Wegen Spam/Trojaner/Malware sperrt der Anbieter vorrübergehend meinen Internetanschluss

Bercht · 11.12.2014, 23:38

Hallo Zusammen

Ich habe, nachdem die Sperrung im Browser angezeigt wurde, selber versucht Herr der Lage zu werden in dem ich die Rätschlage des Anbieters befolgt habe. Der verweist auf folgende Seite zur Unterstützung: https://www.swiss-isa.ch/de/startseite/

Anschliessend bestätigte ich dem Anbieter, dass ich seine Checkliste abgearbeitet habe und nichts mehr zu finden ist. Alles wurde daraufhin wieder freigeschaltet bis jedoch am darauf folgenden Morgen laut Anbieter um 5.30Uhr 9 Spam Mails über unseren Anschluss rausgegangen sind und er somit wieder vom System automatisch gesperrt wurde.

Ich hoffe ich habe meine Hausaufgaben gut gemacht und danke schon mal im vorraus für Euer Engagement!!

Gruss Bercht

cosinus · 12.12.2014, 00:03

Hi und

Logs bitte nicht anhängen, notfalls splitten und über mehrere Postings verteilt posten

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Bercht · 12.12.2014, 08:31

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:56 on 11/12/2014 (Bercht)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-12-2014
Ran by **** (administrator) on BERCHT-PC on 10-12-2014 12:52:56
Running from C:\Users\Bercht\Downloads
Loaded Profiles: UpdatusUser & Bercht &  (Available profiles: UpdatusUser & Bercht)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Swisscom) C:\Program Files (x86)\Swisscom\Sesam\BIN\SecMIPService.exe
(Sierra Wireless, Inc.) C:\Program Files (x86)\Sierra Wireless Inc\Common\SwiCardDetect64.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Swisscom) C:\Program Files (x86)\Swisscom\Unlimited Data Manager\DashBoardS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Microsoft Corporation) C:\Windows\SysWOW64\regini.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(SEC) C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\SAMSUNG\SamsungFastStart\SmartRestarter.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe
(SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe
(Samsung Electronics) C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe
(SurfRight B.V.) C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe
(Microsoft Corporation) C:\Windows\SysWOW64\ipconfig.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
(Faronics Corporation) C:\Users\Bercht\AppData\Local\Temp\{0000900B-DA85-5C25}
(Microsoft Corporation) C:\Windows\SysWOW64\reg.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\HitmanPro.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11855976 2011-05-19] (Realtek Semiconductor)
HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2817872 2012-04-25] (ELAN Microelectronics Corp.)
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-02] (CyberLink)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [669520 2009-01-12] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-03] (Apple Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2011-03-30] (CyberLink Corp.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\Run: [EPSON SX510W Series] => C:\windows\system32\spool\DRIVERS\x64\3\E_IATIFIE.EXE [223232 2008-11-20] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2014-10-14] (Microsoft Corporation)
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\Run: [Epson Stylus SX510W(Netzwerk)] => C:\windows\system32\spool\DRIVERS\x64\3\E_IATIFIE.EXE [223232 2008-11-20] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\Run: [AppleIEDAV] => C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1326408 2013-11-15] (Apple Inc.)
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\Run: [EPSON8B27B2] => C:\windows\system32\spool\DRIVERS\x64\3\E_IATIFIE.EXE [223232 2008-11-20] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\Run: [EPSON SX510W Series (Kopie 1)] => C:\windows\system32\spool\DRIVERS\x64\3\E_IATIFIE.EXE [223232 2008-11-20] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\Run: [tale-anger] => C:\Users\Bercht\AppData\Roaming\Tale_source\tale-wind.exe [171008 2014-12-06] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\Run: [crew-pool] => C:\Users\Bercht\AppData\Local\Crew-conflict\crewsearch.exe [195584 2014-12-09] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\Run: [noise-permit] => C:\Users\Bercht\AppData\Local\Noise-wall\noise-log.exe [69632 2014-12-09] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\Run: [skirt-distribute] => C:\Users\Bercht\AppData\Roaming\Skirtbox\skirtpage.exe [69632 2014-12-10] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\Run: [part-come] => C:\Users\Bercht\AppData\Roaming\Partshall\part_remain.exe [177664 2014-12-10] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\Run: [jkpujwul] => C:\Users\Bercht\AppData\Roaming\Yapcpxmhsh\jrgurjwul.exe [161792 2014-12-10] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\RunOnce: [tale-anger] => C:\Users\Bercht\AppData\Roaming\Tale_source\tale-wind.exe [171008 2014-12-06] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\RunOnce: [crew-pool] => C:\Users\Bercht\AppData\Local\Crew-conflict\crewsearch.exe [195584 2014-12-09] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\RunOnce: [noise-permit] => C:\Users\Bercht\AppData\Local\Noise-wall\noise-log.exe [69632 2014-12-09] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\RunOnce: [skirt-distribute] => C:\Users\Bercht\AppData\Roaming\Skirtbox\skirtpage.exe [69632 2014-12-10] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\RunOnce: [part-come] => C:\Users\Bercht\AppData\Roaming\Partshall\part_remain.exe [177664 2014-12-10] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\MountPoints2: {16e7c278-e234-11e2-8567-00ade1ac1c1a} - F:\LaunchU3.exe -a
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\MountPoints2: {1f2b6a7a-9565-11e1-b892-00ade1ac1c1a} - F:\Start.exe
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\MountPoints2: {63a1d222-33e2-11e1-95ab-e811329aed95} - G:\SETUP.EXE
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\MountPoints2: {7c554016-ad0c-11e1-8e14-00ade1ac1c1a} - F:\Start.exe
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\MountPoints2: {ba084420-9494-11e1-a042-e811329aed95} - F:\Start.exe
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\MountPoints2: {e5dbe520-54b6-11e1-9d99-e811329aed95} - F:\LaunchU3.exe -a
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [EPSON SX510W Series] => C:\windows\system32\spool\DRIVERS\x64\3\E_IATIFIE.EXE [223232 2008-11-20] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2014-10-14] (Microsoft Corporation)
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Epson Stylus SX510W(Netzwerk)] => C:\windows\system32\spool\DRIVERS\x64\3\E_IATIFIE.EXE [223232 2008-11-20] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [AppleIEDAV] => C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1326408 2013-11-15] (Apple Inc.)
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [EPSON8B27B2] => C:\windows\system32\spool\DRIVERS\x64\3\E_IATIFIE.EXE [223232 2008-11-20] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [EPSON SX510W Series (Kopie 1)] => C:\windows\system32\spool\DRIVERS\x64\3\E_IATIFIE.EXE [223232 2008-11-20] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [tale-anger] => C:\Users\Bercht\AppData\Roaming\Tale_source\tale-wind.exe [171008 2014-12-06] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [crew-pool] => C:\Users\Bercht\AppData\Local\Crew-conflict\crewsearch.exe [195584 2014-12-09] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [noise-permit] => C:\Users\Bercht\AppData\Local\Noise-wall\noise-log.exe [69632 2014-12-09] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [skirt-distribute] => C:\Users\Bercht\AppData\Roaming\Skirtbox\skirtpage.exe [69632 2014-12-10] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [part-come] => C:\Users\Bercht\AppData\Roaming\Partshall\part_remain.exe [177664 2014-12-10] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [jkpujwul] => C:\Users\Bercht\AppData\Roaming\Yapcpxmhsh\jrgurjwul.exe [161792 2014-12-10] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [tale-anger] => C:\Users\Bercht\AppData\Roaming\Tale_source\tale-wind.exe [171008 2014-12-06] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [crew-pool] => C:\Users\Bercht\AppData\Local\Crew-conflict\crewsearch.exe [195584 2014-12-09] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [noise-permit] => C:\Users\Bercht\AppData\Local\Noise-wall\noise-log.exe [69632 2014-12-09] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [skirt-distribute] => C:\Users\Bercht\AppData\Roaming\Skirtbox\skirtpage.exe [69632 2014-12-10] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [part-come] => C:\Users\Bercht\AppData\Roaming\Partshall\part_remain.exe [177664 2014-12-10] ()
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {16e7c278-e234-11e2-8567-00ade1ac1c1a} - F:\LaunchU3.exe -a
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {1f2b6a7a-9565-11e1-b892-00ade1ac1c1a} - F:\Start.exe
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {63a1d222-33e2-11e1-95ab-e811329aed95} - G:\SETUP.EXE
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {7c554016-ad0c-11e1-8e14-00ade1ac1c1a} - F:\Start.exe
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {ba084420-9494-11e1-a042-e811329aed95} - F:\Start.exe
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {e5dbe520-54b6-11e1-9d99-e811329aed95} - F:\LaunchU3.exe -a
AppInit_DLLs: C:\windows\system32\nvinitx.dll => C:\windows\system32\nvinitx.dll [226920 2011-05-04] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\windows\SysWOW64\nvinit.dll => C:\windows\SysWOW64\nvinit.dll [192616 2011-05-04] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://samsung.msn.com
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://samsung.msn.com
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://samsung.msn.com
HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://samsung.msn.com
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SMSTDF&pc=MASM&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SMSTDF&pc=MASM&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2363513811-1566349318-2052125673-1001 -> {FA659E7E-D972-4EA2-A51E-42BF1F05FE46} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10262&src=kw&q={searchTerms}&locale=de_CH&apn_ptnrs=^AGT&apn_dtid=^YYYYYY^YY^CH&apn_uid=38078a5e-5035-4e35-b845-947dff379c71&apn_sauid=6F323B30-F5E8-48F3-8E20-A426D504E92E
SearchScopes: HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {FA659E7E-D972-4EA2-A51E-42BF1F05FE46} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10262&src=kw&q={searchTerms}&locale=de_CH&apn_ptnrs=^AGT&apn_dtid=^YYYYYY^YY^CH&apn_uid=38078a5e-5035-4e35-b845-947dff379c71&apn_sauid=6F323B30-F5E8-48F3-8E20-A426D504E92E
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Samsung BHO Class -> {AA609D72-8482-4076-8991-8CDAE5B93BCB} -> C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll ()
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 172.20.10.1

FireFox:
========
FF ProfilePath: C:\Users\Bercht\AppData\Roaming\Mozilla\Firefox\Profiles\394p91y1.default
FF DefaultSearchEngine: Google
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.bluewin.ch
FF NetworkProxy: "gopher", ""
FF NetworkProxy: "gopher_port", ""
FF NetworkProxy: "no_proxies_on", ""
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_15_0_0_239.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_239.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Bercht\AppData\Roaming\Mozilla\Firefox\Profiles\394p91y1.default\user.js
FF SearchPlugin: C:\Users\Bercht\AppData\Roaming\Mozilla\Firefox\Profiles\394p91y1.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\Bercht\AppData\Roaming\Mozilla\Firefox\Profiles\394p91y1.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\Bercht\AppData\Roaming\Mozilla\Firefox\Profiles\394p91y1.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Bercht\AppData\Roaming\Mozilla\Firefox\Profiles\394p91y1.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Bercht\AppData\Roaming\Mozilla\Firefox\Profiles\394p91y1.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Bercht\AppData\Roaming\Mozilla\Firefox\Profiles\394p91y1.default\searchplugins\webde-suche.xml
FF Extension: Avira Browser Safety - C:\Users\Bercht\AppData\Roaming\Mozilla\Firefox\Profiles\394p91y1.default\Extensions\abs@avira.com [2014-11-24]
FF Extension: Ask Toolbar - C:\Users\Bercht\AppData\Roaming\Mozilla\Firefox\Profiles\394p91y1.default\Extensions\toolbar@ask.com [2013-02-25]
FF Extension: Babylon Spelling and Proofreading - C:\Users\Bercht\AppData\Roaming\Mozilla\Firefox\Profiles\394p91y1.default\Extensions\adapter@babylontc.com.xpi [2012-06-10]
FF Extension: Babylon Translation Activation - C:\Users\Bercht\AppData\Roaming\Mozilla\Firefox\Profiles\394p91y1.default\Extensions\ocr@babylon.com.xpi [2012-06-10]
FF Extension: Adblock Plus - C:\Users\Bercht\AppData\Roaming\Mozilla\Firefox\Profiles\394p91y1.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-11]
FF HKLM-x32\...\Firefox\Extensions: [{E4D8AFFF-DA7C-412F-A976-05ED142C7806}] - C:\Program Files (x86)\Swisscom\Unlimited Data Manager\FireFox_Remote
FF Extension: Unlimited Data Manager - C:\Program Files (x86)\Swisscom\Unlimited Data Manager\FireFox_Remote [2012-05-03]
FF HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - {E4D8AFFF-DA7C-412F-A976-05ED142C7806} [Not Found]

Chrome: 
=======
CHR Profile: C:\Users\Bercht\AppData\Local\Google\Chrome\User Data\Default
CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [mjdepfkicdcciagbigfcmdhknnoaaegf] - C:\Program Files (x86)\Deskperience\Word Capture\wcxChrome.crx [2010-07-23]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 EpsonBidirectionalService; C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION) [File not signed]
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [127752 2014-12-07] (SurfRight B.V.)
R2 hmpalertsvc; C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe [1889616 2014-12-09] (SurfRight B.V.)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-12-01] () [File not signed]
R2 SesamService; C:\Program Files (x86)\Swisscom\Sesam\BIN\SecMIPService.exe [1482240 2011-05-16] (Swisscom) [File not signed]
R2 SwiCardDetectSvc; C:\Program Files (x86)\Sierra Wireless Inc\Common\SwiCardDetect64.exe [307568 2010-09-22] (Sierra Wireless, Inc.)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2014-07-16] (TuneUp Software)
R2 UDM Service; C:\Program Files (x86)\Swisscom\Unlimited Data Manager\DashBoardS.exe [182128 2011-05-20] (Swisscom)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 26066201; C:\Windows\System32\DRIVERS\26066201.sys [458336 2014-08-11] (Kaspersky Lab ZAO)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [279616 2011-12-31] (DT Soft Ltd)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [256000 2011-02-18] (Huawei Technologies Co., Ltd.)
R3 hitmanpro37; C:\windows\system32\drivers\hitmanpro37.sys [43664 2014-12-10] ()
R2 hmpalert; C:\Windows\System32\drivers\hmpalert.sys [93144 2014-12-09] ()
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-10] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-08-12] (Windows (R) 2003 DDK 3790 provider)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2014-06-23] (TuneUp Software)
R3 WtSmpAdap; C:\Windows\System32\DRIVERS\wtsmpadap.sys [56688 2011-04-11] (Swisscom)
R1 WtSmpFlt; C:\Windows\System32\DRIVERS\wtsmpflt.sys [409456 2011-04-11] (Swisscom)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-10 12:52 - 2014-12-10 12:53 - 00029363 _____ () C:\Users\Bercht\Downloads\FRST.txt
2014-12-10 12:52 - 2014-12-10 12:52 - 00000000 ____D () C:\FRST
2014-12-10 12:49 - 2014-12-10 12:50 - 02119680 _____ (Farbar) C:\Users\Bercht\Downloads\FRST64.exe
2014-12-10 12:45 - 2014-12-10 12:45 - 00000474 _____ () C:\Users\Bercht\Downloads\defogger_disable.log
2014-12-10 12:45 - 2014-12-10 12:45 - 00000000 _____ () C:\Users\Bercht\defogger_reenable
2014-12-10 12:44 - 2014-12-10 12:45 - 00050477 _____ () C:\Users\Bercht\Downloads\Defogger.exe
2014-12-10 12:11 - 2014-12-10 12:19 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-10 12:11 - 2014-12-10 12:11 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-12-10 12:11 - 2014-12-10 12:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-12-10 12:11 - 2014-12-10 12:11 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-12-10 12:11 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-12-10 12:11 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-12-10 12:11 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-12-10 10:56 - 2014-12-10 11:10 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Bercht\Downloads\mbam-setup-2.0.4.1028.exe
2014-12-10 10:45 - 2014-12-10 10:45 - 00043664 _____ () C:\windows\system32\Drivers\hitmanpro37.sys
2014-12-10 06:09 - 2014-12-10 06:09 - 00000000 ___HD () C:\Users\Bercht\AppData\Roaming\Yapcpxmhsh
2014-12-10 03:23 - 2014-12-10 03:23 - 00000000 ___HD () C:\Users\Bercht\AppData\Roaming\Partshall
2014-12-10 02:01 - 2014-12-10 02:01 - 00000000 ___HD () C:\Users\Bercht\AppData\Roaming\Skirtbox
2014-12-09 22:40 - 2014-12-09 22:40 - 00000000 ___HD () C:\Users\Bercht\AppData\Local\Noise-wall
2014-12-09 20:33 - 2014-12-09 21:41 - 00000000 ____D () C:\Users\Bercht\AppData\Local\Microsoft Games
2014-12-09 13:09 - 2014-12-09 13:08 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2014-12-09 13:08 - 2014-12-09 13:08 - 00000000 ____D () C:\Users\Bercht\AppData\Roaming\Avira
2014-12-09 13:07 - 2014-12-09 13:07 - 00002030 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-12-09 13:07 - 2014-12-09 13:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-12-09 13:07 - 2014-11-24 10:23 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2014-12-09 13:07 - 2014-11-24 10:23 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2014-12-09 13:07 - 2014-11-24 10:23 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2014-12-09 11:45 - 2014-12-09 11:45 - 00000000 ___HD () C:\Users\Bercht\AppData\Local\Crew-conflict
2014-12-09 11:34 - 2014-12-09 22:13 - 00000000 ____D () C:\Program Files (x86)\HitmanPro.Alert
2014-12-09 11:34 - 2014-12-09 12:04 - 00000000 ____D () C:\windows\CryptoGuard
2014-12-09 11:34 - 2014-12-09 11:34 - 00548424 _____ (SurfRight) C:\windows\system32\hmpalert.dll
2014-12-09 11:34 - 2014-12-09 11:34 - 00477008 _____ (SurfRight) C:\windows\SysWOW64\hmpalert.dll
2014-12-09 11:34 - 2014-12-09 11:34 - 00093144 _____ () C:\windows\system32\Drivers\hmpalert.sys
2014-12-09 11:34 - 2014-12-09 11:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro.Alert
2014-12-09 11:34 - 2014-12-09 11:34 - 00000000 ____D () C:\ProgramData\HitmanPro.Alert
2014-12-09 11:32 - 2014-12-09 11:34 - 01889616 _____ (SurfRight B.V.) C:\Users\Bercht\Downloads\hmpalert.exe
2014-12-09 10:53 - 2014-12-09 13:06 - 154051656 _____ () C:\Users\Bercht\Downloads\avira_free_antivirus468_de.exe
2014-12-08 22:49 - 2014-12-08 23:21 - 39441776 _____ () C:\Users\Bercht\Downloads\Firefox Setup 34.0.5.exe
2014-12-07 20:30 - 2014-12-07 20:31 - 00244264 _____ () C:\Users\Bercht\Downloads\Firefox Setup Stub 34.0.5.exe
2014-12-07 20:10 - 2014-12-08 23:00 - 00001250 _____ () C:\windows\system32\.crusader
2014-12-07 20:04 - 2014-12-07 20:04 - 00001909 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2014-12-07 20:04 - 2014-12-07 20:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2014-12-07 20:03 - 2014-12-07 20:04 - 00000000 ____D () C:\Program Files\HitmanPro
2014-12-07 19:32 - 2014-12-07 20:09 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-12-07 19:32 - 2014-12-07 19:32 - 11222744 _____ (SurfRight B.V.) C:\Users\Bercht\Downloads\hitmanpro_x64.exe
2014-12-06 03:08 - 2014-12-06 03:08 - 00000000 ___HD () C:\Users\Bercht\AppData\Roaming\Tale_source
2014-12-05 08:54 - 2014-12-05 08:55 - 00000000 ____D () C:\Users\Bercht\AppData\Local\{311BC302-00CF-4F0E-9E11-6532265259FF}
2014-12-02 23:47 - 2014-12-02 23:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PartyCasino
2014-12-02 09:42 - 2014-12-02 09:42 - 00002197 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\WinZip.lnk
2014-12-02 09:42 - 2014-12-02 09:42 - 00002191 _____ () C:\Users\Public\Desktop\WinZip.lnk
2014-12-02 09:42 - 2014-12-02 09:42 - 00000000 ____D () C:\Users\Bercht\AppData\Local\WinZip
2014-12-02 09:42 - 2014-12-02 09:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip
2014-12-02 09:42 - 2014-12-02 09:42 - 00000000 ____D () C:\Program Files (x86)\WinZip
2014-12-02 09:40 - 2014-12-02 09:41 - 60529152 _____ () C:\Users\Bercht\Downloads\wz190gev-32.msi
2014-11-24 12:33 - 2014-11-11 04:08 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2014-11-24 12:33 - 2014-11-11 04:08 - 00241152 _____ (Microsoft Corporation) C:\windows\system32\pku2u.dll
2014-11-24 12:33 - 2014-11-11 03:44 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2014-11-24 12:33 - 2014-11-11 03:44 - 00186880 _____ (Microsoft Corporation) C:\windows\SysWOW64\pku2u.dll
2014-11-24 12:30 - 2014-11-24 12:31 - 00000000 ____D () C:\Users\Bercht\Desktop\zu verkaufen
2014-11-17 14:34 - 2014-12-02 23:47 - 00001531 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\PartyCasino.lnk
2014-11-17 14:33 - 2014-11-17 14:33 - 00000000 __SHD () C:\Users\Bercht\AppData\Local\EmieBrowserModeList
2014-11-13 13:03 - 2014-11-18 12:23 - 00018377 ____H () C:\Users\Bercht\Desktop\~WRL2214.tmp
2014-11-13 12:04 - 2014-12-09 07:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-13 00:58 - 2014-11-07 20:49 - 00388272 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2014-11-13 00:58 - 2014-11-07 20:23 - 00341168 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2014-11-13 00:58 - 2014-11-06 05:04 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-11-13 00:58 - 2014-11-06 05:03 - 25110016 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-11-13 00:58 - 2014-11-06 05:03 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-11-13 00:58 - 2014-11-06 04:47 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-11-13 00:58 - 2014-11-06 04:46 - 00580096 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-11-13 00:58 - 2014-11-06 04:46 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-11-13 00:58 - 2014-11-06 04:44 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2014-11-13 00:58 - 2014-11-06 04:43 - 02884096 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-11-13 00:58 - 2014-11-06 04:36 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-11-13 00:58 - 2014-11-06 04:35 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-11-13 00:58 - 2014-11-06 04:31 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-11-13 00:58 - 2014-11-06 04:30 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-11-13 00:58 - 2014-11-06 04:30 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-11-13 00:58 - 2014-11-06 04:29 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-11-13 00:58 - 2014-11-06 04:28 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-11-13 00:58 - 2014-11-06 04:23 - 06040064 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-11-13 00:58 - 2014-11-06 04:20 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-11-13 00:58 - 2014-11-06 04:16 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-11-13 00:58 - 2014-11-06 04:13 - 00501248 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2014-11-13 00:58 - 2014-11-06 04:13 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-11-13 00:58 - 2014-11-06 04:12 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2014-11-13 00:58 - 2014-11-06 04:10 - 19781632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-11-13 00:58 - 2014-11-06 04:10 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2014-11-13 00:58 - 2014-11-06 04:07 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-11-13 00:58 - 2014-11-06 04:05 - 02277376 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-11-13 00:58 - 2014-11-06 04:04 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-11-13 00:58 - 2014-11-06 04:03 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-11-13 00:58 - 2014-11-06 04:02 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-11-13 00:58 - 2014-11-06 04:00 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2014-11-13 00:58 - 2014-11-06 04:00 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-11-13 00:58 - 2014-11-06 03:59 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2014-11-13 00:58 - 2014-11-06 03:58 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2014-11-13 00:58 - 2014-11-06 03:57 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-11-13 00:58 - 2014-11-06 03:48 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-11-13 00:58 - 2014-11-06 03:42 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-11-13 00:58 - 2014-11-06 03:41 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-11-13 00:58 - 2014-11-06 03:41 - 00716800 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-11-13 00:58 - 2014-11-06 03:39 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-11-13 00:58 - 2014-11-06 03:38 - 02124288 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-11-13 00:58 - 2014-11-06 03:37 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-11-13 00:58 - 2014-11-06 03:36 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-11-13 00:58 - 2014-11-06 03:34 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-11-13 00:58 - 2014-11-06 03:30 - 14390272 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-11-13 00:58 - 2014-11-06 03:22 - 00688640 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-11-13 00:58 - 2014-11-06 03:21 - 04298240 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-11-13 00:58 - 2014-11-06 03:21 - 02051072 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-11-13 00:58 - 2014-11-06 03:20 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2014-11-13 00:58 - 2014-11-06 03:17 - 02365440 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-11-13 00:58 - 2014-11-06 03:04 - 01550336 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-11-13 00:58 - 2014-11-06 03:03 - 12819456 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-11-13 00:58 - 2014-11-06 02:53 - 00799232 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-11-13 00:58 - 2014-11-06 02:52 - 01892864 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-11-13 00:58 - 2014-11-06 02:48 - 01310208 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-11-13 00:58 - 2014-11-06 02:47 - 00708096 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2014-11-13 00:58 - 2014-11-05 18:56 - 00304640 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2014-11-13 00:58 - 2014-11-05 18:56 - 00228864 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-11-13 00:58 - 2014-11-05 18:52 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-11-13 00:58 - 2014-10-14 03:16 - 00155064 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2014-11-13 00:58 - 2014-10-14 03:13 - 00683520 _____ (Microsoft Corporation) C:\windows\system32\termsrv.dll
2014-11-13 00:58 - 2014-10-14 03:12 - 01460736 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2014-11-13 00:58 - 2014-10-14 03:09 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2014-11-13 00:58 - 2014-10-14 03:07 - 00681984 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2014-11-13 00:58 - 2014-10-14 02:50 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2014-11-13 00:58 - 2014-10-14 02:49 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2014-11-13 00:58 - 2014-10-14 02:47 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2014-11-13 00:58 - 2014-10-14 02:46 - 00681984 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2014-11-13 00:58 - 2014-09-19 10:42 - 00342016 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2014-11-13 00:58 - 2014-09-19 10:42 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2014-11-13 00:58 - 2014-09-19 10:42 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2014-11-13 00:58 - 2014-09-19 10:42 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2014-11-13 00:58 - 2014-09-19 10:42 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2014-11-13 00:58 - 2014-09-19 10:42 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2014-11-13 00:58 - 2014-09-19 10:23 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2014-11-13 00:58 - 2014-09-19 10:23 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2014-11-13 00:58 - 2014-09-19 10:23 - 00221184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2014-11-13 00:58 - 2014-09-19 10:23 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2014-11-13 00:58 - 2014-09-19 10:23 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2014-11-13 00:58 - 2014-09-19 10:23 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2014-11-13 00:58 - 2014-08-21 07:43 - 01882624 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
2014-11-13 00:58 - 2014-08-21 07:40 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll
2014-11-13 00:58 - 2014-08-21 07:26 - 01237504 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll
2014-11-13 00:58 - 2014-08-21 07:23 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3r.dll
2014-11-13 00:58 - 2014-08-12 03:02 - 00878080 _____ (Microsoft Corporation) C:\windows\system32\IMJP10K.DLL
2014-11-13 00:58 - 2014-08-12 02:36 - 00701440 _____ (Microsoft Corporation) C:\windows\SysWOW64\IMJP10K.DLL
2014-11-12 22:21 - 2014-10-25 02:57 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\packager.dll
2014-11-12 22:21 - 2014-10-25 02:32 - 00067584 _____ (Microsoft Corporation) C:\windows\SysWOW64\packager.dll
2014-11-12 22:21 - 2014-10-18 03:05 - 00861696 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll
2014-11-12 22:21 - 2014-10-18 02:33 - 00571904 _____ (Microsoft Corporation) C:\windows\SysWOW64\oleaut32.dll
2014-11-12 22:21 - 2014-10-14 03:13 - 03241984 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
2014-11-12 22:21 - 2014-10-14 02:50 - 02363904 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll
2014-11-12 22:21 - 2014-10-10 01:57 - 03198976 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-11-12 03:56 - 2014-10-03 03:12 - 00500224 _____ (Microsoft Corporation) C:\windows\system32\AUDIOKSE.dll
2014-11-12 03:56 - 2014-10-03 03:11 - 00680960 _____ (Microsoft Corporation) C:\windows\system32\audiosrv.dll
2014-11-12 03:56 - 2014-10-03 03:11 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\AudioEng.dll
2014-11-12 03:56 - 2014-10-03 03:11 - 00296448 _____ (Microsoft Corporation) C:\windows\system32\AudioSes.dll
2014-11-12 03:56 - 2014-10-03 03:11 - 00284672 _____ (Microsoft Corporation) C:\windows\system32\EncDump.dll
2014-11-12 03:56 - 2014-10-03 02:44 - 00442880 _____ (Microsoft Corporation) C:\windows\SysWOW64\AUDIOKSE.dll
2014-11-12 03:56 - 2014-10-03 02:44 - 00374784 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioEng.dll
2014-11-12 03:56 - 2014-10-03 02:44 - 00195584 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioSes.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-10 12:51 - 2009-07-14 05:45 - 00028848 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-10 12:51 - 2009-07-14 05:45 - 00028848 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-10 12:45 - 2011-12-31 20:06 - 00000000 ____D () C:\Users\Bercht
2014-12-10 12:26 - 2012-05-22 23:16 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-12-10 12:11 - 2013-05-14 20:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-10 11:09 - 2012-05-03 22:13 - 00000000 ____D () C:\ProgramData\UDM
2014-12-10 10:55 - 2011-06-09 23:01 - 02040375 _____ () C:\windows\WindowsUpdate.log
2014-12-10 10:50 - 2012-05-03 22:13 - 00000000 ____D () C:\Users\Bercht\AppData\Local\CrashDumps
2014-12-09 19:30 - 2012-01-13 19:30 - 00000254 _____ () C:\windows\Tasks\Epson Printer Software Downloader.job
2014-12-09 13:07 - 2013-02-25 19:43 - 00000000 ____D () C:\ProgramData\Avira
2014-12-09 13:07 - 2013-02-25 19:43 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-12-09 12:11 - 2011-06-09 22:38 - 00703230 _____ () C:\windows\system32\perfh007.dat
2014-12-09 12:11 - 2011-06-09 22:38 - 00150838 _____ () C:\windows\system32\perfc007.dat
2014-12-09 12:11 - 2009-07-14 06:13 - 01629508 _____ () C:\windows\system32\PerfStringBackup.INI
2014-12-09 10:11 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-12-09 10:10 - 2009-07-14 05:51 - 00108471 _____ () C:\windows\setupact.log
2014-12-09 07:22 - 2012-05-06 21:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-09 07:21 - 2011-12-31 20:22 - 00001123 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-12-09 07:21 - 2011-12-31 20:22 - 00001111 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-12-07 20:11 - 2010-11-21 04:47 - 01256494 _____ () C:\windows\PFRO.log
2014-12-04 16:35 - 2011-12-31 20:15 - 00000000 ____D () C:\Users\Bercht\AppData\Local\VirtualStore
2014-12-02 23:47 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-12-02 09:42 - 2012-02-21 02:56 - 00000000 ____D () C:\ProgramData\WinZip
2014-11-26 14:26 - 2012-05-22 23:16 - 00701104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-11-26 14:26 - 2012-05-22 23:16 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-11-26 14:26 - 2011-12-31 17:05 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-13 13:03 - 2011-12-31 13:15 - 00114384 _____ () C:\Users\Bercht\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-13 03:23 - 2009-07-14 05:45 - 00418592 _____ () C:\windows\system32\FNTCACHE.DAT
2014-11-13 03:21 - 2014-05-10 16:40 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-11-13 03:05 - 2011-12-31 20:26 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-11-13 03:03 - 2013-07-28 19:10 - 00000000 ____D () C:\windows\system32\MRT
2014-11-13 03:01 - 2012-11-07 00:45 - 103374192 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-11-12 10:28 - 2012-01-25 01:10 - 00000000 ____D () C:\Users\Bercht\AppData\Roaming\Skype

Some content of TEMP:
====================
C:\Users\Bercht\AppData\Local\Temp\avgnt.exe
C:\Users\Bercht\AppData\Local\Temp\hmpalert_update.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-05 00:22

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-12-2014
Ran by Bercht at 2014-12-10 12:53:37
Running from C:\Users\Bercht\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

„Windows Live Essentials“ (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
„Windows Live Mail“ (x32 Version: 15.4.3502.0922 - „Microsoft Corporation“) Hidden
„Windows Live Messenger“ (x32 Version: 15.4.3502.0922 - „Microsoft Corporation“) Hidden
„Windows Live“ fotogalerija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
ABBYY FineReader 6.0 Sprint (HKLM-x32\...\{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}) (Version: 6.00.1395.4512 - ABBYY Software House)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.239 - Adobe Systems Incorporated)
Adobe Reader 9.5.4 - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-A95000000001}) (Version: 9.5.4 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{21ECABC3-40B2-42DF-8E21-ACF3A4D0D95A}) (Version: 3.0.5 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Ask Toolbar Updater (HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\{79A765E1-C399-405B-85AF-466F52E918B0}) (Version: 1.4.4.57710 - Ask.com) <==== ATTENTION
Ask Toolbar Updater (HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\{79A765E1-C399-405B-85AF-466F52E918B0}) (Version: 1.4.4.57710 - Ask.com) <==== ATTENTION
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
BatteryLifeExtender (HKLM-x32\...\{FFD0E594-823B-4E2B-B680-720B3C852588}) (Version: 1.0.11 - Samsung)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
ChargeableUSB (HKLM-x32\...\{92D50865-FC60-4EA8-BA7A-5581B0D13EFB}) (Version: 1.0.0.0 - SAMSUNG)
CyberLink Media Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 8.0.2227 - CyberLink Corp.)
CyberLink MediaShow (HKLM-x32\...\InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}) (Version: 5.0.1130a - CyberLink Corp.)
CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3802 - CyberLink Corp.)
CyberLink PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.3306 - CyberLink Corp.)
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.3806.02 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.1.3509 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.45.1.0236 - DT Soft Ltd)
Easy Content Share (HKLM-x32\...\{2DDC70C1-C77A-4D08-89D2-9AB648504533}) (Version: 1.0 - Samsung Electronics Co., LTD)
Easy Display Manager (HKLM-x32\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 3.2 - Samsung Electronics Co., Ltd.)
Easy Migration (HKLM-x32\...\{AD86049C-3D9C-43E1-BE73-643F57D83D50}) (Version: 1.0 - Samsung Electronics Co., Ltd.)
Easy Network Manager (HKLM-x32\...\{8732818E-CA78-4ACB-B077-22311BF4C0E4}) (Version: 4.4.7 - Samsung)
Easy SpeedUp Manager (HKLM-x32\...\{EF367AA4-070B-493C-9575-85BE59D789C9}) (Version: 2.1.1.1 - Samsung Electronics Co.,Ltd.)
EasyBatteryManager (HKLM-x32\...\{4A331D24-A9E8-484F-835E-1BA7B139689C}) (Version: 4.0.0.4 - Samsung)
EasyFileShare (HKLM-x32\...\{EA76E65F-6679-495A-A8A6-42AD6602ED4C}) (Version: 1.0.11 - Samsung)
Epson Easy Photo Print 2 (HKLM-x32\...\{87C2248A-C7DD-49ED-9BCD-B312A9D0819E}) (Version: 2.1.0.0 - SEIKO EPSON CORPORATION)
Epson Event Manager (HKLM-x32\...\{48F22622-1CC2-4A83-9C1E-644DD96F832D}) (Version: 2.30.00 - SEIKO EPSON Corporation)
Epson Printer Software Downloader (HKLM-x32\...\Epson Printer Software Downloader) (Version:  - )
Epson Printer Software Downloader (x32 Version: 2.0.0 - SEIKO EPSON CORPORATION) Hidden
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - )
Epson Stylus SX510W_TX550W Handbuch (HKLM-x32\...\Epson Stylus SX510W_TX550W Benutzerhandbuch) (Version:  - )
EPSON SX510W Series Printer Uninstall (HKLM\...\EPSON SX510W Series) (Version:  - SEIKO EPSON Corporation)
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.4j - SEIKO EPSON CORPORATION)
EpsonNet Setup (HKLM-x32\...\{FFFAE01B-466F-4C07-9821-A94FD753BDDA}) (Version: 3.1a - SEIKO EPSON CORPORATION)
ETDWare PS/2-X64 10.7.14.12_WHQL (HKLM\...\Elantech) (Version: 10.7.14.12 - ELAN Microelectronic Corp.)
Fast Start (HKLM-x32\...\{77F45ECD-FAFC-45A8-8896-CFFB139DAAA3}) (Version: 2.2.0.0 - SAMSUNG)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Free Mp3 Wma Converter V 2.2 (HKLM-x32\...\Free Mp3 Wma Converter_is1) (Version: 2.2.0.0 - Koyote Soft)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.9.232 - SurfRight B.V.)
HitmanPro.Alert (HKLM\...\HitmanPro.Alert) (Version: 2.6.5.77 - SurfRight B.V.)
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
ImTOO iPhone Transfer (HKLM-x32\...\ImTOO iPhone Transfer) (Version: 5.4.1.20120803 - ImTOO)
ImTOO iPhone Transfer (HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\ImTOO iPhone Transfer) (Version: 5.4.1.20120803 - ImTOO)
ImTOO iPhone Transfer (HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\ImTOO iPhone Transfer) (Version: 5.4.1.20120803 - ImTOO)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2266 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.0.0.1046 - Intel Corporation)
Intel® PROSet/Wireless WiFi-Software (HKLM\...\{DF7756DD-656A-45C3-BA71-74673E8259A9}) (Version: 15.00.0000.0642 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.32 - Irfan Skiljan)
iTunes (HKLM\...\{33E28B58-7BA0-47B7-AA01-9225ABA2B8A9}) (Version: 11.3.0.54 - Apple Inc.)
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217040FF}) (Version: 7.0.550 - Oracle)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Color Enhancer (HKLM-x32\...\{7F6F62F0-7884-4CFB-B86C-597A4A6D9C4D}) (Version: 1.0 - Samsung Electronics Co., Ltd.)
Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
Nur Entfernen der CopyTrans Suite möglich (HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\...\CopyTrans Suite) (Version: 2.36 - WindSolutions)
Nur Entfernen der CopyTrans Suite möglich (HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\CopyTrans Suite) (Version: 2.36 - WindSolutions)
NVIDIA Graphics Driver 266.72 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 266.72 - NVIDIA Corporation)
PartyCasino (HKLM-x32\...\PartyCasino) (Version:  - PartyGaming)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.210.0 - Tracker Software Products Ltd)
PhoneShare (HKLM-x32\...\{3F50512F-53DF-46B1-8CCB-6C7E638CADD6}) (Version: 9.1.4 - Samsung)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
PokerStars (HKLM-x32\...\PokerStars) (Version:  - PokerStars)
PokerStars.net (HKLM-x32\...\PokerStars.net) (Version:  - PokerStars.net)
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.44.421.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6378 - Realtek Semiconductor Corp.)
Samsung AnyWeb Print (HKLM-x32\...\{318DBE01-1E6B-4243-84B0-210391FE789A}) (Version: 2.0.67.1 - Samsung Electronics Co., Ltd.)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Samsung Recovery Solution 5 (HKLM-x32\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 5.0.0.9 - Samsung)
Samsung Support Center (HKLM-x32\...\{F687E657-F636-44DF-8125-9FEEA2C362F5}) (Version: 1.1.24 - Samsung)
Samsung Universal Print Driver (HKLM-x32\...\Samsung Universal Print Driver) (Version: 2.02.05.00:27 - Samsung Electronics Co., Ltd.)
Samsung Universal Scan Driver (HKLM-x32\...\Samsung Universal Scan Driver) (Version: 1.2.5.0 - Samsung Electronics Co., Ltd.)
Samsung Update Plus (HKLM-x32\...\{142D8CA7-2C6F-45A7-83E3-099AAFD99133}) (Version: 3.0.0.17 - Samsung Electronics Co., Ltd.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
TotalHTMLConverter (HKLM-x32\...\Total HTML Converter_is1) (Version: 2.5 - Softplicity, Inc.)
TotalMailConverter (HKLM-x32\...\Total Mail Converter_is1) (Version: 2.5 - Softplicity, Inc.)
TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.340 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM-x32\...\TuneUp Utilities) (Version: 14.0.1000.340 - TuneUp Software)
TuneUp Utilities 2014 (x32 Version: 14.0.1000.340 - TuneUp Software) Hidden
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (HKLM\...\{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}) (Version: 2.1.23.0 - Intel)
Unlimited Data Manager 10.0.0 (HKLM-x32\...\{8B219E8B-B0B5-4730-9E27-BD3EC339A0CC}) (Version: 10.0.21168.0 - Swisscom)
User Guide (HKLM-x32\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.5 - )
VLC media player 2.0.3 (HKLM-x32\...\VLC media player) (Version: 2.0.3 - VideoLAN)
Windows Live 程式集 (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
WinZip 19.0 (HKLM-x32\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240E4}) (Version: 19.0.11293 - WinZip Computing, S.L. )
WordCaptureX Pro (HKLM-x32\...\{139C1D95-9037-3AB3-F5F4-4A79BF6831EC}) (Version: 4.0.0 - Deskperience)
XMedia Recode Version 3.1.3.6 (HKLM-x32\...\{DDA3C325-47B2-4730-9672-BF3771C08799}_is1) (Version: 3.1.3.6 - XMedia Recode)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

09-12-2014 23:13:58 Geplanter Prüfpunkt

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {04B21C53-B6B6-4442-AEAA-8C79559AED6F} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2010-11-10] (CyberLink)
Task: {0ED2D85F-8AFE-48BE-BC64-DD8B3E06F3E2} - System32\Tasks\WifiManager => C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe [2011-01-04] (Samsung Electronics Co., Ltd.)
Task: {122E1753-840C-4636-9F1E-985D8EE0A014} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2014\OneClick.exe [2014-07-16] (TuneUp Software)
Task: {13C42C5B-C5B5-477F-B2D5-AD9B1F2E33C5} - System32\Tasks\Epson Printer Software Downloader => C:\Program Files (x86)\EPSON\EPAPDL\E_SAPDL2.EXE [2009-01-23] (SEIKO EPSON CORPORATION)
Task: {18A426BA-B82E-4615-AE6E-6CDDC38C0B33} - System32\Tasks\EasyPartitionManager => C:\Windows\MSetup\BA46-12225A02\EPM.exe
Task: {36AE324A-DAEA-4967-A52D-B2DD990FA0F1} - System32\Tasks\MovieColorEnhancer => C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe [2010-11-29] (Samsung Electronics Co., Ltd.)
Task: {415FF63B-7725-4FE9-BFA4-AE154E954C33} - System32\Tasks\EasyDisplayMgr => C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe [2010-12-23] (Samsung Electronics Co., Ltd.)
Task: {43934BC3-0DDB-493F-8BC9-9F3A908E2284} - System32\Tasks\AutoKMS => C:\windows\AutoKMS.exe
Task: {451203D1-3AEA-4306-BC57-D55C6A26F43B} - System32\Tasks\SamsungSupportCenter => C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe [2011-02-07] (SAMSUNG Electronics)
Task: {4A0D2E26-72B1-45D8-AD33-FA495FD26FE7} - System32\Tasks\BatteryLifeExtender => C:\Program Files (x86)\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2010-12-18] (Samsung Electronics. Co. Ltd.)
Task: {4C700B83-DA90-423A-A452-E5DA85B0DB72} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {4D5F2877-5AEC-4D34-B382-20CD663996B1} - System32\Tasks\SUPBackground => C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe [2011-01-11] (Samsung Electronics)
Task: {693F165F-68D5-42B8-B289-E610C91D7410} - System32\Tasks\Apple Diagnostics => C:\Program Files (x86)\Common Files\Apple\Internet Services\EReporter.exe [2013-11-20] (Apple Inc.)
Task: {7380DC84-7DF0-4D6E-85FA-23C91803DAE0} - System32\Tasks\EasyBatteryManager => C:\Program Files (x86)\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe [2010-07-20] (SAMSUNG Electronics co., LTD.)
Task: {751B65D5-0399-42F4-84A0-CB2A1EDACF0A} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-03] (Adobe Systems Incorporated)
Task: {82669EE7-D9ED-4C82-86B9-0B88C681AF93} - System32\Tasks\SmartRestarter => C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe [2010-08-05] (Samsung Electronics Co., Ltd.)
Task: {88382C5B-16AE-4D1D-A7BA-6433AB344D95} - System32\Tasks\advSRS5 => C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe [2010-11-17] (SEC)
Task: {A6FC209D-1372-4A86-98F7-A0F934F57722} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-26] (Adobe Systems Incorporated)
Task: {BDC9B2D4-2DD0-41BA-8B0F-7937912DCF99} - \Scheduled Update for Ask Toolbar No Task File <==== ATTENTION
Task: {C44F098C-221A-403F-BE3B-9F7DDB7CCBAB} - System32\Tasks\EasySpeedUpManager => C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager2.exe [2010-12-23] (Samsung Electronics)
Task: {D34DCCE1-5558-45D5-9D5C-8A24977793CB} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {D6232FEF-02F0-486F-A35A-7C575889A8D8} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {F688D296-0FE7-42CE-9673-37244B97205D} - System32\Tasks\{9BD3A4CF-98CB-4FA1-8CDA-932B4E1B2644} => C:\Program Files (x86)\DigiDNA\DiskAid\DiskAid.exe
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\Epson Printer Software Downloader.job => C:\Program Files (x86)\EPSON\EPAPDL\E_SAPDL2.EXE

==================== Loaded Modules (whitelisted) =============

2011-06-09 22:20 - 2008-06-05 00:53 - 00027648 _____ () C:\windows\System32\spd__l.dll
2013-06-21 12:32 - 2013-06-21 12:32 - 00034304 _____ () C:\windows\System32\sst6clm.dll
2011-06-09 07:27 - 2009-12-01 08:21 - 00244904 ____N () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2014-07-16 09:24 - 2014-07-16 09:24 - 00699704 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\avgrepliba.dll
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2011-06-09 22:17 - 2010-12-17 02:37 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2011-06-09 22:20 - 2010-10-21 19:22 - 00709632 _____ () C:\windows\system32\SnMinDrv.dll
2014-04-23 15:05 - 2014-04-23 15:05 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-04-23 15:04 - 2014-04-23 15:04 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2010-10-13 08:13 - 2010-10-13 08:13 - 00057344 ____R () C:\Program Files (x86)\Swisscom\Sesam\BIN\boost_thread-vc80-mt-1_44.dll
2010-10-13 08:11 - 2010-10-13 08:11 - 00057344 ____R () C:\Program Files (x86)\Swisscom\Sesam\BIN\boost_date_time-vc80-mt-1_44.dll
2011-05-16 14:06 - 2011-05-16 14:06 - 01011712 ____R () C:\Program Files (x86)\Swisscom\Unlimited Data Manager\LIBEAY32.dll
2011-05-16 14:06 - 2011-05-16 14:06 - 00249856 ____R () C:\Program Files (x86)\Swisscom\Unlimited Data Manager\SSLEAY32.dll
2010-10-13 08:12 - 2010-10-13 08:12 - 00663552 ____R () C:\Program Files (x86)\Swisscom\Unlimited Data Manager\boost_regex-vc80-mt-1_44.dll
2010-10-13 08:13 - 2010-10-13 08:13 - 00057344 ____R () C:\Program Files (x86)\Swisscom\Unlimited Data Manager\boost_thread-vc80-mt-1_44.dll
2010-10-13 08:11 - 2010-10-13 08:11 - 00057344 ____R () C:\Program Files (x86)\Swisscom\Unlimited Data Manager\boost_date_time-vc80-mt-1_44.dll
2010-10-13 08:12 - 2010-10-13 08:12 - 00233472 ____R () C:\Program Files (x86)\Swisscom\Unlimited Data Manager\boost_serialization-vc80-mt-1_44.dll
2010-10-13 08:11 - 2010-10-13 08:11 - 00135168 ____R () C:\Program Files (x86)\Swisscom\Unlimited Data Manager\boost_filesystem-vc80-mt-1_44.dll
2010-10-13 08:11 - 2010-10-13 08:11 - 00012288 ____R () C:\Program Files (x86)\Swisscom\Unlimited Data Manager\boost_system-vc80-mt-1_44.dll
2011-05-16 14:04 - 2011-05-16 14:04 - 00438272 ____R () C:\Program Files (x86)\Swisscom\Unlimited Data Manager\sqlite.dll
2011-06-09 07:20 - 2010-07-05 11:42 - 00203776 _____ () C:\Program Files (x86)\Samsung\Movie Color Enhancer\WinCRT.dll
2013-09-14 01:51 - 2013-09-14 01:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 01:50 - 2013-09-14 01:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll
2009-11-02 06:20 - 2009-11-02 06:20 - 00619816 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2009-11-02 06:23 - 2009-11-02 06:23 - 00013096 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2012-01-13 19:29 - 2008-12-22 09:50 - 00135168 ____N () C:\Program Files (x86)\Epson Software\Event Manager\Assistants\Scan Assistant\ScanEngine.dll
2012-01-13 19:29 - 2008-11-21 13:58 - 00057344 ____N () C:\Program Files (x86)\Epson Software\Event Manager\Assistants\Scan Assistant\Satwain.dll
2011-06-09 07:37 - 2006-08-12 04:48 - 00049152 _____ () C:\Program Files (x86)\Samsung\Easy Display Manager\HookDllPS2.dll
2011-06-09 07:35 - 2010-05-07 15:22 - 01636864 _____ () C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\Resdll.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf
2014-11-13 12:04 - 2014-11-26 17:40 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-2363513811-1566349318-2052125673-500 - Administrator - Disabled)
Bercht (S-1-5-21-2363513811-1566349318-2052125673-1001 - Administrator - Enabled) => C:\Users\Bercht
Gast (S-1-5-21-2363513811-1566349318-2052125673-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2363513811-1566349318-2052125673-1003 - Limited - Enabled)
UpdatusUser (S-1-5-21-2363513811-1566349318-2052125673-1000 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/10/2014 10:50:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc100
Name des fehlerhaften Moduls: ole32.DLL, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0003aa0e
ID des fehlerhaften Prozesses: 0x1ee8
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe0
Pfad der fehlerhaften Anwendung: svchost.exe1
Pfad des fehlerhaften Moduls: svchost.exe2
Berichtskennung: svchost.exe3

Error: (12/10/2014 10:49:45 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: {00006756-053A-6288}, Version: 7.72.20.4535, Zeitstempel: 0x5486ba55
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0003aa0e
ID des fehlerhaften Prozesses: 0x2548
Startzeit der fehlerhaften Anwendung: 0x{00006756-053A-6288}0
Pfad der fehlerhaften Anwendung: {00006756-053A-6288}1
Pfad des fehlerhaften Moduls: {00006756-053A-6288}2
Berichtskennung: {00006756-053A-6288}3

Error: (12/09/2014 10:13:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 34.0.5.5443, Zeitstempel: 0x5475dd5d
Name des fehlerhaften Moduls: mozalloc.dll, Version: 34.0.5.5443, Zeitstempel: 0x5475d664
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x334
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (12/09/2014 10:13:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/08/2014 11:00:07 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "RegSetValueExW(0x00000200,(null),0,REG_BINARY,0000000001A9F220.72)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.

Error: (12/08/2014 11:00:07 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "RegSetValueExW(0x000004e8,(null),0,REG_BINARY,000000000099E310.72)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.


Vorgang:
   BackupShutdown-Ereignis

Kontext:
   Ausführungskontext: Writer
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {6368ecb1-60d3-4437-a302-83b9ffc0ce48}

Error: (12/08/2014 11:00:07 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "RegSetValueExW(0x00000b8c,(null),0,REG_BINARY,000000000153E280.72)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.


Vorgang:
   BackupShutdown-Ereignis

Kontext:
   Ausführungskontext: Writer
   Generatorklassen-ID: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
   Generatorname: WMI Writer
   Generatorinstanz-ID: {7b04a2f2-cd05-4638-95c4-344706c1529e}

Error: (12/08/2014 11:00:07 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "RegSetValueExW(0x000001d0,SYSTEM\CurrentControlSet\Services\VSS\Diag\Registry Writer,0,REG_BINARY,00000000015BEC40.72)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.


Vorgang:
   BackupShutdown-Ereignis

Kontext:
   Ausführungskontext: Writer
   Generatorklassen-ID: {afbab4a2-367d-4d15-a586-71dbb18f8485}
   Generatorname: Registry Writer
   Generatorinstanz-ID: {643e87da-ae80-4e7c-bd77-2342d9453461}

Error: (12/08/2014 11:00:07 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "RegSetValueExW(0x000004e8,(null),0,REG_BINARY,000000000099E310.72)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.


Vorgang:
   BackupShutdown-Ereignis

Kontext:
   Ausführungskontext: Writer
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {6368ecb1-60d3-4437-a302-83b9ffc0ce48}

Error: (12/08/2014 11:00:07 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "RegSetValueExW(0x0000021c,SYSTEM\CurrentControlSet\Services\VSS\Diag\Shadow Copy Optimization Writer,0,REG_BINARY,000000000217EA00.72)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.


Vorgang:
   BackupShutdown-Ereignis

Kontext:
   Ausführungskontext: Writer
   Generatorklassen-ID: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Generatorname: Shadow Copy Optimization Writer
   Generatorinstanz-ID: {cfc0ae49-0774-4368-8df3-d321b632791b}


System errors:
=============
Error: (12/10/2014 10:07:32 AM) (Source: Schannel) (EventID: 4119) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 20.

Error: (12/10/2014 09:17:15 AM) (Source: Schannel) (EventID: 4119) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 20.

Error: (12/09/2014 00:18:36 PM) (Source: volsnap) (EventID: 35) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht vergrößert werden kann.

Error: (12/09/2014 07:23:27 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "HitmanPro 3.7 Crusader (Boot)" wurde mit folgendem dienstspezifischem Fehler beendet: %%0.

Error: (12/09/2014 07:21:11 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Description" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (12/09/2014 07:21:11 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Security" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (12/09/2014 07:18:29 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst SwiCardDetectSvc erreicht.

Error: (12/08/2014 11:00:01 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (12/08/2014 11:00:00 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (12/07/2014 08:24:16 PM) (Source: iaStor) (EventID: 9) (User: )
Description: Das Gerät \Device\Ide\iaStor0 hat innerhalb der Fehlerwartezeit nicht geantwortet.


Microsoft Office Sessions:
=========================
Error: (12/10/2014 10:50:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: svchost.exe6.1.7600.163854a5bc100ole32.DLL6.1.7601.175144ce7b96fc00000050003aa0e1ee801d01403cbb237f4C:\windows\syswow64\svchost.exeC:\windows\syswow64\ole32.DLLec037407-8051-11e4-baf6-00ade1ac1c1a

Error: (12/10/2014 10:49:45 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: {00006756-053A-6288}7.72.20.45355486ba55ole32.dll6.1.7601.175144ce7b96fc00000050003aa0e254801d013fd382891aeC:\Users\Bercht\AppData\Local\Temp\{00006756-053A-6288}C:\windows\syswow64\ole32.dlldea2ba32-8051-11e4-baf6-00ade1ac1c1a

Error: (12/09/2014 10:13:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe34.0.5.54435475dd5dmozalloc.dll34.0.5.54435475d664800000030000142533401d013a833e94e6aC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll4580fdce-7fe8-11e4-baf6-00ade1ac1c1a

Error: (12/09/2014 10:13:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/08/2014 11:00:07 PM) (Source: VSS) (EventID: 8193) (User: )
Description: RegSetValueExW(0x00000200,(null),0,REG_BINARY,0000000001A9F220.72)0x80070005, Zugriff verweigert

Error: (12/08/2014 11:00:07 PM) (Source: VSS) (EventID: 8193) (User: )
Description: RegSetValueExW(0x000004e8,(null),0,REG_BINARY,000000000099E310.72)0x80070005, Zugriff verweigert


Vorgang:
   BackupShutdown-Ereignis

Kontext:
   Ausführungskontext: Writer
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {6368ecb1-60d3-4437-a302-83b9ffc0ce48}

Error: (12/08/2014 11:00:07 PM) (Source: VSS) (EventID: 8193) (User: )
Description: RegSetValueExW(0x00000b8c,(null),0,REG_BINARY,000000000153E280.72)0x80070005, Zugriff verweigert


Vorgang:
   BackupShutdown-Ereignis

Kontext:
   Ausführungskontext: Writer
   Generatorklassen-ID: {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
   Generatorname: WMI Writer
   Generatorinstanz-ID: {7b04a2f2-cd05-4638-95c4-344706c1529e}

Error: (12/08/2014 11:00:07 PM) (Source: VSS) (EventID: 8193) (User: )
Description: RegSetValueExW(0x000001d0,SYSTEM\CurrentControlSet\Services\VSS\Diag\Registry Writer,0,REG_BINARY,00000000015BEC40.72)0x80070005, Zugriff verweigert


Vorgang:
   BackupShutdown-Ereignis

Kontext:
   Ausführungskontext: Writer
   Generatorklassen-ID: {afbab4a2-367d-4d15-a586-71dbb18f8485}
   Generatorname: Registry Writer
   Generatorinstanz-ID: {643e87da-ae80-4e7c-bd77-2342d9453461}

Error: (12/08/2014 11:00:07 PM) (Source: VSS) (EventID: 8193) (User: )
Description: RegSetValueExW(0x000004e8,(null),0,REG_BINARY,000000000099E310.72)0x80070005, Zugriff verweigert


Vorgang:
   BackupShutdown-Ereignis

Kontext:
   Ausführungskontext: Writer
   Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
   Generatorname: System Writer
   Generatorinstanz-ID: {6368ecb1-60d3-4437-a302-83b9ffc0ce48}

Error: (12/08/2014 11:00:07 PM) (Source: VSS) (EventID: 8193) (User: )
Description: RegSetValueExW(0x0000021c,SYSTEM\CurrentControlSet\Services\VSS\Diag\Shadow Copy Optimization Writer,0,REG_BINARY,000000000217EA00.72)0x80070005, Zugriff verweigert


Vorgang:
   BackupShutdown-Ereignis

Kontext:
   Ausführungskontext: Writer
   Generatorklassen-ID: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Generatorname: Shadow Copy Optimization Writer
   Generatorinstanz-ID: {cfc0ae49-0774-4368-8df3-d321b632791b}


CodeIntegrity Errors:
===================================
  Date: 2014-12-10 12:51:53.967
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-10 12:45:12.566
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-10 12:10:43.202
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-10 10:50:08.200
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 22:18:35.835
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 20:32:37.168
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 13:04:34.331
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 12:08:09.774
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-12-09 11:59:31.038
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-2630QM CPU @ 2.00GHz
Percentage of memory in use: 41%
Total physical RAM: 8104.19 MB
Available physical RAM: 4728.36 MB
Total Pagefile: 16206.56 MB
Available Pagefile: 12644.43 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:120 GB) (Free:1.46 GB) NTFS
Drive d: () (Fixed) (Total:322.83 GB) (Free:291.96 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 1F8D46A3)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=120 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=322.8 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=22.8 GB) - (Type=27)

==================== End Of Log ============================

Bercht · 12.12.2014, 08:32

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-12-11 22:21:23
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AR1 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Bercht\AppData\Local\Temp\fgdiipog.sys


---- User code sections - GMER 2.1 ----

.text   C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe[888] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                            000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe[888] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe[888] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                             0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe[888] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                          0000000077821465 2 bytes [82, 77]
.text   C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe[888] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                         00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\windows\system32\nvvsvc.exe[912] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                 00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\nvvsvc.exe[912] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                     00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\nvvsvc.exe[912] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                  00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\nvvsvc.exe[912] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                              00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\svchost.exe[1004] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                               00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\svchost.exe[1004] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                   00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\svchost.exe[1004] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\svchost.exe[1004] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                            00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\System32\svchost.exe[480] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\System32\svchost.exe[480] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                    00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\System32\svchost.exe[480] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                 00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\System32\svchost.exe[480] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                             00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\System32\svchost.exe[600] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\System32\svchost.exe[600] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                    00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\System32\svchost.exe[600] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                 00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\System32\svchost.exe[600] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                             00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\svchost.exe[492] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\svchost.exe[492] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                    00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\svchost.exe[492] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                 00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\svchost.exe[492] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                             00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\svchost.exe[988] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\svchost.exe[988] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                    00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\svchost.exe[988] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                 00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\svchost.exe[988] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                             00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\svchost.exe[1292] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                               00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\svchost.exe[1292] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                   00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\svchost.exe[1292] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\svchost.exe[1292] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                            00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\svchost.exe[1484] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                               00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\svchost.exe[1484] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                   00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\svchost.exe[1484] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\svchost.exe[1484] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                            00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                      00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                          00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                       00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                   00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\KERNEL32.dll!K32GetMappedFileNameW                                     000000007748f2e0 5 bytes JMP 000000016fff0148
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                                   00000000774b9a30 7 bytes JMP 000000016fff00d8
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\KERNEL32.dll!K32GetModuleInformation                                   00000000774c94c0 5 bytes JMP 000000016fff0180
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\KERNEL32.dll!K32GetModuleFileNameExW                                   00000000774c9630 5 bytes JMP 000000016fff0110
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\KERNEL32.dll!RegSetValueExA                                            00000000774e87e0 7 bytes JMP 000000016fff01b8
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\KERNELBASE.dll!FreeLibrary                                             000007fefd742db0 5 bytes JMP 000007fffd730180
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\KERNELBASE.dll!GetModuleHandleW                                        000007fefd7437d0 7 bytes JMP 000007fffd7300d8
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                          000007fefd748ef0 6 bytes JMP 000007fffd730148
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\KERNELBASE.dll!GetModuleHandleExW                                      000007fefd75af60 5 bytes JMP 000007fffd730110
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                       000007feff4389f0 8 bytes JMP 000007fffd7301f0
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                     000007feff43be50 8 bytes JMP 000007fffd7301b8
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\ole32.dll!CoCreateInstance                                             000007fefe5a7490 11 bytes JMP 000007fffd730228
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\ole32.dll!CoSetProxyBlanket                                            000007fefe5bbf00 7 bytes JMP 000007fffd730260
.text   C:\windows\system32\nvvsvc.exe[1552] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\nvvsvc.exe[1552] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                    00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\nvvsvc.exe[1552] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                 00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\nvvsvc.exe[1552] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                             00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\System32\spoolsv.exe[1748] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                               00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\System32\spoolsv.exe[1748] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                   00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\System32\spoolsv.exe[1748] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\System32\spoolsv.exe[1748] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                            00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe[1844] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                        000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe[1844] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                            000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe[1844] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                         0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe[2000] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                    000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe[2000] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                        000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe[2000] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                     0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1684] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                      000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1684] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                          000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1684] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                       0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1684] C:\windows\syswow64\psapi.dll!GetModuleInformation + 69                                    0000000077821465 2 bytes [82, 77]
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1684] C:\windows\syswow64\psapi.dll!GetModuleInformation + 155                                   00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1632] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory  000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1632] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory      000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1632] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory   0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files\Bonjour\mDNSResponder.exe[2052] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                    00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Program Files\Bonjour\mDNSResponder.exe[2052] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                        00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Program Files\Bonjour\mDNSResponder.exe[2052] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                     00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Program Files\Bonjour\mDNSResponder.exe[2052] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                 00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2176] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                            000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2176] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2176] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                             0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2176] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                          0000000077821465 2 bytes [82, 77]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2176] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                         00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2284] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                              000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2284] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                  000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2284] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                               0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[2316] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                   000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[2316] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                       000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[2316] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                    0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Swisscom\Sesam\BIN\SecMIPService.exe[2376] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                   000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Swisscom\Sesam\BIN\SecMIPService.exe[2376] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                       000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Swisscom\Sesam\BIN\SecMIPService.exe[2376] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                    0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe[2508] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                     00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe[2508] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                         00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe[2508] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                      00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe[2508] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                  00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files (x86)\Swisscom\Unlimited Data Manager\DashBoardS.exe[2544] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                         000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Swisscom\Unlimited Data Manager\DashBoardS.exe[2544] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                             000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Swisscom\Unlimited Data Manager\DashBoardS.exe[2544] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                          0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Swisscom\Unlimited Data Manager\DashBoardS.exe[2544] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                       0000000077821465 2 bytes [82, 77]
.text   C:\Program Files (x86)\Swisscom\Unlimited Data Manager\DashBoardS.exe[2544] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                      00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe[3488] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                     00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe[3488] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                         00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe[3488] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                      00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe[3488] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                  00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\taskhost.exe[3772] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\taskhost.exe[3772] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\taskhost.exe[3772] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                               00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\taskhost.exe[3772] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                           00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                     000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                         000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                      0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                                           0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                                  000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                                  0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4                              0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation                                  0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                                    00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                       0000000075941d29 5 bytes JMP 000000016fe22450
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                     0000000075941dd7 5 bytes JMP 000000016fe224b0
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                         0000000075942ab1 5 bytes JMP 000000016fe22520
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary                                            0000000075942d17 5 bytes JMP 000000016fe22620
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                    0000000076e5e96b 5 bytes JMP 000000016fe21a00
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                      0000000076e5eba5 5 bytes JMP 000000016fe21a90
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                   0000000077821465 2 bytes [82, 77]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                  00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\ole32.dll!CoSetProxyBlanket                                           00000000770e5ea5 5 bytes JMP 000000016fe21ce0
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\ole32.dll!CoCreateInstance                                            0000000077119d0b 5 bytes JMP 000000016fe21c70
.text   C:\windows\System32\rundll32.exe[3964] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\System32\rundll32.exe[3964] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\System32\rundll32.exe[3964] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                               00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\System32\rundll32.exe[3964] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                           00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\Dwm.exe[896] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                    00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\Dwm.exe[896] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                        00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\Dwm.exe[896] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                     00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\Dwm.exe[896] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                 00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\Explorer.EXE[2484] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                       00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\Explorer.EXE[2484] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                           00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\Explorer.EXE[2484] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                        00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\Explorer.EXE[2484] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                    00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                               00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                   00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                            00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\KERNEL32.dll!K32GetMappedFileNameW                                                              000000007748f2e0 5 bytes JMP 000000016fff0148
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                                                            00000000774b9a30 7 bytes JMP 000000016fff00d8
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\KERNEL32.dll!K32GetModuleInformation                                                            00000000774c94c0 5 bytes JMP 000000016fff0180
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\KERNEL32.dll!K32GetModuleFileNameExW                                                            00000000774c9630 5 bytes JMP 000000016fff0110
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\KERNEL32.dll!RegSetValueExA                                                                     00000000774e87e0 7 bytes JMP 000000016fff01b8
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\KERNELBASE.dll!FreeLibrary                                                                      000007fefd742db0 5 bytes JMP 000007fffd730180
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                 000007fefd7437d0 7 bytes JMP 000007fffd7300d8
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                   000007fefd748ef0 6 bytes JMP 000007fffd730148
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                               000007fefd75af60 5 bytes JMP 000007fffd730110
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                000007feff4389f0 8 bytes JMP 000007fffd7301f0
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                              000007feff43be50 8 bytes JMP 000007fffd7301b8
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\ole32.dll!CoCreateInstance                                                                      000007fefe5a7490 11 bytes JMP 000007fffd730228
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\ole32.dll!CoSetProxyBlanket                                                                     000007fefe5bbf00 7 bytes JMP 000007fffd730260
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                         00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                             00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                          00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                      00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\KERNEL32.dll!K32GetMappedFileNameW                        000000007748f2e0 5 bytes JMP 000000016fff0148
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                      00000000774b9a30 7 bytes JMP 000000016fff00d8
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\KERNEL32.dll!K32GetModuleInformation                      00000000774c94c0 5 bytes JMP 000000016fff0180
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\KERNEL32.dll!K32GetModuleFileNameExW                      00000000774c9630 5 bytes JMP 000000016fff0110
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\KERNEL32.dll!RegSetValueExA                               00000000774e87e0 7 bytes JMP 000000016fff01b8
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\KERNELBASE.dll!FreeLibrary                                000007fefd742db0 5 bytes JMP 000007fffd730180
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\KERNELBASE.dll!GetModuleHandleW                           000007fefd7437d0 7 bytes JMP 000007fffd7300d8
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                             000007fefd748ef0 6 bytes JMP 000007fffd730148
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\KERNELBASE.dll!GetModuleHandleExW                         000007fefd75af60 5 bytes JMP 000007fffd730110
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                          000007feff4389f0 8 bytes JMP 000007fffd7301f0
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                        000007feff43be50 8 bytes JMP 000007fffd7301b8
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\ole32.dll!CoCreateInstance                                000007fefe5a7490 11 bytes JMP 000007fffd730228
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\ole32.dll!CoSetProxyBlanket                               000007fefe5bbf00 7 bytes JMP 000007fffd730260
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                               00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                   00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                            00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\KERNEL32.dll!K32GetMappedFileNameW                                              000000007748f2e0 5 bytes JMP 000000016fff0148
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                                            00000000774b9a30 7 bytes JMP 000000016fff00d8
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\KERNEL32.dll!K32GetModuleInformation                                            00000000774c94c0 5 bytes JMP 000000016fff0180
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\KERNEL32.dll!K32GetModuleFileNameExW                                            00000000774c9630 5 bytes JMP 000000016fff0110
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\KERNEL32.dll!RegSetValueExA                                                     00000000774e87e0 7 bytes JMP 000000016fff01b8
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\KERNELBASE.dll!FreeLibrary                                                      000007fefd742db0 5 bytes JMP 000007fffd730180
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\KERNELBASE.dll!GetModuleHandleW                                                 000007fefd7437d0 7 bytes JMP 000007fffd7300d8
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                   000007fefd748ef0 6 bytes JMP 000007fffd730148
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\KERNELBASE.dll!GetModuleHandleExW                                               000007fefd75af60 5 bytes JMP 000007fffd730110
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                000007feff4389f0 8 bytes JMP 000007fffd7301f0
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                              000007feff43be50 8 bytes JMP 000007fffd7301b8
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\ole32.dll!CoCreateInstance                                                      000007fefe5a7490 11 bytes JMP 000007fffd730228
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\ole32.dll!CoSetProxyBlanket                                                     000007fefe5bbf00 7 bytes JMP 000007fffd730260
.text   C:\Windows\System32\igfxtray.exe[3696] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Windows\System32\igfxtray.exe[3696] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Windows\System32\igfxtray.exe[3696] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                               00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Windows\System32\igfxtray.exe[3696] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                           00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Windows\System32\hkcmd.exe[3124] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                 00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Windows\System32\hkcmd.exe[3124] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                     00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Windows\System32\hkcmd.exe[3124] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                  00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Windows\System32\hkcmd.exe[3124] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                              00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                               00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                           00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\KERNEL32.dll!K32GetMappedFileNameW                                                             000000007748f2e0 5 bytes JMP 000000016fff0148
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                                                           00000000774b9a30 7 bytes JMP 000000016fff00d8
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\KERNEL32.dll!K32GetModuleInformation                                                           00000000774c94c0 5 bytes JMP 000000016fff0180
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\KERNEL32.dll!K32GetModuleFileNameExW                                                           00000000774c9630 5 bytes JMP 000000016fff0110
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\KERNEL32.dll!RegSetValueExA                                                                    00000000774e87e0 7 bytes JMP 000000016fff01b8
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\KERNELBASE.dll!FreeLibrary                                                                     000007fefd742db0 5 bytes JMP 000007fffd730180
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                000007fefd7437d0 7 bytes JMP 000007fffd7300d8
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                  000007fefd748ef0 6 bytes JMP 000007fffd730148
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                              000007fefd75af60 5 bytes JMP 000007fffd730110
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                               000007feff4389f0 8 bytes JMP 000007fffd7301f0
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                             000007feff43be50 8 bytes JMP 000007fffd7301b8
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\ole32.dll!CoCreateInstance                                                                     000007fefe5a7490 11 bytes JMP 000007fffd730228
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\ole32.dll!CoSetProxyBlanket                                                                    000007fefe5bbf00 7 bytes JMP 000007fffd730260
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                               00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                   00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                            00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\KERNEL32.dll!K32GetMappedFileNameW                                                              000000007748f2e0 5 bytes JMP 000000016fff0148
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                                                            00000000774b9a30 7 bytes JMP 000000016fff00d8
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\KERNEL32.dll!K32GetModuleInformation                                                            00000000774c94c0 5 bytes JMP 000000016fff0180
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\KERNEL32.dll!K32GetModuleFileNameExW                                                            00000000774c9630 5 bytes JMP 000000016fff0110
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\KERNEL32.dll!RegSetValueExA                                                                     00000000774e87e0 7 bytes JMP 000000016fff01b8
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\KERNELBASE.dll!FreeLibrary                                                                      000007fefd742db0 5 bytes JMP 000007fffd730180
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                 000007fefd7437d0 7 bytes JMP 000007fffd7300d8
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                   000007fefd748ef0 6 bytes JMP 000007fffd730148
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                               000007fefd75af60 5 bytes JMP 000007fffd730110
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                000007feff4389f0 8 bytes JMP 000007fffd7301f0
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                              000007feff43be50 8 bytes JMP 000007fffd7301b8
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\ole32.dll!CoCreateInstance                                                                      000007fefe5a7490 11 bytes JMP 000007fffd730228
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\ole32.dll!CoSetProxyBlanket                                                                     000007fefe5bbf00 7 bytes JMP 000007fffd730260
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                         00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                             00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                          00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                      00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\KERNEL32.dll!K32GetMappedFileNameW                                                        000000007748f2e0 5 bytes JMP 000000016fff0148
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                                                      00000000774b9a30 7 bytes JMP 000000016fff00d8
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\KERNEL32.dll!K32GetModuleInformation                                                      00000000774c94c0 5 bytes JMP 000000016fff0180
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\KERNEL32.dll!K32GetModuleFileNameExW                                                      00000000774c9630 5 bytes JMP 000000016fff0110
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\KERNEL32.dll!RegSetValueExA                                                               00000000774e87e0 7 bytes JMP 000000016fff01b8
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\KERNELBASE.dll!FreeLibrary                                                                000007fefd742db0 5 bytes JMP 000007fffd730180
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\KERNELBASE.dll!GetModuleHandleW                                                           000007fefd7437d0 7 bytes JMP 000007fffd7300d8
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                             000007fefd748ef0 6 bytes JMP 000007fffd730148
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                         000007fefd75af60 5 bytes JMP 000007fffd730110
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                          000007feff4389f0 8 bytes JMP 000007fffd7301f0
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                        000007feff43be50 8 bytes JMP 000007fffd7301b8
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\ole32.dll!CoCreateInstance                                                                000007fefe5a7490 11 bytes JMP 000007fffd730228
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\ole32.dll!CoSetProxyBlanket                                                               000007fefe5bbf00 7 bytes JMP 000007fffd730260
.text   C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[472] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                            000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[472] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[472] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                             0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[472] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                                  0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[472] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                         000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[472] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                         0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[472] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4                     0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[472] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation                         0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[472] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                           00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                  000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                      000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                   0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                                        0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                               000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                               0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4                           0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation                               0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                                 00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                    0000000075941d29 5 bytes JMP 000000016fe22450
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                  0000000075941dd7 5 bytes JMP 000000016fe224b0
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                      0000000075942ab1 5 bytes JMP 000000016fe22520
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary                                         0000000075942d17 5 bytes JMP 000000016fe22620
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                 0000000076e5e96b 5 bytes JMP 000000016fe21a00
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                   0000000076e5eba5 5 bytes JMP 000000016fe21a90
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\ole32.dll!CoSetProxyBlanket                                        00000000770e5ea5 5 bytes JMP 000000016fe21ce0
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\ole32.dll!CoCreateInstance                                         0000000077119d0b 5 bytes JMP 000000016fe21c70
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                0000000077821465 2 bytes [82, 77]
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                               00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                    000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                 0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                      0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW             000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx             0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4         0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation             0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW               00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW                  0000000075941d29 5 bytes JMP 000000016fe22450
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                0000000075941dd7 5 bytes JMP 000000016fe224b0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW                    0000000075942ab1 5 bytes JMP 000000016fe22520
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary                       0000000075942d17 5 bytes JMP 000000016fe22620
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList               0000000076e5e96b 5 bytes JMP 000000016fe21a00
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                 0000000076e5eba5 5 bytes JMP 000000016fe21a90
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\ole32.dll!CoSetProxyBlanket                      00000000770e5ea5 5 bytes JMP 000000016fe21ce0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\ole32.dll!CoCreateInstance                       0000000077119d0b 5 bytes JMP 000000016fe21c70
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                    000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                        000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                     0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                          0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                 000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                 0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4             0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation                 0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                   00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW                      0000000075941d29 5 bytes JMP 000000016fe22450
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                    0000000075941dd7 5 bytes JMP 000000016fe224b0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW                        0000000075942ab1 5 bytes JMP 000000016fe22520
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary                           0000000075942d17 5 bytes JMP 000000016fe22620
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                   0000000076e5e96b 5 bytes JMP 000000016fe21a00
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                     0000000076e5eba5 5 bytes JMP 000000016fe21a90
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\ole32.dll!CoSetProxyBlanket                          00000000770e5ea5 5 bytes JMP 000000016fe21ce0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\ole32.dll!CoCreateInstance                           0000000077119d0b 5 bytes JMP 000000016fe21c70
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                  0000000077821465 2 bytes [82, 77]
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                 00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\windows\system32\igfxsrvc.exe[4580] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\igfxsrvc.exe[4580] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\igfxsrvc.exe[4580] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                               00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\igfxsrvc.exe[4580] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                           00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                 00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                     00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                  00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                              00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\KERNEL32.dll!K32GetMappedFileNameW                                000000007748f2e0 5 bytes JMP 000000016fff0148
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                              00000000774b9a30 7 bytes JMP 000000016fff00d8
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\KERNEL32.dll!K32GetModuleInformation                              00000000774c94c0 5 bytes JMP 000000016fff0180
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\KERNEL32.dll!K32GetModuleFileNameExW                              00000000774c9630 5 bytes JMP 000000016fff0110
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\KERNEL32.dll!RegSetValueExA                                       00000000774e87e0 7 bytes JMP 000000016fff01b8
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\KERNELBASE.dll!FreeLibrary                                        000007fefd742db0 5 bytes JMP 000007fffd730180
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\KERNELBASE.dll!GetModuleHandleW                                   000007fefd7437d0 7 bytes JMP 000007fffd7300d8
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                     000007fefd748ef0 6 bytes JMP 000007fffd730148
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\KERNELBASE.dll!GetModuleHandleExW                                 000007fefd75af60 5 bytes JMP 000007fffd730110
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                  000007feff4389f0 8 bytes JMP 000007fffd7301f0
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                000007feff43be50 8 bytes JMP 000007fffd7301b8
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\ole32.dll!CoCreateInstance                                        000007fefe5a7490 11 bytes JMP 000007fffd730228
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\ole32.dll!CoSetProxyBlanket                                       000007fefe5bbf00 7 bytes JMP 000007fffd730260
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                         000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                             000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                          0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                                               0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                                      000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                                      0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4                                  0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation                                      0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                                        00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                           0000000075941d29 5 bytes JMP 000000016fe22450
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                         0000000075941dd7 5 bytes JMP 000000016fe224b0
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                             0000000075942ab1 5 bytes JMP 000000016fe22520
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary                                                0000000075942d17 5 bytes JMP 000000016fe22620
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                        0000000076e5e96b 5 bytes JMP 000000016fe21a00
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                          0000000076e5eba5 5 bytes JMP 000000016fe21a90
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\ole32.dll!CoSetProxyBlanket                                               00000000770e5ea5 5 bytes JMP 000000016fe21ce0
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\ole32.dll!CoCreateInstance                                                0000000077119d0b 5 bytes JMP 000000016fe21c70
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                         000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                             000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                          0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                               0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                      000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                      0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4                  0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation                      0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                        00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW                           0000000075941d29 5 bytes JMP 000000016fe22450
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                         0000000075941dd7 5 bytes JMP 000000016fe224b0
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW                             0000000075942ab1 5 bytes JMP 000000016fe22520
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary                                0000000075942d17 5 bytes JMP 000000016fe22620
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                        0000000076e5e96b 5 bytes JMP 000000016fe21a00
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                          0000000076e5eba5 5 bytes JMP 000000016fe21a90
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\ole32.dll!CoSetProxyBlanket                               00000000770e5ea5 5 bytes JMP 000000016fe21ce0
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\ole32.dll!CoCreateInstance                                0000000077119d0b 5 bytes JMP 000000016fe21c70
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                       0000000077821465 2 bytes [82, 77]
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                      00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                     000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                         000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                      0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                           0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                  000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                  0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4              0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation                  0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                    00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW                       0000000075941d29 5 bytes JMP 000000016fe22450
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                     0000000075941dd7 5 bytes JMP 000000016fe224b0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW                         0000000075942ab1 5 bytes JMP 000000016fe22520
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary                            0000000075942d17 5 bytes JMP 000000016fe22620
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                    0000000076e5e96b 5 bytes JMP 000000016fe21a00
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                      0000000076e5eba5 5 bytes JMP 000000016fe21a90
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\ole32.dll!CoSetProxyBlanket                           00000000770e5ea5 5 bytes JMP 000000016fe21ce0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\ole32.dll!CoCreateInstance                            0000000077119d0b 5 bytes JMP 000000016fe21c70
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                   0000000077821465 2 bytes [82, 77]
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                  00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe[4752] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                    000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe[4752] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                        000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe[4752] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                     0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2720] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                        000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2720] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                            000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2720] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                         0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                    000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                 0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                                                                      0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                                                             000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                                                             0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4                                                         0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation                                                             0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                                                               00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                  0000000075941d29 5 bytes JMP 000000016fe22450
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                                0000000075941dd7 5 bytes JMP 000000016fe224b0
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                    0000000075942ab1 5 bytes JMP 000000016fe22520
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                       0000000075942d17 5 bytes JMP 000000016fe22620
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                               0000000076e5e96b 5 bytes JMP 000000016fe21a00
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                 0000000076e5eba5 5 bytes JMP 000000016fe21a90
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                      00000000770e5ea5 5 bytes JMP 000000016fe21ce0
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\ole32.dll!CoCreateInstance                                                                       0000000077119d0b 5 bytes JMP 000000016fe21c70
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                              0000000077821465 2 bytes [82, 77]
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                             00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\windows\system32\svchost.exe[3092] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                               00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\svchost.exe[3092] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                   00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\svchost.exe[3092] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\svchost.exe[3092] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                            00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                   00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                       00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                    00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\KERNEL32.dll!K32GetMappedFileNameW                                                  000000007748f2e0 5 bytes JMP 000000016fff0148
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                                                00000000774b9a30 7 bytes JMP 000000016fff00d8
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\KERNEL32.dll!K32GetModuleInformation                                                00000000774c94c0 5 bytes JMP 000000016fff0180
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\KERNEL32.dll!K32GetModuleFileNameExW                                                00000000774c9630 5 bytes JMP 000000016fff0110
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\KERNEL32.dll!RegSetValueExA                                                         00000000774e87e0 7 bytes JMP 000000016fff01b8
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\KERNELBASE.dll!FreeLibrary                                                          000007fefd742db0 5 bytes JMP 000007fffd730180
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\KERNELBASE.dll!GetModuleHandleW                                                     000007fefd7437d0 7 bytes JMP 000007fffd7300d8
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                       000007fefd748ef0 6 bytes JMP 000007fffd730148
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                   000007fefd75af60 5 bytes JMP 000007fffd730110
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                    000007feff4389f0 8 bytes JMP 000007fffd7301f0
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                  000007feff43be50 8 bytes JMP 000007fffd7301b8
.text   C:\windows\system32\svchost.exe[5588] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                               00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\svchost.exe[5588] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                   00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\svchost.exe[5588] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\svchost.exe[5588] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                            00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4512] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4512] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                    000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4512] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                 0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5444] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                          000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5444] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                              000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5444] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                           0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5444] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                        0000000077821465 2 bytes [82, 77]
.text   C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5444] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                       00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4448] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                       00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4448] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                           00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4448] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                        00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4448] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                    00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe[5008] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                          0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe[5008] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                 000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe[5008] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                 0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe[5008] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4             0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe[5008] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation                 0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe[5008] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                   00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5548] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5548] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                    000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5548] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                 0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                               00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                   00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                            00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\KERNEL32.dll!K32GetMappedFileNameW                                                              000000007748f2e0 5 bytes JMP 000000016fff0148
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                                                            00000000774b9a30 7 bytes JMP 000000016fff00d8
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\KERNEL32.dll!K32GetModuleInformation                                                            00000000774c94c0 5 bytes JMP 000000016fff0180
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\KERNEL32.dll!K32GetModuleFileNameExW                                                            00000000774c9630 5 bytes JMP 000000016fff0110
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\KERNEL32.dll!RegSetValueExA                                                                     00000000774e87e0 7 bytes JMP 000000016fff01b8
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\KERNELBASE.dll!FreeLibrary                                                                      000007fefd742db0 5 bytes JMP 000007fffd730180
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                 000007fefd7437d0 7 bytes JMP 000007fffd7300d8
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                   000007fefd748ef0 6 bytes JMP 000007fffd730148
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                               000007fefd75af60 5 bytes JMP 000007fffd730110
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\ole32.dll!CoCreateInstance                                                                      000007fefe5a7490 11 bytes JMP 000007fffd730228
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\ole32.dll!CoSetProxyBlanket                                                                     000007fefe5bbf00 7 bytes JMP 000007fffd730260
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                000007feff4389f0 8 bytes JMP 000007fffd7301f0
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                              000007feff43be50 8 bytes JMP 000007fffd7301b8
.text   C:\windows\system32\wbem\wmiprvse.exe[1168] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                         00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\wbem\wmiprvse.exe[1168] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                             00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\wbem\wmiprvse.exe[1168] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                          00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\wbem\wmiprvse.exe[1168] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                      00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                      000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                          000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                       0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                                                            0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                                                   000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                                                   0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4                                               0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation                                                   0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                                                     00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                        0000000075941d29 5 bytes JMP 000000016fe22450
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                      0000000075941dd7 5 bytes JMP 000000016fe224b0
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                          0000000075942ab1 5 bytes JMP 000000016fe22520
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary                                                             0000000075942d17 5 bytes JMP 000000016fe22620
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                     0000000076e5e96b 5 bytes JMP 000000016fe21a00
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                       0000000076e5eba5 5 bytes JMP 000000016fe21a90
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\ole32.dll!CoSetProxyBlanket                                                            00000000770e5ea5 5 bytes JMP 000000016fe21ce0
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\ole32.dll!CoCreateInstance                                                             0000000077119d0b 5 bytes JMP 000000016fe21c70

---- Threads - GMER 2.1 ----

Thread  C:\windows\SysWOW64\dxdiag.exe [4744:4692]                                                                                                                000000007ef97c32
Thread  C:\windows\SysWOW64\dxdiag.exe [4744:5016]                                                                                                                000000007ef97be4
Thread  C:\windows\SysWOW64\dxdiag.exe [4744:5108]                                                                                                                000000007ef991d3
Thread  C:\windows\SysWOW64\dxdiag.exe [4744:4792]                                                                                                                000000007ef9dc0c
Thread  C:\windows\SysWOW64\dxdiag.exe [4744:3476]                                                                                                                000000007efa1f3f
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [3440:5332]                                                                                            000007fefe590168
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [3440:5060]                                                                                            000007fefb542bf8
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [3440:2880]                                                                                            000007fef0c44830
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [3440:1220]                                                                                            000007fefa3b5124

---- Registry - GMER 2.1 ----

Reg     HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{4A062CF4-8368-448A-A157-80A85B4679DF}\Connection@Name               isatap.{50B746CA-9BED-408D-B51F-D7B5966CB452}
Reg     HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind                  \Device\{43F955B2-B4F4-4254-819A-972F0CC63C25}?\Device\{DB578851-3239-4A43-B16B-A7EB5648772C}?\Device\{4A062CF4-8368-448A-A157-80A85B4679DF}?\Device\{6B788D5F-D829-4031-B33D-93EB52CF2DAE}?\Device\{192D6987-CD84-49BD-9DB4-A70743DBC101}?\Device\{44782A54-CA43-4C5B-B132-139C0E4492AA}?
Reg     HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route                 "{43F955B2-B4F4-4254-819A-972F0CC63C25}"?"{DB578851-3239-4A43-B16B-A7EB5648772C}"?"{4A062CF4-8368-448A-A157-80A85B4679DF}"?"{6B788D5F-D829-4031-B33D-93EB52CF2DAE}"?"{192D6987-CD84-49BD-9DB4-A70743DBC101}"?"{44782A54-CA43-4C5B-B132-139C0E4492AA}"?
Reg     HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export                \Device\TCPIP6TUNNEL_{43F955B2-B4F4-4254-819A-972F0CC63C25}?\Device\TCPIP6TUNNEL_{DB578851-3239-4A43-B16B-A7EB5648772C}?\Device\TCPIP6TUNNEL_{4A062CF4-8368-448A-A157-80A85B4679DF}?\Device\TCPIP6TUNNEL_{6B788D5F-D829-4031-B33D-93EB52CF2DAE}?\Device\TCPIP6TUNNEL_{192D6987-CD84-49BD-9DB4-A70743DBC101}?\Device\TCPIP6TUNNEL_{44782A54-CA43-4C5B-B132-139C0E4492AA}?
Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\dca971053aec                                                                               
Reg     HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{4A062CF4-8368-448A-A157-80A85B4679DF}@InterfaceName                                    isatap.{50B746CA-9BED-408D-B51F-D7B5966CB452}
Reg     HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{4A062CF4-8368-448A-A157-80A85B4679DF}@ReusableType                                     0
Reg     HKLM\SYSTEM\CurrentControlSet\services\rdyboost\Parameters@LastBootPlanUserTime                                                                           ?Do?, ?Dez ?11 ?14, 09:59:16????????????A??????????????????????
Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\dca971053aec (not active ControlSet)                                                           

---- Disk sectors - GMER 2.1 ----

Disk    \Device\Harddisk0\DR0                                                                                                                                     unknown MBR code

---- EOF - GMER 2.1 ----

Bercht · 12.12.2014, 08:34

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-12-11 22:21:23
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AR1 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Bercht\AppData\Local\Temp\fgdiipog.sys


---- User code sections - GMER 2.1 ----

.text   C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe[888] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                            000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe[888] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe[888] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                             0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe[888] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                          0000000077821465 2 bytes [82, 77]
.text   C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe[888] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                         00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\windows\system32\nvvsvc.exe[912] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                 00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\nvvsvc.exe[912] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                     00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\nvvsvc.exe[912] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                  00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\nvvsvc.exe[912] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                              00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\svchost.exe[1004] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                               00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\svchost.exe[1004] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                   00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\svchost.exe[1004] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\svchost.exe[1004] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                            00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\System32\svchost.exe[480] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\System32\svchost.exe[480] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                    00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\System32\svchost.exe[480] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                 00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\System32\svchost.exe[480] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                             00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\System32\svchost.exe[600] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\System32\svchost.exe[600] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                    00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\System32\svchost.exe[600] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                 00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\System32\svchost.exe[600] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                             00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\svchost.exe[492] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\svchost.exe[492] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                    00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\svchost.exe[492] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                 00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\svchost.exe[492] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                             00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\svchost.exe[988] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\svchost.exe[988] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                    00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\svchost.exe[988] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                 00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\svchost.exe[988] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                             00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\svchost.exe[1292] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                               00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\svchost.exe[1292] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                   00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\svchost.exe[1292] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\svchost.exe[1292] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                            00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\svchost.exe[1484] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                               00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\svchost.exe[1484] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                   00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\svchost.exe[1484] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\svchost.exe[1484] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                            00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                      00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                          00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                       00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                   00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\KERNEL32.dll!K32GetMappedFileNameW                                     000000007748f2e0 5 bytes JMP 000000016fff0148
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                                   00000000774b9a30 7 bytes JMP 000000016fff00d8
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\KERNEL32.dll!K32GetModuleInformation                                   00000000774c94c0 5 bytes JMP 000000016fff0180
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\KERNEL32.dll!K32GetModuleFileNameExW                                   00000000774c9630 5 bytes JMP 000000016fff0110
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\KERNEL32.dll!RegSetValueExA                                            00000000774e87e0 7 bytes JMP 000000016fff01b8
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\KERNELBASE.dll!FreeLibrary                                             000007fefd742db0 5 bytes JMP 000007fffd730180
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\KERNELBASE.dll!GetModuleHandleW                                        000007fefd7437d0 7 bytes JMP 000007fffd7300d8
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                          000007fefd748ef0 6 bytes JMP 000007fffd730148
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\KERNELBASE.dll!GetModuleHandleExW                                      000007fefd75af60 5 bytes JMP 000007fffd730110
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                       000007feff4389f0 8 bytes JMP 000007fffd7301f0
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                     000007feff43be50 8 bytes JMP 000007fffd7301b8
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\ole32.dll!CoCreateInstance                                             000007fefe5a7490 11 bytes JMP 000007fffd730228
.text   C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1540] C:\windows\system32\ole32.dll!CoSetProxyBlanket                                            000007fefe5bbf00 7 bytes JMP 000007fffd730260
.text   C:\windows\system32\nvvsvc.exe[1552] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\nvvsvc.exe[1552] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                    00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\nvvsvc.exe[1552] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                 00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\nvvsvc.exe[1552] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                             00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\System32\spoolsv.exe[1748] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                               00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\System32\spoolsv.exe[1748] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                   00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\System32\spoolsv.exe[1748] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\System32\spoolsv.exe[1748] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                            00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe[1844] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                        000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe[1844] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                            000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe[1844] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                         0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe[2000] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                    000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe[2000] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                        000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe[2000] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                     0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1684] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                      000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1684] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                          000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1684] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                       0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1684] C:\windows\syswow64\psapi.dll!GetModuleInformation + 69                                    0000000077821465 2 bytes [82, 77]
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1684] C:\windows\syswow64\psapi.dll!GetModuleInformation + 155                                   00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1632] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory  000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1632] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory      000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1632] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory   0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files\Bonjour\mDNSResponder.exe[2052] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                    00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Program Files\Bonjour\mDNSResponder.exe[2052] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                        00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Program Files\Bonjour\mDNSResponder.exe[2052] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                     00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Program Files\Bonjour\mDNSResponder.exe[2052] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                 00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2176] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                            000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2176] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2176] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                             0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2176] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                          0000000077821465 2 bytes [82, 77]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2176] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                         00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2284] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                              000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2284] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                  000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2284] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                               0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[2316] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                   000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[2316] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                       000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[2316] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                    0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Swisscom\Sesam\BIN\SecMIPService.exe[2376] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                   000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Swisscom\Sesam\BIN\SecMIPService.exe[2376] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                       000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Swisscom\Sesam\BIN\SecMIPService.exe[2376] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                    0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe[2508] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                     00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe[2508] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                         00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe[2508] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                      00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe[2508] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                  00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files (x86)\Swisscom\Unlimited Data Manager\DashBoardS.exe[2544] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                         000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Swisscom\Unlimited Data Manager\DashBoardS.exe[2544] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                             000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Swisscom\Unlimited Data Manager\DashBoardS.exe[2544] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                          0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Swisscom\Unlimited Data Manager\DashBoardS.exe[2544] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                       0000000077821465 2 bytes [82, 77]
.text   C:\Program Files (x86)\Swisscom\Unlimited Data Manager\DashBoardS.exe[2544] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                      00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe[3488] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                     00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe[3488] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                         00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe[3488] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                      00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe[3488] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                  00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\taskhost.exe[3772] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\taskhost.exe[3772] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\taskhost.exe[3772] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                               00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\taskhost.exe[3772] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                           00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                     000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                         000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                      0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                                           0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                                  000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                                  0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4                              0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation                                  0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                                    00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                       0000000075941d29 5 bytes JMP 000000016fe22450
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                     0000000075941dd7 5 bytes JMP 000000016fe224b0
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                         0000000075942ab1 5 bytes JMP 000000016fe22520
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary                                            0000000075942d17 5 bytes JMP 000000016fe22620
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                    0000000076e5e96b 5 bytes JMP 000000016fe21a00
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                      0000000076e5eba5 5 bytes JMP 000000016fe21a90
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                   0000000077821465 2 bytes [82, 77]
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                  00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\ole32.dll!CoSetProxyBlanket                                           00000000770e5ea5 5 bytes JMP 000000016fe21ce0
.text   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3924] C:\windows\syswow64\ole32.dll!CoCreateInstance                                            0000000077119d0b 5 bytes JMP 000000016fe21c70
.text   C:\windows\System32\rundll32.exe[3964] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\System32\rundll32.exe[3964] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\System32\rundll32.exe[3964] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                               00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\System32\rundll32.exe[3964] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                           00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\Dwm.exe[896] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                    00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\Dwm.exe[896] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                        00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\Dwm.exe[896] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                     00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\Dwm.exe[896] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                 00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\Explorer.EXE[2484] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                       00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\Explorer.EXE[2484] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                           00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\Explorer.EXE[2484] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                        00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\Explorer.EXE[2484] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                    00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                               00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                   00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                            00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\KERNEL32.dll!K32GetMappedFileNameW                                                              000000007748f2e0 5 bytes JMP 000000016fff0148
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                                                            00000000774b9a30 7 bytes JMP 000000016fff00d8
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\KERNEL32.dll!K32GetModuleInformation                                                            00000000774c94c0 5 bytes JMP 000000016fff0180
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\KERNEL32.dll!K32GetModuleFileNameExW                                                            00000000774c9630 5 bytes JMP 000000016fff0110
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\KERNEL32.dll!RegSetValueExA                                                                     00000000774e87e0 7 bytes JMP 000000016fff01b8
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\KERNELBASE.dll!FreeLibrary                                                                      000007fefd742db0 5 bytes JMP 000007fffd730180
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                 000007fefd7437d0 7 bytes JMP 000007fffd7300d8
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                   000007fefd748ef0 6 bytes JMP 000007fffd730148
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                               000007fefd75af60 5 bytes JMP 000007fffd730110
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                000007feff4389f0 8 bytes JMP 000007fffd7301f0
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                              000007feff43be50 8 bytes JMP 000007fffd7301b8
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\ole32.dll!CoCreateInstance                                                                      000007fefe5a7490 11 bytes JMP 000007fffd730228
.text   C:\windows\system32\taskeng.exe[1000] C:\windows\system32\ole32.dll!CoSetProxyBlanket                                                                     000007fefe5bbf00 7 bytes JMP 000007fffd730260
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                         00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                             00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                          00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                      00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\KERNEL32.dll!K32GetMappedFileNameW                        000000007748f2e0 5 bytes JMP 000000016fff0148
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                      00000000774b9a30 7 bytes JMP 000000016fff00d8
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\KERNEL32.dll!K32GetModuleInformation                      00000000774c94c0 5 bytes JMP 000000016fff0180
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\KERNEL32.dll!K32GetModuleFileNameExW                      00000000774c9630 5 bytes JMP 000000016fff0110
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\KERNEL32.dll!RegSetValueExA                               00000000774e87e0 7 bytes JMP 000000016fff01b8
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\KERNELBASE.dll!FreeLibrary                                000007fefd742db0 5 bytes JMP 000007fffd730180
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\KERNELBASE.dll!GetModuleHandleW                           000007fefd7437d0 7 bytes JMP 000007fffd7300d8
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                             000007fefd748ef0 6 bytes JMP 000007fffd730148
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\KERNELBASE.dll!GetModuleHandleExW                         000007fefd75af60 5 bytes JMP 000007fffd730110
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                          000007feff4389f0 8 bytes JMP 000007fffd7301f0
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                        000007feff43be50 8 bytes JMP 000007fffd7301b8
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\ole32.dll!CoCreateInstance                                000007fefe5a7490 11 bytes JMP 000007fffd730228
.text   C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[3592] C:\windows\system32\ole32.dll!CoSetProxyBlanket                               000007fefe5bbf00 7 bytes JMP 000007fffd730260
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                               00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                   00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                            00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\KERNEL32.dll!K32GetMappedFileNameW                                              000000007748f2e0 5 bytes JMP 000000016fff0148
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                                            00000000774b9a30 7 bytes JMP 000000016fff00d8
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\KERNEL32.dll!K32GetModuleInformation                                            00000000774c94c0 5 bytes JMP 000000016fff0180
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\KERNEL32.dll!K32GetModuleFileNameExW                                            00000000774c9630 5 bytes JMP 000000016fff0110
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\KERNEL32.dll!RegSetValueExA                                                     00000000774e87e0 7 bytes JMP 000000016fff01b8
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\KERNELBASE.dll!FreeLibrary                                                      000007fefd742db0 5 bytes JMP 000007fffd730180
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\KERNELBASE.dll!GetModuleHandleW                                                 000007fefd7437d0 7 bytes JMP 000007fffd7300d8
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                   000007fefd748ef0 6 bytes JMP 000007fffd730148
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\KERNELBASE.dll!GetModuleHandleExW                                               000007fefd75af60 5 bytes JMP 000007fffd730110
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                000007feff4389f0 8 bytes JMP 000007fffd7301f0
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                              000007feff43be50 8 bytes JMP 000007fffd7301b8
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\ole32.dll!CoCreateInstance                                                      000007fefe5a7490 11 bytes JMP 000007fffd730228
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3660] C:\windows\system32\ole32.dll!CoSetProxyBlanket                                                     000007fefe5bbf00 7 bytes JMP 000007fffd730260
.text   C:\Windows\System32\igfxtray.exe[3696] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Windows\System32\igfxtray.exe[3696] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Windows\System32\igfxtray.exe[3696] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                               00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Windows\System32\igfxtray.exe[3696] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                           00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Windows\System32\hkcmd.exe[3124] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                 00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Windows\System32\hkcmd.exe[3124] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                     00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Windows\System32\hkcmd.exe[3124] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                  00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Windows\System32\hkcmd.exe[3124] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                              00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                               00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                           00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\KERNEL32.dll!K32GetMappedFileNameW                                                             000000007748f2e0 5 bytes JMP 000000016fff0148
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                                                           00000000774b9a30 7 bytes JMP 000000016fff00d8
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\KERNEL32.dll!K32GetModuleInformation                                                           00000000774c94c0 5 bytes JMP 000000016fff0180
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\KERNEL32.dll!K32GetModuleFileNameExW                                                           00000000774c9630 5 bytes JMP 000000016fff0110
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\KERNEL32.dll!RegSetValueExA                                                                    00000000774e87e0 7 bytes JMP 000000016fff01b8
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\KERNELBASE.dll!FreeLibrary                                                                     000007fefd742db0 5 bytes JMP 000007fffd730180
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                000007fefd7437d0 7 bytes JMP 000007fffd7300d8
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                  000007fefd748ef0 6 bytes JMP 000007fffd730148
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                              000007fefd75af60 5 bytes JMP 000007fffd730110
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                               000007feff4389f0 8 bytes JMP 000007fffd7301f0
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                             000007feff43be50 8 bytes JMP 000007fffd7301b8
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\ole32.dll!CoCreateInstance                                                                     000007fefe5a7490 11 bytes JMP 000007fffd730228
.text   C:\Windows\System32\igfxpers.exe[3204] C:\windows\system32\ole32.dll!CoSetProxyBlanket                                                                    000007fefe5bbf00 7 bytes JMP 000007fffd730260
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                               00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                   00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                            00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\KERNEL32.dll!K32GetMappedFileNameW                                                              000000007748f2e0 5 bytes JMP 000000016fff0148
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                                                            00000000774b9a30 7 bytes JMP 000000016fff00d8
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\KERNEL32.dll!K32GetModuleInformation                                                            00000000774c94c0 5 bytes JMP 000000016fff0180
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\KERNEL32.dll!K32GetModuleFileNameExW                                                            00000000774c9630 5 bytes JMP 000000016fff0110
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\KERNEL32.dll!RegSetValueExA                                                                     00000000774e87e0 7 bytes JMP 000000016fff01b8
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\KERNELBASE.dll!FreeLibrary                                                                      000007fefd742db0 5 bytes JMP 000007fffd730180
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                 000007fefd7437d0 7 bytes JMP 000007fffd7300d8
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                   000007fefd748ef0 6 bytes JMP 000007fffd730148
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                               000007fefd75af60 5 bytes JMP 000007fffd730110
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                000007feff4389f0 8 bytes JMP 000007fffd7301f0
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                              000007feff43be50 8 bytes JMP 000007fffd7301b8
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\ole32.dll!CoCreateInstance                                                                      000007fefe5a7490 11 bytes JMP 000007fffd730228
.text   C:\windows\system32\taskeng.exe[3232] C:\windows\system32\ole32.dll!CoSetProxyBlanket                                                                     000007fefe5bbf00 7 bytes JMP 000007fffd730260
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                         00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                             00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                          00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                      00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\KERNEL32.dll!K32GetMappedFileNameW                                                        000000007748f2e0 5 bytes JMP 000000016fff0148
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                                                      00000000774b9a30 7 bytes JMP 000000016fff00d8
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\KERNEL32.dll!K32GetModuleInformation                                                      00000000774c94c0 5 bytes JMP 000000016fff0180
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\KERNEL32.dll!K32GetModuleFileNameExW                                                      00000000774c9630 5 bytes JMP 000000016fff0110
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\KERNEL32.dll!RegSetValueExA                                                               00000000774e87e0 7 bytes JMP 000000016fff01b8
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\KERNELBASE.dll!FreeLibrary                                                                000007fefd742db0 5 bytes JMP 000007fffd730180
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\KERNELBASE.dll!GetModuleHandleW                                                           000007fefd7437d0 7 bytes JMP 000007fffd7300d8
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                             000007fefd748ef0 6 bytes JMP 000007fffd730148
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                         000007fefd75af60 5 bytes JMP 000007fffd730110
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                          000007feff4389f0 8 bytes JMP 000007fffd7301f0
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                        000007feff43be50 8 bytes JMP 000007fffd7301b8
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\ole32.dll!CoCreateInstance                                                                000007fefe5a7490 11 bytes JMP 000007fffd730228
.text   C:\Program Files\Elantech\ETDCtrl.exe[1244] C:\windows\system32\ole32.dll!CoSetProxyBlanket                                                               000007fefe5bbf00 7 bytes JMP 000007fffd730260
.text   C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[472] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                            000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[472] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[472] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                             0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[472] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                                  0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[472] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                         000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[472] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                         0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[472] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4                     0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[472] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation                         0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe[472] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                           00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                  000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                      000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                   0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                                        0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                               000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                               0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4                           0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation                               0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                                 00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                    0000000075941d29 5 bytes JMP 000000016fe22450
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                  0000000075941dd7 5 bytes JMP 000000016fe224b0
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                      0000000075942ab1 5 bytes JMP 000000016fe22520
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary                                         0000000075942d17 5 bytes JMP 000000016fe22620
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                 0000000076e5e96b 5 bytes JMP 000000016fe21a00
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                   0000000076e5eba5 5 bytes JMP 000000016fe21a90
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\ole32.dll!CoSetProxyBlanket                                        00000000770e5ea5 5 bytes JMP 000000016fe21ce0
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\ole32.dll!CoCreateInstance                                         0000000077119d0b 5 bytes JMP 000000016fe21c70
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                0000000077821465 2 bytes [82, 77]
.text   C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4208] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                               00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                    000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                 0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                      0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW             000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx             0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4         0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation             0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW               00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW                  0000000075941d29 5 bytes JMP 000000016fe22450
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                0000000075941dd7 5 bytes JMP 000000016fe224b0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW                    0000000075942ab1 5 bytes JMP 000000016fe22520
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary                       0000000075942d17 5 bytes JMP 000000016fe22620
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList               0000000076e5e96b 5 bytes JMP 000000016fe21a00
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                 0000000076e5eba5 5 bytes JMP 000000016fe21a90
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\ole32.dll!CoSetProxyBlanket                      00000000770e5ea5 5 bytes JMP 000000016fe21ce0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[4400] C:\windows\syswow64\ole32.dll!CoCreateInstance                       0000000077119d0b 5 bytes JMP 000000016fe21c70
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                    000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                        000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                     0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                          0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                 000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                 0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4             0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation                 0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                   00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW                      0000000075941d29 5 bytes JMP 000000016fe22450
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                    0000000075941dd7 5 bytes JMP 000000016fe224b0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW                        0000000075942ab1 5 bytes JMP 000000016fe22520
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary                           0000000075942d17 5 bytes JMP 000000016fe22620
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                   0000000076e5e96b 5 bytes JMP 000000016fe21a00
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                     0000000076e5eba5 5 bytes JMP 000000016fe21a90
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\ole32.dll!CoSetProxyBlanket                          00000000770e5ea5 5 bytes JMP 000000016fe21ce0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\ole32.dll!CoCreateInstance                           0000000077119d0b 5 bytes JMP 000000016fe21c70
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                  0000000077821465 2 bytes [82, 77]
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[4556] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                 00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\windows\system32\igfxsrvc.exe[4580] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\igfxsrvc.exe[4580] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\igfxsrvc.exe[4580] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                               00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\igfxsrvc.exe[4580] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                           00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                 00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                     00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                  00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                              00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\KERNEL32.dll!K32GetMappedFileNameW                                000000007748f2e0 5 bytes JMP 000000016fff0148
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                              00000000774b9a30 7 bytes JMP 000000016fff00d8
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\KERNEL32.dll!K32GetModuleInformation                              00000000774c94c0 5 bytes JMP 000000016fff0180
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\KERNEL32.dll!K32GetModuleFileNameExW                              00000000774c9630 5 bytes JMP 000000016fff0110
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\KERNEL32.dll!RegSetValueExA                                       00000000774e87e0 7 bytes JMP 000000016fff01b8
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\KERNELBASE.dll!FreeLibrary                                        000007fefd742db0 5 bytes JMP 000007fffd730180
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\KERNELBASE.dll!GetModuleHandleW                                   000007fefd7437d0 7 bytes JMP 000007fffd7300d8
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                     000007fefd748ef0 6 bytes JMP 000007fffd730148
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\KERNELBASE.dll!GetModuleHandleExW                                 000007fefd75af60 5 bytes JMP 000007fffd730110
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                  000007feff4389f0 8 bytes JMP 000007fffd7301f0
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                000007feff43be50 8 bytes JMP 000007fffd7301b8
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\ole32.dll!CoCreateInstance                                        000007fefe5a7490 11 bytes JMP 000007fffd730228
.text   C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[3880] C:\windows\system32\ole32.dll!CoSetProxyBlanket                                       000007fefe5bbf00 7 bytes JMP 000007fffd730260
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                         000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                             000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                          0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                                               0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                                      000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                                      0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4                                  0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation                                      0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                                        00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                           0000000075941d29 5 bytes JMP 000000016fe22450
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                         0000000075941dd7 5 bytes JMP 000000016fe224b0
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                             0000000075942ab1 5 bytes JMP 000000016fe22520
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary                                                0000000075942d17 5 bytes JMP 000000016fe22620
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                        0000000076e5e96b 5 bytes JMP 000000016fe21a00
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                          0000000076e5eba5 5 bytes JMP 000000016fe21a90
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\ole32.dll!CoSetProxyBlanket                                               00000000770e5ea5 5 bytes JMP 000000016fe21ce0
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4128] C:\windows\syswow64\ole32.dll!CoCreateInstance                                                0000000077119d0b 5 bytes JMP 000000016fe21c70
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                         000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                             000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                          0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                               0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                      000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                      0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4                  0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation                      0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                        00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW                           0000000075941d29 5 bytes JMP 000000016fe22450
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                         0000000075941dd7 5 bytes JMP 000000016fe224b0
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW                             0000000075942ab1 5 bytes JMP 000000016fe22520
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary                                0000000075942d17 5 bytes JMP 000000016fe22620
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                        0000000076e5e96b 5 bytes JMP 000000016fe21a00
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                          0000000076e5eba5 5 bytes JMP 000000016fe21a90
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\ole32.dll!CoSetProxyBlanket                               00000000770e5ea5 5 bytes JMP 000000016fe21ce0
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\ole32.dll!CoCreateInstance                                0000000077119d0b 5 bytes JMP 000000016fe21c70
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                       0000000077821465 2 bytes [82, 77]
.text   C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[1100] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                      00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                     000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                         000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                      0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                           0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                  000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                  0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4              0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation                  0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                    00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW                       0000000075941d29 5 bytes JMP 000000016fe22450
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                     0000000075941dd7 5 bytes JMP 000000016fe224b0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW                         0000000075942ab1 5 bytes JMP 000000016fe22520
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary                            0000000075942d17 5 bytes JMP 000000016fe22620
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                    0000000076e5e96b 5 bytes JMP 000000016fe21a00
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                      0000000076e5eba5 5 bytes JMP 000000016fe21a90
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\ole32.dll!CoSetProxyBlanket                           00000000770e5ea5 5 bytes JMP 000000016fe21ce0
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\ole32.dll!CoCreateInstance                            0000000077119d0b 5 bytes JMP 000000016fe21c70
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                   0000000077821465 2 bytes [82, 77]
.text   C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4684] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                  00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe[4752] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                    000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe[4752] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                        000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe[4752] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                     0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2720] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                        000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2720] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                            000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2720] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                         0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                    000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                 0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                                                                      0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                                                             000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                                                             0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4                                                         0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation                                                             0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                                                               00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                  0000000075941d29 5 bytes JMP 000000016fe22450
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                                0000000075941dd7 5 bytes JMP 000000016fe224b0
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                    0000000075942ab1 5 bytes JMP 000000016fe22520
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                       0000000075942d17 5 bytes JMP 000000016fe22620
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                               0000000076e5e96b 5 bytes JMP 000000016fe21a00
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                 0000000076e5eba5 5 bytes JMP 000000016fe21a90
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                      00000000770e5ea5 5 bytes JMP 000000016fe21ce0
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\ole32.dll!CoCreateInstance                                                                       0000000077119d0b 5 bytes JMP 000000016fe21c70
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                              0000000077821465 2 bytes [82, 77]
.text   C:\windows\SysWOW64\dxdiag.exe[4744] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                             00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\windows\system32\svchost.exe[3092] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                               00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\svchost.exe[3092] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                   00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\svchost.exe[3092] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\svchost.exe[3092] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                            00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                   00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                       00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                    00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\KERNEL32.dll!K32GetMappedFileNameW                                                  000000007748f2e0 5 bytes JMP 000000016fff0148
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                                                00000000774b9a30 7 bytes JMP 000000016fff00d8
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\KERNEL32.dll!K32GetModuleInformation                                                00000000774c94c0 5 bytes JMP 000000016fff0180
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\KERNEL32.dll!K32GetModuleFileNameExW                                                00000000774c9630 5 bytes JMP 000000016fff0110
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\KERNEL32.dll!RegSetValueExA                                                         00000000774e87e0 7 bytes JMP 000000016fff01b8
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\KERNELBASE.dll!FreeLibrary                                                          000007fefd742db0 5 bytes JMP 000007fffd730180
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\KERNELBASE.dll!GetModuleHandleW                                                     000007fefd7437d0 7 bytes JMP 000007fffd7300d8
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                       000007fefd748ef0 6 bytes JMP 000007fffd730148
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                   000007fefd75af60 5 bytes JMP 000007fffd730110
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                    000007feff4389f0 8 bytes JMP 000007fffd7301f0
.text   C:\Program Files\Elantech\ETDCtrlHelper.exe[6040] C:\windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                  000007feff43be50 8 bytes JMP 000007fffd7301b8
.text   C:\windows\system32\svchost.exe[5588] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                               00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\svchost.exe[5588] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                   00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\svchost.exe[5588] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\svchost.exe[5588] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                            00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4512] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4512] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                    000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[4512] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                 0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5444] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                          000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5444] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                              000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5444] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                           0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5444] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                        0000000077821465 2 bytes [82, 77]
.text   C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5444] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                       00000000778214bb 2 bytes [82, 77]
.text   ...                                                                                                                                                       * 2
.text   C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4448] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                       00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4448] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                           00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4448] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                        00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4448] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                    00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe[5008] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                          0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe[5008] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                 000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe[5008] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                 0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe[5008] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4             0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe[5008] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation                 0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe[5008] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                   00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5548] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5548] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                    000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5548] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                 0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                               00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                   00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                            00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\KERNEL32.dll!K32GetMappedFileNameW                                                              000000007748f2e0 5 bytes JMP 000000016fff0148
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                                                            00000000774b9a30 7 bytes JMP 000000016fff00d8
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\KERNEL32.dll!K32GetModuleInformation                                                            00000000774c94c0 5 bytes JMP 000000016fff0180
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\KERNEL32.dll!K32GetModuleFileNameExW                                                            00000000774c9630 5 bytes JMP 000000016fff0110
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\KERNEL32.dll!RegSetValueExA                                                                     00000000774e87e0 7 bytes JMP 000000016fff01b8
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\KERNELBASE.dll!FreeLibrary                                                                      000007fefd742db0 5 bytes JMP 000007fffd730180
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                 000007fefd7437d0 7 bytes JMP 000007fffd7300d8
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                   000007fefd748ef0 6 bytes JMP 000007fffd730148
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                               000007fefd75af60 5 bytes JMP 000007fffd730110
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\ole32.dll!CoCreateInstance                                                                      000007fefe5a7490 11 bytes JMP 000007fffd730228
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\ole32.dll!CoSetProxyBlanket                                                                     000007fefe5bbf00 7 bytes JMP 000007fffd730260
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                000007feff4389f0 8 bytes JMP 000007fffd7301f0
.text   C:\windows\system32\wuauclt.exe[5764] C:\windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                              000007feff43be50 8 bytes JMP 000007fffd7301b8
.text   C:\windows\system32\wbem\wmiprvse.exe[1168] C:\windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                         00000000776c1430 5 bytes JMP 0000000177660010
.text   C:\windows\system32\wbem\wmiprvse.exe[1168] C:\windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                             00000000776c1490 5 bytes JMP 0000000177660028
.text   C:\windows\system32\wbem\wmiprvse.exe[1168] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                          00000000776c17b0 1 byte JMP 0000000177660040
.text   C:\windows\system32\wbem\wmiprvse.exe[1168] C:\windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                      00000000776c17b2 3 bytes {JMP 0xfffffffffff9e890}
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                      000000007786fac0 5 bytes JMP 00000001750a8cf0
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                          000000007786fb58 5 bytes JMP 00000001750a8ea0
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                       0000000077870038 5 bytes JMP 00000001750a8d80
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\KERNEL32.dll!RegSetValueExA                                                            0000000075501409 7 bytes JMP 000000016fe21e90
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                                                   000000007551b21b 5 bytes JMP 000000016fe21da0
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                                                   0000000075598e24 3 bytes JMP 000000016fe21d90
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx + 4                                               0000000075598e28 3 bytes [FA, CC, CC]
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\KERNEL32.dll!K32GetModuleInformation                                                   0000000075598ea9 5 bytes JMP 000000016fe21e80
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                                                     00000000755991ff 5 bytes JMP 000000016fe21e10
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                        0000000075941d29 5 bytes JMP 000000016fe22450
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                      0000000075941dd7 5 bytes JMP 000000016fe224b0
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                          0000000075942ab1 5 bytes JMP 000000016fe22520
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary                                                             0000000075942d17 5 bytes JMP 000000016fe22620
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                     0000000076e5e96b 5 bytes JMP 000000016fe21a00
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                       0000000076e5eba5 5 bytes JMP 000000016fe21a90
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\ole32.dll!CoSetProxyBlanket                                                            00000000770e5ea5 5 bytes JMP 000000016fe21ce0
.text   C:\Users\Bercht\Downloads\Gmer-19357.exe[6832] C:\windows\syswow64\ole32.dll!CoCreateInstance                                                             0000000077119d0b 5 bytes JMP 000000016fe21c70

---- Threads - GMER 2.1 ----

Thread  C:\windows\SysWOW64\dxdiag.exe [4744:4692]                                                                                                                000000007ef97c32
Thread  C:\windows\SysWOW64\dxdiag.exe [4744:5016]                                                                                                                000000007ef97be4
Thread  C:\windows\SysWOW64\dxdiag.exe [4744:5108]                                                                                                                000000007ef991d3
Thread  C:\windows\SysWOW64\dxdiag.exe [4744:4792]                                                                                                                000000007ef9dc0c
Thread  C:\windows\SysWOW64\dxdiag.exe [4744:3476]                                                                                                                000000007efa1f3f
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [3440:5332]                                                                                            000007fefe590168
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [3440:5060]                                                                                            000007fefb542bf8
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [3440:2880]                                                                                            000007fef0c44830
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [3440:1220]                                                                                            000007fefa3b5124

---- Registry - GMER 2.1 ----

Reg     HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{4A062CF4-8368-448A-A157-80A85B4679DF}\Connection@Name               isatap.{50B746CA-9BED-408D-B51F-D7B5966CB452}
Reg     HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind                  \Device\{43F955B2-B4F4-4254-819A-972F0CC63C25}?\Device\{DB578851-3239-4A43-B16B-A7EB5648772C}?\Device\{4A062CF4-8368-448A-A157-80A85B4679DF}?\Device\{6B788D5F-D829-4031-B33D-93EB52CF2DAE}?\Device\{192D6987-CD84-49BD-9DB4-A70743DBC101}?\Device\{44782A54-CA43-4C5B-B132-139C0E4492AA}?
Reg     HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route                 "{43F955B2-B4F4-4254-819A-972F0CC63C25}"?"{DB578851-3239-4A43-B16B-A7EB5648772C}"?"{4A062CF4-8368-448A-A157-80A85B4679DF}"?"{6B788D5F-D829-4031-B33D-93EB52CF2DAE}"?"{192D6987-CD84-49BD-9DB4-A70743DBC101}"?"{44782A54-CA43-4C5B-B132-139C0E4492AA}"?
Reg     HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export                \Device\TCPIP6TUNNEL_{43F955B2-B4F4-4254-819A-972F0CC63C25}?\Device\TCPIP6TUNNEL_{DB578851-3239-4A43-B16B-A7EB5648772C}?\Device\TCPIP6TUNNEL_{4A062CF4-8368-448A-A157-80A85B4679DF}?\Device\TCPIP6TUNNEL_{6B788D5F-D829-4031-B33D-93EB52CF2DAE}?\Device\TCPIP6TUNNEL_{192D6987-CD84-49BD-9DB4-A70743DBC101}?\Device\TCPIP6TUNNEL_{44782A54-CA43-4C5B-B132-139C0E4492AA}?
Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\dca971053aec                                                                               
Reg     HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{4A062CF4-8368-448A-A157-80A85B4679DF}@InterfaceName                                    isatap.{50B746CA-9BED-408D-B51F-D7B5966CB452}
Reg     HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{4A062CF4-8368-448A-A157-80A85B4679DF}@ReusableType                                     0
Reg     HKLM\SYSTEM\CurrentControlSet\services\rdyboost\Parameters@LastBootPlanUserTime                                                                           ?Do?, ?Dez ?11 ?14, 09:59:16????????????A??????????????????????
Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\dca971053aec (not active ControlSet)                                                           

---- Disk sectors - GMER 2.1 ----

Disk    \Device\Harddisk0\DR0                                                                                                                                     unknown MBR code

---- EOF - GMER 2.1 ----

Bercht · 12.12.2014, 08:37

Code:

ATTFilter

HitmanPro 3.7.9.232
www.hitmanpro.com

   Computer name . . . . : BERCHT-PC
   Windows . . . . . . . : 6.1.1.7601.X64/8
   User name . . . . . . : Bercht-PC\Bercht
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Trial (26 days left)

   Scan date . . . . . . : 2014-12-11 21:12:08
   Scan mode . . . . . . : Quick
   Scan duration . . . . : 9m 2s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : Yes

   Threats . . . . . . . : 1
   Traces  . . . . . . . : 3

   Objects scanned . . . : 3.884
   Files scanned . . . . : 3.884
   Remnants scanned  . . : 0 files / 0 keys

Malware _____________________________________________________________________

   C:\Users\Bercht\AppData\Local\Reward-come\reward-scratch.exe -> PendingDelete
      Size . . . . . . . : 73.728 bytes
      Age  . . . . . . . : 0.0 days (2014-12-11 20:23:53)
      Entropy  . . . . . : 6.2
      SHA-256  . . . . . : CC25FD461F8085574AD182851507D0AF92332E8F86F43E35925FEC0BF45FBF62
    > Bitdefender  . . . : Gen:Variant.Graftor.167231
      Fuzzy  . . . . . . : 118.0
      Startup
         HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reward-truck
         HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\reward-truck

Code:

ATTFilter

HitmanPro 3.7.9.232
www.hitmanpro.com

   Computer name . . . . : BERCHT-PC
   Windows . . . . . . . : 6.1.1.7601.X64/8
   User name . . . . . . : Bercht-PC\Bercht
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Trial (26 days left)

   Scan date . . . . . . : 2014-12-11 20:24:00
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 35m 19s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : Yes

   Threats . . . . . . . : 5
   Traces  . . . . . . . : 22

   Objects scanned . . . : 2.458.689
   Files scanned . . . . : 137.256
   Remnants scanned  . . : 580.926 files / 1.740.507 keys

Malware _____________________________________________________________________

   C:\Users\Bercht\AppData\Local\Crew-conflict\crewsearch.exe -> PendingDelete
      Size . . . . . . . : 195.584 bytes
      Age  . . . . . . . : 2.4 days (2014-12-09 11:45:24)
      Entropy  . . . . . : 7.0
      SHA-256  . . . . . : 73DC58CF72289BFFF06DF9D3E473193D555E3EFA698495A4BC080AECCCB5DB3C
      Product  . . . . . : Kaspersky Anti-Virus
      Publisher  . . . . : Franzis Verlag GmbH
      Description  . . . : Driver lnstaller
      Copyright  . . . . : © 1997-2010 Kaspersky Lab ZAO.
      LanguageID . . . . : 1033
    > Bitdefender  . . . : Gen:Variant.Graftor.166853
      Fuzzy  . . . . . . : 120.0
      Startup
         HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\crew-pool
         HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\crew-pool
         HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\crew-pool
         HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\crew-pool
      Forensic Cluster
         -3.7s C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
         -3.7s C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
         -0.0s C:\Users\Bercht\AppData\Local\Crew-conflict\
          0.0s C:\Users\Bercht\AppData\Local\Crew-conflict\crewsearch.exe

   C:\Users\Bercht\AppData\Local\Noise-wall\noise-log.exe -> PendingDelete
      Size . . . . . . . : 69.632 bytes
      Age  . . . . . . . : 1.9 days (2014-12-09 22:40:58)
      Entropy  . . . . . : 6.4
      SHA-256  . . . . . : D6328AB1F22FB72A90EDF1B36DB501AAC0A77746EE8C8B744E70085458181444
      Product  . . . . . : Poikeverse Doisew Solferecoiles
      Copyright  . . . . : Jaseget Bodefzeoi 2015
      LanguageID . . . . : 1033
    > Bitdefender  . . . : Gen:Variant.Kazy.513165
      Fuzzy  . . . . . . : 116.0
      Startup
         HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noise-permit
         HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\noise-permit
      Forensic Cluster
         -3.3s C:\Windows\Prefetch\{0000F9A8-E2FE-4DD4}-356F71A5.pf
         -0.0s C:\Users\Bercht\AppData\Local\Noise-wall\
          0.0s C:\Users\Bercht\AppData\Local\Noise-wall\noise-log.exe
          6.7s C:\Windows\Prefetch\DISKPERF.EXE-D6497BEC.pf

   C:\Users\Bercht\AppData\Roaming\Principle_craft\principle-establish.exe -> PendingDelete
      Size . . . . . . . : 69.632 bytes
      Age  . . . . . . . : 0.8 days (2014-12-11 00:59:42)
      Entropy  . . . . . : 6.4
      SHA-256  . . . . . : 62475BC675620902BF070A5EB7AD00DBE4007DF767B7A4540B504D22D47AAC8A
      Product  . . . . . : Poikeverse Doisew Solferecoiles
      Copyright  . . . . : Jaseget Bodefzeoi 2015
      LanguageID . . . . : 1033
    > Kaspersky  . . . . : Backdoor.Win32.Androm.fqkb
      Fuzzy  . . . . . . : 116.0
      Startup
         HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\principle-ensure
         HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\principle-ensure
         HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\principle-ensure
         HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\principle-ensure
      Forensic Cluster
         -0.0s C:\Users\Bercht\AppData\Roaming\Principle_craft\
          0.0s C:\Users\Bercht\AppData\Roaming\Principle_craft\principle-establish.exe

   C:\Users\Bercht\AppData\Roaming\Skirtbox\skirtpage.exe -> PendingDelete
      Size . . . . . . . : 69.632 bytes
      Age  . . . . . . . : 1.8 days (2014-12-10 02:01:17)
      Entropy  . . . . . : 6.4
      SHA-256  . . . . . : 3817A97A69C791783A4DF80248BAEFB0BB4E67EB2F73E2CC0F777E2550B491B0
      Product  . . . . . : Poikeverse Doisew Solferecoiles
      Copyright  . . . . : Jaseget Bodefzeoi 2015
      LanguageID . . . . : 1033
    > Bitdefender  . . . : Gen:Variant.Kazy.513165
    > Kaspersky  . . . . : Backdoor.Win32.Androm.fqeg
      Fuzzy  . . . . . . : 116.0
      Startup
         HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\skirt-distribute
         HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\skirt-distribute
         HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\skirt-distribute
         HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\skirt-distribute
      Forensic Cluster
         -3.3s C:\Windows\Prefetch\{000074FA-5DB7-FF42}-F8B61B01.pf
         -0.0s C:\Users\Bercht\AppData\Roaming\Skirtbox\
          0.0s C:\Users\Bercht\AppData\Roaming\Skirtbox\skirtpage.exe
          6.6s C:\Windows\Prefetch\REG.EXE-4978446A.pf

   C:\Users\Bercht\AppData\Roaming\Yapcpxmhsh\jrgurjwul.exe -> PendingDelete
      Size . . . . . . . : 161.792 bytes
      Age  . . . . . . . : 1.6 days (2014-12-10 06:09:08)
      Entropy  . . . . . : 6.9
      SHA-256  . . . . . : 36B4BBD788887246F21788677EC90D9F25EDF8817697B65EE1103114CF22B9D4
      Product  . . . . . : ArcaVir 2010
      Publisher  . . . . : Franzis Verlag GmbH
      Description  . . . : ArcaVir Fixing tool
      Copyright  . . . . : Copyright (C) 2004-2010 ArcaBit
      LanguageID . . . . : 1033
    > Kaspersky  . . . . : Trojan-Dropper.Win32.Injector.lael
      Fuzzy  . . . . . . : 115.0
      Startup
         HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jkpujwul
         HKU\S-1-5-21-2363513811-1566349318-2052125673-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jkpujwul
      Forensic Cluster
         -0.1s C:\Users\Bercht\AppData\Roaming\Yapcpxmhsh\
          0.0s C:\Users\Bercht\AppData\Roaming\Yapcpxmhsh\jrgurjwul.exe


Suspicious files ____________________________________________________________

   C:\Users\Bercht\Downloads\FRST64.exe
      Size . . . . . . . : 2.119.680 bytes
      Age  . . . . . . . : 1.3 days (2014-12-10 12:49:28)
      Entropy  . . . . . : 7.5
      SHA-256  . . . . . : 61D20A8AE7D1E85A6DC6073E473F235373F148A38BB33BD163E00CE100A0FF8F
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 11.12.2014
Scan Time: 21:21:16
Logfile: MWB.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2014.12.11.06
Rootkit Database: v2014.12.08.03
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Bercht

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 379902
Time Elapsed: 13 min, 24 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 1
PUP.Optional.CrossRider.A, HKU\S-1-5-21-2363513811-1566349318-2052125673-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\NEW WINDOWS\ALLOW|*.crossrider.com, CrossriderApp0002258, Delete-on-Reboot, [f59d3b26cbb1360036b2d3f2986c8878]

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 2
Trojan.Agent.DED, C:\$Recycle.Bin\S-1-5-21-2363513811-1566349318-2052125673-1001\$R5E0BMD.zip, Quarantined, [f9991948f78588aed9b2fcebf40d966a], 
Trojan.Agent.DED, C:\$Recycle.Bin\S-1-5-21-2363513811-1566349318-2052125673-1001\$RPO01ED.zip, Quarantined, [009261007b018fa71576bb2ca55c867a], 

Physical Sectors: 0
(No malicious items detected)


(end)

Code:

ATTFilter

Exportierte Ereignisse:

11.12.2014 21:20 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\Bercht\AppData\Roaming\Partshall\part_remain.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.Gen4' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '57e86e74.qua' 
      verschoben!
      Der Registrierungseintrag 
      <HKEY_USERS\S-1-5-21-2363513811-1566349318-2052125673-1001\SOFTWARE\Microsoft\Wi
      ndows\CurrentVersion\Run\part-come> wurde erfolgreich repariert.

11.12.2014 21:18 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Bercht\AppData\Roaming\Partshall\part_remain.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.Gen4' [trojan] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

11.12.2014 21:12 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Bercht\AppData\Roaming\Partshall\part_remain.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.Gen4' [trojan] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

11.12.2014 21:10 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Bercht\AppData\Roaming\Partshall\part_remain.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.Gen4' [trojan] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

11.12.2014 21:10 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Bercht\AppData\Roaming\Partshall\part_remain.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.Gen4' [trojan] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

11.12.2014 21:10 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Bercht\AppData\Roaming\Partshall\part_remain.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.ZPACK.Gen4' [trojan] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

11.12.2014 20:53 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\Bercht\AppData\Local\Temp\{0000900B-DA85-5C25}'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.Xpack.113588' 
      [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '57ea60a9.qua' 
      verschoben!

11.12.2014 20:51 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Bercht\AppData\Local\Temp\{0000900B-DA85-5C25}'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.Xpack.113588' [trojan] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

11.12.2014 20:51 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Bercht\AppData\Local\Temp\{0000900B-DA85-5C25}'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.Xpack.113588' [trojan] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

11.12.2014 01:15 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Bercht\AppData\Roaming\Tale_source\tale-wind.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Trustezeb.171008' [trojan] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

11.12.2014 00:29 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Bercht\AppData\Roaming\Tale_source\tale-wind.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Trustezeb.171008' [trojan] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

11.12.2014 00:29 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Bercht\AppData\Roaming\Tale_source\tale-wind.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Trustezeb.171008' [trojan] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

11.12.2014 00:29 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Bercht\AppData\Roaming\Tale_source\tale-wind.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Trustezeb.171008' [trojan] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

11.12.2014 00:09 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Bercht\AppData\Roaming\Tale_source\tale-wind.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Trustezeb.171008' [trojan] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

10.12.2014 23:38 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Users\Bercht\AppData\Roaming\Tale_source\tale-wind.exe'
      wurde ein Virus oder unerwünschtes Programm 'TR/Trustezeb.171008' [trojan] 
      gefunden.
      Ausgeführte Aktion: Zugriff verweigern

cosinus · 12.12.2014, 09:33

Zitat:

System32\Tasks\AutoKMS => C:\windows\AutoKMS.exe

Da ist mindestens eine gecrackte Software drauf: Microsoft Office

Lesestoff:
Illegale Software: Cracks, Keygens und Co

Bitte lesen => http://www.trojaner-board.de/95393-c...-software.html

Es geht weiter wenn du alles Illegale entfernt hast.

Bei wiederholten Crack/Keygen Verstößen behalte ich es mir vor, den Support einzustellen, d.h. Hilfe nur noch bei der Datensicherung und Neuinstallation des Betriebssystems.

Wegen Spam/Trojaner/Malware sperrt der Anbieter vorrübergehend meinen Internetanschluss

Log-Analyse und Auswertung: Wegen Spam/Trojaner/Malware sperrt der Anbieter vorrübergehend meinen Internetanschluss