files (x86)\Namenslexikon ==================== One Month Modified Files and Folders ======= 2014-01-30 19:44 - 2014-01-30 19:42 - 00017732 _____ C:\Users\****\Downloads\FRST.txt 2014-01-30 19:43 - 2010-04-05 13:46 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-01-30 19:42 - 2014-01-29 10:06 - 00000000 ____D C:\FRST 2014-01-30 19:14 - 2013-01-28 11:45 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-01-30 18:11 - 2014-01-30 18:11 - 00000000 ____D C:\Windows\system32\%LOCALAPPDATA% 2014-01-30 17:52 - 2013-03-10 18:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird 2014-01-30 17:52 - 2010-09-10 12:01 - 00000000 ____D C:\Users\Admin\AppData\Local\Thunderbird 2014-01-30 17:18 - 2014-01-30 17:18 - 00000893 _____ C:\Users\Admin\Desktop\JRT.txt 2014-01-30 17:06 - 2014-01-30 17:06 - 00000000 ____D C:\Windows\ERUNT 2014-01-30 17:01 - 2010-04-05 13:37 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-01-30 16:52 - 2009-07-14 05:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-01-30 16:52 - 2009-07-14 05:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-01-30 16:44 - 2011-09-22 18:24 - 00042276 _____ C:\Windows\setupact.log 2014-01-30 16:44 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2014-01-30 16:43 - 2009-09-08 05:37 - 01388732 _____ C:\Windows\WindowsUpdate.log 2014-01-30 16:42 - 2014-01-30 16:14 - 00000000 ____D C:\AdwCleaner 2014-01-30 16:42 - 2014-01-24 22:06 - 00000000 ____D C:\ProgramData\Uniblue 2014-01-30 16:42 - 2011-11-30 17:44 - 00000000 ____D C:\Users\****\AppData\Roaming\Babylon 2014-01-30 16:06 - 2011-11-13 17:03 - 00098358 _____ C:\Windows\PFRO.log 2014-01-30 15:37 - 2014-01-30 15:37 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes 2014-01-30 15:34 - 2014-01-30 15:34 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-01-30 15:34 - 2014-01-30 15:34 - 00000000 ____D C:\ProgramData\Malwarebytes 2014-01-30 15:34 - 2014-01-30 15:34 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-01-30 15:25 - 2014-01-30 15:25 - 01037068 _____ (Thisisu) C:\Users\****\Downloads\JRT.exe 2014-01-30 15:19 - 2014-01-30 15:19 - 01166132 _____ C:\Users\****\Downloads\adwcleaner.exe 2014-01-30 15:18 - 2014-01-30 15:17 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\****\Downloads\mbam-setup-1.75.0.1300.exe 2014-01-30 12:14 - 2013-08-01 11:34 - 00000000 ____D C:\pending 2014-01-30 11:38 - 2010-03-30 15:51 - 00088479 _____ C:\Windows\Run32A50.mch 2014-01-30 09:58 - 2010-03-31 16:16 - 00000131 _____ C:\Windows\Star.ini 2014-01-30 09:58 - 2010-03-30 15:59 - 00000000 ____D C:\Program Files (x86)\Transit XV 2014-01-30 09:58 - 2010-03-30 15:28 - 00000035 _____ C:\Windows\A5W.INI 2014-01-30 09:58 - 2010-03-30 15:28 - 00000000 ____D C:\Windows\A5W_DATA 2014-01-29 15:06 - 2011-10-28 20:16 - 00002035 _____ C:\Users\****\AppData\Roaming\SAS7_000.DAT 2014-01-29 14:39 - 2013-01-28 11:45 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-01-29 14:39 - 2013-01-28 11:45 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-01-29 14:39 - 2010-10-13 14:13 - 00000000 ____D C:\Users\Admin\AppData\Local\Adobe 2014-01-29 14:35 - 2011-06-21 08:30 - 00000000 ____D C:\Users\****** 2014-01-29 14:28 - 2014-01-29 14:28 - 00000000 ____D C:\Users\*****\AppData\Roaming\AVAST Software 2014-01-29 14:24 - 2010-05-14 22:01 - 00000404 _____ C:\Windows\Brownie.ini 2014-01-29 13:24 - 2014-01-29 13:17 - 00462752 _____ C:\Users\****\Desktop\Gmer.txt 2014-01-29 13:16 - 2014-01-29 13:16 - 00462761 _____ C:\Users\Admin\Desktop\Gmer.log 2014-01-29 12:08 - 2014-01-29 12:08 - 00658328 _____ C:\Users\Admin\Desktop\Gmer.txt 2014-01-29 11:07 - 2014-01-29 10:26 - 00029581 _____ C:\Users\****\Desktop\Addition.txt 2014-01-29 10:55 - 2014-01-29 10:24 - 00034881 _____ C:\Users\****\Desktop\FRST.txt 2014-01-29 09:33 - 2014-01-29 09:33 - 00000000 _____ C:\Users\Admin\defogger_reenable 2014-01-29 09:33 - 2013-05-07 18:29 - 00000472 _____ C:\Users\****\Desktop\defogger_disable.log 2014-01-29 09:33 - 2010-06-20 22:32 - 00000000 ____D C:\Users\Admin 2014-01-29 09:29 - 2014-01-29 09:29 - 00370971 _____ C:\Users\****\Desktop\gmer_2.1.19355.zip 2014-01-29 09:24 - 2014-01-29 09:23 - 02079744 _____ (Farbar) C:\Users\****\Downloads\FRST64.exe 2014-01-29 09:23 - 2014-01-29 09:23 - 00050477 _____ C:\Users\****\Downloads\Defogger(1).exe 2014-01-29 07:14 - 2012-02-17 20:49 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2014-01-28 23:40 - 2014-01-28 23:39 - 00002210 _____ C:\Windows\wininit.ini 2014-01-28 23:11 - 2012-02-17 20:49 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2014-01-28 23:10 - 2011-10-28 02:28 - 00000000 ____D C:\Program Files (x86)\Power Translator 12 2014-01-28 22:54 - 2014-01-28 20:39 - 00359656 _____ (Microsoft Corporation) C:\Users\Admin\Downloads\msicuu2.exe 2014-01-28 22:03 - 2013-06-11 12:23 - 00000000 ____D C:\Program Files\WinRAR 2014-01-28 21:17 - 2014-01-28 21:17 - 00000000 ____D C:\Program Files\Common Files\Apple 2014-01-28 20:17 - 2013-11-17 21:07 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-01-28 20:17 - 2012-05-05 21:43 - 00000000 ____D C:\Program Files (x86)\iTunes 2014-01-28 20:14 - 2011-11-13 15:37 - 00000000 ____D C:\Program Files (x86)\QuickTime 2014-01-28 20:11 - 2011-01-02 21:41 - 00000000 ____D C:\ProgramData\Apple 2014-01-28 19:44 - 2009-08-26 06:16 - 00000000 ____D C:\Program Files (x86)\Microsoft Office 2014-01-28 19:44 - 2009-08-22 11:23 - 00000000 ____D C:\Windows\ShellNew 2014-01-28 19:27 - 2009-08-26 06:16 - 00000000 ____D C:\ProgramData\Microsoft Help 2014-01-28 19:27 - 2009-07-14 03:34 - 00000449 _____ C:\Windows\win.ini 2014-01-28 18:12 - 2011-10-29 23:34 - 00000000 ____D C:\Program Files (x86)\ABBYY FineReader 11 2014-01-28 14:23 - 2014-01-28 14:23 - 00283096 _____ (Mozilla) C:\Users\****\Downloads\Firefox Setup Stub 26.0.exe 2014-01-28 11:34 - 2009-08-22 10:33 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2014-01-28 11:32 - 2013-10-22 10:58 - 00000000 ____D C:\ProgramData\SYSTRAN 2014-01-27 16:48 - 2014-01-27 16:46 - 90578216 _____ (AVAST Software) C:\Users\****\Downloads\avast_free_antivirus_setup.exe 2014-01-26 19:15 - 2010-08-05 10:27 - 00000000 ____D C:\Users\****\AppData\Roaming\FileZilla 2014-01-26 13:57 - 2009-11-16 20:36 - 00115976 _____ C:\Users\****\AppData\Local\GDIPFONTCACHEV1.DAT 2014-01-26 13:55 - 2009-07-14 05:45 - 00453088 _____ C:\Windows\system32\FNTCACHE.DAT 2014-01-26 13:48 - 2010-07-06 09:38 - 00115976 _____ C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT 2014-01-26 12:50 - 2009-11-29 16:01 - 00000633 _____ C:\Windows\ODBC.INI 2014-01-26 12:49 - 2010-07-06 09:38 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-01-26 12:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system 2014-01-26 12:43 - 2014-01-26 12:43 - 00000000 ____D C:\.jes 2014-01-25 10:46 - 2011-11-05 14:56 - 00000000 ____D C:\Users\****\Downloads\F4 installationsordner 2014-01-24 23:52 - 2013-10-22 13:47 - 00000000 ____D C:\Users\****\AppData\Roaming\SYSTRAN 2014-01-24 23:52 - 2013-10-22 13:47 - 00000000 ____D C:\Users\****\AppData\Local\SYSTRAN 2014-01-24 23:40 - 2014-01-24 23:40 - 01069512 _____ (Solid State Networks) C:\Users\****\Downloads\install_flashplayer12x32au_mssd_aaa_aih(1).exe 2014-01-24 22:13 - 2010-07-06 09:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Mozilla 2014-01-24 22:11 - 2014-01-24 22:11 - 00000000 ____D C:\ProgramData\Oracle 2014-01-24 22:10 - 2014-01-24 22:10 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-01-24 22:10 - 2014-01-24 22:10 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-01-24 22:10 - 2014-01-24 22:10 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-01-24 22:10 - 2014-01-24 22:10 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-01-24 22:10 - 2010-06-29 13:48 - 00000000 ____D C:\Program Files (x86)\Java 2014-01-24 21:56 - 2014-01-24 21:56 - 00000000 ____D C:\Users\Admin\AppData\Roaming\AVAST Software 2014-01-24 21:56 - 2010-07-06 09:38 - 00001425 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-01-24 21:56 - 2010-07-06 09:38 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-01-24 21:56 - 2010-07-06 09:37 - 00000000 ____D C:\Users\Admin\AppData\Local\VirtualStore 2014-01-24 21:51 - 2014-01-24 21:48 - 00000000 ____D C:\Users\Desktop\Dragon NaturallySpeaking 11 Home 2014-01-24 21:42 - 2014-01-24 21:42 - 00000667 _____ C:\Besitz übernehmen.reg 2014-01-24 21:36 - 2014-01-24 21:36 - 01069512 _____ (Solid State Networks) C:\Users\****\Downloads\install_flashplayer12x32au_mssd_aaa_aih.exe 2014-01-24 06:51 - 2010-05-14 22:04 - 00000432 _____ C:\Windows\BRWMARK.INI 2014-01-24 04:39 - 2011-12-18 18:23 - 00000000 ____D C:\Users\****\AppData\Local\.elfohilfe 2014-01-23 13:08 - 2009-09-08 15:27 - 00754068 _____ C:\Windows\system32\perfh007.dat 2014-01-23 13:08 - 2009-09-08 15:27 - 00171888 _____ C:\Windows\system32\perfc007.dat 2014-01-23 13:08 - 2009-07-14 06:13 - 01760852 _____ C:\Windows\system32\PerfStringBackup.INI 2014-01-23 12:44 - 2014-01-23 12:44 - 00001781 _____ C:\Users\Public\Desktop\f4.lnk 2014-01-23 12:44 - 2014-01-23 12:42 - 00000000 ____D C:\Program Files (x86)\f4 2014-01-23 12:43 - 2014-01-23 12:43 - 00006906 _____ C:\Windows\SysWOW64\jupdate-1.6.0_07-b06.log 2014-01-23 01:17 - 2010-08-04 21:37 - 00000000 ____D C:\Users\****\AppData\Roaming\vlc 2014-01-23 01:12 - 2012-04-19 18:52 - 00000000 ____D C:\Users\****\AppData\Roaming\dvdcss 2014-01-22 15:22 - 2013-03-27 19:49 - 00030863 _____ C:\Users\****\Downloads\Feiertage_2009-2013_DE.ics 2014-01-15 18:11 - 2013-07-27 10:08 - 00000000 ____D C:\Windows\system32\MRT 2014-01-15 18:07 - 2010-05-09 20:43 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-01-09 18:12 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\Documents\Family Tree Maker 2014-01-09 15:09 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\AppData\Local\IsolatedStorage 2014-01-09 15:09 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\AppData\Local\Ancestry.com 2014-01-09 14:49 - 2014-01-09 14:49 - 00000000 ____D C:\IExp1.tmp 2014-01-09 14:49 - 2014-01-09 14:48 - 00000000 ___HD C:\Windows\msdownld.tmp 2014-01-09 14:48 - 2014-01-09 14:48 - 00002043 _____ C:\Users\Public\Desktop\Family Tree Maker 2010 (DE).lnk 2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Windows\RegisteredPackages 2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft WSE 3.0 2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Program Files (x86)\Microsoft WSE 2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\IExp0.tmp 2014-01-09 14:48 - 2014-01-09 14:43 - 00000000 ____D C:\Program Files (x86)\Family Tree Maker 2010 (DE) 2014-01-09 14:48 - 2014-01-09 14:43 - 00000000 ____D C:\Program Files (x86)\BCL Technologies 2014-01-09 14:34 - 2014-01-09 14:34 - 00000000 ____D C:\Users\****\AppData\Roaming\YORAKO 2014-01-09 14:31 - 2014-01-09 14:31 - 00000000 ____D C:\Program Files (x86)\Namenslexikon Files to move or delete: ==================== C:\Users\Desktop\ImagoMPEG-Muxer.exe C:\Users\****\FineCount.reg Some content of TEMP: ==================== C:\Users\Admin\AppData\Local\Temp\Quarantine.exe C:\Users\****\AppData\Local\Temp\DivXSetup.exe C:\Users\****\AppData\Local\Temp\DWPUpgradeInstaller.exe C:\Users\****\AppData\Local\Temp\ffmpeg13.exe C:\Users\****\AppData\Local\Temp\jna666123695494861687.dll C:\Users\****\AppData\Local\Temp\RSPUpgradeInstaller.exe C:\Users\****\AppData\Local\Temp\SkypeSetup.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== End Of Log ============================ --- --- --- |
|
31.01.2014, 16:16
| #12 |
| /// the machine /// TB-Ausbilder | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle??ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
01.02.2014, 10:12
| #13 |
| | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Guten Abend, einige Programme starteten nach den vorigen Scans über Admin und gingen nicht! Die Downloads von Eset und Security Check waren plötzlich auf Admin/Downloads!  All dies, obwohl die Downloads und Programmaufrufe vom nicht-Admin-Benutzerkonto gestartet wurden. Hat sich aber nun wieder geregelt, alles stimmt wieder.  Positiv: Delta search ist entfernt. Eset stoppt bei ca. 90% beim Apple Mobile Device Driver.. letzterer lässt sich nicht deinstallieren. Code:
ATTFilter ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=12
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=82408bf70a66fe46a8f9568c4fcdebdc
# engine=16889
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-01-31 10:17:39
# local_time=2014-01-31 11:17:39 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 36808 142836509 0 0
# scanned=75293
# found=4
# cleaned=0
# scan_time=5955
sh=D6CF7460A4F696A0E053E042B09C92A7970F30BD ft=1 fh=3da28455addb719c vn="a variant of Win32/Adware.Yontoo.B application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll.vir"
sh=B1EC69FED8C774E82CA75E281D04815342F05014 ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip worm" ac=I fn="C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage38.zip"
sh=AFBD87CE1316F244F89DC8F2664E30CDA622FC1E ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip worm" ac=I fn="C:\ProgramData\Spybot - Search & Destroy\Recovery\YontooPagerage4.zip"
sh=552EE4F57C9683F7E82B13CF3F414188C653582D ft=1 fh=5565d5049be9d18b vn="multiple threats" ac=I fn="C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PN0FWDDV\yontoosetup[1].exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.79 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` MVPS Hosts File Spybot - Search & Destroy Malwarebytes Anti-Malware Version 1.75.0.1300 Java 7 Update 51 Adobe Flash Player 12.0.0.43 Flash Player out of Date! Adobe Reader 9 Adobe Reader out of Date! Mozilla Firefox (26.0) Mozilla Thunderbird (17.0.5) ````````Process Check: objlist.exe by Laurent```````` ESET ESET Online Scanner OnlineScannerApp.exe Avast5 AvastSvc.exe Avast5 AvastUI.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log``````````````````````  FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014
Ran by **** (ATTENTION: The logged in user is not administrator) on ****-PC on 01-02-2014 00:30:07
Running from C:\Users\****\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Acer Inc.) C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(AVAST Software) C:\Program Files\Avast5\AvastUI.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Hidfind.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [ePower_DMC] - C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe [492032 2009-07-21] (Acer Inc.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8060960 2009-08-06] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint2K\Apoint.exe [295936 2009-05-22] (Alps Electric Co., Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\\isuspm.exe [2068856 2011-10-12] (Flexera Software LLC.)
HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\Avast5\AvastUI.exe [3764024 2013-12-27] (AVAST Software)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [Duden Korrektor SysTray] - C:\Program Files (x86)\Duden\Duden Korrektor\DKtray.exe [619216 2009-05-18] (Expert System S.p.A.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18642024 2013-02-28] (Skype Technologies S.A.)
HKCU\...\Run: [AutoStart-Manager 2006] - C:\Program Files (x86)\Tools&More\Autostart-Manager\AutoStart-Manager.exe [397312 2005-12-23] (Wirth New Media Sarl )
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.bing.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=extensa_5230&r=27361109a116l0308z185i4751t287
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
URLSearchHook: HKCU - (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_de
SearchScopes: HKCU - {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Avast5\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Avast5\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Avast5\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Avast5\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\Avast5\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - No Name - {1DBAB667-A486-421e-AFE4-CF07DD0088E5} - No File
Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\Avast5\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No File
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default
FF DefaultSearchEngine: benefind
FF SelectedSearchEngine: benefind
FF Homepage: hxxp://www.benefind.de
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.13.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.13.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8064.0206 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: nuance.com/DragonRIAPlugin - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\npDgnRia.dll (Nuance Communications Inc.)
FF Plugin HKCU: @citrixonline.com/appdetectorplugin - C:\Users\****\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\searchplugins\100-search-engines.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\searchplugins\benefind.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\searchplugins\ecosia.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\searchplugins\scroogle-ssl-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: RequestPolicy - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\Extensions\requestpolicy@requestpolicy.com.xpi [2013-01-29]
FF Extension: NoScript - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-01-28]
FF Extension: Google Privacy - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\psssww1k.default\Extensions\{ea61041c-1e22-4400-99a0-aea461e69d04}.xpi [2013-01-28]
FF HKLM-x32\...\Firefox\Extensions: [jid0-lmZNVK7a82O8cufhdfB9dUDfA2w@jetpack] - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\ffShim.xpi
FF Extension: No Name - C:\Program Files (x86)\Nuance\NaturallySpeaking12\Program\ffShim.xpi [2012-07-13]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Avast5\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Avast5\WebRep\FF [2011-04-25]
==================== Services (Whitelisted) =================
R2 ABBYY.Licensing.FineReader.Professional.11.0; C:\Program Files (x86)\ABBYY FineReader 11\NetworkLicenseServer.exe [819976 2011-09-22] (ABBYY)
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759072 2008-10-09] (ABBYY (BIT Software))
R2 avast! Antivirus; C:\Program Files\Avast5\AvastSvc.exe [50344 2013-12-27] (AVAST Software)
R2 ETService; C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [24576 2009-08-12] ()
S2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 MSSQL$MSSMLBIZ; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S2 NewServiceInstall1; C:\Program Files (x86)\SDL International\T2007_FL\TT\Lng\Dialogs1031.lng [11264 2007-04-23] ()
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated)
S2 LEC TranslateDotNet Server; "C:\Program Files (x86)\Power Translator 12\LogoMedia TranslateDotNet Server.exe" [x]
==================== Drivers (Whitelisted) ====================
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2013-10-23] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2013-12-27] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-10-23] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-10-23] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1034464 2013-12-27] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422216 2013-12-27] (AVAST Software)
S3 aswStm; C:\Windows\system32\drivers\aswStm.sys [79672 2013-12-27] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2013-12-27] ()
R3 bbcap; C:\Windows\System32\DRIVERS\bbcap.sys [4608 2010-12-23] (Windows (R) Codename Longhorn DDK provider)
S3 O2MDRDR; C:\Windows\system32\DRIVERS\o2mdx64.sys [63264 2009-05-07] (O2Micro )
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] ()
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-01 00:30 - 2014-02-01 00:30 - 00017293 _____ C:\Users\****\Downloads\FRST.txt
2014-01-31 23:23 - 2014-01-31 23:23 - 00000000 ____D C:\Program Files\Common Files\Apple
2014-01-31 21:32 - 2014-01-31 21:32 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-31 20:52 - 2014-01-31 20:53 - 00987425 _____ C:\Users\Admin\Downloads\SecurityCheck.exe
2014-01-31 20:32 - 2014-01-31 20:32 - 02347384 _____ (ESET) C:\Users\Admin\Downloads\esetsmartinstaller_enu.exe _nicht gelöscht, da nicht beendet
2014-01-30 18:11 - 2014-01-30 18:11 - 00000000 ____D C:\Windows\system32\%LOCALAPPDATA%
2014-01-30 17:18 - 2014-01-30 17:18 - 00000893 _____ C:\Users\Admin\Desktop\JRT.txt
2014-01-30 17:06 - 2014-01-30 17:06 - 00000000 ____D C:\Windows\ERUNT
2014-01-30 16:14 - 2014-01-30 16:42 - 00000000 ____D C:\AdwCleaner
2014-01-30 15:37 - 2014-01-30 15:37 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2014-01-30 15:34 - 2014-01-30 15:34 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-30 15:34 - 2014-01-30 15:34 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-30 15:34 - 2014-01-30 15:34 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-30 15:34 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-30 15:25 - 2014-01-30 15:25 - 01037068 _____ (Thisisu) C:\Users\****\Downloads\JRT.exe
2014-01-30 15:19 - 2014-01-30 15:19 - 01166132 _____ C:\Users\****\Downloads\adwcleaner.exe
2014-01-30 15:17 - 2014-01-30 15:18 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\****\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-29 14:28 - 2014-01-29 14:28 - 00000000 ____D C:\Users\*****\AppData\Roaming\AVAST Software
2014-01-29 13:17 - 2014-01-29 13:24 - 00462752 _____ C:\Users\****\Desktop\Gmer.txt
2014-01-29 13:16 - 2014-01-29 13:16 - 00462761 _____ C:\Users\Admin\Desktop\Gmer.log
2014-01-29 12:08 - 2014-01-29 12:08 - 00658328 _____ C:\Users\Admin\Desktop\Gmer.txt
2014-01-29 10:26 - 2014-01-29 11:07 - 00029581 _____ C:\Users\****\Desktop\Addition.txt
2014-01-29 10:24 - 2014-01-29 10:55 - 00034881 _____ C:\Users\****\Desktop\FRST.txt
2014-01-29 10:06 - 2014-02-01 00:30 - 00000000 ____D C:\FRST
2014-01-29 09:33 - 2014-01-29 09:33 - 00000000 _____ C:\Users\Admin\defogger_reenable
2014-01-29 09:29 - 2014-01-29 09:29 - 00370971 _____ C:\Users\****\Desktop\gmer_2.1.19355.zip
2014-01-29 09:23 - 2014-01-29 09:24 - 02079744 _____ (Farbar) C:\Users\****\Downloads\FRST64.exe
2014-01-29 09:23 - 2014-01-29 09:23 - 00050477 _____ C:\Users\****\Downloads\Defogger(1).exe
2014-01-28 23:39 - 2014-01-28 23:40 - 00002210 _____ C:\Windows\wininit.ini
2014-01-28 20:39 - 2014-01-28 22:54 - 00359656 _____ (Microsoft Corporation) C:\Users\Admin\Downloads\msicuu2.exe
2014-01-28 14:23 - 2014-01-28 14:23 - 00283096 _____ (Mozilla) C:\Users\****\Downloads\Firefox Setup Stub 26.0.exe
2014-01-27 16:46 - 2014-01-27 16:48 - 90578216 _____ (AVAST Software) C:\Users\****\Downloads\avast_free_antivirus_setup.exe
2014-01-26 12:43 - 2014-01-26 12:43 - 00000000 ____D C:\.jes
2014-01-24 23:40 - 2014-01-24 23:40 - 01069512 _____ (Solid State Networks) C:\Users\****\Downloads\install_flashplayer12x32au_mssd_aaa_aih(1).exe
2014-01-24 22:11 - 2014-01-24 22:11 - 00000000 ____D C:\ProgramData\Oracle
2014-01-24 22:10 - 2014-01-24 22:10 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-01-24 22:10 - 2014-01-24 22:10 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-01-24 22:10 - 2014-01-24 22:10 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-01-24 22:10 - 2014-01-24 22:10 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-01-24 22:06 - 2014-01-30 16:42 - 00000000 ____D C:\ProgramData\Uniblue
2014-01-24 21:56 - 2014-01-24 21:56 - 00000000 ____D C:\Users\Admin\AppData\Roaming\AVAST Software
2014-01-24 21:48 - 2014-01-24 21:51 - 00000000 ____D C:\Users\Desktop\Dragon NaturallySpeaking 11 Home
2014-01-24 21:48 - 2013-03-04 11:09 - 00005757 _____ C:\Users\Desktop\ADMIN-Aktionen ab 28-01-13.doc - Verknüpfung.lnk
2014-01-24 21:48 - 2013-02-04 18:21 - 00001042 _____ C:\Users\Desktop\ProjectX.jar - Verknüpfung.lnk
2014-01-24 21:48 - 2013-02-04 18:11 - 00208384 _____ (Imago) C:\Users\Desktop\ImagoMPEG-Muxer.exe
2014-01-24 21:48 - 2012-10-09 13:55 - 00001014 _____ C:\Users\Desktop\kreawi Prüfungstrainer (Demo).lnk
2014-01-24 21:48 - 2012-05-05 20:14 - 00001380 _____ C:\Users\Desktop\CopyTrans Control Center.lnk
2014-01-24 21:48 - 2011-09-22 10:05 - 00001172 _____ C:\Users\Desktop\WavePad Sound Editor.lnk
2014-01-24 21:48 - 2011-09-01 07:08 - 00000977 _____ C:\Users\Desktop\Juice.lnk
2014-01-24 21:48 - 2011-05-16 06:41 - 00006332 _____ C:\Users\Desktop\Router_Setup.html
2014-01-24 21:48 - 2011-04-07 13:35 - 00001304 _____ C:\Users\Desktop\Audio Converter.lnk
2014-01-24 21:48 - 2011-03-26 12:29 - 00001402 _____ C:\Users\Desktop\YouTube to MP3 Converter.lnk
2014-01-24 21:48 - 2011-03-26 12:29 - 00001243 _____ C:\Users\Desktop\DVDVideoSoft Studio.lnk
2014-01-24 21:48 - 2009-05-20 22:32 - 00000172 ____R C:\Users\Desktop\Router Login.url
2014-01-24 21:42 - 2014-01-24 21:42 - 00000667 _____ C:\Besitz übernehmen.reg
2014-01-24 21:36 - 2014-01-24 21:36 - 01069512 _____ (Solid State Networks) C:\Users\****\Downloads\install_flashplayer12x32au_mssd_aaa_aih.exe
2014-01-23 12:44 - 2014-01-23 12:44 - 00001781 _____ C:\Users\Public\Desktop\f4.lnk
2014-01-23 12:43 - 2014-01-23 12:43 - 00006906 _____ C:\Windows\SysWOW64\jupdate-1.6.0_07-b06.log
2014-01-23 12:42 - 2014-01-23 12:44 - 00000000 ____D C:\Program Files (x86)\f4
2014-01-15 14:26 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 14:26 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 14:26 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 14:26 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 14:26 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 14:26 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 14:26 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 14:26 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 14:26 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-09 15:09 - 2014-01-09 18:12 - 00000000 ____D C:\Users\****\Documents\Family Tree Maker
2014-01-09 15:09 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\AppData\Local\IsolatedStorage
2014-01-09 15:09 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\AppData\Local\Ancestry.com
2014-01-09 14:49 - 2014-01-09 14:49 - 00000000 ____D C:\IExp1.tmp
2014-01-09 14:48 - 2014-01-09 14:49 - 00000000 ___HD C:\Windows\msdownld.tmp
2014-01-09 14:48 - 2014-01-09 14:48 - 00002043 _____ C:\Users\Public\Desktop\Family Tree Maker 2010 (DE).lnk
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Windows\RegisteredPackages
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft WSE 3.0
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Program Files (x86)\Microsoft WSE
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\IExp0.tmp
2014-01-09 14:43 - 2014-01-09 14:48 - 00000000 ____D C:\Program Files (x86)\Family Tree Maker 2010 (DE)
2014-01-09 14:43 - 2014-01-09 14:48 - 00000000 ____D C:\Program Files (x86)\BCL Technologies
2014-01-09 14:34 - 2014-01-09 14:34 - 00000000 ____D C:\Users\****\AppData\Roaming\YORAKO
2014-01-09 14:31 - 2014-01-09 14:31 - 00000000 ____D C:\Program Files (x86)\Namenslexikon
==================== One Month Modified Files and Folders =======
2014-02-01 00:30 - 2014-02-01 00:30 - 00017293 _____ C:\Users\****\Downloads\FRST.txt
2014-02-01 00:30 - 2014-01-29 10:06 - 00000000 ____D C:\FRST
2014-02-01 00:28 - 2010-04-05 13:37 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-01 00:14 - 2013-01-28 11:45 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-01 00:05 - 2009-09-08 05:37 - 01453683 _____ C:\Windows\WindowsUpdate.log
2014-01-31 23:44 - 2009-07-14 05:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-31 23:44 - 2009-07-14 05:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-31 23:43 - 2010-04-05 13:46 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-31 23:23 - 2014-01-31 23:23 - 00000000 ____D C:\Program Files\Common Files\Apple
2014-01-31 21:32 - 2014-01-31 21:32 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-31 21:31 - 2009-09-08 15:27 - 00754068 _____ C:\Windows\system32\perfh007.dat
2014-01-31 21:31 - 2009-09-08 15:27 - 00171888 _____ C:\Windows\system32\perfc007.dat
2014-01-31 21:31 - 2009-07-14 06:13 - 01760852 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-31 21:22 - 2011-09-22 18:24 - 00043071 _____ C:\Windows\setupact.log
2014-01-31 20:53 - 2014-01-31 20:52 - 00987425 _____ C:\Users\Admin\Downloads\SecurityCheck.exe
2014-01-31 20:32 - 2014-01-31 20:32 - 02347384 _____ (ESET) C:\Users\Admin\Downloads\esetsmartinstaller_enu löschanleitung beachten.exe
2014-01-30 18:11 - 2014-01-30 18:11 - 00000000 ____D C:\Windows\system32\%LOCALAPPDATA%
2014-01-30 17:52 - 2013-03-10 18:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2014-01-30 17:52 - 2010-09-10 12:01 - 00000000 ____D C:\Users\Admin\AppData\Local\Thunderbird
2014-01-30 17:18 - 2014-01-30 17:18 - 00000893 _____ C:\Users\Admin\Desktop\JRT.txt
2014-01-30 17:06 - 2014-01-30 17:06 - 00000000 ____D C:\Windows\ERUNT
2014-01-30 16:44 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-30 16:42 - 2014-01-30 16:14 - 00000000 ____D C:\AdwCleaner
2014-01-30 16:42 - 2014-01-24 22:06 - 00000000 ____D C:\ProgramData\Uniblue
2014-01-30 16:42 - 2011-11-30 17:44 - 00000000 ____D C:\Users\****\AppData\Roaming\Babylon
2014-01-30 16:06 - 2011-11-13 17:03 - 00098358 _____ C:\Windows\PFRO.log
2014-01-30 15:37 - 2014-01-30 15:37 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Malwarebytes
2014-01-30 15:34 - 2014-01-30 15:34 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-01-30 15:34 - 2014-01-30 15:34 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-30 15:34 - 2014-01-30 15:34 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-30 15:25 - 2014-01-30 15:25 - 01037068 _____ (Thisisu) C:\Users\****\Downloads\JRT.exe
2014-01-30 15:19 - 2014-01-30 15:19 - 01166132 _____ C:\Users\****\Downloads\adwcleaner.exe
2014-01-30 15:18 - 2014-01-30 15:17 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\****\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-30 12:14 - 2013-08-01 11:34 - 00000000 ____D C:\pending
2014-01-30 11:38 - 2010-03-30 15:51 - 00088479 _____ C:\Windows\Run32A50.mch
2014-01-30 09:58 - 2010-03-31 16:16 - 00000131 _____ C:\Windows\Star.ini
2014-01-30 09:58 - 2010-03-30 15:59 - 00000000 ____D C:\Program Files (x86)\Transit XV
2014-01-30 09:58 - 2010-03-30 15:28 - 00000035 _____ C:\Windows\A5W.INI
2014-01-30 09:58 - 2010-03-30 15:28 - 00000000 ____D C:\Windows\A5W_DATA
2014-01-29 15:06 - 2011-10-28 20:16 - 00002035 _____ C:\Users\****\AppData\Roaming\SAS7_000.DAT
2014-01-29 14:39 - 2013-01-28 11:45 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-01-29 14:39 - 2013-01-28 11:45 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-29 14:39 - 2010-10-13 14:13 - 00000000 ____D C:\Users\Admin\AppData\Local\Adobe
2014-01-29 14:35 - 2011-06-21 08:30 - 00000000 ____D C:\Users\*****
2014-01-29 14:28 - 2014-01-29 14:28 - 00000000 ____D C:\Users\*****\AppData\Roaming\AVAST Software
2014-01-29 14:24 - 2010-05-14 22:01 - 00000404 _____ C:\Windows\Brownie.ini
2014-01-29 13:24 - 2014-01-29 13:17 - 00462752 _____ C:\Users\****\Desktop\Gmer.txt
2014-01-29 13:16 - 2014-01-29 13:16 - 00462761 _____ C:\Users\Admin\Desktop\Gmer.log
2014-01-29 12:08 - 2014-01-29 12:08 - 00658328 _____ C:\Users\Admin\Desktop\Gmer.txt
2014-01-29 11:07 - 2014-01-29 10:26 - 00029581 _____ C:\Users\****\Desktop\Addition.txt
2014-01-29 10:55 - 2014-01-29 10:24 - 00034881 _____ C:\Users\****\Desktop\FRST.txt
2014-01-29 09:33 - 2014-01-29 09:33 - 00000000 _____ C:\Users\Admin\defogger_reenable
2014-01-29 09:33 - 2013-05-07 18:29 - 00000472 _____ C:\Users\****\Desktop\defogger_disable.log
2014-01-29 09:33 - 2010-06-20 22:32 - 00000000 ____D C:\Users\Admin
2014-01-29 09:29 - 2014-01-29 09:29 - 00370971 _____ C:\Users\****\Desktop\gmer_2.1.19355.zip
2014-01-29 09:24 - 2014-01-29 09:23 - 02079744 _____ (Farbar) C:\Users\****\Downloads\FRST64.exe
2014-01-29 09:23 - 2014-01-29 09:23 - 00050477 _____ C:\Users\****\Downloads\Defogger(1).exe
2014-01-29 07:14 - 2012-02-17 20:49 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2014-01-28 23:40 - 2014-01-28 23:39 - 00002210 _____ C:\Windows\wininit.ini
2014-01-28 23:11 - 2012-02-17 20:49 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy
2014-01-28 23:10 - 2011-10-28 02:28 - 00000000 ____D C:\Program Files (x86)\Power Translator 12
2014-01-28 22:54 - 2014-01-28 20:39 - 00359656 _____ (Microsoft Corporation) C:\Users\Admin\Downloads\msicuu2.exe
2014-01-28 22:03 - 2013-06-11 12:23 - 00000000 ____D C:\Program Files\WinRAR
2014-01-28 20:17 - 2013-11-17 21:07 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-28 20:17 - 2012-05-05 21:43 - 00000000 ____D C:\Program Files (x86)\iTunes
2014-01-28 20:14 - 2011-11-13 15:37 - 00000000 ____D C:\Program Files (x86)\QuickTime
2014-01-28 20:11 - 2011-01-02 21:41 - 00000000 ____D C:\ProgramData\Apple
2014-01-28 19:44 - 2009-08-26 06:16 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2014-01-28 19:44 - 2009-08-22 11:23 - 00000000 ____D C:\Windows\ShellNew
2014-01-28 19:27 - 2009-08-26 06:16 - 00000000 ____D C:\ProgramData\Microsoft Help
2014-01-28 19:27 - 2009-07-14 03:34 - 00000449 _____ C:\Windows\win.ini
2014-01-28 18:12 - 2011-10-29 23:34 - 00000000 ____D C:\Program Files (x86)\ABBYY FineReader 11
2014-01-28 14:23 - 2014-01-28 14:23 - 00283096 _____ (Mozilla) C:\Users\****\Downloads\Firefox Setup Stub 26.0.exe
2014-01-28 11:34 - 2009-08-22 10:33 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2014-01-28 11:32 - 2013-10-22 10:58 - 00000000 ____D C:\ProgramData\SYSTRAN
2014-01-27 16:48 - 2014-01-27 16:46 - 90578216 _____ (AVAST Software) C:\Users\****\Downloads\avast_free_antivirus_setup.exe
2014-01-26 19:15 - 2010-08-05 10:27 - 00000000 ____D C:\Users\****\AppData\Roaming\FileZilla
2014-01-26 13:57 - 2009-11-16 20:36 - 00115976 _____ C:\Users\****\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-26 13:55 - 2009-07-14 05:45 - 00453088 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-26 13:48 - 2010-07-06 09:38 - 00115976 _____ C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-26 12:50 - 2009-11-29 16:01 - 00000633 _____ C:\Windows\ODBC.INI
2014-01-26 12:49 - 2010-07-06 09:38 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-26 12:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system
2014-01-26 12:43 - 2014-01-26 12:43 - 00000000 ____D C:\.jes
2014-01-25 10:46 - 2011-11-05 14:56 - 00000000 ____D C:\Users\****\Downloads\F4 installationsordner
2014-01-24 23:52 - 2013-10-22 13:47 - 00000000 ____D C:\Users\****\AppData\Roaming\SYSTRAN
2014-01-24 23:52 - 2013-10-22 13:47 - 00000000 ____D C:\Users\****\AppData\Local\SYSTRAN
2014-01-24 23:40 - 2014-01-24 23:40 - 01069512 _____ (Solid State Networks) C:\Users\****\Downloads\install_flashplayer12x32au_mssd_aaa_aih(1).exe
2014-01-24 22:13 - 2010-07-06 09:39 - 00000000 ____D C:\Users\Admin\AppData\Local\Mozilla
2014-01-24 22:11 - 2014-01-24 22:11 - 00000000 ____D C:\ProgramData\Oracle
2014-01-24 22:10 - 2014-01-24 22:10 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-01-24 22:10 - 2014-01-24 22:10 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-01-24 22:10 - 2014-01-24 22:10 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-01-24 22:10 - 2014-01-24 22:10 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-01-24 22:10 - 2010-06-29 13:48 - 00000000 ____D C:\Program Files (x86)\Java
2014-01-24 21:56 - 2014-01-24 21:56 - 00000000 ____D C:\Users\Admin\AppData\Roaming\AVAST Software
2014-01-24 21:56 - 2010-07-06 09:38 - 00001425 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-01-24 21:56 - 2010-07-06 09:38 - 00000000 ___RD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-01-24 21:56 - 2010-07-06 09:37 - 00000000 ____D C:\Users\Admin\AppData\Local\VirtualStore
2014-01-24 21:51 - 2014-01-24 21:48 - 00000000 ____D C:\Users\Desktop\Dragon NaturallySpeaking 11 Home
2014-01-24 21:42 - 2014-01-24 21:42 - 00000667 _____ C:\Besitz übernehmen.reg
2014-01-24 21:36 - 2014-01-24 21:36 - 01069512 _____ (Solid State Networks) C:\Users\****\Downloads\install_flashplayer12x32au_mssd_aaa_aih.exe
2014-01-24 06:51 - 2010-05-14 22:04 - 00000432 _____ C:\Windows\BRWMARK.INI
2014-01-24 04:39 - 2011-12-18 18:23 - 00000000 ____D C:\Users\****\AppData\Local\.elfohilfe
2014-01-23 12:44 - 2014-01-23 12:44 - 00001781 _____ C:\Users\Public\Desktop\f4.lnk
2014-01-23 12:44 - 2014-01-23 12:42 - 00000000 ____D C:\Program Files (x86)\f4
2014-01-23 12:43 - 2014-01-23 12:43 - 00006906 _____ C:\Windows\SysWOW64\jupdate-1.6.0_07-b06.log
2014-01-23 01:17 - 2010-08-04 21:37 - 00000000 ____D C:\Users\****\AppData\Roaming\vlc
2014-01-23 01:12 - 2012-04-19 18:52 - 00000000 ____D C:\Users\****\AppData\Roaming\dvdcss
2014-01-22 15:22 - 2013-03-27 19:49 - 00030863 _____ C:\Users\****\Downloads\Feiertage_2009-2013_DE.ics
2014-01-15 18:11 - 2013-07-27 10:08 - 00000000 ____D C:\Windows\system32\MRT
2014-01-15 18:07 - 2010-05-09 20:43 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-09 18:12 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\Documents\Family Tree Maker
2014-01-09 15:09 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\AppData\Local\IsolatedStorage
2014-01-09 15:09 - 2014-01-09 15:09 - 00000000 ____D C:\Users\****\AppData\Local\Ancestry.com
2014-01-09 14:49 - 2014-01-09 14:49 - 00000000 ____D C:\IExp1.tmp
2014-01-09 14:49 - 2014-01-09 14:48 - 00000000 ___HD C:\Windows\msdownld.tmp
2014-01-09 14:48 - 2014-01-09 14:48 - 00002043 _____ C:\Users\Public\Desktop\Family Tree Maker 2010 (DE).lnk
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Windows\RegisteredPackages
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft WSE 3.0
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\Program Files (x86)\Microsoft WSE
2014-01-09 14:48 - 2014-01-09 14:48 - 00000000 ____D C:\IExp0.tmp
2014-01-09 14:48 - 2014-01-09 14:43 - 00000000 ____D C:\Program Files (x86)\Family Tree Maker 2010 (DE)
2014-01-09 14:48 - 2014-01-09 14:43 - 00000000 ____D C:\Program Files (x86)\BCL Technologies
2014-01-09 14:34 - 2014-01-09 14:34 - 00000000 ____D C:\Users\****\AppData\Roaming\YORAKO
2014-01-09 14:31 - 2014-01-09 14:31 - 00000000 ____D C:\Program Files (x86)\Namenslexikon
Files to move or delete:
====================
C:\Users\Desktop\ImagoMPEG-Muxer.exe
C:\Users\****\FineCount.reg
Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\Quarantine.exe
C:\Users\****\AppData\Local\Temp\DivXSetup.exe
C:\Users\****\AppData\Local\Temp\DWPUpgradeInstaller.exe
C:\Users\****\AppData\Local\Temp\ffmpeg13.exe
C:\Users\****\AppData\Local\Temp\jna666123695494861687.dll
C:\Users\****\AppData\Local\Temp\RSPUpgradeInstaller.exe
C:\Users\****\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== End Of Log ============================
--- --- --- Geändert von jo07 (01.02.2014 um 01:00 Uhr) |
|
02.02.2014, 06:30
| #14 |
| /// the machine /// TB-Ausbilder | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Flash wird falsch angezeigt Fertig Falls Du Lob oder Kritik loswerden möchtest kannst Du das hier tun Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
02.02.2014, 10:27
| #15 |
| | Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? Danke.. noch Fragen? Ja: Eset ist doch nicht durchgelaufen. Danach hat ein Stick, der beim Eset-Scan mit angeschlossen war, und den ich dann auf dem Netbook benutzen wollte, dort eine Virenmeldung ausgelöst (Datei: ein Servicepack eines Programms, das nicht mehr supportet wird, das ich aber noch brauche).. Grüße Jo07 |
|
| Themen zu Smartpcfixer mit Spybot so gut es ging bereinigt.. bitte Restekontrolle?? |
| avast, scan, security, smartpcfixer spybot, software, spybot, win |
Linear-Darstellung
