hier gehts weiter:

76A55CF7 5 Bytes JMP 00DE00BF \par
.text C:\\Windows\\system32\\svchost.exe[1360] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 01690069 \par
.text C:\\Windows\\system32\\svchost.exe[1360] msvcrt.dll!system 77C6804B 5 Bytes JMP 01690FD4 \par
.text C:\\Windows\\system32\\svchost.exe[1360] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 01690FEF \par
.text C:\\Windows\\system32\\svchost.exe[1360] msvcrt.dll!_open 77C6D106 5 Bytes JMP 0169000C \par
.text C:\\Windows\\system32\\svchost.exe[1360] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 01690044 \par
.text C:\\Windows\\system32\\svchost.exe[1360] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 01690029 \par
.text C:\\Windows\\system32\\svchost.exe[1360] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 00DF0FC0 \par
.text C:\\Windows\\system32\\svchost.exe[1360] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 00DF0FD1 \par
.text C:\\Windows\\system32\\svchost.exe[1360] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 00DF0000 \par
.text C:\\Windows\\system32\\svchost.exe[1360] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 00DF0062 \par
.text C:\\Windows\\system32\\svchost.exe[1360] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 00DF0F9B \par
.text C:\\Windows\\system32\\svchost.exe[1360] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 00DF0022 \par
.text C:\\Windows\\system32\\svchost.exe[1360] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 00DF0011 \par
.text C:\\Windows\\system32\\svchost.exe[1360] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 00DF003D \par
.text C:\\Windows\\system32\\svchost.exe[1360] WS2_32.dll!socket 769936D1 5 Bytes JMP 014E0FE5 \par
.text C:\\Windows\\system32\\svchost.exe[1488] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 00160FE5 \par
.text C:\\Windows\\system32\\svchost.exe[1488] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 00160FB9 \par
.text C:\\Windows\\system32\\svchost.exe[1488] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 00160FD4 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 001400B6 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 00140F70 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 00140F33 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 00140F4E \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 00140076 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 00140FDE \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 00140FCD \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 0014009B \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 00140065 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 00140FB2 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 00140054 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 00140039 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 00140F81 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 001400E5 \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 0014000A \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 00140FEF \par
.text C:\\Windows\\system32\\svchost.exe[1488] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 00140F5F \par
.text C:\\Windows\\system32\\svchost.exe[1488] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 00180FA6 \par
.text C:\\Windows\\system32\\svchost.exe[1488] msvcrt.dll!system 77C6804B 5 Bytes JMP 00180FB7 \par
.text C:\\Windows\\system32\\svchost.exe[1488] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 00180016 \par
.text C:\\Windows\\system32\\svchost.exe[1488] msvcrt.dll!_open 77C6D106 5 Bytes JMP 00180FEF \par
.text C:\\Windows\\system32\\svchost.exe[1488] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 00180027 \par
.text C:\\Windows\\system32\\svchost.exe[1488] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 00180FD2 \par
.text C:\\Windows\\system32\\svchost.exe[1488] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 00150FD4 \par
.text C:\\Windows\\system32\\svchost.exe[1488] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 0015005B \par
.text C:\\Windows\\system32\\svchost.exe[1488] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 00150000 \par
.text C:\\Windows\\system32\\svchost.exe[1488] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 00150080 \par
.text C:\\Windows\\system32\\svchost.exe[1488] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 00150FC3 \par
.text C:\\Windows\\system32\\svchost.exe[1488] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 00150FEF \par
.text C:\\Windows\\system32\\svchost.exe[1488] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 0015001B \par
.text C:\\Windows\\system32\\svchost.exe[1488] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 0015004A \par
.text C:\\Windows\\system32\\svchost.exe[1488] WS2_32.dll!socket 769936D1 5 Bytes JMP 00170000 \par
.text C:\\Windows\\system32\\svchost.exe[1540] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 008B0FEF \par
.text C:\\Windows\\system32\\svchost.exe[1540] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 008B0FC3 \par
.text C:\\Windows\\system32\\svchost.exe[1540] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 008B0FDE \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 00890F46 \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 0089008C \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 008900D3 \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 008900AE \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 00890F75 \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 00890FDE \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 00890FC3 \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 0089007B \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 00890F86 \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 00890FA1 \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 00890043 \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 00890FB2 \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 0089006A \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 008900EE \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 00890014 \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 00890FEF \par
.text C:\\Windows\\system32\\svchost.exe[1540] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 0089009D \par
.text C:\\Windows\\system32\\svchost.exe[1540] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 009A0F7C \par
.text C:\\Windows\\system32\\svchost.exe[1540] msvcrt.dll!system 77C6804B 5 Bytes JMP 009A0F97 \par
.text C:\\Windows\\system32\\svchost.exe[1540] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 009A0000 \par
.text C:\\Windows\\system32\\svchost.exe[1540] msvcrt.dll!_open 77C6D106 5 Bytes JMP 009A0FEF \par
.text C:\\Windows\\system32\\svchost.exe[1540] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 009A0011 \par
.text C:\\Windows\\system32\\svchost.exe[1540] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 009A0FC6 \par
.text C:\\Windows\\system32\\svchost.exe[1540] ADVAPI32.dll!RegCreateKeyExA 77A139AB 1 Byte [E9]\par
.text C:\\Windows\\system32\\svchost.exe[1540] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 008A0FAF \par
.text C:\\Windows\\system32\\svchost.exe[1540] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 008A0FC0 \par
.text C:\\Windows\\system32\\svchost.exe[1540] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 008A0000 \par
.text C:\\Windows\\system32\\svchost.exe[1540] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 008A0051 \par
.text C:\\Windows\\system32\\svchost.exe[1540] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 008A006C \par
.text C:\\Windows\\system32\\svchost.exe[1540] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 008A001B \par
.text C:\\Windows\\system32\\svchost.exe[1540] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 008A0FE5 \par
.text C:\\Windows\\system32\\svchost.exe[1540] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 008A002C \par
.text C:\\Windows\\system32\\svchost.exe[1540] WS2_32.dll!socket 769936D1 5 Bytes JMP 008C0FEF \par
.text C:\\Windows\\system32\\svchost.exe[1732] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 00F50000 \par
.text C:\\Windows\\system32\\svchost.exe[1732] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 00F50FDB \par
.text C:\\Windows\\system32\\svchost.exe[1732] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 00F50011 \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 00DD0F68 \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 00DD00AE \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 00DD0F3C \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 00DD00DD \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 00DD0082 \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 00DD0022 \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 00DD0FDB \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 00DD009D \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 00DD0F9E \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 00DD0FB9 \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 00DD005B \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 00DD0FCA \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 00DD0F8D \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 00DD0F2B \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 00DD0011 \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 00DD0000 \par
.text C:\\Windows\\system32\\svchost.exe[1732] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 00DD0F57 \par
.text C:\\Windows\\system32\\svchost.exe[1732] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 00F7004E \par
.text C:\\Windows\\system32\\svchost.exe[1732] msvcrt.dll!system 77C6804B 5 Bytes JMP 00F70FC3 \par
.text C:\\Windows\\system32\\svchost.exe[1732] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 00F70018 \par
.text C:\\Windows\\system32\\svchost.exe[1732] msvcrt.dll!_open 77C6D106 5 Bytes JMP 00F70FEF \par
.text C:\\Windows\\system32\\svchost.exe[1732] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 00F70033 \par
.text C:\\Windows\\system32\\svchost.exe[1732] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 00F70FDE \par
.text C:\\Windows\\system32\\svchost.exe[1732] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 00F40FC0 \par
.text C:\\Windows\\system32\\svchost.exe[1732] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 00F40047 \par
.text C:\\Windows\\system32\\svchost.exe[1732] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 00F40FEF \par
.text C:\\Windows\\system32\\svchost.exe[1732] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 00F40062 \par
.text C:\\Windows\\system32\\svchost.exe[1732] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 00F40FAF \par
.text C:\\Windows\\system32\\svchost.exe[1732] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 00F40025 \par
.text C:\\Windows\\system32\\svchost.exe[1732] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 00F4000A \par
.text C:\\Windows\\system32\\svchost.exe[1732] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 00F40036 \par
.text C:\\Windows\\system32\\svchost.exe[1732] WS2_32.dll!socket 769936D1 5 Bytes JMP 00F60FEF \par
.text C:\\Windows\\system32\\svchost.exe[1732] WININET.dll!InternetOpenA 76ACD690 5 Bytes JMP 00F30000 \par
.text C:\\Windows\\system32\\svchost.exe[1732] WININET.dll!InternetOpenW 76ACDB09 5 Bytes JMP 00F30FE5 \par
.text C:\\Windows\\system32\\svchost.exe[1732] WININET.dll!InternetOpenUrlA 76ACF3A4 5 Bytes JMP 00F30FD4 \par
.text C:\\Windows\\system32\\svchost.exe[1732] WININET.dll!InternetOpenUrlW 76B16DDF 5 Bytes JMP 00F3001B \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 03A9000A \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 03A90FE5 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 03A9001B \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 03A6007B \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 03A60060 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 03A600B1 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 03A60F10 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 03A60F57 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 03A60011 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 03A60FC0 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 03A60F35 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 03A60F68 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 03A60F94 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 03A60F79 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 03A60FA5 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 03A60F46 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 03A60EFF \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 03A60FE5 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 03A60000 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 03A6008C \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 03A8003D \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] msvcrt.dll!system 77C6804B 5 Bytes JMP 03A80022 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 03A80FBC \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] msvcrt.dll!_open 77C6D106 5 Bytes JMP 03A80000 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 03A80011 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 03A80FE3 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 03A70036 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 03A7001B \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 03A70FEF \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 03A70F94 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 03A70051 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 03A7000A \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 03A70FCA \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 03A70FB9 \par
.text C:\\Program Files\\Microsoft SQL Server\\MSSQL10.SQLEXPRESS\\MSSQL\\Binn\\sqlservr.exe[1968] WS2_32.dll!socket 769936D1 5 Bytes JMP 03A50FE5 \par
.text C:\\Windows\\System32\\svchost.exe[2156] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 00190000 \par
.text C:\\Windows\\System32\\svchost.exe[2156] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 00190FD4 \par
.text C:\\Windows\\System32\\svchost.exe[2156] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 00190FE5 \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 001600AB \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 00160F65 \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 001600E1 \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 00160F4A \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 00160F9B \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 00160036 \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 00160047 \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 0016009A \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 00160075 \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 00160058 \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 00160FB6 \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 00160FDB \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 00160F80 \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 00160F2F \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 0016001B \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 0016000A \par
.text C:\\Windows\\System32\\svchost.exe[2156] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 001600C6 \par
.text C:\\Windows\\System32\\svchost.exe[2156] msvcrt.dll!_wsystem 77C67F2F 1 Byte [E9]\par
.text C:\\Windows\\System32\\svchost.exe[2156] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 00180033 \par
.text C:\\Windows\\System32\\svchost.exe[2156] msvcrt.dll!system 77C6804B 5 Bytes JMP 00180FA8 \par
.text C:\\Windows\\System32\\svchost.exe[2156] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 00180FCD \par
.text C:\\Windows\\System32\\svchost.exe[2156] msvcrt.dll!_open 77C6D106 5 Bytes JMP 00180FEF \par
.text C:\\Windows\\System32\\svchost.exe[2156] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 00180022 \par
.text C:\\Windows\\System32\\svchost.exe[2156] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 00180FDE \par
.text C:\\Windows\\System32\\svchost.exe[2156] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 00170F83 \par
.text C:\\Windows\\System32\\svchost.exe[2156] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 00170F9E \par
.text C:\\Windows\\System32\\svchost.exe[2156] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 0017000A \par
.text C:\\Windows\\System32\\svchost.exe[2156] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 00170025 \par
.text C:\\Windows\\System32\\svchost.exe[2156] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 00170F68 \par
.text C:\\Windows\\System32\\svchost.exe[2156] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 00170FDE \par
.text C:\\Windows\\System32\\svchost.exe[2156] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 00170FEF \par
.text C:\\Windows\\System32\\svchost.exe[2156] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 00170FB9 \par
.text C:\\Windows\\System32\\svchost.exe[2156] WS2_32.dll!socket 769936D1 5 Bytes JMP 00090000 \par
.text C:\\Windows\\System32\\svchost.exe[2228] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 001F000A \par
.text C:\\Windows\\System32\\svchost.exe[2228] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 001F0FD4 \par
.text C:\\Windows\\System32\\svchost.exe[2228] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 001F0FEF \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 000B0EFA \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 000B0F15 \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 000B0091 \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 000B0076 \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 000B0040 \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 000B0FC3 \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 000B0FA8 \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 000B0F30 \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 000B0F72 \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 000B001E \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 000B002F \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 000B0F97 \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 000B0F4B \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 000B00A2 \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 000B0FDE \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 000B0FEF \par
.text C:\\Windows\\System32\\svchost.exe[2228] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 000B005B \par
.text C:\\Windows\\System32\\svchost.exe[2228] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 000D0FAD \par
.text C:\\Windows\\System32\\svchost.exe[2228] msvcrt.dll!system 77C6804B 5 Bytes JMP 000D0FC8 \par
.text C:\\Windows\\System32\\svchost.exe[2228] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 000D001D \par
.text C:\\Windows\\System32\\svchost.exe[2228] msvcrt.dll!_open 77C6D106 5 Bytes JMP 000D000C \par
.text C:\\Windows\\System32\\svchost.exe[2228] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 000D0038 \par
.text C:\\Windows\\System32\\svchost.exe[2228] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 000D0FEF \par
.text C:\\Windows\\System32\\svchost.exe[2228] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 000C006C \par
.text C:\\Windows\\System32\\svchost.exe[2228] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 000C0040 \par
.text C:\\Windows\\System32\\svchost.exe[2228] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 000C0000 \par
.text C:\\Windows\\System32\\svchost.exe[2228] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 000C005B \par
.text C:\\Windows\\System32\\svchost.exe[2228] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 000C0FA5 \par
.text C:\\Windows\\System32\\svchost.exe[2228] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 000C001B \par
.text C:\\Windows\\System32\\svchost.exe[2228] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 000C0FE5 \par
.text C:\\Windows\\System32\\svchost.exe[2228] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 000C0FD4 \par
.text C:\\Windows\\System32\\svchost.exe[2228] WS2_32.dll!socket 769936D1 5 Bytes JMP 000A0FEF \par
.text C:\\Windows\\system32\\svchost.exe[2368] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 00700000 \par
.text C:\\Windows\\system32\\svchost.exe[2368] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 00700FE5 \par
.text C:\\Windows\\system32\\svchost.exe[2368] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 0070001B \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 006D0F26 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 006D0F37 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 006D0087 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 006D0EF0 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 006D0F52 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 006D0FCA \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 006D0011 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 006D0058 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 006D0F6F \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 006D0F80 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 006D0022 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 006D0FA5 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 006D0047 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 006D0ED5 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 006D0FDB \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 006D0000 \par
.text C:\\Windows\\system32\\svchost.exe[2368] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 006D0F15 \par
.text C:\\Windows\\system32\\svchost.exe[2368] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 006F003D \par
.text C:\\Windows\\system32\\svchost.exe[2368] msvcrt.dll!system 77C6804B 5 Bytes JMP 006F0FB2 \par
.text C:\\Windows\\system32\\svchost.exe[2368] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 006F0011 \par
.text C:\\Windows\\system32\\svchost.exe[2368] msvcrt.dll!_open 77C6D106 5 Bytes JMP 006F0FE3 \par
.text C:\\Windows\\system32\\svchost.exe[2368] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 006F0022 \par
.text C:\\Windows\\system32\\svchost.exe[2368] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 006F0000 \par
.text C:\\Windows\\system32\\svchost.exe[2368] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 006E0073 \par
.text C:\\Windows\\system32\\svchost.exe[2368] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 006E0FD1 \par
.text C:\\Windows\\system32\\svchost.exe[2368] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 006E000A \par
.text C:\\Windows\\system32\\svchost.exe[2368] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 006E0062 \par
.text C:\\Windows\\system32\\svchost.exe[2368] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 006E0084 \par
.text C:\\Windows\\system32\\svchost.exe[2368] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 006E002C \par
.text C:\\Windows\\system32\\svchost.exe[2368] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 006E001B \par
.text C:\\Windows\\system32\\svchost.exe[2368] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 006E0047 \par
.text C:\\Windows\\system32\\svchost.exe[2368] WS2_32.dll!socket 769936D1 5 Bytes JMP 00240000 \par
.text C:\\Windows\\system32\\svchost.exe[2496] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 009F0FEF \par
.text C:\\Windows\\system32\\svchost.exe[2496] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 009F0FCD \par
.text C:\\Windows\\system32\\svchost.exe[2496] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 009F0FDE \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 00980080 \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 00980F3A \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 009800C0 \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 009800A5 \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 0098005B \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 00980FE5 \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 00980FC0 \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 00980F55 \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 0098004A \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 00980F9E \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 00980F8D \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 00980FAF \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 00980F66 \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 00980F04 \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 0098001B \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 00980000 \par
.text C:\\Windows\\system32\\svchost.exe[2496] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 00980F29 \par
.text C:\\Windows\\system32\\svchost.exe[2496] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 009E0049 \par
.text C:\\Windows\\system32\\svchost.exe[2496] msvcrt.dll!system 77C6804B 5 Bytes JMP 009E0038 \par
.text C:\\Windows\\system32\\svchost.exe[2496] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 009E001D \par
.text C:\\Windows\\system32\\svchost.exe[2496] msvcrt.dll!_open 77C6D106 5 Bytes JMP 009E0000 \par
.text C:\\Windows\\system32\\svchost.exe[2496] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 009E0FC8 \par
.text C:\\Windows\\system32\\svchost.exe[2496] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 009E0FEF \par
.text C:\\Windows\\system32\\svchost.exe[2496] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 009D0F7C \par
.text C:\\Windows\\system32\\svchost.exe[2496] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 009D0FA8 \par
.text C:\\Windows\\system32\\svchost.exe[2496] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 009D0000 \par
.text C:\\Windows\\system32\\svchost.exe[2496] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 009D0F8D \par
.text C:\\Windows\\system32\\svchost.exe[2496] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 009D0F61 \par
.text C:\\Windows\\system32\\svchost.exe[2496] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 009D0FCA \par
.text C:\\Windows\\system32\\svchost.exe[2496] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 009D0FDB \par
.text C:\\Windows\\system32\\svchost.exe[2496] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 009D0FB9 \par
.text C:\\Windows\\system32\\svchost.exe[2496] WS2_32.dll!socket 769936D1 5 Bytes JMP 00930FEF \par
.text C:\\Program Files\\Common Files\\Mcafee\\McSvcHost\\McSvHost.exe[2612] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 71639AE2 C:\\Program Files\\Common Files\\McAfee\\McProxy\\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)\par
.text C:\\Program Files\\Common Files\\Mcafee\\McSvcHost\\McSvHost.exe[2612] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 71639A20 C:\\Program Files\\Common Files\\McAfee\\McProxy\\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)\par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ntdll.dll!NtCreateFile 77D243D4 5 Bytes JMP 00040FE5 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ntdll.dll!NtCreateProcess 77D24494 5 Bytes JMP 0004000A \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ntdll.dll!NtProtectVirtualMemory 77D24D34 5 Bytes JMP 00040FD4 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!GetStartupInfoW 769C1929 5 Bytes JMP 0001008E \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!GetStartupInfoA 769C19C9 5 Bytes JMP 00010F48 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!CreateProcessW 769C1BF3 5 Bytes JMP 00010F08 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!CreateProcessA 769C1C28 5 Bytes JMP 0001009F \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!VirtualProtect 769C1DC3 5 Bytes JMP 00010058 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!CreateNamedPipeA 769C2EF5 5 Bytes JMP 0001001B \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!CreateNamedPipeW 769C5C0C 5 Bytes JMP 0001002C \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!CreatePipe 769E8E6E 5 Bytes JMP 00010F63 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!LoadLibraryExW 769E9109 5 Bytes JMP 00010F74 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!LoadLibraryW 769E9362 5 Bytes JMP 00010F9B \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!LoadLibraryExA 769E94B4 5 Bytes JMP 0001003D \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!LoadLibraryA 769E94DC 5 Bytes JMP 00010FB6 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!VirtualProtectEx 769EDBDA 5 Bytes JMP 00010073 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!GetProcAddress 76A0903B 5 Bytes JMP 00010EF7 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!CreateFileW 76A0AECB 5 Bytes JMP 00010000 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!CreateFileA 76A0CE5F 5 Bytes JMP 00010FEF \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] kernel32.dll!WinExec 76A55CF7 5 Bytes JMP 00010F2D \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] msvcrt.dll!_wsystem 77C67F2F 5 Bytes JMP 00070049 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] msvcrt.dll!system 77C6804B 5 Bytes JMP 00070038 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] msvcrt.dll!_creat 77C6BBE1 5 Bytes JMP 0007000C \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] msvcrt.dll!_open 77C6D106 5 Bytes JMP 00070FE3 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] msvcrt.dll!_wcreat 77C6D326 5 Bytes JMP 00070027 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] msvcrt.dll!_wopen 77C6D501 5 Bytes JMP 00070FD2 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ADVAPI32.dll!RegCreateKeyExA 77A139AB 5 Bytes JMP 00080FDE \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ADVAPI32.dll!RegCreateKeyA 77A13BA9 5 Bytes JMP 00080065 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ADVAPI32.dll!RegOpenKeyA 77A189C7 5 Bytes JMP 0008000A \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ADVAPI32.dll!RegCreateKeyW 77A2391E 5 Bytes JMP 00080076 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ADVAPI32.dll!RegCreateKeyExW 77A241F1 5 Bytes JMP 00080FCD \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ADVAPI32.dll!RegOpenKeyExA 77A27C42 5 Bytes JMP 00080FEF \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ADVAPI32.dll!RegOpenKeyW 77A2E2B5 5 Bytes JMP 00080025 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] ADVAPI32.dll!RegOpenKeyExW 77A37BA1 5 Bytes JMP 00080040 \par
.text C:\\Windows\\system32\\wuauclt.exe[3524] WS2_32.dll!socket 769936D1 5 Bytes JMP 00140FE5 \par
\par
---- User IAT/EAT - GMER 1.0.15 ----\par
\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [747B7817] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipCloneImage] [7480A86D] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [747BBB22] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [747AF695] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdiplusStartup] [747B75E9] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [747AE7CA] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [747E8395] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [747BDA60] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [747AFFFA] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [747AFF61] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [747A71CF] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [7483CAE2] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [747DC8D8] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [747AD968] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipFree] [747A6853] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipAlloc] [747A687E] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Windows\\Explorer.EXE[684] @ C:\\Windows\\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [747B2AD1] C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)\par
IAT C:\\Program Files\\Common Files\\McAfee\\SystemCore\\mfevtps.exe[1804] @ C:\\Windows\\system32\\CRYPT32.dll [ADVAPI32.dll!RegQueryValueExW] [00D276E0] C:\\Program Files\\Common Files\\McAfee\\SystemCore\\mfevtps.exe (McAfee Process Validation Service/McAfee, Inc.)\par
IAT C:\\Program Files\\Common Files\\McAfee\\SystemCore\\mfevtps.exe[1804] @ C:\\Windows\\system32\\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [00D27740] C:\\Program Files\\Common Files\\McAfee\\SystemCore\\mfevtps.exe (McAfee Process Validation Service/McAfee, Inc.)\par
\par
---- Devices - GMER 1.0.15 ----\par
\par
AttachedDevice \\FileSystem\\Ntfs \\Ntfs mfehidk.sys (McAfee Link Driver/McAfee, Inc.)\par
AttachedDevice \\Driver\\kbdclass \\Device\\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)\par
AttachedDevice \\Driver\\tdx \\Device\\Tcp mfewfpk.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)\par
\par
Device \\Driver\\BTHUSB \\Device\\00000071 bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)\par
Device \\Driver\\BTHUSB \\Device\\00000073 bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)\par
\par
AttachedDevice \\Driver\\tdx \\Device\\Udp mfewfpk.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)\par
\par
---- Registry - GMER 1.0.15 ----\par
\par
Reg HKLM\\SYSTEM\\CurrentControlSet\\Services\\BTHPORT\\Parameters\\Keys\\0002783d0ca0 \par
Reg HKLM\\SYSTEM\\CurrentControlSet\\Services\\BTHPORT\\Parameters\\Keys\\0002783d0cab \par
Reg HKLM\\SYSTEM\\CurrentControlSet\\Services\\BTHPORT\\Parameters\\Keys\\0002783d0ccf \par
Reg HKLM\\SYSTEM\\CurrentControlSet\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f \par
Reg HKLM\\SYSTEM\\CurrentControlSet\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f@00076109d093 0xBE 0x71 0x6F 0xA2 ...\par
Reg HKLM\\SYSTEM\\CurrentControlSet\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f@0007610a45c5 0x63 0x0B 0x36 0x42 ...\par
Reg HKLM\\SYSTEM\\CurrentControlSet\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f@0012471a5b4d 0x5A 0x05 0x5B 0xF1 ...\par
Reg HKLM\\SYSTEM\\CurrentControlSet\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f@0001e3be7d5f 0x72 0x1B 0x9B 0x26 ...\par
Reg HKLM\\SYSTEM\\CurrentControlSet\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f@00076108f7fb 0xA3 0xB6 0xBA 0xAD ...\par
Reg HKLM\\SYSTEM\\ControlSet003\\Services\\BTHPORT\\Parameters\\Keys\\0002783d0ca0 (not active ControlSet) \par
Reg HKLM\\SYSTEM\\ControlSet003\\Services\\BTHPORT\\Parameters\\Keys\\0002783d0cab (not active ControlSet) \par
Reg HKLM\\SYSTEM\\ControlSet003\\Services\\BTHPORT\\Parameters\\Keys\\0002783d0ccf (not active ControlSet) \par
Reg HKLM\\SYSTEM\\ControlSet003\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f (not active ControlSet) \par
Reg HKLM\\SYSTEM\\ControlSet003\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f@00076109d093 0xBE 0x71 0x6F 0xA2 ...\par
Reg HKLM\\SYSTEM\\ControlSet003\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f@0007610a45c5 0x63 0x0B 0x36 0x42 ...\par
Reg HKLM\\SYSTEM\\ControlSet003\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f@0012471a5b4d 0x5A 0x05 0x5B 0xF1 ...\par
Reg HKLM\\SYSTEM\\ControlSet003\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f@0001e3be7d5f 0x72 0x1B 0x9B 0x26 ...\par
Reg HKLM\\SYSTEM\\ControlSet003\\Services\\BTHPORT\\Parameters\\Keys\\00027875610f@00076108f7fb 0xA3 0xB6 0xBA 0xAD ...\par
\par
---- EOF - GMER 1.0.15 ----\par
}
#

Hier das Ergebnis des bootkit_remover:

Bootkit Remover
(c) 2009 eSage Lab
www.esagelab.com

Program version: 1.1.0.0
OS Version: Microsoft Windows Vista Home Premium Edition Service Pack 2 (build 6
002), 32-bit

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000002`80100000
Boot sector MD5 is: 4b154a99a615e82aee4f69fabfe5ed3d

Size Device Name MBR Status
--------------------------------------------
186 GB \\.\PhysicalDrive0 Unknown boot code

Unknown boot code has been found on some of your physical disks.
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>


Done;
Press any key to quit...

Hallo cosinus,

Die osam.exe wird von irgendeinem McAfee Shield, den ich nicht abschalten kann, während des Scans gelöscht. Selbst wen ich McAfee aus der autostart lösche, wird der Scan unterbrochen und die osam.exe ist gelöscht. Vielleicht hast Du ja dazu eine Idee.

Danke und Grüße
intrus