Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung

Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung


Log-Analyse und Auswertung: Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Alt 11.01.2015, 19:43   #1
der_phil
 
Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung - Standard

Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung


Hallo liebes Board,

mein Nachbar (70 jähriger Rentner) hat seit 2 Wochen das Problem, dass sein Windows Probleme macht beim Hochfahren und willkürlich irgendwelche Scans gestartet werden (keine Hardwäreänderungen in letzter Zeit), und teilweise die Windows Fehlerbehebung läuft, irgendwas wiederhergestellt wird, dann eine Reparatur ausgeführt wird und anschließend alles für eine kurze Zeit wieder geht.

Ich hatte ihm schon ein paar Mal diverse Viren und Trojaner entfernt (u.a. das BKA ding).

Jetzt wollte ich mich führ ihn erkundigen ob denn evtl wieder ein Schädling dafür verantwortlich ist. Kenne mich selbst damit leider zu wenig aus, deswegen danke ich euch schon einmal für eure Hilfe!

Ich habe die Files angehängt weil es scheinbar zu viele Zeichen waren.

Während des 1. GMER Scans gab es auch einen Blue Screen mit folgender Fehlermeldung:

Code:
ATTFilter
 Problemsignatur:
  Problemereignisname:	BlueScreen
  Betriebsystemversion:	6.1.7601.2.1.0.768.3
  Gebietsschema-ID:	1031

Zusatzinformationen zum Problem:
  BCCode:	1000007e
  BCP1:	FFFFFFFF80000004
  BCP2:	FFFFF8800698191A
  BCP3:	FFFFF88005DFA828
  BCP4:	FFFFF88005DFA080
  OS Version:	6_1_7601
  Service Pack:	1_0
  Product:	768_1

Dateien, die bei der Beschreibung des Problems hilfreich sind:
  C:\Windows\Minidump\011115-35771-01.dmp
  C:\Users\Rolf Schauberger\AppData\Local\Temp\WER-55427-0.sysdata.xml

Lesen Sie unsere Datenschutzbestimmungen online:
  hxxp://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0407

Wenn die Onlinedatenschutzbestimmungen nicht verfügbar sind, lesen Sie unsere Datenschutzbestimmungen offline:
  C:\Windows\system32\de-DE\erofflps.txt

Mein Nachbar und Ich wären euch unheimlich dankbar wenn ihr uns hierbei helfen könntet. Vielen Dank

Alt 11.01.2015, 19:48   #2
schrauber
/// the machine
/// TB-Ausbilder
 
Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung - Standard

Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung


Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________

__________________
Alt 12.01.2015, 10:42   #3
der_phil
 
Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung - Standard

Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung


Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-01-2015
Ran by Rolf Schauberger at 2015-01-11 19:00:37
Running from C:\Users\Rolf Schauberger\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus (Enabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 6.2.2 - Hewlett-Packard) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.3.9130 - Adobe Systems Inc.)
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.2.1.650 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Premiere Elements 9 (HKLM-x32\...\PremElem90) (Version: 9.0 - Adobe Systems Incorporated)
Adobe Reader 9.4.0 MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.4.0 - Adobe Systems Incorporated)
ArcSoft Magic-i Visual Effects 2 (HKLM-x32\...\{61438020-DDD4-42FA-99A2-50225441980A}) (Version: 2.0.1.134 - ArcSoft)
ArcSoft WebCam Companion 4 (HKLM-x32\...\{C793AD32-2BB8-4CC4-ABD3-A1469C21593C}) (Version: 4.0.21.369 - ArcSoft)
ArcSoft WebCam Message Board (HKLM-x32\...\{DE27B805-6833-4B20-9B62-D3EF2660791A}) (Version: 1.1.1.79 - ArcSoft)
Avast Internet Security (HKLM-x32\...\avast) (Version: 10.0.2208 - AVAST Software)
Bing Maps 3D (HKLM\...\{6ACE7F46-FACE-4125-AE86-672F4F2A6A28}) (Version: 4.0.903.16005 - Microsoft Corporation)
CCleaner (HKLM\...\CCleaner) (Version: 4.11 - Piriform)
Complément Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Content Manager 2 (HKLM-x32\...\Content Manager 2) (Version: 3.18.0.342250 - NNG Llc.)
Control ActiveX de Windows Live Mesh para conexiones remotas (HKLM-x32\...\{04668DF2-D32F-4555-9C7E-35523DCD6544}) (Version: 15.4.5722.2 - Microsoft Corporation)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (HKLM-x32\...\{55D003F4-9599-44BF-BA9E-95D060730DD3}) (Version: 15.4.5722.2 - Microsoft Corporation)
Corel WinDVD (HKLM-x32\...\{5C1F18D2-F6B7-4242-B803-B5A78648185D}) (Version: 10.0.5.756 - Corel Inc.)
CyberLink YouPaint (HKLM-x32\...\InstallShield_{72BF1DA0-2B00-4794-9173-159722019B74}) (Version: 1.2.0.2101 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKU\S-1-5-21-2266135243-3458477776-180843295-1000\...\Dropbox) (Version: 2.6.24 - Dropbox, Inc.)
Elements 9 Organizer (x32 Version: 9.0 - Adobe Systems Incorporated) Hidden
Elements STI Installer (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
Evernote (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 3.5.7.2910 - Evernote Corp.)
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.131 - Google Inc.)
Google Drive (HKLM-x32\...\{418BAAD1-754D-48B4-B078-46EF4F25AF42}) (Version: 1.15.6556.8063 - Google, Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
HP Photosmart B109a-m All-in-One Driver 14.0 Rel. 6 (HKLM\...\{A253A57F-4319-49B5-B405-64587FFBCFE2}) (Version: 14.0 - HP)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.0.1008 - Intel Corporation)
Internet Updater (HKLM-x32\...\InternetUpdater) (Version: 2.6.52 - Parallel Lines Development, LLC) <==== ATTENTION
Java(TM) 6 Update 22 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416022FF}) (Version: 6.0.220 - Oracle)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Lollipop (HKU\S-1-5-21-2266135243-3458477776-180843295-1000\...\lollipop_04250909) (Version:  - Lollipop Network, S.L.) <==== ATTENTION
Media Gallery (Version: 1.4.0.11300 - Your Company Name) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Touch Pack for Windows 7 (HKLM-x32\...\{8FF90DB8-6DED-44A3-B182-244FEC09012F}) (Version: 1.0.40517.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 3.0 (HKLM-x32\...\{3898934B-05AE-41CD-96BE-70DA9BFBCE1F}) (Version: 3.0.11010.0 - Microsoft Corporation)
Mozilla Firefox 21.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 21.0 (x86 de)) (Version: 21.0 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MyFreeCodec (HKU\S-1-5-21-2266135243-3458477776-180843295-1000\...\MyFreeCodec) (Version:  - )
Naviextras Toolbox Prerequesities (HKLM-x32\...\{537575D6-3B96-474C-BD8F-DFF667363DBD}) (Version: 1.0.0 - NNG Llc.)
NirSoft BlueScreenView (HKLM-x32\...\NirSoft BlueScreenView) (Version:  - )
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)
NVIDIA Grafiktreiber 266.18 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 266.18 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.10.0514 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.10.0514 - NVIDIA Corporation)
PhoenixRC (HKLM-x32\...\{7A03BEDC-6390-440E-8D13-721A22F0BD1F}) (Version: 3.00.12 - Ihr Firmenname)
PMB (HKLM-x32\...\{B6A98E5F-D6A7-46FB-9E9D-1F7BF443491C}) (Version: 5.5.00.11260 - Sony Corporation)
PMB VAIO Edition Guide (x32 Version: 1.4.00.10090 - Sony Corporation) Hidden
PS_AIO_06_B109a-m_SW_Min (x32 Version: 140.0.690.000 - Hewlett-Packard) Hidden
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6251 - Realtek Semiconductor Corp.)
Remote Keyboard (x32 Version: 1.1.0.12170 - Sony Corporation) Hidden
Remote Play mit PlayStation®3 (HKLM-x32\...\{07441A52-E208-478A-92B7-5C337CA8C131}) (Version: 1.0.2.06210 - Sony Corporation)
Remote Play with PlayStation 3 (x32 Version: 1.0.2.06210 - Sony Corporation) Hidden
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.26.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.26.0 - Renesas Electronics Corporation) Hidden
Samsung Story Album Viewer (HKLM-x32\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13052_1 - Samsung Electronics Co., Ltd.)
Samsung Story Album Viewer (x32 Version: 1.0.0.13052_1 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.24.0 - SAMSUNG Electronics Co., Ltd.)
Scan (x32 Version: 140.0.80.000 - Hewlett-Packard) Hidden
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SmartSound Quicktracks for Premiere Elements 9.0 (HKLM-x32\...\InstallShield_{6748E773-5DA0-4D19-8AA5-273B4133A09B}) (Version: 3.12.3090 - SmartSound Software Inc)
SmartSound Quicktracks for Premiere Elements 9.0 (x32 Version: 3.12.3090 - SmartSound Software Inc) Hidden
Toolbox (x32 Version: 140.0.428.000 - Hewlett-Packard) Hidden
Updater (HKLM-x32\...\{D54E3D9F-FEB8-4D2D-A138-B69A5C80080B}) (Version: 2.6.49 - Creative Island Media, LLC) <==== ATTENTION
VAIO - Media Gallery (HKLM-x32\...\{DD88F979-FA58-41AC-980C-A6E1A82B61D9}) (Version: 1.4.0.11300 - Sony Corporation)
VAIO - PMB VAIO Edition Guide (HKLM-x32\...\InstallShield_{FF1FC66F-536F-46BD-98E3-D8DA127A810E}) (Version: 1.4.00.10090 - Sony Corporation)
VAIO - Remote-Tastatur  (HKLM-x32\...\{7396FB15-9AB4-4B78-BDD8-24A9C15D2C65}) (Version: 1.0.0.12170 - Sony Corporation)
VAIO Care (HKLM-x32\...\{36C5BBF0-E5BF-4DE1-B684-7E90B0C93FB5}) (Version: 6.3.2.10200 - Sony Corporation)
VAIO Care (x32 Version: 6.3.2.10200 - Sony Corporation) Hidden
VAIO Control Center (HKLM-x32\...\{72042FA6-5609-489F-A8EA-3C2DD650F667}) (Version: 4.4.0.11260 - Sony Corporation)
VAIO Data Restore Tool (HKLM-x32\...\{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}) (Version: 1.5.0.10140 - Sony Corporation)
VAIO Data Restore Tool (x32 Version: 1.5.0.10140 - Sony Corporation) Hidden
VAIO Gate (HKLM-x32\...\{A7C30414-2382-4086-B0D6-01A88ABA21C3}) (Version: 2.3.0.11090 - Sony Corporation)
VAIO Gate Default (HKLM-x32\...\{B7546697-2A80-4256-A24B-1C33163F535B}) (Version: 2.3.0.11220 - Sony Corporation)
VAIO Hardware Diagnostics (x32 Version: 4.1.0.10120 - Sony Corporation) Hidden
VAIO Media plus (HKLM-x32\...\{8DE50158-80AA-4FF2-9E9F-0A7C46F71FCD}) (Version: 2.1.0.23300 - Sony Corporation)
VAIO Media plus (Version: 2.1.0.23300 - Your Company Name) Hidden
VAIO Media plus Opening Movie (HKLM-x32\...\{9238E8A4-BEBA-43A3-B926-769BDBF194C5}) (Version: 2.1.0.13220 - Sony Corporation)
VAIO Quick Web Access (HKLM-x32\...\splashtop) (Version: 1.4.4.8 - Sony Corporation)
VAIO Quick Web Access (x32 Version: 1.4.4.8 - Sony Corporation) Hidden
VAIO Sample Contents (HKLM-x32\...\{547C9EB4-4CA6-402F-9D1B-8BD30DC71E44}) (Version: 1.4.2.09010 - Sony Corporation)
VAIO screensaver (HKLM-x32\...\VAIO screensaver) (Version: 1.0.0.0 - Sony Europe)
VAIO Smart Network (HKLM-x32\...\{0899D75A-C2FC-42EA-A702-5B9A5F24EAD5}) (Version: 3.4.0.12090 - Sony Corporation)
VAIO Update (HKLM-x32\...\{5BEE8F1F-BD32-4553-8107-500439E43BD7}) (Version: 5.3.0.11180 - Sony Corporation)
VAIO-Handbuch (HKLM-x32\...\{C6E893E7-E5EA-4CD5-917C-5443E753FCBD}) (Version: 1.2.0.11040 - Sony Corporation)
VAIO-Support für Übertragungen (HKLM-x32\...\{5DDAFB4B-C52E-468A-9E23-3B0CEEB671BF}) (Version: 1.3.0.11250 - Sony Corporation)
Viewster - Viewster - Viewster Launch App (HKLM-x32\...\Viewster Viewster) (Version: "1.0.0" - "Viewster")
WIDCOMM Bluetooth Software (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.6300 - Broadcom Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (HKLM-x32\...\{C32CE55C-12BA-4951-8797-0967FDEF556F}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}) (Version: 15.4.5722.2 - Microsoft Corporation)
WiseConvert (HKLM-x32\...\WiseConvert) (Version: 1.0 - WiseConvert) <==== ATTENTION!
Компаньон Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Элемент управления Windows Live Mesh ActiveX для удаленных подключений (HKLM-x32\...\{BCB0D6F7-7EAB-4009-A6F2-8E0E7F317773}) (Version: 15.4.5722.2 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2266135243-3458477776-180843295-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2266135243-3458477776-180843295-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2266135243-3458477776-180843295-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2266135243-3458477776-180843295-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2266135243-3458477776-180843295-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)

==================== Restore Points  =========================

22-12-2014 11:06:28 avast! antivirus system restore point
22-12-2014 11:19:17 Windows Update
22-12-2014 12:58:29 Windows Update
27-12-2014 10:57:45 Windows Update
30-12-2014 11:06:07 Windows Update
31-12-2014 17:04:01 avast! antivirus system restore point
31-12-2014 17:06:21 Gerätetreiber-Paketinstallation: Avast Netzwerkdienst
31-12-2014 17:08:24 Windows Update
04-01-2015 21:30:00 avast! antivirus system restore point
05-01-2015 14:45:16 avast! antivirus system restore point
05-01-2015 14:50:37 Windows Update
08-01-2015 16:16:38 avast! antivirus system restore point
08-01-2015 16:18:58 Gerätetreiber-Paketinstallation: Avast Netzwerkdienst
08-01-2015 16:21:59 Windows Update
11-01-2015 10:53:22 avast! antivirus system restore point
11-01-2015 16:42:49 avast! antivirus system restore point
11-01-2015 16:47:28 Windows Update
11-01-2015 17:11:09 Windows-Sicherung
11-01-2015 18:42:50 avast! antivirus system restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0572480E-A4D6-403F-A573-ACF8E8E4DE58} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-26] (Google Inc.)
Task: {095D9381-B0D9-433A-ABE8-8001BCCC023D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-26] (Google Inc.)
Task: {13F66198-2A6F-4F69-B70D-8A5051089080} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {166AF505-17D4-4381-BF54-7223D153AA97} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-11] (Adobe Systems Incorporated)
Task: {258A2963-BA15-4E29-AF49-3150001A1CA6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-02-20] (Piriform Ltd)
Task: {607D7CD3-8C4C-4CFD-B4FD-AE27EB758A39} - System32\Tasks\VAIO Care Support => C:\Program Files\Sony\VAIO Care\VCSpt.exe [2010-09-27] (Sony Corporation)
Task: {7AABFAE1-5D93-47D1-A266-4B5143804899} - System32\Tasks\SONY\VAIO Gate\VAIO Gate => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2010-11-16] (Sony Corporation)
Task: {7C0CF055-7FBB-4979-A7A4-96AB80B778BB} - System32\Tasks\SONY\VAIO Gate\StartExecuteProxy => C:\Program Files\Sony\VAIO Gate\ExecutionProxy.exe [2010-11-16] (Sony Corporation)
Task: {7FBC739F-35A7-42C9-9A98-F8B324317899} - System32\Tasks\SONY\VAIO Power Management\VPM Logon Start => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2010-12-06] (Sony Corporation)
Task: {83CCA2B6-38F4-41F8-80EC-6181B723C07C} - System32\Tasks\VAIO Care => C:\Program Files\Sony\VAIO Care\VCsystray.exe [2010-10-20] (Sony Corporation)
Task: {8FD5C340-C6FE-4FBF-A027-76FE1E4D8203} - System32\Tasks\SONY\VAIO Update\VAIO Update 5 => C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe [2010-11-18] (Sony Corporation)
Task: {9FDB2E10-2D69-42E0-92AA-75120E533CF8} - System32\Tasks\SONY\VAIO Smart Network\VSN Logon Start => C:\Program Files\Sony\VAIO Smart Network\VSNClient
Task: {C6C938E7-2E03-4041-B7FB-CB1EC790FC1F} - System32\Tasks\SONY\VAIO Power Management\VPM Session Change => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2010-12-06] (Sony Corporation)
Task: {CCF1B63E-A82D-4502-8D42-44B309A5699D} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation)
Task: {F1866651-4D91-4C05-B448-8DDEFDF31E96} - System32\Tasks\VCOneClick => C:\Program Files\Sony\VAIO Care\VCOneClick.exe [2010-10-14] ()
Task: {F1CCD594-85B8-43CF-8C46-14AA7C96AFE2} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-11-16] (AVAST Software)
Task: {F4D15A0C-6FE1-4FF7-98A2-65AB0B2B602A} - System32\Tasks\SONY\VAIO Power Management\VPM Unlock => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2010-12-06] (Sony Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-05-24 08:01 - 2010-11-18 08:23 - 00057344 _____ () C:\Program Files\Sony\VAIO Update 5\VUAgentPS64.dll
2013-05-24 08:25 - 2010-10-14 04:33 - 00275456 _____ () C:\Program Files\Sony\VAIO Care\CRM\ManagedVAIORecoveryMedia.dll
2013-05-24 08:25 - 2010-10-14 04:33 - 00182272 _____ () C:\Program Files\Sony\VAIO Care\CRM\VAIORecovery.dll
2013-05-24 08:25 - 2010-10-14 04:33 - 00070656 _____ () C:\Program Files\Sony\VAIO Care\CRM\Logging.dll
2013-05-24 08:25 - 2010-10-14 04:33 - 00058880 _____ () C:\Program Files\Sony\VAIO Care\CRM\VAIOCommon.dll
2013-05-24 08:25 - 2010-10-14 04:33 - 00215040 _____ () C:\Program Files\Sony\VAIO Care\CRM\OsServices.dll
2013-05-24 08:25 - 2010-10-14 04:33 - 00043008 _____ () C:\Program Files\Sony\VAIO Care\CRM\PluginFactory.dll
2013-05-24 08:25 - 2010-10-14 04:33 - 00043520 _____ () C:\Program Files\Sony\VAIO Care\CRM\XMLTools.dll
2013-05-24 08:25 - 2010-10-14 04:33 - 00059392 _____ () C:\Program Files\Sony\VAIO Care\CRM\VAIOInstallAppsDrivers.dll
2013-05-24 08:25 - 2010-10-14 04:33 - 00157696 _____ () C:\Program Files\Sony\VAIO Care\CRM\InstallDB.dll
2013-05-24 08:25 - 2010-10-14 04:33 - 00138240 _____ () C:\Program Files\Sony\VAIO Care\CRM\InstallationTools.dll
2013-05-24 08:25 - 2010-10-14 04:33 - 00024576 _____ () C:\Program Files\Sony\VAIO Care\CRM\VAIOUtility.dll
2015-01-08 16:19 - 2015-01-08 16:19 - 02909696 _____ () C:\Program Files\AVAST Software\Avast\defs\15010800\algo.dll
2015-01-11 18:45 - 2015-01-11 18:45 - 02909696 _____ () C:\Program Files\AVAST Software\Avast\defs\15011101\algo.dll
2014-11-16 12:29 - 2014-11-16 12:29 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-05-24 08:00 - 2011-01-31 13:46 - 00013824 _____ () C:\Program Files (x86)\Sony\VAIO Event Service\VESBasePS.dll
2014-10-20 15:45 - 2014-10-20 15:45 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\93182e9779b8be0f688fd0784df6d7fb\IsdiInterop.ni.dll
2013-05-24 07:54 - 2010-11-05 22:50 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2014-05-03 15:24 - 2014-04-24 01:33 - 00065352 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\chrome_elf.dll
2014-05-03 15:24 - 2014-04-24 01:33 - 00674632 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\libglesv2.dll
2014-05-03 15:24 - 2014-04-24 01:33 - 00093000 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\libegl.dll
2014-05-03 15:24 - 2014-04-24 01:33 - 04081480 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\pdf.dll
2014-05-03 15:24 - 2014-04-24 01:33 - 00390472 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\ppGoogleNaClPluginChrome.dll
2014-05-03 15:24 - 2014-04-24 01:33 - 01647432 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Rolf Schauberger\Downloads\OriginalMail (1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Rolf Schauberger\Downloads\OriginalMail.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe ARM => "c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: Norton Online Backup => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe

========================= Accounts: ==========================

Administrator (S-1-5-21-2266135243-3458477776-180843295-500 - Administrator - Disabled)
Gast (S-1-5-21-2266135243-3458477776-180843295-501 - Limited - Disabled)
Rolf Schauberger (S-1-5-21-2266135243-3458477776-180843295-1000 - Administrator - Enabled) => C:\Users\Rolf Schauberger

==================== Faulty Device Manager Devices =============

Name: avast! Firewall NDIS Filter Miniport
Description: avast! Firewall NDIS Filter Miniport
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: ALWIL Software
Service: aswNdis
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
 This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/11/2015 06:59:14 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (01/11/2015 06:59:14 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (01/11/2015 06:36:10 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
(Stream product id=0x0066): Streaming Failed

Error: (01/11/2015 06:36:10 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
Too many failures while downloading ranges: 2

Error: (01/11/2015 06:13:07 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
(Stream product id=0x0066): Streaming Failed

Error: (01/11/2015 06:13:07 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
Too many failures while downloading ranges: 2

Error: (01/11/2015 05:55:49 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
(Stream product id=0x0066): Streaming Failed

Error: (01/11/2015 05:55:49 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
Too many failures while downloading ranges: 2

Error: (01/11/2015 04:42:20 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
(Stream product id=0x0066): Streaming Failed

Error: (01/11/2015 04:42:20 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
Too many failures while downloading ranges: 2


System errors:
=============
Error: (01/11/2015 06:35:26 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "IKE- und AuthIP IPsec-Schlüsselerstellungsmodule" wurde mit folgendem Fehler beendet: 
%%13876

Error: (01/11/2015 06:35:14 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Optimizer Pro Crash Monitor erreicht.

Error: (01/11/2015 06:34:25 PM) (Source: NetBT) (EventID: 4307) (User: )
Description: Initialisierung fehlgeschlagen, da die Transportschicht das Öffnen der Anfangsadressen verweigerte.

Error: (01/11/2015 06:34:25 PM) (Source: NetBT) (EventID: 4307) (User: )
Description: Initialisierung fehlgeschlagen, da die Transportschicht das Öffnen der Anfangsadressen verweigerte.

Error: (01/11/2015 06:34:12 PM) (Source: NetBT) (EventID: 4307) (User: )
Description: Initialisierung fehlgeschlagen, da die Transportschicht das Öffnen der Anfangsadressen verweigerte.

Error: (01/11/2015 06:33:28 PM) (Source: NetBT) (EventID: 4307) (User: )
Description: Initialisierung fehlgeschlagen, da die Transportschicht das Öffnen der Anfangsadressen verweigerte.

Error: (01/11/2015 06:33:27 PM) (Source: NetBT) (EventID: 4307) (User: )
Description: Initialisierung fehlgeschlagen, da die Transportschicht das Öffnen der Anfangsadressen verweigerte.

Error: (01/11/2015 06:33:27 PM) (Source: NetBT) (EventID: 4307) (User: )
Description: Initialisierung fehlgeschlagen, da die Transportschicht das Öffnen der Anfangsadressen verweigerte.

Error: (01/11/2015 06:27:59 PM) (Source: NetBT) (EventID: 4307) (User: )
Description: Initialisierung fehlgeschlagen, da die Transportschicht das Öffnen der Anfangsadressen verweigerte.

Error: (01/11/2015 06:27:59 PM) (Source: NetBT) (EventID: 4307) (User: )
Description: Initialisierung fehlgeschlagen, da die Transportschicht das Öffnen der Anfangsadressen verweigerte.


Microsoft Office Sessions:
=========================
Error: (01/11/2015 06:59:14 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Users\Rolf Schauberger\Downloads\SoftonicDownloader_fuer_samsung-kies.exe

Error: (01/11/2015 06:59:14 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Users\Rolf Schauberger\Downloads\SoftonicDownloader_fuer_samsung-kies (1).exe

Error: (01/11/2015 06:36:10 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: (Stream product id=0x0066): Streaming Failed

Error: (01/11/2015 06:36:10 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Too many failures while downloading ranges: 2

Error: (01/11/2015 06:13:07 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: (Stream product id=0x0066): Streaming Failed

Error: (01/11/2015 06:13:07 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Too many failures while downloading ranges: 2

Error: (01/11/2015 05:55:49 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: (Stream product id=0x0066): Streaming Failed

Error: (01/11/2015 05:55:49 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Too many failures while downloading ranges: 2

Error: (01/11/2015 04:42:20 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: (Stream product id=0x0066): Streaming Failed

Error: (01/11/2015 04:42:20 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Too many failures while downloading ranges: 2


CodeIntegrity Errors:
===================================
  Date: 2013-08-14 17:50:26.719
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-14 17:50:26.619
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-14 17:50:26.479
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-14 17:50:26.329
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-14 17:50:26.199
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-14 17:50:26.089
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-14 17:50:25.959
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-14 17:50:25.769
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-14 17:50:25.539
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-14 17:50:25.369
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-2410M CPU @ 2.30GHz
Percentage of memory in use: 47%
Total physical RAM: 4077.3 MB
Available physical RAM: 2143.82 MB
Total Pagefile: 8152.77 MB
Available Pagefile: 5636.05 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:915.42 GB) (Free:839.24 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: F340C475)
Partition 1: (Not Active) - (Size=16 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=915.4 GB) - (Type=07 NTFS)

==================== End Of Log ============================
FRST:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-01-2015
Ran by Rolf Schauberger (administrator) on ROLFSCHAUBERGER on 11-01-2015 18:59:46
Running from C:\Users\Rolf Schauberger\Downloads
Loaded Profile: Rolf Schauberger (Available profiles: Rolf Schauberger)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSpt.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCPerfService.exe
(Sony of America Corporation) C:\Program Files\Sony\VAIO Care\listener.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update 5\VUAgent.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11613288 2010-11-26] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2184808 2010-11-26] (Realtek Semiconductor)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-05] (Intel Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] => c:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [648032 2010-11-26] (Sony Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2014-12-12] (AVAST Software)
HKU\S-1-5-21-2266135243-3458477776-180843295-1000\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
HKU\S-1-5-18\...\Run: [Updater] => C:\ProgramData\Updater\updater.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SVEF&bmod=SVEF
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SVEF&bmod=SVEF
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKU\.DEFAULT -> {0F44A6EE-16E3-4A65-9F64-71495D1535FB} URL = hxxp://de.shopping.com/?linkin_id=8056363
SearchScopes: HKU\.DEFAULT -> {87C8801B-2E0D-482B-8D22-E4D7B87641E5} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
SearchScopes: HKU\.DEFAULT -> {E286E88F-E5F0-4C9A-B5ED-5BDBCA6ECE99} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-16/4?mpre=hxxp://shop.ebay.de/?_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-2266135243-3458477776-180843295-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKU\S-1-5-21-2266135243-3458477776-180843295-1000 -> {8DA38C5A-DEC3-4A6D-88BE-8F3C78B41826} URL = hxxp://de.shopping.com/?linkin_id=8056363
SearchScopes: HKU\S-1-5-21-2266135243-3458477776-180843295-1000 -> {B6328077-6BD7-48FF-83DB-03A883897D37} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-16/4?mpre=hxxp://shop.ebay.de/?_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-2266135243-3458477776-180843295-1000 -> {C7FE4137-3517-41C8-B134-C4D31F57C727} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll No File
Toolbar: HKU\S-1-5-21-2266135243-3458477776-180843295-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Rolf Schauberger\AppData\Roaming\Mozilla\Firefox\Profiles\5vg3s90o.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_246.dll ()
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/VirtualEarth3D,version=4.0 -> c:\Program Files (x86)\Virtual Earth 3D\ ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/VirtualEarth3D,version=4.0 -> c:\Program Files (x86)\Virtual Earth 3D\ ()
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\omiga-plus.xml
FF Extension: Widget context - C:\Users\Rolf Schauberger\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-03-14]
FF Extension: Amazon-Icon - C:\Users\Rolf Schauberger\AppData\Roaming\Mozilla\Firefox\Profiles\5vg3s90o.default\Extensions\amazon-icon@giga.de [2014-05-03]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: No Name - C:\Users\Rolf Schauberger\AppData\Roaming\Mozilla\Firefox\Profiles\5vg3s90o.default\extensions\support@websteroidsapp.com [Not Found]
FF Extension: No Name - C:\Users\Rolf Schauberger\AppData\Roaming\Mozilla\Firefox\Profiles\5vg3s90o.default\extensions\quick_start@gmail.com [Not Found]
FF Extension: No Name - C:\Users\Rolf Schauberger\AppData\Roaming\Mozilla\Firefox\Profiles\5vg3s90o.default\extensions\{94cd2cc3-083f-49ba-a218-4cda4b4829fd} [Not Found]
FF Extension: No Name - C:\Users\Rolf Schauberger\AppData\Roaming\Mozilla\Firefox\Profiles\5vg3s90o.default\extensions\faststartff@gmail.com [Not Found]

Chrome: 
=======
CHR Profile: C:\Users\Rolf Schauberger\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Rolf Schauberger\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-03]
CHR Extension: (YouTube) - C:\Users\Rolf Schauberger\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-03]
CHR Extension: (Google-Suche) - C:\Users\Rolf Schauberger\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-03]
CHR Extension: (Google Wallet) - C:\Users\Rolf Schauberger\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-03]
CHR Extension: (Google Mail) - C:\Users\Rolf Schauberger\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-03]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-16] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [104416 2014-11-16] (AVAST Software)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2009-05-14] (Hewlett-Packard) [File not signed]
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2009-05-14] (Hewlett-Packard) [File not signed]
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [257936 2010-08-12] (Sony Corporation)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [864000 2010-09-27] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update 5\VUAgent.exe [1310096 2010-11-18] (Sony Corporation)
S2 051cdb72; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro 3.11\OptProMon.dll",ENT
S3 COMSysApp; %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-11-16] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2014-11-16] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-11-16] (AVAST Software)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [449936 2014-11-16] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-11-16] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-11-16] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-11-22] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-11-16] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-11-16] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-11-16] ()
R3 NWLowRider; C:\Windows\System32\DRIVERS\NWLowRider.sys [26176 2010-12-23] ()
R3 NWWakeFilterLR; C:\Windows\System32\DRIVERS\NWWakeFilterLR.sys [14400 2010-12-23] (n/a)
R2 risdsnpe; C:\Windows\System32\DRIVERS\risdsnxc64.sys [98816 2010-12-27] (REDC)
S3 cpuz134; \??\C:\Users\ROLFSC~1\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-11 18:59 - 2015-01-11 19:00 - 00019015 _____ () C:\Users\Rolf Schauberger\Downloads\FRST.txt
2015-01-11 18:59 - 2015-01-11 18:59 - 02124288 _____ (Farbar) C:\Users\Rolf Schauberger\Downloads\FRST64.exe
2015-01-11 18:59 - 2015-01-11 18:59 - 00000000 ____D () C:\FRST
2015-01-11 18:44 - 2014-11-16 12:29 - 00364512 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-12-22 11:23 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-22 11:23 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-11 18:53 - 2014-08-03 11:06 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-01-11 18:50 - 2013-05-24 08:40 - 00004002 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{144C6AEE-420B-449A-84E4-C9A323E2AAF3}
2015-01-11 18:44 - 2014-11-16 12:30 - 00001990 _____ () C:\Users\Public\Desktop\Avast SafeZone.lnk
2015-01-11 18:44 - 2014-11-16 12:30 - 00001930 _____ () C:\Users\Public\Desktop\Avast Internet Security.lnk
2015-01-11 18:44 - 2013-05-24 14:00 - 00003924 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-01-11 18:43 - 2009-07-14 05:45 - 00022752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-11 18:43 - 2009-07-14 05:45 - 00022752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-11 18:39 - 2013-05-24 07:52 - 01690671 _____ () C:\Windows\WindowsUpdate.log
2015-01-11 18:35 - 2013-05-24 08:10 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-11 18:34 - 2014-05-03 15:26 - 00020757 _____ () C:\Windows\setupact.log
2015-01-11 18:34 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-11 18:31 - 2013-05-24 08:10 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-11 18:28 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-01-11 17:54 - 2013-05-24 08:32 - 00000000 ____D () C:\Users\Rolf Schauberger
2015-01-11 17:52 - 2014-11-16 12:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-01-11 17:52 - 2013-05-24 08:00 - 00000000 ____D () C:\ProgramData\Sony Corporation
2015-01-11 17:52 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2015-01-11 10:51 - 2013-05-24 08:45 - 00000000 ____D () C:\Users\Rolf Schauberger\AppData\Roaming\SoftGrid Client
2014-12-27 11:59 - 2013-05-24 08:46 - 00699876 _____ () C:\Windows\system32\perfh007.dat
2014-12-27 11:59 - 2013-05-24 08:46 - 00149758 _____ () C:\Windows\system32\perfc007.dat
2014-12-27 11:59 - 2009-07-14 06:13 - 01622260 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-22 11:13 - 2014-05-03 15:26 - 00007514 _____ () C:\Windows\PFRO.log

Some content of TEMP:
====================
C:\Users\Rolf Schauberger\AppData\Local\Temp\amazonicon_v4.exe
C:\Users\Rolf Schauberger\AppData\Local\Temp\amazoninstallernircmdc.exe
C:\Users\Rolf Schauberger\AppData\Local\Temp\BackupSetup.exe
C:\Users\Rolf Schauberger\AppData\Local\Temp\optprosetup.exe
C:\Users\Rolf Schauberger\AppData\Local\Temp\Quarantine.exe
C:\Users\Rolf Schauberger\AppData\Local\Temp\ReimagePackage.exe
C:\Users\Rolf Schauberger\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Rolf Schauberger\AppData\Local\Temp\sdapskill.exe
C:\Users\Rolf Schauberger\AppData\Local\Temp\sdaspwn.exe
C:\Users\Rolf Schauberger\AppData\Local\Temp\sqlite3.dll
C:\Users\Rolf Schauberger\AppData\Local\Temp\sweetpage_294wld.exe
C:\Users\Rolf Schauberger\AppData\Local\Temp\vcredist_x64.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-05 16:40

==================== End Of Log ============================
--- --- ---

--- --- ---
__________________
Alt 12.01.2015, 10:46   #4
der_phil
 
Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung - Standard

Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung


GMER:
Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-01-11 19:24:58
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD10 rev.05.0 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\ROLFSC~1\AppData\Local\Temp\fglyipow.sys


---- User code sections - GMER 2.1 ----

.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                0000000077931360 5 bytes JMP 000000014a560460
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                         00000000779313b0 5 bytes JMP 000000014a560450
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                         0000000077931510 5 bytes JMP 000000014a560370
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                              0000000077931560 5 bytes JMP 000000014a560470
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                    0000000077931570 5 bytes JMP 000000014a5603e0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                         0000000077931620 5 bytes JMP 000000014a560320
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                  0000000077931650 5 bytes JMP 000000014a5603b0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                     0000000077931670 5 bytes JMP 000000014a560390
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                           00000000779316b0 5 bytes JMP 000000014a5602e0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                         0000000077931730 5 bytes JMP 000000014a5602d0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                       0000000077931750 5 bytes JMP 000000014a560310
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                        0000000077931790 5 bytes JMP 000000014a5603c0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                     00000000779317e0 5 bytes JMP 000000014a5603f0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                        0000000077931940 5 bytes JMP 000000014a560230
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                             0000000077931b00 5 bytes JMP 000000014a560480
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                            0000000077931b30 5 bytes JMP 000000014a5603a0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                     0000000077931c10 5 bytes JMP 000000014a5602f0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                  0000000077931c20 5 bytes JMP 000000014a560350
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                        0000000077931c80 5 bytes JMP 000000014a560290
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                     0000000077931d10 5 bytes JMP 000000014a5602b0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                      0000000077931d30 5 bytes JMP 000000014a5603d0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                         0000000077931d40 5 bytes JMP 000000014a560330
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                  0000000077931db0 5 bytes JMP 000000014a560410
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                     0000000077931de0 5 bytes JMP 000000014a560240
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                          00000000779320a0 5 bytes JMP 000000014a5601e0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                     0000000077932160 5 bytes JMP 000000014a560250
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                     0000000077932190 5 bytes JMP 000000014a560490
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                            00000000779321a0 5 bytes JMP 000000014a5604a0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                       00000000779321d0 5 bytes JMP 000000014a560300
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                    00000000779321e0 5 bytes JMP 000000014a560360
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                          0000000077932240 5 bytes JMP 000000014a5602a0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                       0000000077932290 5 bytes JMP 000000014a5602c0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                          00000000779322c0 5 bytes JMP 000000014a560380
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                           00000000779322d0 5 bytes JMP 000000014a560340
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                    00000000779325c0 5 bytes JMP 000000014a560440
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                   00000000779327c0 5 bytes JMP 000000014a560260
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                      00000000779327d0 5 bytes JMP 000000014a560270
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                    00000000779327e0 5 bytes JMP 000000014a560400
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                00000000779329a0 5 bytes JMP 000000014a5601f0
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                 00000000779329b0 5 bytes JMP 000000014a560210
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                      0000000077932a20 5 bytes JMP 000000014a560200
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                      0000000077932a80 5 bytes JMP 000000014a560420
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                       0000000077932a90 5 bytes JMP 000000014a560430
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                  0000000077932aa0 5 bytes JMP 000000014a560220
.text  C:\Windows\system32\csrss.exe[556] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                          0000000077932b80 5 bytes JMP 000000014a560280
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                              0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                       00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                       0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                            0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                  0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                       0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                   0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                         00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                       0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                     0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                      0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                   00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                      0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                           0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                          0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                   0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                      0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                   0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                    0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                       0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                   0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                        00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                   0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                   0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                          00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                     00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                  00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                        0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                     0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                        00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                         00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                  00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                 00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                    00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                  00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                              00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                               00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                    0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                    0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                     0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\system32\wininit.exe[604] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                        0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                0000000077931360 5 bytes JMP 000000014a560460
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                         00000000779313b0 5 bytes JMP 000000014a560450
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                         0000000077931510 5 bytes JMP 000000014a560370
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                              0000000077931560 5 bytes JMP 000000014a560470
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                    0000000077931570 5 bytes JMP 000000014a5603e0
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                         0000000077931620 5 bytes JMP 000000014a560320
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                  0000000077931650 5 bytes JMP 000000014a5603b0
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                     0000000077931670 5 bytes JMP 000000014a560390
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                           00000000779316b0 5 bytes JMP 000000014a5602e0
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                         0000000077931730 5 bytes JMP 000000014a5602d0
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                       0000000077931750 5 bytes JMP 000000014a560310
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                        0000000077931790 5 bytes JMP 000000014a5603c0
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                     00000000779317e0 5 bytes JMP 000000014a5603f0
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                        0000000077931940 5 bytes JMP 000000014a560230
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                             0000000077931b00 5 bytes JMP 000000014a560480
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                            0000000077931b30 5 bytes JMP 000000014a5603a0
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                     0000000077931c10 5 bytes JMP 000000014a5602f0
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                  0000000077931c20 5 bytes JMP 000000014a560350
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                        0000000077931c80 5 bytes JMP 000000014a560290
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                     0000000077931d10 5 bytes JMP 000000014a5602b0
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                      0000000077931d30 5 bytes JMP 000000014a5603d0
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                         0000000077931d40 5 bytes JMP 000000014a560330
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                  0000000077931db0 5 bytes JMP 000000014a560410
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                     0000000077931de0 5 bytes JMP 000000014a560240
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                          00000000779320a0 5 bytes JMP 000000014a5601e0
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                     0000000077932160 5 bytes JMP 000000014a560250
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                     0000000077932190 5 bytes JMP 000000014a560490
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                            00000000779321a0 5 bytes JMP 000000014a5604a0
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                       00000000779321d0 5 bytes JMP 000000014a560300
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                    00000000779321e0 5 bytes JMP 000000014a560360
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                          0000000077932240 5 bytes JMP 000000014a5602a0
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                       0000000077932290 5 bytes JMP 000000014a5602c0
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                          00000000779322c0 5 bytes JMP 000000014a560380
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                           00000000779322d0 5 bytes JMP 000000014a560340
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                    00000000779325c0 5 bytes JMP 000000014a560440
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                   00000000779327c0 5 bytes JMP 000000014a560260
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                      00000000779327d0 5 bytes JMP 000000014a560270
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                    00000000779327e0 5 bytes JMP 000000014a560400
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                00000000779329a0 5 bytes JMP 000000014a5601f0
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                 00000000779329b0 5 bytes JMP 000000014a560210
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                      0000000077932a20 5 bytes JMP 000000014a560200
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                      0000000077932a80 5 bytes JMP 000000014a560420
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                       0000000077932a90 5 bytes JMP 000000014a560430
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                  0000000077932aa0 5 bytes JMP 000000014a560220
.text  C:\Windows\system32\csrss.exe[628] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                          0000000077932b80 5 bytes JMP 000000014a560280
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                             0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                      00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                      0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                           0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                 0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                      0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                               0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                  0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                        00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                      0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                    0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                     0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                  00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                     0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                          0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                         0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                  0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                               0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                     0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                  0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                   0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                      0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                               0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                  0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                       00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                  0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                  0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                         00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                    00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                 00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                       0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                    0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                       00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                        00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                 00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                   00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                 00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                             00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                              00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                   0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                   0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                    0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                               0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                       0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                         00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                         0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                              0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                    0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                         0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                  0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                     0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                           00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                         0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                       0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                        0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                     00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                        0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                             0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                            0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                     0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                  0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                        0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                     0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                      0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                         0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                  0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                     0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                          00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                     0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                     0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                            00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                       00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                    00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                          0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                       0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                          00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                           00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                    00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                   00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                      00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                    00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                 00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                      0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                      0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                       0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                  0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\system32\lsass.exe[700] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                          0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                  0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                           00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                           0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                      0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                           0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                    0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                       0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                             00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                           0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                         0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                          0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                       00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                          0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                               0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                              0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                       0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                    0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                          0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                       0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                        0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                           0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                    0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                       0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                            00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                       0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                       0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                              00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                         00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                      00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                            0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                         0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                            00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                             00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                      00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                     00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                        00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                      00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                  00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                   00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                        0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                        0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                         0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                    0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\system32\lsm.exe[708] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                            0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                             0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                      00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                      0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                           0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                 0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                      0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                               0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                  0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                        00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                      0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                    0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                     0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                  00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                     0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                          0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                         0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                  0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                               0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                     0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                  0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                   0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                      0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                               0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                  0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                       00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                  0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                  0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                         00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                    00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                 00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                       0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                    0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                       00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                        00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                 00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                   00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                 00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                             00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                              00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                   0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                   0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                    0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                               0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\system32\winlogon.exe[732] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                       0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                              0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                       00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                       0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                            0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                  0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                       0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                   0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                         00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                       0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                     0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                      0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                   00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                      0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                           0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                          0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                   0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                      0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                   0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                    0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                       0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                   0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                        00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                   0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                   0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                          00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                     00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                  00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                        0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                     0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                        00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                         00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                  00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                 00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                    00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                  00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                              00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                               00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                    0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                    0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                     0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\system32\svchost.exe[884] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                        0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                               0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                        00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                        0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                             0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                   0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                        0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                 0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                    0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                          00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                        0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                      0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                       0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                    00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                       0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                            0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                           0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                    0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                 0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                       0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                    0000000077931d10 5 bytes JMP 0000000077a902b0

Alt 12.01.2015, 10:49   #5
der_phil
 
Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung - Standard

Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung


Code:
ATTFilter
text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                     0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                        0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                 0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                    0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                         00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                    0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                    0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                           00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                      00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                   00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                         0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                      0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                         00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                          00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                   00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                  00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                     00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                   00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                               00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                     0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                     0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                      0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                 0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\system32\nvvsvc.exe[960] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                         0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                             0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                      00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                      0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                           0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                 0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                      0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                               0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                  0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                        00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                      0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                    0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                     0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                  00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                     0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                          0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                         0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                  0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                               0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                     0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                  0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                   0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                      0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                               0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                  0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                       00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                  0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                  0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                         00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                    00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                 00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                       0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                    0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                       00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                        00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                 00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                   00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                 00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                             00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                              00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                   0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                   0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                    0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                               0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\system32\svchost.exe[1000] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                       0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                              0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                       00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                       0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                            0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                  0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                       0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                   0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                         00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                       0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                     0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                      0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                   00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                      0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                           0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                          0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                   0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                      0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                   0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                    0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                       0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                   0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                        00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                   0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                   0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                          00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                     00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                  00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                        0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                     0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                        00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                         00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                  00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                 00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                    00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                  00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                              00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                               00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                    0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                    0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                     0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\System32\svchost.exe[808] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                        0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                             0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                      00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                      0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                           0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                 0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                      0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                               0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                  0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                        00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                      0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                    0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                     0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                  00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                     0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                          0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                         0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                  0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                               0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                     0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                  0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                   0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                      0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                               0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                  0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                       00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                  0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                  0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                         00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                    00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                 00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                       0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                    0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                       00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                        00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                 00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                   00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                 00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                             00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                              00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                   0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                   0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                    0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                               0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\System32\svchost.exe[1040] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                       0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                             0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                      00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                      0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                           0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                 0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                      0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                               0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                  0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                        00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                      0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                    0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                     0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                  00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                     0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                          0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                         0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                  0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                               0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                     0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                  0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                   0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                      0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                               0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                  0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                       00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                  0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                  0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                         00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                    00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                 00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                       0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                    0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                       00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                        00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                 00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                   00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                 00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                             00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                              00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                   0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                   0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                    0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                               0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\system32\svchost.exe[1068] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                       0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                             0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                      00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                      0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                           0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                 0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                      0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                               0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                  0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                        00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                      0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                    0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                     0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                  00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                     0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                          0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                         0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                  0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                               0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                     0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                  0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                   0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                      0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                               0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                  0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                       00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                  0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                  0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                         00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                    00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                 00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                       0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                    0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                       00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                        00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                 00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                   00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                 00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                             00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                              00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                   0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                   0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                    0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                               0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\system32\svchost.exe[1100] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                       0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                             0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                      00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                      0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                           0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                 0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                      0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                               0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                  0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                        00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                      0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                    0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                     0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                  00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                     0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                          0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                         0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                  0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                               0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                     0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                  0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                   0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                      0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                               0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                  0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                       00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                  0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                  0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                         00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                    00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                 00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                       0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                    0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                       00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                        00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                 00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                   00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                 00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                             00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                              00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                   0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                   0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                    0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                               0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\system32\AUDIODG.EXE[1160] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                       0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                             0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                      00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                      0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                           0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                 0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                      0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                               0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                  0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                        00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                      0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                    0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                     0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                  00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                     0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                          0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                         0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                  0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                               0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                     0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                  0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                   0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                      0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                               0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                  0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                       00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                  0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                  0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                         00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                    00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                 00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                       0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                    0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                       00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                        00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                 00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                   00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                 00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                             00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                              00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                   0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                   0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                    0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                               0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\system32\svchost.exe[1300] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                       0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                    0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                             00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                             0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                  0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                        0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                             0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                      0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                         0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                               00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                             0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                           0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                            0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                         00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                            0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                 0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                         0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                      0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                            0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                         0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                          0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                             0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                      0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                         0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                              00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                         0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                         0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                           00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                        00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                              0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                           0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                              00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                               00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                        00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                       00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                          00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                        00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                    00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                     00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                          0000000077932a20 5 bytes JMP 0000000077a90200


Alt 12.01.2015, 10:50   #6
der_phil
 
Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung - Standard

Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung


Code:
ATTFilter
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                          0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                           0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                      0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1416] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                              0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                              0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                       00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                       0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                            0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                  0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                       0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                   0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                         00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                       0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                     0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                      0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                   00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                      0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                           0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                          0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                   0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                      0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                   0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                    0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                       0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                   0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                        00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                   0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                   0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                          00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                     00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                  00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                        0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                     0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                        00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                         00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                  00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                 00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                    00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                  00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                              00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                               00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                    0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                    0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                     0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\system32\nvvsvc.exe[1428] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                        0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                             0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                      00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                      0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                           0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                 0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                      0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                               0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                  0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                        00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                      0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                    0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                     0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                  00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                     0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                          0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                         0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                  0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                               0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                     0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                  0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                   0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                      0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                               0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                  0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                       00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                  0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                  0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                         00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                    00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                 00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                       0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                    0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                       00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                        00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                 00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                   00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                 00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                             00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                              00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                   0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                   0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                    0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                               0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\System32\spoolsv.exe[1848] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                       0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                             0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                      00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                      0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                           0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                 0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                      0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                               0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                  0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                        00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                      0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                    0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                     0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                  00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                     0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                          0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                         0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                  0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                               0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                     0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                  0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                   0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                      0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                               0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                  0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                       00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                  0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                  0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                         00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                    00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                 00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                       0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                    0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                       00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                        00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                 00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                   00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                 00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                             00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                              00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                   0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                   0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                    0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                               0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\system32\taskeng.exe[1860] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                       0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                             0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                      00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                      0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                           0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                 0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                      0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                               0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                  0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                        00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                      0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                    0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                     0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                  00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                     0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                          0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                         0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                  0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                               0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                     0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                  0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                   0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                      0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                               0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                  0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                       00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                  0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                  0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                         00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                    00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                 00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                       0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                    0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                       00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                        00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                 00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                   00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                 00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                             00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                              00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                   0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                   0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                    0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                               0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\system32\svchost.exe[1896] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                       0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Program Files\AVAST Software\Avast\afwServ.exe[1956] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                                   0000000076388791 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                             0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                      00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                      0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                           0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                 0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                      0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                               0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                  0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                        00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                      0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                    0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                     0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                  00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                     0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                          0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                         0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                  0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                               0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                     0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                  0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                   0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                      0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                               0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                  0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                       00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                  0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                  0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                         00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                    00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                 00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                       0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                    0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                       00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                        00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                 00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                   00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                 00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                             00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                              00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                   0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                   0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                    0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                               0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\system32\taskeng.exe[1944] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                       0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                 0000000077931360 5 bytes JMP 0000000100070460
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                          00000000779313b0 5 bytes JMP 0000000100070450
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                          0000000077931510 5 bytes JMP 0000000100070370
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                               0000000077931560 5 bytes JMP 0000000100070470
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                     0000000077931570 5 bytes JMP 00000001000703e0
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                          0000000077931620 5 bytes JMP 0000000100070320
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                   0000000077931650 5 bytes JMP 00000001000703b0
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                      0000000077931670 5 bytes JMP 0000000100070390
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                            00000000779316b0 5 bytes JMP 00000001000702e0
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                          0000000077931730 5 bytes JMP 00000001000702d0
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                        0000000077931750 5 bytes JMP 0000000100070310
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                         0000000077931790 5 bytes JMP 00000001000703c0
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                      00000000779317e0 5 bytes JMP 00000001000703f0
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                         0000000077931940 5 bytes JMP 0000000100070230
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                              0000000077931b00 5 bytes JMP 0000000100070480
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                             0000000077931b30 5 bytes JMP 00000001000703a0
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                      0000000077931c10 5 bytes JMP 00000001000702f0
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                   0000000077931c20 5 bytes JMP 0000000100070350
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                         0000000077931c80 5 bytes JMP 0000000100070290
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                      0000000077931d10 5 bytes JMP 00000001000702b0
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                       0000000077931d30 5 bytes JMP 00000001000703d0
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                          0000000077931d40 5 bytes JMP 0000000100070330
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                   0000000077931db0 5 bytes JMP 0000000100070410
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                      0000000077931de0 5 bytes JMP 0000000100070240
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                           00000000779320a0 5 bytes JMP 00000001000701e0
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                      0000000077932160 5 bytes JMP 0000000100070250
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                      0000000077932190 5 bytes JMP 0000000100070490
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                             00000000779321a0 5 bytes JMP 00000001000704a0
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                        00000000779321d0 5 bytes JMP 0000000100070300
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                     00000000779321e0 5 bytes JMP 0000000100070360
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                           0000000077932240 5 bytes JMP 00000001000702a0
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                        0000000077932290 5 bytes JMP 00000001000702c0
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                           00000000779322c0 5 bytes JMP 0000000100070380
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                            00000000779322d0 5 bytes JMP 0000000100070340
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                     00000000779325c0 5 bytes JMP 0000000100070440
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                    00000000779327c0 5 bytes JMP 0000000100070260
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                       00000000779327d0 5 bytes JMP 0000000100070270
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                     00000000779327e0 5 bytes JMP 0000000100070400
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                 00000000779329a0 5 bytes JMP 00000001000701f0
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                  00000000779329b0 5 bytes JMP 0000000100070210
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                       0000000077932a20 5 bytes JMP 0000000100070200
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                       0000000077932a80 5 bytes JMP 0000000100070420
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                        0000000077932a90 5 bytes JMP 0000000100070430
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                   0000000077932aa0 5 bytes JMP 0000000100070220
.text  C:\Windows\system32\Dwm.exe[1468] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                           0000000077932b80 5 bytes JMP 0000000100070280
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                                     0000000077931360 5 bytes JMP 0000000100070460
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                              00000000779313b0 5 bytes JMP 0000000100070450
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                              0000000077931510 5 bytes JMP 0000000100070370
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                                   0000000077931560 5 bytes JMP 0000000100070470
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                         0000000077931570 5 bytes JMP 00000001000703e0
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                              0000000077931620 5 bytes JMP 0000000100070320
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                       0000000077931650 5 bytes JMP 00000001000703b0
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                          0000000077931670 5 bytes JMP 0000000100070390
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                                00000000779316b0 5 bytes JMP 00000001000702e0
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                              0000000077931730 5 bytes JMP 00000001000702d0
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                            0000000077931750 5 bytes JMP 0000000100070310
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                             0000000077931790 5 bytes JMP 00000001000703c0
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                          00000000779317e0 5 bytes JMP 00000001000703f0
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                             0000000077931940 5 bytes JMP 0000000100070230
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                                  0000000077931b00 5 bytes JMP 0000000100070480
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                                 0000000077931b30 5 bytes JMP 00000001000703a0
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                          0000000077931c10 5 bytes JMP 00000001000702f0
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                                       0000000077931c20 5 bytes JMP 0000000100070350
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                             0000000077931c80 5 bytes JMP 0000000100070290
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                          0000000077931d10 5 bytes JMP 00000001000702b0
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                           0000000077931d30 5 bytes JMP 00000001000703d0
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                              0000000077931d40 5 bytes JMP 0000000100070330
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                                       0000000077931db0 5 bytes JMP 0000000100070410
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                          0000000077931de0 5 bytes JMP 0000000100070240
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                               00000000779320a0 5 bytes JMP 00000001000701e0
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                          0000000077932160 5 bytes JMP 0000000100070250
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                          0000000077932190 5 bytes JMP 0000000100070490
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                                 00000000779321a0 5 bytes JMP 00000001000704a0
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                            00000000779321d0 5 bytes JMP 0000000100070300
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                         00000000779321e0 5 bytes JMP 0000000100070360
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                               0000000077932240 5 bytes JMP 00000001000702a0
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                            0000000077932290 5 bytes JMP 00000001000702c0
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                               00000000779322c0 5 bytes JMP 0000000100070380
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                                00000000779322d0 5 bytes JMP 0000000100070340
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                         00000000779325c0 5 bytes JMP 0000000100070440
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                        00000000779327c0 5 bytes JMP 0000000100070260
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                           00000000779327d0 5 bytes JMP 0000000100070270
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                         00000000779327e0 5 bytes JMP 0000000100070400
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                                     00000000779329a0 5 bytes JMP 00000001000701f0
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                                      00000000779329b0 5 bytes JMP 0000000100070210
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                           0000000077932a20 5 bytes JMP 0000000100070200
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                           0000000077932a80 5 bytes JMP 0000000100070420
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                            0000000077932a90 5 bytes JMP 0000000100070430
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                                       0000000077932aa0 5 bytes JMP 0000000100070220
.text  C:\Windows\Explorer.EXE[2036] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                               0000000077932b80 5 bytes JMP 0000000100070280
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                             0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                      00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                      0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                           0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                 0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                      0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                               0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                  0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                        00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                      0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                    0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                     0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                  00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                     0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                          0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                         0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                  0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                               0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                     0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                  0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                   0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                      0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                               0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                  0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                       00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                  0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                  0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                         00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                    00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                 00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                       0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                    0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                       00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                        00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                 00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                   00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                 00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                             00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                              00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                   0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                   0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                    0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                               0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\system32\taskeng.exe[2140] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                       0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                               0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                        00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                        0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                             0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                   0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                        0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                 0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                    0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                          00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                        0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                      0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                       0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                    00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                       0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                            0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                           0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                    0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                 0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                       0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                    0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                     0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                        0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                 0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                    0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                         00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                    0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                    0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                           00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                      00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                   00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                         0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                      0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                         00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                          00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                   00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                  00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                     00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                   00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                               00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                     0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                     0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                      0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                 0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                         0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                             0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                      00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                      0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                           0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                 0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                      0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                               0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                  0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                        00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                      0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                    0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                     0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                  00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                     0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                          0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                         0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                  0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                               0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                     0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                  0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                   0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                      0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                               0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                  0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                       00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                  0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                  0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                         00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                    00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                 00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                       0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                    0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                       00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                        00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                 00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                   00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                 00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                             00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                              00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                   0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                   0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                    0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                               0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                       0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                               0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                        00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                        0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                             0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                   0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                        0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                 0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                    0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                          00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                        0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                      0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                       0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                    00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                       0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                            0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                           0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                    0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                 0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                       0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                    0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                     0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                        0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                 0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                    0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                         00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                    0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                    0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                           00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                      00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                   00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                         0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                      0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                         00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                          00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                   00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                  00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                     00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                   00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                               00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                     0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                     0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                      0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                 0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[900] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                         0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                      0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                               00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                               0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                    0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                          0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                               0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                        0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                           0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                 00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                               0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                             0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                              0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                           00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                              0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                   0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                  0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                           0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                        0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                              0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                           0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                            0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                               0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                        0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                           0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                           0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                           0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                  00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                             00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                          00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                             0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                 00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                          00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                         00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                            00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                          00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                      00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                       00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                            0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                            0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                             0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                        0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe[3132] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Program Files\AVAST Software\Avast\avastui.exe[3244] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                                   0000000076388791 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                     0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                              00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                              0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                   0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                         0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                              0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                       0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                          0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                              0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                            0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                             0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                          00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                             0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                  0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                 0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                          0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                       0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                             0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                          0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                           0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                              0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                       0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                          0000000077931de0 5 bytes JMP 0000000077a90240

Alt 12.01.2015, 10:55   #7
der_phil
 
Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung - Standard

Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung


Code:
ATTFilter
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                               00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                          0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                          0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                 00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                            00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                         00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                               0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                            0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                               00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                         00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                        00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                           00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                         00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                     00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                      00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                           0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                           0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                            0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                       0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[3816] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                               0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                          0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                   00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                   0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                        0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                              0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                   0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                            0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                               0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                     00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                   0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                 0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                  0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                               00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                  0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                       0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                      0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                               0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                            0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                  0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                               0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                   0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                            0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                               0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                    00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                               0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                               0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                      00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                 00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                              00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                    0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                 0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                    00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                     00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                              00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                             00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                              00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                          00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                           00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                 0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                            0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe[3984] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                    0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                             0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                      00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                      0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                           0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                 0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                      0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                               0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                  0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                        00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                      0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                    0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                     0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                  00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                     0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                          0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                         0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                  0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                               0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                     0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                  0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                   0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                      0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                               0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                  0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                       00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                  0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                  0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                         00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                    00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                 00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                       0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                    0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                       00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                        00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                 00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                   00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                 00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                             00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                              00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                   0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                   0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                    0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                               0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\system32\svchost.exe[4184] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                       0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                             0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                      00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                      0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                           0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                 0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                      0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                               0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                  0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                        00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                      0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                    0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                     0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                  00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                     0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                          0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                         0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                  0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                               0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                     0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                  0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                   0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                      0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                               0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                  0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                       00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                  0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                  0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                         00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                    00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                 00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                       0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                    0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                       00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                        00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                 00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                   00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                 00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                             00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                              00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                   0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                   0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                    0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                               0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\system32\svchost.exe[4212] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                       0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                     0000000077931360 5 bytes JMP 0000000100070460
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                              00000000779313b0 5 bytes JMP 0000000100070450
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                              0000000077931510 5 bytes JMP 0000000100070370
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                   0000000077931560 5 bytes JMP 0000000100070470
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                         0000000077931570 5 bytes JMP 00000001000703e0
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                              0000000077931620 5 bytes JMP 0000000100070320
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                       0000000077931650 5 bytes JMP 00000001000703b0
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                          0000000077931670 5 bytes JMP 0000000100070390
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                00000000779316b0 5 bytes JMP 00000001000702e0
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                              0000000077931730 5 bytes JMP 00000001000702d0
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                            0000000077931750 5 bytes JMP 0000000100070310
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                             0000000077931790 5 bytes JMP 00000001000703c0
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                          00000000779317e0 5 bytes JMP 00000001000703f0
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                             0000000077931940 5 bytes JMP 0000000100070230
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                  0000000077931b00 5 bytes JMP 0000000100070480
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                 0000000077931b30 5 bytes JMP 00000001000703a0
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                          0000000077931c10 5 bytes JMP 00000001000702f0
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                       0000000077931c20 5 bytes JMP 0000000100070350
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                             0000000077931c80 5 bytes JMP 0000000100070290
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                          0000000077931d10 5 bytes JMP 00000001000702b0
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                           0000000077931d30 5 bytes JMP 00000001000703d0
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                              0000000077931d40 5 bytes JMP 0000000100070330
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                       0000000077931db0 5 bytes JMP 0000000100070410
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                          0000000077931de0 5 bytes JMP 0000000100070240
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                               00000000779320a0 5 bytes JMP 00000001000701e0
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                          0000000077932160 5 bytes JMP 0000000100070250
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                          0000000077932190 5 bytes JMP 0000000100070490
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                 00000000779321a0 5 bytes JMP 00000001000704a0
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                            00000000779321d0 5 bytes JMP 0000000100070300
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                         00000000779321e0 5 bytes JMP 0000000100070360
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                               0000000077932240 5 bytes JMP 00000001000702a0
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                            0000000077932290 5 bytes JMP 00000001000702c0
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                               00000000779322c0 5 bytes JMP 0000000100070380
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                00000000779322d0 5 bytes JMP 0000000100070340
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                         00000000779325c0 5 bytes JMP 0000000100070440
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                        00000000779327c0 5 bytes JMP 0000000100070260
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                           00000000779327d0 5 bytes JMP 0000000100070270
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                         00000000779327e0 5 bytes JMP 0000000100070400
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                     00000000779329a0 5 bytes JMP 00000001000701f0
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                      00000000779329b0 5 bytes JMP 0000000100070210
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                           0000000077932a20 5 bytes JMP 0000000100070200
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                           0000000077932a80 5 bytes JMP 0000000100070420
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                            0000000077932a90 5 bytes JMP 0000000100070430
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                       0000000077932aa0 5 bytes JMP 0000000100070220
.text  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[4348] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                               0000000077932b80 5 bytes JMP 0000000100070280
.text  C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4544] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                             0000000077531465 2 bytes [53, 77]
.text  C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[4544] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                            00000000775314bb 2 bytes [53, 77]
.text  ...                                                                                                                                                    * 2
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[4784] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000077531465 2 bytes [53, 77]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[4784] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000775314bb 2 bytes [53, 77]
.text  ...                                                                                                                                                    * 2
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                       0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                     0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                           0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                         0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                            0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                  00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                              0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                               0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                            00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                               0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                    0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                   0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                            0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                         0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                               0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                            0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                             0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                         0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                            0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                 00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                            0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                            0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                   00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                              00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                           00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                 0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                              0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                 00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                  00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                           00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                          00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                             00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                           00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                       00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                        00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                             0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                             0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                              0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                         0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\system32\SearchIndexer.exe[1500] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                 0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                             0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                      00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                      0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                           0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                 0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                      0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                               0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                  0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                        00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                      0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                    0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                     0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                  00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                     0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                          0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                         0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                  0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                               0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                     0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                  0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                   0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                      0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                               0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                  0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                       00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                  0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                  0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                         00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                    00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                 00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                       0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                    0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                       00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                        00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                 00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                   00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                 00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                             00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                              00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                   0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                   0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                    0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                               0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[5084] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                       0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                             0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                      00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                      0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                           0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                 0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                      0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                               0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                  0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                        00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                      0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                    0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                     0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                  00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                     0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                          0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                         0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                  0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                               0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                     0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                  0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                   0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                      0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                               0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                  0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                       00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                  0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                  0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                         00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                    00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                 00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                       0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                    0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                       00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                        00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                 00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                   00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                 00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                             00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                              00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                   0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                   0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                    0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                               0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\SYSTEM32\WISPTIS.EXE[1856] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                       0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                               0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                        00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                        0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                             0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                   0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                        0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                 0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                    0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                          00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                        0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                      0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                       0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                    00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                       0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                            0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                           0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                    0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                 0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                       0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                    0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                     0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                        0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                 0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                    0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                         00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                    0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                    0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                           00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                      00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                   00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                         0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                      0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                         00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                          00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                   00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                  00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                     00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                   00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                               00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                     0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                     0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                      0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                 0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[2064] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                         0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                      0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                               00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                               0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                    0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                          0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                               0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                        0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                           0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                 00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                               0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                             0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                              0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                           00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                              0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                   0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                  0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                           0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                        0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                              0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                           0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                            0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                               0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                        0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                           0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                           0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                           0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                  00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                             00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                          00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                             0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                 00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                          00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                         00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                            00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                          00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                      00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                       00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                            0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                            0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                             0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                        0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe[5324] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                               0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                        00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                        0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                             0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                   0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                        0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                 0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                    0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                          00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                        0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                      0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                       0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                    00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                       0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                            0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                           0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                    0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                 0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                       0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                    0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                     0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                        0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                 0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                    0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                         00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                    0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                    0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                           00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                      00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                   00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                         0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                      0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                         00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                          00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                   00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                  00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                     00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                   00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                               00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                     0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                     0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                      0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                 0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe[5556] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                         0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                                             0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                                      00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                                      0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                                           0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                 0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                                      0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                               0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                                  0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                                        00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                                      0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                                    0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                                     0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                  00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                                     0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                                          0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                                         0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                                  0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                                               0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                                     0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                                  0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                   0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                                      0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                                               0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                                  0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                                       00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                                  0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                                  0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                                         00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                                    00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                                 00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                                       0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                                    0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                                       00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                                        00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                                 00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                                                00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                                   00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                 00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                                             00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                                              00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                                   0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                                   0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                                    0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                                               0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Windows\system32\svchost.exe[6112] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                                       0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Windows\SysWOW64\RunDll32.exe[6128] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                         0000000077531465 2 bytes [53, 77]
.text  C:\Windows\SysWOW64\RunDll32.exe[6128] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                        00000000775314bb 2 bytes [53, 77]
.text  ...                                                                                                                                                    * 2
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                            0000000077931360 5 bytes JMP 0000000077a90460
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                     00000000779313b0 5 bytes JMP 0000000077a90450
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                     0000000077931510 5 bytes JMP 0000000077a90370
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                          0000000077931560 5 bytes JMP 0000000077a90470
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                0000000077931570 5 bytes JMP 0000000077a903e0
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                     0000000077931620 5 bytes JMP 0000000077a90320
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                              0000000077931650 5 bytes JMP 0000000077a903b0
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                                 0000000077931670 5 bytes JMP 0000000077a90390
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                       00000000779316b0 5 bytes JMP 0000000077a902e0
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                     0000000077931730 5 bytes JMP 0000000077a902d0
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                                   0000000077931750 5 bytes JMP 0000000077a90310
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                                    0000000077931790 5 bytes JMP 0000000077a903c0
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                 00000000779317e0 5 bytes JMP 0000000077a903f0
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                                    0000000077931940 5 bytes JMP 0000000077a90230
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                         0000000077931b00 5 bytes JMP 0000000077a90480
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                        0000000077931b30 5 bytes JMP 0000000077a903a0
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                                 0000000077931c10 5 bytes JMP 0000000077a902f0
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                              0000000077931c20 5 bytes JMP 0000000077a90350
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                                    0000000077931c80 5 bytes JMP 0000000077a90290
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                                 0000000077931d10 5 bytes JMP 0000000077a902b0
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                  0000000077931d30 5 bytes JMP 0000000077a903d0
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                     0000000077931d40 5 bytes JMP 0000000077a90330
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                              0000000077931db0 5 bytes JMP 0000000077a90410
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                                 0000000077931de0 5 bytes JMP 0000000077a90240
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                      00000000779320a0 5 bytes JMP 0000000077a901e0
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                                 0000000077932160 5 bytes JMP 0000000077a90250
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                                 0000000077932190 5 bytes JMP 0000000077a90490
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                        00000000779321a0 5 bytes JMP 0000000077a904a0
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                                   00000000779321d0 5 bytes JMP 0000000077a90300
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                                00000000779321e0 5 bytes JMP 0000000077a90360
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                      0000000077932240 5 bytes JMP 0000000077a902a0
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                                   0000000077932290 5 bytes JMP 0000000077a902c0
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                      00000000779322c0 5 bytes JMP 0000000077a90380
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                       00000000779322d0 5 bytes JMP 0000000077a90340
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                                00000000779325c0 5 bytes JMP 0000000077a90440
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                               00000000779327c0 5 bytes JMP 0000000077a90260
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                                  00000000779327d0 5 bytes JMP 0000000077a90270
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                00000000779327e0 5 bytes JMP 0000000077a90400
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                            00000000779329a0 5 bytes JMP 0000000077a901f0
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                             00000000779329b0 5 bytes JMP 0000000077a90210
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                                  0000000077932a20 5 bytes JMP 0000000077a90200
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                                  0000000077932a80 5 bytes JMP 0000000077a90420
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                                   0000000077932a90 5 bytes JMP 0000000077a90430
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                              0000000077932aa0 5 bytes JMP 0000000077a90220
.text  C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe[6760] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                      0000000077932b80 5 bytes JMP 0000000077a90280
.text  C:\Users\Rolf Schauberger\Downloads\Gmer-19357.exe[7024] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                       0000000077531465 2 bytes [53, 77]
.text  C:\Users\Rolf Schauberger\Downloads\Gmer-19357.exe[7024] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                      00000000775314bb 2 bytes [53, 77]
.text  ...                                                                                                                                                    * 2

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\90004ea92a34                                                                            
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\90004ea92a34 (not active ControlSet)                                                        

---- EOF - GMER 2.1 ----
So das müssten alle gewesen sein. Vielen Dank für deine fixe Antwort mit so schneller Hilfe hätten wir gar nicht gerechnet

Gruß

der_Phil

Alt 12.01.2015, 11:24   #8
schrauber
/// the machine
/// TB-Ausbilder
 
Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung - Standard

Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung


Lade Dir bitte von hier Revo Uninstaller Download Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
  • Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
  • Klicke auf Optionen und wähle als Sprache Deutsch.
  • Suche im Uninstallerfeld nach den Programmen:

    Internet Updater

    Lollipop

    Updater

    WiseConvert


  • Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
  • Wähle anschließend den Modus "Moderat" aus.
  • Reste löschen:
    Klicke auf dann auf und dann auf .

 





Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 12.01.2015, 20:29   #9
der_phil
 
Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung - Standard

Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung


Ich habe es so wie beschrieben ausgeführt.Davor jedoch fuhr der Rechner nicht mehr hoch und es startete die Windows Systemstartreperatur hing sich immer auf und nach 30 mins hatte sich noch nichts getan. Musste den Scan im abgesicherten Modus machen hoffe das ist OK.

Code:
ATTFilter
ComboFix 15-01-08.01 - Rolf Schauberger 12.01.2015  20:20:06.1.4 - x64 NETWORK
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4077.3225 [GMT 1:00]
ausgeführt von:: c:\users\Rolf Schauberger\Downloads\ComboFix.exe
AV: avast! Antivirus *Enabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
FW: avast! Antivirus *Enabled* {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}
SP: avast! Antivirus *Enabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Rolf Schauberger\AppData\Local\assembly\tmp
c:\users\Rolf Schauberger\AppData\Roaming\Microsoft\Windows\Recent\E-Mail.website
c:\windows\msdownld.tmp
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-12-12 bis 2015-01-12  ))))))))))))))))))))))))))))))
.
.
2015-01-12 19:10 . 2015-01-12 19:10	--------	d-----w-	c:\program files (x86)\VS Revo Group
2015-01-11 22:02 . 2014-12-15 03:13	11870360	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{65FF6B4E-C0EB-41AC-A2F3-529BB06DC716}\mpengine.dll
2015-01-11 18:42 . 2015-01-11 18:42	--------	d-----w-	c:\program files\WinRAR
2015-01-11 17:59 . 2015-01-11 18:01	--------	d-----w-	C:\FRST
2015-01-11 17:44 . 2014-11-16 11:29	364512	----a-w-	c:\windows\system32\aswBoot.exe
2015-01-11 17:21 . 2015-01-11 17:21	--------	d-----w-	c:\users\Rolf Schauberger\AppData\Local\ElevatedDiagnostics
2014-12-22 10:23 . 2014-12-13 05:09	144384	----a-w-	c:\windows\system32\ieUnatt.exe
2014-12-22 10:23 . 2014-12-13 03:33	115712	----a-w-	c:\windows\SysWow64\ieUnatt.exe
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-01-06 03:36 . 2013-05-24 13:21	298120	------w-	c:\windows\system32\MpSigStub.exe
2014-12-11 14:53 . 2014-08-03 10:06	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-12-11 14:53 . 2014-08-03 10:06	701104	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-12-10 18:02 . 2013-05-24 08:15	112710672	----a-w-	c:\windows\system32\MRT.exe
2014-12-04 02:50 . 2014-12-10 17:45	413184	----a-w-	c:\windows\system32\generaltel.dll
2014-12-04 02:50 . 2014-12-10 17:45	741376	----a-w-	c:\windows\system32\invagent.dll
2014-12-04 02:50 . 2014-12-10 17:45	396800	----a-w-	c:\windows\system32\devinv.dll
2014-12-04 02:50 . 2014-12-10 17:45	830976	----a-w-	c:\windows\system32\appraiser.dll
2014-12-04 02:50 . 2014-12-10 17:45	192000	----a-w-	c:\windows\system32\aepic.dll
2014-12-04 02:50 . 2014-12-10 17:45	227328	----a-w-	c:\windows\system32\aepdu.dll
2014-12-04 02:44 . 2014-12-10 17:45	1083392	----a-w-	c:\windows\system32\aeinv.dll
2014-12-01 23:28 . 2014-12-10 17:45	1232040	----a-w-	c:\windows\system32\aitstatic.exe
2014-11-27 01:43 . 2014-12-10 17:45	389296	----a-w-	c:\windows\system32\iedkcs32.dll
2014-11-22 11:11 . 2013-05-24 13:00	1050432	----a-w-	c:\windows\system32\drivers\aswsnx.sys
2014-11-22 03:13 . 2014-12-10 17:45	25059840	----a-w-	c:\windows\system32\mshtml.dll
2014-11-22 03:06 . 2014-12-10 17:45	2724864	----a-w-	c:\windows\system32\mshtml.tlb
2014-11-22 03:06 . 2014-12-10 17:45	4096	----a-w-	c:\windows\system32\ieetwcollectorres.dll
2014-11-22 02:50 . 2014-12-10 17:45	66560	----a-w-	c:\windows\system32\iesetup.dll
2014-11-22 02:50 . 2014-12-10 17:45	580096	----a-w-	c:\windows\system32\vbscript.dll
2014-11-22 02:49 . 2014-12-10 17:45	48640	----a-w-	c:\windows\system32\ieetwproxystub.dll
2014-11-22 02:49 . 2014-12-10 17:45	2885120	----a-w-	c:\windows\system32\iertutil.dll
2014-11-22 02:48 . 2014-12-10 17:45	88064	----a-w-	c:\windows\system32\MshtmlDac.dll
2014-11-22 02:41 . 2014-12-10 17:45	54784	----a-w-	c:\windows\system32\jsproxy.dll
2014-11-22 02:40 . 2014-12-10 17:45	34304	----a-w-	c:\windows\system32\iernonce.dll
2014-11-22 02:37 . 2014-12-10 17:45	633856	----a-w-	c:\windows\system32\ieui.dll
2014-11-22 02:35 . 2014-12-10 17:45	114688	----a-w-	c:\windows\system32\ieetwcollector.exe
2014-11-22 02:34 . 2014-12-10 17:45	814080	----a-w-	c:\windows\system32\jscript9diag.dll
2014-11-22 02:34 . 2014-12-10 17:45	6039552	----a-w-	c:\windows\system32\jscript9.dll
2014-11-22 02:26 . 2014-12-10 17:45	968704	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2014-11-22 02:22 . 2014-12-10 17:45	490496	----a-w-	c:\windows\system32\dxtmsft.dll
2014-11-22 02:20 . 2014-12-10 17:45	2724864	----a-w-	c:\windows\SysWow64\mshtml.tlb
2014-11-22 02:14 . 2014-12-10 17:45	77824	----a-w-	c:\windows\system32\JavaScriptCollectionAgent.dll
2014-11-22 02:09 . 2014-12-10 17:45	199680	----a-w-	c:\windows\system32\msrating.dll
2014-11-22 02:08 . 2014-12-10 17:45	92160	----a-w-	c:\windows\system32\mshtmled.dll
2014-11-22 02:07 . 2014-12-10 17:45	501248	----a-w-	c:\windows\SysWow64\vbscript.dll
2014-11-22 02:07 . 2014-12-10 17:45	62464	----a-w-	c:\windows\SysWow64\iesetup.dll
2014-11-22 02:06 . 2014-12-10 17:45	47616	----a-w-	c:\windows\SysWow64\ieetwproxystub.dll
2014-11-22 02:05 . 2014-12-10 17:45	64000	----a-w-	c:\windows\SysWow64\MshtmlDac.dll
2014-11-22 02:05 . 2014-12-10 17:45	316928	----a-w-	c:\windows\system32\dxtrans.dll
2014-11-22 01:54 . 2014-12-10 17:45	620032	----a-w-	c:\windows\SysWow64\jscript9diag.dll
2014-11-22 01:49 . 2014-12-10 17:45	718848	----a-w-	c:\windows\system32\ie4uinit.exe
2014-11-22 01:49 . 2014-12-10 17:45	800768	----a-w-	c:\windows\system32\msfeeds.dll
2014-11-22 01:47 . 2014-12-10 17:45	1359360	----a-w-	c:\windows\system32\mshtmlmedia.dll
2014-11-22 01:46 . 2014-12-10 17:45	2125312	----a-w-	c:\windows\system32\inetcpl.cpl
2014-11-22 01:43 . 2014-12-10 17:45	14412800	----a-w-	c:\windows\system32\ieframe.dll
2014-11-22 01:40 . 2014-12-10 17:45	60416	----a-w-	c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2014-11-22 01:29 . 2014-12-10 17:45	4299264	----a-w-	c:\windows\SysWow64\jscript9.dll
2014-11-22 01:28 . 2014-12-10 17:45	2358272	----a-w-	c:\windows\system32\wininet.dll
2014-11-22 01:22 . 2014-12-10 17:45	2052096	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2014-11-22 01:21 . 2014-12-10 17:45	1155072	----a-w-	c:\windows\SysWow64\mshtmlmedia.dll
2014-11-22 01:15 . 2014-12-10 17:45	1548288	----a-w-	c:\windows\system32\urlmon.dll
2014-11-22 01:03 . 2014-12-10 17:45	800768	----a-w-	c:\windows\system32\ieapfltr.dll
2014-11-22 01:00 . 2014-12-10 17:45	1888256	----a-w-	c:\windows\SysWow64\wininet.dll
2014-11-16 11:29 . 2014-04-21 15:08	29208	----a-w-	c:\windows\system32\drivers\aswHwid.sys
2014-11-16 11:29 . 2014-01-07 11:20	116728	----a-w-	c:\windows\system32\drivers\aswstm.sys
2014-11-16 11:29 . 2013-05-24 13:00	436624	----a-w-	c:\windows\system32\drivers\aswsp.sys
2014-11-16 11:29 . 2013-05-24 13:00	93568	----a-w-	c:\windows\system32\drivers\aswRdr2.sys
2014-11-16 11:29 . 2013-05-24 13:00	267632	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2014-11-16 11:29 . 2013-05-24 13:00	65776	----a-w-	c:\windows\system32\drivers\aswRvrt.sys
2014-11-16 11:29 . 2013-05-24 13:00	83280	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2014-11-16 11:29 . 2014-11-16 11:29	43152	----a-w-	c:\windows\avastSS.scr
2014-11-16 11:29 . 2013-05-27 09:47	28184	----a-w-	c:\windows\system32\drivers\aswKbd.sys
2014-11-16 11:29 . 2014-11-16 11:29	449936	----a-w-	c:\windows\system32\drivers\aswNdisFlt.sys
2014-11-11 03:09 . 2014-12-10 17:45	1424384	----a-w-	c:\windows\system32\WindowsCodecs.dll
2014-11-11 03:08 . 2014-11-19 20:11	241152	----a-w-	c:\windows\system32\pku2u.dll
2014-11-11 03:08 . 2014-11-19 20:11	728064	----a-w-	c:\windows\system32\kerberos.dll
2014-11-11 02:44 . 2014-12-10 17:45	1230336	----a-w-	c:\windows\SysWow64\WindowsCodecs.dll
2014-11-11 02:44 . 2014-11-19 20:11	186880	----a-w-	c:\windows\SysWow64\pku2u.dll
2014-11-11 02:44 . 2014-11-19 20:11	550912	----a-w-	c:\windows\SysWow64\kerberos.dll
2014-11-11 01:46 . 2014-12-10 17:45	119296	----a-w-	c:\windows\system32\drivers\tdx.sys
2014-11-08 03:16 . 2014-12-10 17:44	2048	----a-w-	c:\windows\system32\tzres.dll
2014-11-08 02:45 . 2014-12-10 17:44	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2014-10-30 02:03 . 2014-12-10 17:44	165888	----a-w-	c:\windows\system32\charmap.exe
2014-10-30 01:45 . 2014-12-10 17:44	155136	----a-w-	c:\windows\SysWow64\charmap.exe
2014-10-25 01:57 . 2014-11-13 11:16	77824	----a-w-	c:\windows\system32\packager.dll
2014-10-25 01:32 . 2014-11-13 11:16	67584	----a-w-	c:\windows\SysWow64\packager.dll
2014-10-18 02:05 . 2014-11-13 11:16	861696	----a-w-	c:\windows\system32\oleaut32.dll
2014-10-18 02:05 . 2014-12-10 18:01	4121600	----a-w-	c:\windows\system32\mf.dll
2014-10-18 01:33 . 2014-11-13 11:16	571904	----a-w-	c:\windows\SysWow64\oleaut32.dll
2014-10-18 01:33 . 2014-12-10 18:01	3209728	----a-w-	c:\windows\SysWow64\mf.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	131248	----a-w-	c:\users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	131248	----a-w-	c:\users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	131248	----a-w-	c:\users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	131248	----a-w-	c:\users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-11-05 283160]
"PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2010-11-26 648032]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2015-01-12 5227112]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-7-29 1132320]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R0 aswRvrt;avast! Revert; [x]
R0 aswVmm;avast! VM Monitor; [x]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
R2 051cdb72;Optimizer Pro Crash Monitor;c:\windows\system32\rundll32.exe;c:\windows\SYSNATIVE\rundll32.exe [x]
R2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe;c:\program files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [x]
R2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe;c:\program files\AVAST Software\Avast\afwServ.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
R2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [x]
R2 regi;regi;c:\windows\system32\drivers\regi.sys;c:\windows\SYSNATIVE\drivers\regi.sys [x]
R2 SampleCollector;VAIO Care Performance Service;c:\program files\Sony\VAIO Care\VCPerfService.exe;c:\program files\Sony\VAIO Care\VCPerfService.exe [x]
R2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [x]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
R2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe;c:\program files\Sony\VAIO Power Management\SPMService.exe [x]
R2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe;c:\program files\Sony\VAIO Smart Network\VSNService.exe [x]
R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftKsUFilter.sys [x]
R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys;c:\windows\SYSNATIVE\drivers\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 cpuz134;cpuz134;c:\users\ROLFSC~1\AppData\Local\Temp\cpuz134\cpuz134_x64.sys;c:\users\ROLFSC~1\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y60x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1y60x64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]
R3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
R3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
R3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
R3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
R3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
R3 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [x]
R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [x]
R3 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [x]
R3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [x]
R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [x]
R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [x]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [x]
R3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update 5\VUAgent.exe;c:\program files\Sony\VAIO Update 5\VUAgent.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 aswNdisFlt;Avast! Firewall Driver;c:\windows\system32\DRIVERS\aswNdisFlt.sys;c:\windows\SYSNATIVE\DRIVERS\aswNdisFlt.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys;c:\windows\SYSNATIVE\drivers\aswKbd.sys [x]
S2 rimspci;rimspci;c:\windows\system32\DRIVERS\rimssne64.sys;c:\windows\SYSNATIVE\DRIVERS\rimssne64.sys [x]
S2 risdsnpe;risdsnpe;c:\windows\system32\DRIVERS\risdsnxc64.sys;c:\windows\SYSNATIVE\DRIVERS\risdsnxc64.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 NWLowRider;NextWindow LowRider Touch Screen;c:\windows\system32\DRIVERS\NWLowRider.sys;c:\windows\SYSNATIVE\DRIVERS\NWLowRider.sys [x]
S3 NWWakeFilterLR;NextWindow Remote Wake Blocker;c:\windows\system32\DRIVERS\NWWakeFilterLR.sys;c:\windows\SYSNATIVE\DRIVERS\NWWakeFilterLR.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys;c:\windows\SYSNATIVE\DRIVERS\SFEP.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-05-03 14:24	1078088	----a-w-	c:\program files (x86)\Google\Chrome\Application\34.0.1847.131\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-01-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-08-03 14:53]
.
2015-01-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-24 16:20]
.
2015-01-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-24 16:20]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-11-16 11:29	860984	----a-w-	c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	164016	----a-w-	c:\users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	164016	----a-w-	c:\users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	164016	----a-w-	c:\users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	164016	----a-w-	c:\users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2014-04-25 08:03	777032	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2014-04-25 08:03	777032	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2014-04-25 08:03	777032	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2014-04-25 08:03	777032	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2014-04-25 08:03	777032	----a-w-	c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-26 11613288]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-11-26 2184808]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mDefault_Search_URL = hxxp://www.google.com
mDefault_Page_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = <local>
TCP: DhcpNameServer = 192.168.2.1 192.168.2.1
FF - ProfilePath - c:\users\Rolf Schauberger\AppData\Roaming\Mozilla\Firefox\Profiles\5vg3s90o.default\
FF - ExtSQL: !HIDDEN! 2014-03-07 11:50; quick_start@gmail.com; c:\users\Rolf Schauberger\AppData\Roaming\Mozilla\Firefox\Profiles\5vg3s90o.default\extensions\quick_start@gmail.com
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKU-Default-Run-Updater - c:\programdata\Updater\updater.exe
AddRemove-VAIO screensaver - c:\program files (x86)\VAIO screensavers\VAIOScreensaverGeneric.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\SampleCollector]
"ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=5000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\% C3 Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=inteldata\""
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_246_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_246_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_246_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_246_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_246.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.15"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_246.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_246.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_246.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-01-12  20:27:27
ComboFix-quarantined-files.txt  2015-01-12 19:27
.
Vor Suchlauf: 18 Verzeichnis(se), 900.774.207.488 Bytes frei
Nach Suchlauf: 25 Verzeichnis(se), 900.887.363.584 Bytes frei
.
- - End Of File - - D3D26AF7C42F868C3CF9F829A79ACE7F

Alt 12.01.2015, 20:50   #10
schrauber
/// the machine
/// TB-Ausbilder
 
Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung - Standard

Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung


Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 14.01.2015, 11:48   #11
der_phil
 
Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung - Standard

Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung


Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 14.01.2015
Suchlauf-Zeit: 10:45:00
Logdatei: Malebytes.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.01.14.03
Rootkit Datenbank: v2015.01.07.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Rolf Schauberger

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 353567
Verstrichene Zeit: 9 Min, 19 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 2
PUP.Optional.MultiIE.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\DynConIE, In Quarantäne, [014a0bec5c2d48ee7cb3b92c4abaa858], 
PUP.Optional.FastStart.A, HKU\S-1-5-21-2266135243-3458477776-180843295-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS, In Quarantäne, [e46795629dec0d29a01e621dae5512ee], 

Registrierungswerte: 1
PUP.Optional.FastStart.A, HKU\S-1-5-21-2266135243-3458477776-180843295-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS|appid, faststartff@gmail.com, In Quarantäne, [e46795629dec0d29a01e621dae5512ee]

Registrierungsdaten: 2
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[9caf31c6b9d0a29412d20291fb0a649c]
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[004bb641dfaaba7c34b0751e818411ef]

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 11
PUP.Optional.Vid, C:\Users\Rolf Schauberger\Downloads\iLividSetup-r575-n-bc (1).exe, In Quarantäne, [103b679073161125f1b3c664ae53728e], 
PUP.Optional.Vid, C:\Users\Rolf Schauberger\Downloads\iLividSetup-r575-n-bc (2).exe, In Quarantäne, [ac9f34c3c6c33bfb851f0a207c8550b0], 
PUP.Optional.Vid, C:\Users\Rolf Schauberger\Downloads\iLividSetup-r575-n-bc.exe, In Quarantäne, [58f392654b3ea98d475df139b64bd32d], 
PUP.Optional.BundleInstaller.A, C:\Users\Rolf Schauberger\Downloads\Player.exe, In Quarantäne, [b2998f68ec9d0531d7915edc2cd41ee2], 
PUP.Optional.Conduit.A, C:\Users\Rolf Schauberger\Downloads\Setup_brch.exe, In Quarantäne, [58f3b0475a2fec4a1c4104680df44cb4], 
PUP.Optional.Softonic, C:\Users\Rolf Schauberger\Downloads\SoftonicDownloader_fuer_samsung-kies (1).exe, In Quarantäne, [89c28473addc2d090d9c41e544bda35d], 
PUP.Optional.Softonic, C:\Users\Rolf Schauberger\Downloads\SoftonicDownloader_fuer_samsung-kies.exe, In Quarantäne, [44075b9ca3e6082ee9c04cda12efb34d], 
PUP.Optional.RegCleanerPro, C:\Users\Rolf Schauberger\Downloads\rcpsetup_softonic_soft_util_300_250_pd.exe, In Quarantäne, [024912e5a3e6c076af35f5370001ab55], 
PUP.Optional.WidgetContext.A, C:\Users\Rolf Schauberger\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi, In Quarantäne, [8fbc985f216878beabbb87e5c53ec43c], 
PUP.Optional.MultiExtension.A, C:\Users\Rolf Schauberger\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igjjkeeamkpihpncmmbgdkhdnjpcfmfb_0.localstorage-journal, In Quarantäne, [be8d0aedcbbe36007c5adfbbbf44f60a], 
PUP.Optional.ISearch.A, C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\omiga-plus.xml, In Quarantäne, [a7a42dca7316f04639cbf4e3857f9d63], 

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)
Code:
ATTFilter
# AdwCleaner v4.107 - Bericht erstellt am 14/01/2015 um 11:28:00
# Aktualisiert 07/01/2015 von Xplode
# Database : 2014-12-21.4 [Local]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Rolf Schauberger - ROLFSCHAUBERGER
# Gestartet von : C:\Users\Rolf Schauberger\Downloads\AdwCleaner_4.107.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : 051cdb72

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17496


-\\ Mozilla Firefox v21.0 (de)


-\\ Google Chrome v34.0.1847.131


*************************

AdwCleaner[R0].txt - [20932 octets] - [03/05/2014 16:14:03]
AdwCleaner[R1].txt - [2762 octets] - [03/05/2014 16:16:59]
AdwCleaner[R2].txt - [1229 octets] - [03/05/2014 17:13:13]
AdwCleaner[R3].txt - [10877 octets] - [08/12/2014 21:18:24]
AdwCleaner[R4].txt - [1469 octets] - [14/01/2015 11:24:04]
AdwCleaner[R5].txt - [1529 octets] - [14/01/2015 11:26:50]
AdwCleaner[S0].txt - [19053 octets] - [03/05/2014 16:14:37]
AdwCleaner[S1].txt - [1441 octets] - [03/05/2014 16:22:25]
AdwCleaner[S2].txt - [9493 octets] - [08/12/2014 21:19:50]
AdwCleaner[S3].txt - [1454 octets] - [14/01/2015 11:28:00]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1514 octets] ##########
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 7 Home Premium x64
Ran by Rolf Schauberger on 14.01.2015 at 11:36:32,66
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Program Files (x86)\myfree codec"
Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\reimage repair"



~~~ FireFox

Successfully deleted the following from C:\Users\Rolf Schauberger\AppData\Roaming\mozilla\firefox\profiles\5vg3s90o.default\prefs.js

user_pref("valueApps.autoDisableScopes", -1);
user_pref("valueApps.storage./9B+7E+x305", "247E27413334363379453A3D2A722C797A7E7A3128333B474953462D584D503D263F2D2E3135443B464E4F5B565E695B426D6265523B544243464959505B637D737
user_pref("valueApps.storage./9B+7E,x305", "247E28412F3F3E3779453A3D2A722C797B787D3128333C4748402C574C4F3C253E2C2E2B2F433A454E59505B57676A66426D62455E69543D56444643465B525D667
user_pref("valueApps.storage./9B+7E-x305", "247E29327641363937333545397E3F493B2F77317E202520362D3842474A58515A5C585D505F593964595C49324B393A3F395047525C4173686B6965677B796F6D7
user_pref("valueApps.storage./9B+7E.:2z527", "2423");
user_pref("valueApps.storage./9B+7E.x305", "247E2A4137374434337A463B3E2B732D7A7D7C213229343F564654524C474A595A4851505E51523964595C49324B393C3B3E5047525D6C6A6B6F786D68506A6F717
user_pref("valueApps.storage./9B+7E/x305", "247E2B413536327844393C29712B787C7B773027323E4C4343534E2D585B3C253E2C302E34433A45515862695E675A416C6164513A5341454348584F5A666D7B7C7
user_pref("valueApps.storage./9B+7E06CG5EL8:", "6E6D6869737272736F74");
user_pref("valueApps.storage./9B+7E06CG5EL;8I:K", "247E2D2F226A74736E6F79787879757A242F4B49474F42357D5D5C3D");
user_pref("valueApps.storage./9B+7E0x305", "247E2C403A407743383B28702A777C757D2F26313E41295547484D515A4E5A59325D5255422B443237303749404B585E685E706E6E6674626E696B4D786D705D465
user_pref("valueApps.storage./9B+7E1x305", "247E2D41313D403279453A3D2A722C7A77797E31283341473E454745482F5A4F523F2841302D2F33463D48566265685C6B675F6D70604873686B58415A4946484B5
user_pref("valueApps.storage./9B+7E2x305", "247E2E3542313D3D393A7B473C3F2C742E79207D3229344356554E472E594E51325E4F412A4335373231483F4A59655F5F626C5B717369756975744D786D70517E6
user_pref("valueApps.storage./9B+7E3x305", "247E2F413F3B36333F47463F7D493E412E76307E222421352C37474B59574B4A4858584E5E3762573A535E49324B3A3D3F3B504752626C625D75786D766A7C517C7
user_pref("valueApps.storage./9B+7E4x305", "247E302C407642373A276F29777B74762E2530413E4F494A522B55553A233C2B2F282941384354515E5D56615F56685C426D6265523B544346494A59505B6C697A7
user_pref("valueApps.storage./9B+7E5x305", "247E3136422B7743383B28702A79757A772F2631434B3D49564A50592E594E314A55402942322E332F473E495B5D595A6A5E58707262674974696C59425B4B474B5
user_pref("valueApps.storage./9B+7E6x305", "247E322C3E32323238453E7C483D402D752F7E7B2424342B364953545259585A5A50524E36615659462F4838353D3C4D444F626C6D6B72716A77614D786D705D465
user_pref("valueApps.storage./9B+7E7x305", "247E333D2C3F3E3F79453A3D2A722C7B7A797A31283347513F445559424C5A315C5154412A4333323037483F4A5E68565B5970606E6C666164734C776C6F5C455E4
user_pref("valueApps.storage./9B+7E8x305", "247E343D3F3B35373B3F367C47472C742E7E782332293449565540472E594E513E274030323533453C475C5558636A656E625E6C616B7068734B766B6E5B445D4D4
user_pref("valueApps.storage./9B+7E9x305", "247E35332C3F327844393C29712B7B757979302732484C4F4F44504C4754585C5048345F5457442D46373135344B424D636B5D5F5F73696B4A756A6D5A435C4D474
user_pref("valueApps.storage./9B+7E:x305", "247E36333B38327844393C29712B7B76797A30273249485545442C574C4F3C253E2F2A2D2D433A455C67555B5E3F6A5F624F3851423D403F564D586F7A68786C717
user_pref("valueApps.storage./9B+7E;x305", "247E373F333F3738422F7B473C3F2C742E7E7A7A22332A354D462C574C4F3C253E2F2B2B31433A455D6356575C5C5A416C6164513A5344404045584F5A7273717A7
user_pref("valueApps.storage./9B+7E<x305", "247E38343030442F463644377D493E412E7630217D2426352C37504C4757514B4F47345F5457442D4637343A3A4B424D665E705B646571634A756A6D5A435C4D4A5
user_pref("valueApps.storage./9B+7E=x305", "247E3933363F41413739357C483D402D752F207E2022342B36505459574C554F515B345F5457442D46373637384B424D676B706E606F61666B63664D786D705D465
user_pref("valueApps.storage./9B+7E>x305", "247E3A41363F323238387B473C3F2C742E7E20217C332A35504F5346482F5A4F523F28413233342F463D48635C5D66626A436E6366533C55464748425A515C77707
user_pref("valueApps.storage./9B+7E?x305", "247E3B2D2F2F334134403A3A7D494C2D752F2023207E342B3652504C5249555256525C35605558452E47383B38364C434E6A706F5F65635D736F677578684C65706
user_pref("valueApps.storage./9B+7E@x305", "247E3C40422B7743383B28702A7B767E782F26314E52543D2A554A2D46513C253E302B332C433A45626756516259655F5F436E63465F6A553E5749444C445C535E7
user_pref("valueApps.storage./9B+7EAx305", "247E3D3D37387743383B28702A7B7A757E2F26314F4B524B4445494B49485450585952535F513863585B48314A3C3B363D4F46516F6B6E6D63776D687666507B707
user_pref("valueApps.storage./9B+7EBE3G=;D9N9=D", "372C2D326975762E3A3C7B3A39434A494841434B265146492965504656496571734D334B57");
user_pref("valueApps.storage./9B+7EBx305", "247E3E393141303D33454036327E4A3F422F77317B7D23352C37565949484E4F51525C4E4C55535B54605A5A3E695E614E37503B3D41544B567575656D7367796D6
user_pref("valueApps.storage./9B+7ECx305", "247E3F3D303043312E7A463B3E2B732D7B207E3128335351565551575A4F584C5E335E5356432C4534383649404B6B59566C686B46716669563F58474B485C535E7
user_pref("valueApps.storage./9B+7EDx305", "247E4035422A363879453A3D2A722C7D202F26315247543C484A2C574C2F48533E27403233433A45665B68505C5E406B6E4F38514343544B56776C79616D6F517C7
user_pref("valueApps.storage./9B+7Etx305", "247E6E2F2E3B323342357B44392B732D7A7B7B7C32293423524C5457474A4E50565D4A61515F5D575255643D685D604D364F3D3E3E3D544B5645486A736D696F527
user_pref("valueApps.storage./9B-0?3G>D", "6E6B3E697243726D7A424576462047774E7B257A227B512A20232A5527242C5C275B5B5C");
user_pref("valueApps.storage./9B-0?3G@6:5;", "");
user_pref("valueApps.storage./9B-0?3GFA7EF", "2B2E2C3D");
user_pref("valueApps.storage./9B-3=3ECCJA=F>", "247E333D2C452F4135276F297B7E7D21202F26313E4249357D37382F3A494D5D513F283338435D6554695B65546D57695D5D686365533C70766C66755E");
user_pref("valueApps.storage./9B/>01=9A6K6<IM;KRIE@PDAWM", "6A696B7273747576");
user_pref("valueApps.storage./9B3=>@44I48?", "372C2D3269757633423633414847203E3D474E4D4C45474F2A554A4D2D5858585E4B554E366352564F");
user_pref("valueApps.storage./9B5BA==9CJAG", "6B6D6D403F4371717A73734874474B7B4D20504C4F");
user_pref("valueApps.storage./9B6B11G4C56B>F;P;ANR@P", "6E6D686973727273706F71757B");
user_pref("valueApps.storage./9B90E@.3C;7B=?OFB>>RHIQS", "393F352F3E");
user_pref("valueApps.storage./9B9643G3/9E", "6A");
user_pref("valueApps.storage./9B;45>:BI9I7IE", "2B2E2C3D");
user_pref("valueApps.storage./9B<:222H64<", "393F352F3E");
user_pref("valueApps.storage./9B<:222H64<L8DAJ", "6D70706E7674707977762A7A72727A78757E7D");
user_pref("valueApps.storage./9B=+03EH8H8J?:", "4443");
user_pref("valueApps.storage./9B?+E2A52D8", "372C2D326975762E3A3C7B3A39434A494841434B2651464929655046566470727951555E5E52");
user_pref("valueApps.storage./9B?B0D:8AJ62<H", "6D");
user_pref("valueApps.storage./9BA@0<0BI6A7GN:6@L?", "6C");
user_pref("valueApps.storage.PG_ENABLE", "74727565");
user_pref("valueApps.storage.SF_JUST_INSTALLED", "46414C5345");
user_pref("valueApps.storage.SF_STATUS", "454E41424C4544");
user_pref("valueApps.storage.SF_USER_ID", "6369645F32353230313431313336313831363432343836");
user_pref("valueApps.storage.cbfirsttime", "467269204D617920303220323031342031313A33363A323020474D542B30323030");
user_pref("valueApps.storage.mam_gk_appStateReportTime", "31333939303233333731303432");
user_pref("valueApps.storage.mam_gk_appsConfig", "7B2241707073436F6E66696775726174696F6E223A5B7B226964223A2245617379746F626F6F6B5F7461726765746564222C2275726C223A22687474703A2
user_pref("valueApps.storage.mam_gk_appsDefaultEnabled", "6E756C6C");
user_pref("valueApps.storage.mam_gk_calledSetupService", "31");
user_pref("valueApps.storage.mam_gk_currentVersion", "312E31322E302E35");
user_pref("valueApps.storage.mam_gk_first_time", "31");
user_pref("valueApps.storage.mam_gk_lastLoginTime", "31333939303233333731343536");
user_pref("valueApps.storage.mam_gk_localization", "7B226469616C6F674F4B223A7B2254657874223A224F4B227D2C22646D626F7831223A7B2254657874223A22416E6765626F745C6E64657320546167657
user_pref("valueApps.storage.mam_gk_mamEnabled", "66616C7365");
user_pref("valueApps.storage.mam_gk_settings1.12.0.5", "7B22537461747573223A22737563636565646564222C2244617461223A7B2263757272656E7444617465223A223230313430353032222C22696E746
user_pref("valueApps.storage.mam_gk_showWelcomeGadget", "66616C7365");
user_pref("valueApps.storage.mam_gk_stamp", "313130325F30");
user_pref("valueApps.storage.mam_gk_userId", "36393361396131652D353735372D346334312D623965372D306263643036333765333436");
user_pref("valueApps.storage.mam_gk_user_approval_interacted", "");



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 14.01.2015 at 11:43:18,56
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-01-2015
Ran by Rolf Schauberger at 2015-01-14 11:45:04
Running from C:\Users\Rolf Schauberger\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus (Enabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 6.2.2 - Hewlett-Packard) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.3.9130 - Adobe Systems Inc.)
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.2.1.650 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Premiere Elements 9 (HKLM-x32\...\PremElem90) (Version: 9.0 - Adobe Systems Incorporated)
Adobe Reader 9.4.0 MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.4.0 - Adobe Systems Incorporated)
ArcSoft Magic-i Visual Effects 2 (HKLM-x32\...\{61438020-DDD4-42FA-99A2-50225441980A}) (Version: 2.0.1.134 - ArcSoft)
ArcSoft WebCam Companion 4 (HKLM-x32\...\{C793AD32-2BB8-4CC4-ABD3-A1469C21593C}) (Version: 4.0.21.369 - ArcSoft)
ArcSoft WebCam Message Board (HKLM-x32\...\{DE27B805-6833-4B20-9B62-D3EF2660791A}) (Version: 1.1.1.79 - ArcSoft)
Avast Internet Security (HKLM-x32\...\avast) (Version: 10.0.2208 - AVAST Software)
Bing Maps 3D (HKLM\...\{6ACE7F46-FACE-4125-AE86-672F4F2A6A28}) (Version: 4.0.903.16005 - Microsoft Corporation)
CCleaner (HKLM\...\CCleaner) (Version: 4.11 - Piriform)
Complément Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Content Manager 2 (HKLM-x32\...\Content Manager 2) (Version: 3.18.0.342250 - NNG Llc.)
Control ActiveX de Windows Live Mesh para conexiones remotas (HKLM-x32\...\{04668DF2-D32F-4555-9C7E-35523DCD6544}) (Version: 15.4.5722.2 - Microsoft Corporation)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (HKLM-x32\...\{55D003F4-9599-44BF-BA9E-95D060730DD3}) (Version: 15.4.5722.2 - Microsoft Corporation)
Corel WinDVD (HKLM-x32\...\{5C1F18D2-F6B7-4242-B803-B5A78648185D}) (Version: 10.0.5.756 - Corel Inc.)
CyberLink YouPaint (HKLM-x32\...\InstallShield_{72BF1DA0-2B00-4794-9173-159722019B74}) (Version: 1.2.0.2101 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKU\S-1-5-21-2266135243-3458477776-180843295-1000\...\Dropbox) (Version: 2.6.24 - Dropbox, Inc.)
Elements 9 Organizer (x32 Version: 9.0 - Adobe Systems Incorporated) Hidden
Elements STI Installer (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
Evernote (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 3.5.7.2910 - Evernote Corp.)
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.131 - Google Inc.)
Google Drive (HKLM-x32\...\{418BAAD1-754D-48B4-B078-46EF4F25AF42}) (Version: 1.15.6556.8063 - Google, Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
HP Photosmart B109a-m All-in-One Driver 14.0 Rel. 6 (HKLM\...\{A253A57F-4319-49B5-B405-64587FFBCFE2}) (Version: 14.0 - HP)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.0.1008 - Intel Corporation)
Java(TM) 6 Update 22 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416022FF}) (Version: 6.0.220 - Oracle)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Media Gallery (Version: 1.4.0.11300 - Your Company Name) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Touch Pack for Windows 7 (HKLM-x32\...\{8FF90DB8-6DED-44A3-B182-244FEC09012F}) (Version: 1.0.40517.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 3.0 (HKLM-x32\...\{3898934B-05AE-41CD-96BE-70DA9BFBCE1F}) (Version: 3.0.11010.0 - Microsoft Corporation)
Mozilla Firefox 21.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 21.0 (x86 de)) (Version: 21.0 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MyFreeCodec (HKU\S-1-5-21-2266135243-3458477776-180843295-1000\...\MyFreeCodec) (Version:  - )
Naviextras Toolbox Prerequesities (HKLM-x32\...\{537575D6-3B96-474C-BD8F-DFF667363DBD}) (Version: 1.0.0 - NNG Llc.)
NirSoft BlueScreenView (HKLM-x32\...\NirSoft BlueScreenView) (Version:  - )
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)
NVIDIA Grafiktreiber 266.18 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 266.18 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.10.0514 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.10.0514 - NVIDIA Corporation)
PhoenixRC (HKLM-x32\...\{7A03BEDC-6390-440E-8D13-721A22F0BD1F}) (Version: 3.00.12 - Ihr Firmenname)
PMB (HKLM-x32\...\{B6A98E5F-D6A7-46FB-9E9D-1F7BF443491C}) (Version: 5.5.00.11260 - Sony Corporation)
PMB VAIO Edition Guide (x32 Version: 1.4.00.10090 - Sony Corporation) Hidden
PS_AIO_06_B109a-m_SW_Min (x32 Version: 140.0.690.000 - Hewlett-Packard) Hidden
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6251 - Realtek Semiconductor Corp.)
Remote Keyboard (x32 Version: 1.1.0.12170 - Sony Corporation) Hidden
Remote Play mit PlayStation®3 (HKLM-x32\...\{07441A52-E208-478A-92B7-5C337CA8C131}) (Version: 1.0.2.06210 - Sony Corporation)
Remote Play with PlayStation 3 (x32 Version: 1.0.2.06210 - Sony Corporation) Hidden
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.26.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.26.0 - Renesas Electronics Corporation) Hidden
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Samsung Story Album Viewer (HKLM-x32\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13052_1 - Samsung Electronics Co., Ltd.)
Samsung Story Album Viewer (x32 Version: 1.0.0.13052_1 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.24.0 - SAMSUNG Electronics Co., Ltd.)
Scan (x32 Version: 140.0.80.000 - Hewlett-Packard) Hidden
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SmartSound Quicktracks for Premiere Elements 9.0 (HKLM-x32\...\InstallShield_{6748E773-5DA0-4D19-8AA5-273B4133A09B}) (Version: 3.12.3090 - SmartSound Software Inc)
SmartSound Quicktracks for Premiere Elements 9.0 (x32 Version: 3.12.3090 - SmartSound Software Inc) Hidden
Toolbox (x32 Version: 140.0.428.000 - Hewlett-Packard) Hidden
VAIO - Media Gallery (HKLM-x32\...\{DD88F979-FA58-41AC-980C-A6E1A82B61D9}) (Version: 1.4.0.11300 - Sony Corporation)
VAIO - PMB VAIO Edition Guide (HKLM-x32\...\InstallShield_{FF1FC66F-536F-46BD-98E3-D8DA127A810E}) (Version: 1.4.00.10090 - Sony Corporation)
VAIO - Remote-Tastatur  (HKLM-x32\...\{7396FB15-9AB4-4B78-BDD8-24A9C15D2C65}) (Version: 1.0.0.12170 - Sony Corporation)
VAIO Care (HKLM-x32\...\{36C5BBF0-E5BF-4DE1-B684-7E90B0C93FB5}) (Version: 6.3.2.10200 - Sony Corporation)
VAIO Care (x32 Version: 6.3.2.10200 - Sony Corporation) Hidden
VAIO Control Center (HKLM-x32\...\{72042FA6-5609-489F-A8EA-3C2DD650F667}) (Version: 4.4.0.11260 - Sony Corporation)
VAIO Data Restore Tool (HKLM-x32\...\{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}) (Version: 1.5.0.10140 - Sony Corporation)
VAIO Data Restore Tool (x32 Version: 1.5.0.10140 - Sony Corporation) Hidden
VAIO Gate (HKLM-x32\...\{A7C30414-2382-4086-B0D6-01A88ABA21C3}) (Version: 2.3.0.11090 - Sony Corporation)
VAIO Gate Default (HKLM-x32\...\{B7546697-2A80-4256-A24B-1C33163F535B}) (Version: 2.3.0.11220 - Sony Corporation)
VAIO Hardware Diagnostics (x32 Version: 4.1.0.10120 - Sony Corporation) Hidden
VAIO Media plus (HKLM-x32\...\{8DE50158-80AA-4FF2-9E9F-0A7C46F71FCD}) (Version: 2.1.0.23300 - Sony Corporation)
VAIO Media plus (Version: 2.1.0.23300 - Your Company Name) Hidden
VAIO Media plus Opening Movie (HKLM-x32\...\{9238E8A4-BEBA-43A3-B926-769BDBF194C5}) (Version: 2.1.0.13220 - Sony Corporation)
VAIO Quick Web Access (HKLM-x32\...\splashtop) (Version: 1.4.4.8 - Sony Corporation)
VAIO Quick Web Access (x32 Version: 1.4.4.8 - Sony Corporation) Hidden
VAIO Sample Contents (HKLM-x32\...\{547C9EB4-4CA6-402F-9D1B-8BD30DC71E44}) (Version: 1.4.2.09010 - Sony Corporation)
VAIO screensaver (HKLM-x32\...\VAIO screensaver) (Version: 1.0.0.0 - Sony Europe)
VAIO Smart Network (HKLM-x32\...\{0899D75A-C2FC-42EA-A702-5B9A5F24EAD5}) (Version: 3.4.0.12090 - Sony Corporation)
VAIO Update (HKLM-x32\...\{5BEE8F1F-BD32-4553-8107-500439E43BD7}) (Version: 5.3.0.11180 - Sony Corporation)
VAIO-Handbuch (HKLM-x32\...\{C6E893E7-E5EA-4CD5-917C-5443E753FCBD}) (Version: 1.2.0.11040 - Sony Corporation)
VAIO-Support für Übertragungen (HKLM-x32\...\{5DDAFB4B-C52E-468A-9E23-3B0CEEB671BF}) (Version: 1.3.0.11250 - Sony Corporation)
Viewster - Viewster - Viewster Launch App (HKLM-x32\...\Viewster Viewster) (Version: "1.0.0" - "Viewster")
WIDCOMM Bluetooth Software (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.6300 - Broadcom Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (HKLM-x32\...\{C32CE55C-12BA-4951-8797-0967FDEF556F}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}) (Version: 15.4.5722.2 - Microsoft Corporation)
WinRAR 5.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)
Компаньон Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Элемент управления Windows Live Mesh ActiveX для удаленных подключений (HKLM-x32\...\{BCB0D6F7-7EAB-4009-A6F2-8E0E7F317773}) (Version: 15.4.5722.2 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2266135243-3458477776-180843295-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2266135243-3458477776-180843295-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2266135243-3458477776-180843295-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2266135243-3458477776-180843295-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2266135243-3458477776-180843295-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rolf Schauberger\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)

==================== Restore Points  =========================

22-12-2014 12:58:29 Windows Update
27-12-2014 10:57:45 Windows Update
30-12-2014 11:06:07 Windows Update
31-12-2014 17:04:01 avast! antivirus system restore point
31-12-2014 17:06:21 Gerätetreiber-Paketinstallation: Avast Netzwerkdienst
31-12-2014 17:08:24 Windows Update
04-01-2015 21:30:00 avast! antivirus system restore point
05-01-2015 14:45:16 avast! antivirus system restore point
05-01-2015 14:50:37 Windows Update
08-01-2015 16:16:38 avast! antivirus system restore point
08-01-2015 16:18:58 Gerätetreiber-Paketinstallation: Avast Netzwerkdienst
08-01-2015 16:21:59 Windows Update
11-01-2015 10:53:22 avast! antivirus system restore point
11-01-2015 16:42:49 avast! antivirus system restore point
11-01-2015 16:47:28 Windows Update
11-01-2015 17:11:09 Windows-Sicherung
11-01-2015 18:42:50 avast! antivirus system restore point
11-01-2015 23:02:13 Windows Update
12-01-2015 20:47:08 VAIO Care Automatic Restore Point
12-01-2015 20:47:52 VAIO Care Automatic Restore Point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2015-01-12 20:25 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0572480E-A4D6-403F-A573-ACF8E8E4DE58} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-26] (Google Inc.)
Task: {095D9381-B0D9-433A-ABE8-8001BCCC023D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-26] (Google Inc.)
Task: {13F66198-2A6F-4F69-B70D-8A5051089080} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {166AF505-17D4-4381-BF54-7223D153AA97} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-11] (Adobe Systems Incorporated)
Task: {258A2963-BA15-4E29-AF49-3150001A1CA6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-02-20] (Piriform Ltd)
Task: {607D7CD3-8C4C-4CFD-B4FD-AE27EB758A39} - System32\Tasks\VAIO Care Support => C:\Program Files\Sony\VAIO Care\VCSpt.exe [2010-09-27] (Sony Corporation)
Task: {7AABFAE1-5D93-47D1-A266-4B5143804899} - System32\Tasks\SONY\VAIO Gate\VAIO Gate => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2010-11-16] (Sony Corporation)
Task: {7C0CF055-7FBB-4979-A7A4-96AB80B778BB} - System32\Tasks\SONY\VAIO Gate\StartExecuteProxy => C:\Program Files\Sony\VAIO Gate\ExecutionProxy.exe [2010-11-16] (Sony Corporation)
Task: {7FBC739F-35A7-42C9-9A98-F8B324317899} - System32\Tasks\SONY\VAIO Power Management\VPM Logon Start => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2010-12-06] (Sony Corporation)
Task: {83CCA2B6-38F4-41F8-80EC-6181B723C07C} - System32\Tasks\VAIO Care => C:\Program Files\Sony\VAIO Care\VCsystray.exe [2010-10-20] (Sony Corporation)
Task: {8FD5C340-C6FE-4FBF-A027-76FE1E4D8203} - System32\Tasks\SONY\VAIO Update\VAIO Update 5 => C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe [2010-11-18] (Sony Corporation)
Task: {9FDB2E10-2D69-42E0-92AA-75120E533CF8} - System32\Tasks\SONY\VAIO Smart Network\VSN Logon Start => C:\Program Files\Sony\VAIO Smart Network\VSNClient
Task: {A88EE442-BCDB-4DD7-A6FE-E50C57E8D4DB} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation)
Task: {C5F8A06E-9EB5-44D7-BD2E-60C7A9DE678B} - System32\Tasks\{17A4E46D-5398-4A56-A744-EC7F486E3F04} => pcalua.exe -a "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe" -d "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller"
Task: {C6C938E7-2E03-4041-B7FB-CB1EC790FC1F} - System32\Tasks\SONY\VAIO Power Management\VPM Session Change => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2010-12-06] (Sony Corporation)
Task: {F1866651-4D91-4C05-B448-8DDEFDF31E96} - System32\Tasks\VCOneClick => C:\Program Files\Sony\VAIO Care\VCOneClick.exe [2010-10-14] ()
Task: {F1CCD594-85B8-43CF-8C46-14AA7C96AFE2} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-11-16] (AVAST Software)
Task: {F4D15A0C-6FE1-4FF7-98A2-65AB0B2B602A} - System32\Tasks\SONY\VAIO Power Management\VPM Unlock => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2010-12-06] (Sony Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-05-24 08:25 - 2010-10-14 04:33 - 00275456 _____ () C:\Program Files\Sony\VAIO Care\CRM\ManagedVAIORecoveryMedia.dll
2013-05-24 08:25 - 2010-10-14 04:33 - 00182272 _____ () C:\Program Files\Sony\VAIO Care\CRM\VAIORecovery.dll
2013-05-24 08:25 - 2010-10-14 04:33 - 00070656 _____ () C:\Program Files\Sony\VAIO Care\CRM\Logging.dll
2013-05-24 08:25 - 2010-10-14 04:33 - 00058880 _____ () C:\Program Files\Sony\VAIO Care\CRM\VAIOCommon.dll
2013-05-24 08:25 - 2010-10-14 04:33 - 00215040 _____ () C:\Program Files\Sony\VAIO Care\CRM\OsServices.dll
2013-05-24 08:25 - 2010-10-14 04:33 - 00043008 _____ () C:\Program Files\Sony\VAIO Care\CRM\PluginFactory.dll
2013-05-24 08:25 - 2010-10-14 04:33 - 00043520 _____ () C:\Program Files\Sony\VAIO Care\CRM\XMLTools.dll
2013-05-24 08:25 - 2010-10-14 04:33 - 00059392 _____ () C:\Program Files\Sony\VAIO Care\CRM\VAIOInstallAppsDrivers.dll
2013-05-24 08:25 - 2010-10-14 04:33 - 00157696 _____ () C:\Program Files\Sony\VAIO Care\CRM\InstallDB.dll
2013-05-24 08:25 - 2010-10-14 04:33 - 00138240 _____ () C:\Program Files\Sony\VAIO Care\CRM\InstallationTools.dll
2013-05-24 08:25 - 2010-10-14 04:33 - 00024576 _____ () C:\Program Files\Sony\VAIO Care\CRM\VAIOUtility.dll
2015-01-14 11:20 - 2015-01-14 11:20 - 02909696 _____ () C:\Program Files\AVAST Software\Avast\defs\15011400\algo.dll
2014-11-16 12:29 - 2014-11-16 12:29 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-05-24 08:00 - 2011-01-31 13:46 - 00013824 _____ () C:\Program Files (x86)\Sony\VAIO Event Service\VESBasePS.dll
2014-10-20 15:45 - 2014-10-20 15:45 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\93182e9779b8be0f688fd0784df6d7fb\IsdiInterop.ni.dll
2013-05-24 07:54 - 2010-11-05 22:50 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Rolf Schauberger\Downloads\OriginalMail (1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Rolf Schauberger\Downloads\OriginalMail.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe ARM => "c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: Norton Online Backup => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe

========================= Accounts: ==========================

Administrator (S-1-5-21-2266135243-3458477776-180843295-500 - Administrator - Disabled)
Gast (S-1-5-21-2266135243-3458477776-180843295-501 - Limited - Disabled)
Rolf Schauberger (S-1-5-21-2266135243-3458477776-180843295-1000 - Administrator - Enabled) => C:\Users\Rolf Schauberger

==================== Faulty Device Manager Devices =============

Name: avast! Firewall NDIS Filter Miniport
Description: avast! Firewall NDIS Filter Miniport
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: ALWIL Software
Service: aswNdis
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
 This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2015-01-12 20:24:38.757
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-01-12 20:24:38.617
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-08-14 17:50:26.719
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-14 17:50:26.619
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-14 17:50:26.479
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-14 17:50:26.329
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-14 17:50:26.199
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-14 17:50:26.089
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-14 17:50:25.959
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-08-14 17:50:25.769
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-2410M CPU @ 2.30GHz
Percentage of memory in use: 36%
Total physical RAM: 4077.3 MB
Available physical RAM: 2598.53 MB
Total Pagefile: 8152.77 MB
Available Pagefile: 6268.07 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:915.42 GB) (Free:838.77 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: F340C475)
Partition 1: (Not Active) - (Size=16 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=915.4 GB) - (Type=07 NTFS)

==================== End Of Log ============================
Das wären die LOG files. Das merkwürdige ist, mein Nachbar mein morgens fährt der Rechner jetzt relativ fix hoc, aber je später am Abend es ist desto langsamer tut er das (angeblich^^).

Alt 14.01.2015, 13:24   #12
schrauber
/// the machine
/// TB-Ausbilder
 
Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung - Standard

Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort

Themen zu Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung
appdata, blue, blue screen, c:\windows, code, diverse, fehlermeldung, folge, gmer, hochfahren, home, offline, online, problem, probleme, schädling, screen, service, system32, temp, trojaner, viren, windows, windows 7, windows probleme


« win 8.1 Werbung und Popsups in Firefox und IE seit 2 Stunden ... | BetterMarkit lässt sich nicht entfernen »


Ähnliche Themen: Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung


  1. Windows 7 Home Premium SP1 Langsam
    Log-Analyse und Auswertung - 03.05.2015 (7)
  2. Windows 7 Home Premium - Avast - Gruppenrichtlinie
    Log-Analyse und Auswertung - 04.11.2014 (5)
  3. Windows 7 Home Premium - SpyHunter 4 deinstallieren
    Log-Analyse und Auswertung - 16.09.2014 (17)
  4. Umstellung xp zu windows 7 home premium
    Alles rund um Windows - 20.03.2014 (5)
  5. Windows 7 Home Premium Stürzt ab/PC Neustart
    Alles rund um Windows - 17.12.2013 (3)
  6. Windows / Home Premium BKA/Interpol Speerbildschirm
    Log-Analyse und Auswertung - 13.10.2013 (3)
  7. Weißer Bildschirm nach Windows-Start (Windows 7 Premium Home)
    Plagegeister aller Art und deren Bekämpfung - 28.08.2013 (13)
  8. GVU-Trojaner mit Windows 7 Home Premium
    Log-Analyse und Auswertung - 28.08.2013 (19)
  9. Gvu Trojaner unter Windows 7 home Premium
    Plagegeister aller Art und deren Bekämpfung - 06.08.2013 (1)
  10. Windows 7 Home Premium auf Laptop neu aufspielen
    Alles rund um Windows - 21.07.2013 (13)
  11. GVU Trojaner 2.07 Windows Vista Home Premium
    Plagegeister aller Art und deren Bekämpfung - 28.06.2013 (5)
  12. Backdoor.bot auf Windows-7 Home Premium (x64)
    Plagegeister aller Art und deren Bekämpfung - 08.10.2012 (49)
  13. GVU Trojaner 2.07 - Windows Vista Home Premium 32 Bit
    Log-Analyse und Auswertung - 07.10.2012 (6)
  14. BKA Trojaner - Windows 7 Home Premium 64bit
    Plagegeister aller Art und deren Bekämpfung - 12.08.2012 (17)
  15. Windows Vista Home Premium 32-Bit Trojaner Windows gesperrt 50€ zahlen.
    Log-Analyse und Auswertung - 23.01.2012 (1)
  16. Windows 7 Home Premium 64 Bit laptop brennen
    Alles rund um Windows - 05.06.2010 (1)
  17. VIRUSS! Windows Vista Home Premium
    Alles rund um Windows - 10.04.2010 (3)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung - Hallo liebes Board, mein Nachbar (70 jähriger Rentner) hat seit 2 Wochen das Problem, dass sein Windows Probleme macht beim Hochfahren und willkürlich irgendwelche Scans gestartet werden (keine Hardwäreänderungen in - Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung...
Archiv
Du betrachtest: Windows 7 Home Premium: Merkwürdige Scans und Windows Fehlerbehebung auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19