| |
| |||||||
Log-Analyse und Auswertung: TR/Crypt.XPACK.Gen3 backdoor/trojanWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
28.09.2010, 18:01
| #16 |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  TR/Crypt.XPACK.Gen3 backdoor/trojan Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus Anschließend den bootkit_remover herunterladen. Entpacke das Tool in einen eigenen Ordner auf dem Desktop und führe in diesem Ordner die Datei remove.exe aus. Wenn Du Windows Vista oder Windows 7 verwendest, musst Du die remover.exe über ein Rechtsklick => als Administrator ausführen Ein schwarzes Fenster wird sich öffnen und automatisch nach bösartigen Veränderungen im MBR suchen. Poste dann bitte, ob es Veränderungen gibt und wenn ja in welchem device. Am besten alles posten was die remover.exe ausgibt.
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
28.09.2010, 18:11
| #17 |
 | TR/Crypt.XPACK.Gen3 backdoor/trojan Sorry, meine Frage hat sich erledigt, habe die Anleitung gerade gelesen.
__________________ |
|
28.09.2010, 20:18
| #18 |
| | TR/Crypt.XPACK.Gen3 backdoor/trojan Hier erstmal der GMER log, OSAM wird noch ausgeführt.
__________________GMER Logfile: Code:
ATTFilter GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-09-28 20:51:00
Windows 5.1.2600 Service Pack 2
Running: i2vrgo4t.exe; Driver: C:\DOKUME~1\Family\LOKALE~1\Temp\axtdapod.sys
---- System - GMER 1.0.15 ----
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software) ZwClose [0xA8158110]
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software) ZwCreateFile [0xA8157920]
SSDT F7CF7436 ZwCreateKey
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software) ZwCreateProcess [0xA8156F20]
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software) ZwCreateProcessEx [0xA8156D90]
SSDT F7CF742C ZwCreateThread
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software) ZwDeleteFile [0xA8158190]
SSDT F7CF743B ZwDeleteKey
SSDT F7CF7445 ZwDeleteValueKey
SSDT \SystemRoot\system32\drivers\khips.sys (Sunbelt Kerio Host Intrusion Prevention Driver/Sunbelt Software) ZwLoadDriver [0xA75AA9A0]
SSDT F7CF744A ZwLoadKey
SSDT \SystemRoot\system32\drivers\khips.sys (Sunbelt Kerio Host Intrusion Prevention Driver/Sunbelt Software) ZwMapViewOfSection [0xA75AAB30]
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software) ZwOpenFile [0xA8157BF0]
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software) ZwOpenKey [0xA8154140]
SSDT F7CF7418 ZwOpenProcess
SSDT F7CF741D ZwOpenThread
SSDT F7CF7454 ZwReplaceKey
SSDT F7CF744F ZwRestoreKey
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software) ZwResumeThread [0xA8157510]
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software) ZwSetInformationFile [0xA8157F00]
SSDT F7CF7440 ZwSetValueKey
SSDT F7CF7427 ZwTerminateProcess
SSDT \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software) ZwWriteFile [0xA8157E50]
Code \??\C:\DOKUME~1\Family\LOKALE~1\Temp\catchme.sys pIofCallDriver
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!ZwCallbackReturn + 24DC 805011E0 2 Bytes [30, AB]
PAGENDSM NDIS.sys!NdisMIndicateStatus F7337A5F 6 Bytes JMP A814BED0 \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
? C:\DOKUME~1\Family\LOKALE~1\Temp\mbr.sys Das System kann die angegebene Datei nicht finden. !
? C:\DOKUME~1\Family\LOKALE~1\Temp\catchme.sys Das System kann die angegebene Datei nicht finden. !
? C:\WINDOWS\system32\Drivers\PROCEXP113.SYS Das System kann die angegebene Datei nicht finden. !
---- User code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\spoolsv.exe[252] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\spoolsv.exe[252] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\spoolsv.exe[252] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\spoolsv.exe[252] WS2_32.dll!socket 71A13B91 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\spoolsv.exe[252] WS2_32.dll!bind 71A13E00 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\spoolsv.exe[252] WS2_32.dll!connect 71A1406A 5 Bytes JMP 00080950
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] WS2_32.dll!socket 71A13B91 5 Bytes JMP 001308C4
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] WS2_32.dll!bind 71A13E00 5 Bytes JMP 00130838
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe[332] WS2_32.dll!connect 71A1406A 5 Bytes JMP 00130950
.text C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\svchost.exe[360] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\svchost.exe[360] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\svchost.exe[360] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00080720
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] WS2_32.dll!socket 71A13B91 5 Bytes JMP 001308C4
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] WS2_32.dll!bind 71A13E00 5 Bytes JMP 00130838
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[444] WS2_32.dll!connect 71A1406A 5 Bytes JMP 00130950
.text C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
.text C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
.text C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
.text C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
.text C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
.text C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
.text C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
.text C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
.text C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
.text C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
.text C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
.text C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
.text C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe[772] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
.text C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001601A8
.text C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00160090
.text C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00160694
.text C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!CreateProcessW 7C802332 5 Bytes JMP 001602C0
.text C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!CreateProcessA 7C802367 5 Bytes JMP 00160234
.text C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00160004
.text C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0016011C
.text C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001604F0
.text C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!CreateThread 7C81082F 5 Bytes JMP 0016057C
.text C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001603D8
.text C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0016034C
.text C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!WinExec 7C86114D 5 Bytes JMP 00160464
.text C:\WINDOWS\system32\csrss.exe[800] KERNEL32.dll!SetThreadContext 7C862849 5 Bytes JMP 00160608
.text C:\WINDOWS\system32\csrss.exe[800] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001607AC
.text C:\WINDOWS\system32\csrss.exe[800] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00160720
.text C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000701A8
.text C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00070090
.text C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00070694
.text C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000702C0
.text C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00070234
.text C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00070004
.text C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0007011C
.text C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000704F0
.text C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0007057C
.text C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000703D8
.text C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0007034C
.text C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00070464
.text C:\WINDOWS\system32\winlogon.exe[828] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00070608
.text C:\WINDOWS\system32\winlogon.exe[828] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000707AC
.text C:\WINDOWS\system32\winlogon.exe[828] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00070720
.text C:\WINDOWS\system32\winlogon.exe[828] WS2_32.dll!socket 71A13B91 5 Bytes JMP 000708C4
.text C:\WINDOWS\system32\winlogon.exe[828] WS2_32.dll!bind 71A13E00 5 Bytes JMP 00070838
.text C:\WINDOWS\system32\winlogon.exe[828] WS2_32.dll!connect 71A1406A 5 Bytes JMP 00070950
.text C:\WINDOWS\system32\services.exe[872] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\services.exe[872] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\services.exe[872] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\services.exe[872] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\services.exe[872] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\services.exe[872] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\services.exe[872] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\services.exe[872] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\services.exe[872] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\services.exe[872] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\services.exe[872] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\services.exe[872] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\services.exe[872] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\services.exe[872] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\services.exe[872] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\services.exe[872] WS2_32.dll!socket 71A13B91 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\services.exe[872] WS2_32.dll!bind 71A13E00 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\services.exe[872] WS2_32.dll!connect 71A1406A 5 Bytes JMP 00080950
.text C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\lsass.exe[884] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\lsass.exe[884] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\lsass.exe[884] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\lsass.exe[884] WS2_32.dll!socket 71A13B91 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\lsass.exe[884] WS2_32.dll!bind 71A13E00 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\lsass.exe[884] WS2_32.dll!connect 71A1406A 5 Bytes JMP 00080950
.text C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
.text C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
.text C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
.text C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
.text C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
.text C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
.text C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
.text C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
.text C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
.text C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
.text C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
.text C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
.text C:\WINDOWS\system32\UTSCSI.EXE[948] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
.text C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
.text C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
.text C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
.text C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
.text C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
.text C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
.text C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
.text C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
.text C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
.text C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
.text C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
.text C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
.text C:\WINDOWS\system32\Ati2evxx.exe[1056] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
.text C:\WINDOWS\system32\Ati2evxx.exe[1056] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
.text C:\WINDOWS\system32\Ati2evxx.exe[1056] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
.text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\svchost.exe[1072] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\svchost.exe[1072] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\svchost.exe[1072] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\svchost.exe[1072] WS2_32.dll!socket 71A13B91 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\svchost.exe[1072] WS2_32.dll!bind 71A13E00 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\svchost.exe[1072] WS2_32.dll!connect 71A1406A 5 Bytes JMP 00080950
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\svchost.exe[1140] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\svchost.exe[1140] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\svchost.exe[1140] WS2_32.dll!socket 71A13B91 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\svchost.exe[1140] WS2_32.dll!bind 71A13E00 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\svchost.exe[1140] WS2_32.dll!connect 71A1406A 5 Bytes JMP 00080950
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464
.text C:\WINDOWS\System32\svchost.exe[1372] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608
.text C:\WINDOWS\System32\svchost.exe[1372] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000807AC
.text C:\WINDOWS\System32\svchost.exe[1372] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00080720
.text C:\WINDOWS\System32\svchost.exe[1372] WS2_32.dll!socket 71A13B91 5 Bytes JMP 000808C4
.text C:\WINDOWS\System32\svchost.exe[1372] WS2_32.dll!bind 71A13E00 5 Bytes JMP 00080838
.text C:\WINDOWS\System32\svchost.exe[1372] WS2_32.dll!connect 71A1406A 5 Bytes JMP 00080950
.text C:\WINDOWS\System32\svchost.exe[1372] WININET.dll!InternetOpenW 7718AF65 5 Bytes JMP 00080DB0
.text C:\WINDOWS\System32\svchost.exe[1372] WININET.dll!InternetConnectA 771930F3 5 Bytes JMP 00080F54
.text C:\WINDOWS\System32\svchost.exe[1372] WININET.dll!InternetOpenA 771958EA 5 Bytes JMP 00080D24
.text C:\WINDOWS\System32\svchost.exe[1372] WININET.dll!InternetOpenUrlA 77195B9D 5 Bytes JMP 00080E3C
.text C:\WINDOWS\System32\svchost.exe[1372] WININET.dll!InternetConnectW 7719EE30 5 Bytes JMP 00080FE0
.text C:\WINDOWS\System32\svchost.exe[1372] WININET.dll!InternetOpenUrlW 771A5B82 5 Bytes JMP 00080EC8
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\svchost.exe[1412] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\svchost.exe[1412] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\svchost.exe[1412] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\svchost.exe[1520] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\svchost.exe[1520] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\svchost.exe[1520] WS2_32.dll!socket 71A13B91 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\svchost.exe[1520] WS2_32.dll!bind 71A13E00 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\svchost.exe[1520] WS2_32.dll!connect 71A1406A 5 Bytes JMP 00080950
.text C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
.text C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
.text C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
.text C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
.text C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
.text C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
.text C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
.text C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
.text C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
.text C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
.text C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
.text C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
.text C:\Programme\a-squared Free\a2service.exe[1576] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
.text C:\Programme\a-squared Free\a2service.exe[1576] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
.text C:\Programme\a-squared Free\a2service.exe[1576] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] WS2_32.dll!socket 71A13B91 5 Bytes JMP 001308C4
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] WS2_32.dll!bind 71A13E00 5 Bytes JMP 00130838
.text C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe[1600] WS2_32.dll!connect 71A1406A 5 Bytes JMP 00130950
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] WS2_32.dll!socket 71A13B91 5 Bytes JMP 001308C4
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] WS2_32.dll!bind 71A13E00 5 Bytes JMP 00130838
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] WS2_32.dll!connect 71A1406A 5 Bytes JMP 00130950
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1644] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
.text C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
.text C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
.text C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
.text C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
.text C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
.text C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
.text C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
.text C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
.text C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
.text C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
.text C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
.text C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
.text C:\WINDOWS\system32\CTsvcCDA.EXE[1688] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
.text C:\WINDOWS\system32\CTsvcCDA.EXE[1688] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
.text C:\WINDOWS\system32\CTsvcCDA.EXE[1688] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
.text C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
.text C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
.text C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
.text C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
.text C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
.text C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
.text C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
.text C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
.text C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
.text C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
.text C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
.text C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
.text C:\Programme\Java\jre6\bin\jqs.exe[1732] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
.text C:\Programme\Java\jre6\bin\jqs.exe[1732] WS2_32.dll!socket 71A13B91 5 Bytes JMP 001308C4
.text C:\Programme\Java\jre6\bin\jqs.exe[1732] WS2_32.dll!bind 71A13E00 5 Bytes JMP 00130838
.text C:\Programme\Java\jre6\bin\jqs.exe[1732] WS2_32.dll!connect 71A1406A 5 Bytes JMP 00130950
.text C:\Programme\Java\jre6\bin\jqs.exe[1732] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
.text C:\Programme\Java\jre6\bin\jqs.exe[1732] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
.text C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\svchost.exe[1768] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\svchost.exe[1768] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\svchost.exe[1768] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\svchost.exe[1768] WS2_32.dll!socket 71A13B91 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\svchost.exe[1768] WS2_32.dll!bind 71A13E00 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\svchost.exe[1768] WS2_32.dll!connect 71A1406A 5 Bytes JMP 00080950
.text C:\WINDOWS\system32\svchost.exe[1768] WININET.dll!InternetOpenW 7718AF65 5 Bytes JMP 00080DB0
.text C:\WINDOWS\system32\svchost.exe[1768] WININET.dll!InternetConnectA 771930F3 5 Bytes JMP 00080F54
.text C:\WINDOWS\system32\svchost.exe[1768] WININET.dll!InternetOpenA 771958EA 5 Bytes JMP 00080D24
.text C:\WINDOWS\system32\svchost.exe[1768] WININET.dll!InternetOpenUrlA 77195B9D 5 Bytes JMP 00080E3C
.text C:\WINDOWS\system32\svchost.exe[1768] WININET.dll!InternetConnectW 7719EE30 5 Bytes JMP 00080FE0
.text C:\WINDOWS\system32\svchost.exe[1768] WININET.dll!InternetOpenUrlW 771A5B82 5 Bytes JMP 00080EC8
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000301A8
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00030090
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00030694
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000302C0
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00030234
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00030004
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0003011C
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000304F0
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0003057C
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000303D8
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0003034C
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00030464
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00030608
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000307AC
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00030720
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] WS2_32.dll!socket 71A13B91 5 Bytes JMP 000308C4
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] WS2_32.dll!bind 71A13E00 5 Bytes JMP 00030838
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] WS2_32.dll!connect 71A1406A 5 Bytes JMP 00030950
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] WININET.dll!InternetOpenW 7718AF65 5 Bytes JMP 00030DB0
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] WININET.dll!InternetConnectA 771930F3 5 Bytes JMP 00030F54
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] WININET.dll!InternetOpenA 771958EA 5 Bytes JMP 00030D24
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] WININET.dll!InternetOpenUrlA 77195B9D 5 Bytes JMP 00030E3C
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] WININET.dll!InternetConnectW 7719EE30 5 Bytes JMP 00030FE0
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe[1808] WININET.dll!InternetOpenUrlW 771A5B82 5 Bytes JMP 00030EC8
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] WS2_32.dll!socket 71A13B91 5 Bytes JMP 001308C4
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] WS2_32.dll!bind 71A13E00 5 Bytes JMP 00130838
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[1848] WS2_32.dll!connect 71A1406A 5 Bytes JMP 00130950
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] WININET.dll!InternetOpenW 7718AF65 5 Bytes JMP 00130DB0
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] WININET.dll!InternetConnectA 771930F3 5 Bytes JMP 00130F54
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] WININET.dll!InternetOpenA 771958EA 5 Bytes JMP 00130D24
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] WININET.dll!InternetOpenUrlA 77195B9D 5 Bytes JMP 00130E3C
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] WININET.dll!InternetConnectW 7719EE30 5 Bytes JMP 00130FE0
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] WININET.dll!InternetOpenUrlW 771A5B82 5 Bytes JMP 00130EC8
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] WS2_32.dll!socket 71A13B91 5 Bytes JMP 001308C4
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] WS2_32.dll!bind 71A13E00 5 Bytes JMP 00130838
.text C:\Programme\Lavasoft\Ad-Aware\aawservice.exe[1896] WS2_32.dll!connect 71A1406A 5 Bytes JMP 00130950
.text C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
.text C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
.text C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
.text C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
.text C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
.text C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
.text C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
.text C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
.text C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
.text C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
.text C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
.text C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
.text C:\WINDOWS\system32\Ati2evxx.exe[2000] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
.text C:\WINDOWS\system32\Ati2evxx.exe[2000] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
.text C:\WINDOWS\system32\Ati2evxx.exe[2000] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000807AC
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00080720
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] WS2_32.dll!socket 71A13B91 5 Bytes JMP 000808C4
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] WS2_32.dll!bind 71A13E00 5 Bytes JMP 00080838
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2272] WS2_32.dll!connect 71A1406A 5 Bytes JMP 00080950
.text C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000701A8
.text C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00070090
.text C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00070694
.text C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000702C0
.text C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00070234
.text C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00070004
.text C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0007011C
.text C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000704F0
.text C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0007057C
.text C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000703D8
.text C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0007034C
.text C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00070464
.text C:\WINDOWS\system32\wscntfy.exe[2388] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00070608
.text C:\WINDOWS\system32\wscntfy.exe[2388] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000707AC
.text C:\WINDOWS\system32\wscntfy.exe[2388] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00070720
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
.text C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe[2404] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00130004
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0013011C
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001304F0
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0013057C
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001303D8
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0013034C
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00130464
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00130608
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001307AC
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00130720
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] WS2_32.dll!socket 71A13B91 5 Bytes JMP 001308C4
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] WS2_32.dll!bind 71A13E00 5 Bytes JMP 00130838
.text C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe[2540] WS2_32.dll!connect 71A1406A 5 Bytes JMP 00130950
.text C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8
.text C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090
.text C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694
.text C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0
.text C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234
.text C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004
.text C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C
.text C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0
.text C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C
.text C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8
.text C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C
.text C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464
.text C:\WINDOWS\System32\svchost.exe[2808] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608
.text C:\WINDOWS\System32\svchost.exe[2808] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000807AC
.text C:\WINDOWS\System32\svchost.exe[2808] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00080720
.text C:\WINDOWS\System32\svchost.exe[2808] WS2_32.dll!socket 71A13B91 5 Bytes JMP 000808C4
.text C:\WINDOWS\System32\svchost.exe[2808] WS2_32.dll!bind 71A13E00 5 Bytes JMP 00080838
.text C:\WINDOWS\System32\svchost.exe[2808] WS2_32.dll!connect 71A1406A 5 Bytes JMP 00080950
.text E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001401A8
.text E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00140090
.text E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00140694
.text E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001402C0
.text E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00140234
.text E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00140004
.text E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0014011C
.text E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 001404F0
.text E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0014057C
.text E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 001403D8
.text E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0014034C
.text E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00140464
.text E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00140608
.text E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 001407AC
.text E:\Alex\Anti aaaa\i2vrgo4t.exe[3356] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00140720
.text C:\WINDOWS\explorer.exe[3924] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8
.text C:\WINDOWS\explorer.exe[3924] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090
.text C:\WINDOWS\explorer.exe[3924] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694
.text C:\WINDOWS\explorer.exe[3924] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0
.text C:\WINDOWS\explorer.exe[3924] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234
.text C:\WINDOWS\explorer.exe[3924] kernel32.dll!VirtualAlloc 7C809A81 5 Bytes JMP 00080004
.text C:\WINDOWS\explorer.exe[3924] kernel32.dll!VirtualAllocEx 7C809AA2 5 Bytes JMP 0008011C
.text C:\WINDOWS\explorer.exe[3924] kernel32.dll!CreateRemoteThread 7C810626 5 Bytes JMP 000804F0
.text C:\WINDOWS\explorer.exe[3924] kernel32.dll!CreateThread 7C81082F 5 Bytes JMP 0008057C
.text C:\WINDOWS\explorer.exe[3924] kernel32.dll!CreateProcessInternalW 7C8191EB 5 Bytes JMP 000803D8
.text C:\WINDOWS\explorer.exe[3924] kernel32.dll!CreateProcessInternalA 7C81DA9E 5 Bytes JMP 0008034C
.text C:\WINDOWS\explorer.exe[3924] kernel32.dll!WinExec 7C86114D 5 Bytes JMP 00080464
.text C:\WINDOWS\explorer.exe[3924] kernel32.dll!SetThreadContext 7C862849 5 Bytes JMP 00080608
.text C:\WINDOWS\explorer.exe[3924] USER32.dll!SetWindowsHookExW 77D2E4AF 5 Bytes JMP 000807AC
.text C:\WINDOWS\explorer.exe[3924] USER32.dll!SetWindowsHookExA 77D311E9 5 Bytes JMP 00080720
.text C:\WINDOWS\explorer.exe[3924] WININET.dll!InternetOpenW 7718AF65 5 Bytes JMP 00080DB0
.text C:\WINDOWS\explorer.exe[3924] WININET.dll!InternetConnectA 771930F3 5 Bytes JMP 00080F54
.text C:\WINDOWS\explorer.exe[3924] WININET.dll!InternetOpenA 771958EA 5 Bytes JMP 00080D24
.text C:\WINDOWS\explorer.exe[3924] WININET.dll!InternetOpenUrlA 77195B9D 5 Bytes JMP 00080E3C
.text C:\WINDOWS\explorer.exe[3924] WININET.dll!InternetConnectW 7719EE30 5 Bytes JMP 00080FE0
.text C:\WINDOWS\explorer.exe[3924] WININET.dll!InternetOpenUrlW 771A5B82 5 Bytes JMP 00080EC8
.text C:\WINDOWS\explorer.exe[3924] WS2_32.dll!socket 71A13B91 5 Bytes JMP 000808C4
.text C:\WINDOWS\explorer.exe[3924] WS2_32.dll!bind 71A13E00 5 Bytes JMP 00080838
.text C:\WINDOWS\explorer.exe[3924] WS2_32.dll!connect 71A1406A 5 Bytes JMP 00080950
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [A814BCE0] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [A814BD00] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [A814BD90] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [A814BDC0] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [A814BD90] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [A814BD00] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [A814BCE0] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [A814BD90] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] [A814BDC0] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] [A814BCE0] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [A814BD00] \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Tcpip \Device\Ip fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
AttachedDevice \Driver\Tcpip \Device\Ip ntkrnlpa.exe (NT-Kernel und -System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
AttachedDevice \Driver\Tcpip \Device\Tcp ntkrnlpa.exe (NT-Kernel und -System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
AttachedDevice \Driver\Tcpip \Device\Udp ntkrnlpa.exe (NT-Kernel und -System/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)
AttachedDevice \Driver\Tcpip \Device\RawIp ntkrnlpa.exe (NT-Kernel und -System/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
|
|
28.09.2010, 20:25
| #19 |
| | TR/Crypt.XPACK.Gen3 backdoor/trojan OSAM Log:OSAM Logfile: Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 21:25:01 on 28.09.2010 OS: Windows XP Professional Service Pack 2 (Build 2600) Default Browser: Microsoft Corporation Internet Explorer 6.00.2900.2180 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Boot Execute] -----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )----- "BootExecute" - "Microsoft Corporation" - C:\WINDOWS\system32\autochk.exe "BootExecute" - ? - C:\WINDOWS\system32\lsdelete.exe (File found, but it contains no detailed information) [Common] -----( %SystemRoot%\Tasks )----- "AppleSoftwareUpdate.job" - "Apple Inc." - C:\Programme\Apple Software Update\SoftwareUpdate.exe -----( HKLM\SOFTWARE\Microsoft\Windows Scripting Host\Locations )----- "CScript" - "Microsoft Corporation" - C:\WINDOWS\System32\cscript.exe "WScript" - "Microsoft Corporation" - C:\WINDOWS\System32\wscript.exe [Control Panel Objects] -----( %SystemRoot%\system32 )----- "access.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\access.cpl "ALSNDMGR.CPL" - "Realtek Semiconductor Corp." - C:\WINDOWS\system32\ALSNDMGR.CPL "appwiz.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\appwiz.cpl "bthprops.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\bthprops.cpl "desk.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\desk.cpl "firewall.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\firewall.cpl "hdwwiz.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\hdwwiz.cpl "inetcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\inetcpl.cpl "intl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\intl.cpl "irprops.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\irprops.cpl "javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl "joy.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\joy.cpl "main.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\main.cpl "mmsys.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\mmsys.cpl "ncpa.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\ncpa.cpl "netsetup.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\netsetup.cpl "nusrmgr.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\nusrmgr.cpl "nwc.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\nwc.cpl "odbccp32.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\odbccp32.cpl "powercfg.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\powercfg.cpl "RTSndMgr.CPL" - "Realtek Semiconductor Corp." - C:\WINDOWS\system32\RTSndMgr.CPL "sysdm.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\sysdm.cpl "telephon.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\telephon.cpl "timedate.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\timedate.cpl "wscui.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\wscui.cpl "wuaucpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\wuaucpl.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\ANTIVI~1\Avira\ANTIVI~1\avconfig.cpl "Avira AntiVir PersonalEdition Classic" - ? - C:\PROGRA~1\ANTIVI~1\avconfig.cpl (File not found) "Avira AntiVir PersonalEdition Classic Konfiguration" - ? - C:\PROGRA~1\ANTIVI~1\avconfig.cpl (File not found) "DeviceControl" - "Creative Technology Ltd." - C:\Programme\Creative\SBAudigy\Device Control\USBAudio.cpl "Internet Connection Firewall" - "Microsoft Corporation" - C:\WINDOWS\system32\Firewall.cpl "NetSetupWizard" - "Microsoft Corporation" - C:\WINDOWS\system32\NetSetup.cpl "QuickTime" - "Apple Inc." - C:\Programme\QuickTime Alternative\QTSystem\QuickTime.cpl "Speech" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Speech\sapi.cpl [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "AFD" (AFD) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\afd.sys "AliIde" (AliIde) - "Acer Laboratories Inc." - C:\WINDOWS\System32\DRIVERS\aliide.sys "AMD Processor Driver" (AmdK8) - "Advanced Micro Devices" - C:\WINDOWS\System32\DRIVERS\AmdK8.sys "AnyDVD" (AnyDVD) - "SlySoft, Inc." - C:\WINDOWS\System32\Drivers\AnyDVD.sys "Apple Mobile USB Driver" (USBAAPL) - "Apple, Inc." - C:\WINDOWS\System32\Drivers\usbaapl.sys "Asynchroner RAS -Medientreiber" (AsyncMac) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\asyncmac.sys "ati2mtag" (ati2mtag) - "ATI Technologies Inc." - C:\WINDOWS\System32\DRIVERS\ati2mtag.sys "Audiostubtreiber" (audstub) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\audstub.sys "avgio" (avgio) - "Avira GmbH" - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avgio.sys "avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys "avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys "BDA Slip De-Framer" (SLIP) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\SLIP.sys "BDA-IPSink" (streamip) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\StreamIP.sys "Beep" (Beep) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Beep.sys "catchme" (catchme) - ? - C:\DOKUME~1\Family\LOKALE~1\Temp\catchme.sys (File not found) "CD-ROM-Laufwerktreiber" (Cdrom) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\cdrom.sys "Cdaudio" (Cdaudio) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Cdaudio.sys "Cdfs" (Cdfs) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Cdfs.sys "Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys (File not found) "Creative OS Services Driver" (ossrv) - "Creative Technology Ltd." - C:\WINDOWS\System32\DRIVERS\ctoss2k.sys "Creative SoundFont Management Device Driver" (ctsfm2k) - "Creative Technology Ltd" - C:\WINDOWS\System32\DRIVERS\ctsfm2k.sys "Diskettencontrollertreiber" (Fdc) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\fdc.sys "Diskettenlaufwerktreiber" (Flpydisk) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\flpydisk.sys "dmload" (dmload) - "Microsoft Corp., Veritas Software." - C:\WINDOWS\System32\drivers\dmload.sys "ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - C:\WINDOWS\System32\Drivers\ElbyCDIO.sys "Fastfat" (Fastfat) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Fastfat.sys "Filtertreiber für CD-Brennen" (Imapi) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\imapi.sys "Filtertreiber für digitale CD-Audiowiedergabe" (redbook) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\redbook.sys "Filtertreiber für IP-Verkehr" (IpFilterDriver) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys "Filtertreiber für IPX-Verkehr" (NwlnkFlt) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\nwlnkflt.sys "Filtertreiber für Systemwiederherstellung" (sr) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\sr.sys "Fips" (Fips) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Fips.sys "Firewall Driver" (fwdrv) - "Sunbelt Software" - C:\WINDOWS\system32\drivers\fwdrv.sys "FltMgr" (FltMgr) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\fltMgr.sys "Fs_Rec" (Fs_Rec) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Fs_Rec.sys "GEAR ASPI Filter Driver" (GEARAspiWDM) - "GEAR Software Inc." - C:\WINDOWS\System32\DRIVERS\GEARAspiWDM.sys "GVCplDrv" (GVCplDrv) - ? - C:\WINDOWS\system32\drivers\GVCplDrv.sys (File found, but it contains no detailed information) "HTTP" (HTTP) - "Microsoft Corporation" - C:\WINDOWS\System32\Drivers\HTTP.sys "i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys (File not found) "i8042-Tastatur- und PS/2-Mausanschluss-Treiber" (i8042prt) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\i8042prt.sys "IP/IP-Tunneltreiber" (IpInIp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ipinip.sys "IPSEC-Treiber" (IPSec) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ipsec.sys "IPv6-Windows-Firewalltreiber" (Ip6Fw) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\Ip6Fw.sys "IR-Enumeratordienst" (IRENUM) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\irenum.sys "Kerio HIPS Driver" (khips) - "Sunbelt Software" - C:\WINDOWS\system32\drivers\khips.sys "KSecDD" (KSecDD) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\KSecDD.sys "Laufwerktreiber" (Disk) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\disk.sys "lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys (File not found) "Logitech AEC Driver" (LVcKap) - "Logitech Inc." - C:\WINDOWS\System32\DRIVERS\LVcKap.sys "Logitech LVPr2Mon Driver" (LVPr2Mon) - "Logitech Inc." - C:\WINDOWS\System32\DRIVERS\LVPr2Mon.sys "Logitech Machine Vision Engine Loader" (LVMVDrv) - "Logitech Inc." - C:\WINDOWS\System32\DRIVERS\LVMVDrv.sys "m5288" (m5288) - "ULi Electronics Inc." - C:\WINDOWS\System32\DRIVERS\m5288.sys "Maus-HID-Treiber" (mouhid) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mouhid.sys "Mausklassentreiber" (Mouclass) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mouclass.sys "Microcode Updatetreiber" (Update) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\update.sys "Microsoft ACPI-Treiber" (ACPI) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ACPI.sys "Microsoft HID Class-Treiber" (hidusb) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\hidusb.sys "Microsoft Kernel GS Wavetablesynthesizer" (swmidi) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\swmidi.sys "Microsoft Kernel-Audiosplitter" (splitter) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\splitter.sys "Microsoft Kernel-DLS-Synthesizer" (DMusic) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\DMusic.sys "Microsoft Kernel-DRM-Audioentschlüsselung" (drmkaud) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\drmkaud.sys "Microsoft Kernel-Echounterdrückung" (aec) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\aec.sys "Microsoft Kernel-Systemaudiogerät" (sysaudio) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\sysaudio.sys "Microsoft Kernel-Waveaudiomixer" (kmixer) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\kmixer.sys "Microsoft Proxy für Streaming Clock" (MSPCLOCK) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\MSPCLOCK.sys "Microsoft Proxy für Streaming Quality Manager" (MSPQM) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\MSPQM.sys "Microsoft Standard-USB-Haupttreiber" (usbccgp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbccgp.sys "Microsoft Streaming Service Proxy" (MSKSSRV) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\MSKSSRV.sys "Microsoft Streaming Tee/Sink-to-Sink-Konvertierung" (MSTEE) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\MSTEE.sys "Microsoft TV-/Videoverbindung" (NdisIP) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\NdisIP.sys "Microsoft UAA-Bustreiber für High Definition Audio" (HDAudBus) - "Windows (R) Server 2003 DDK provider" - C:\WINDOWS\System32\DRIVERS\HDAudBus.sys "Microsoft USB-Druckerklasse" (usbprint) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbprint.sys "Microsoft USB-Standardhubtreiber" (usbhub) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbhub.sys "Microsoft-Systemverwaltungs-BIOS-Treiber" (mssmbios) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mssmbios.sys "Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller" (usbehci) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbehci.sys "Miniporttreiber für Microsoft USB Open Host-Controller" (usbohci) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbohci.sys "mnmdd" (mnmdd) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\mnmdd.sys "Modem" (Modem) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Modem.sys "Motorola Inc. USB Device" (MotDev) - "Motorola Inc" - C:\WINDOWS\System32\DRIVERS\motodrv.sys "Motorola USB CDC ACM Driver" (motmodem) - "Motorola" - C:\WINDOWS\System32\DRIVERS\motmodem.sys "MountMgr" (MountMgr) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\MountMgr.sys "MRXSMB" (MRxSmb) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mrxsmb.sys "Msfs" (Msfs) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Msfs.sys "Mup" (Mup) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Mup.sys "NABTS/FEC VBI-Codec" (NABTSFEC) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\NABTSFEC.sys "NDIS-Benutzermodus-E/A-Protokoll" (Ndisuio) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ndisuio.sys "NDIS-Systemtreiber" (NDIS) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\NDIS.sys "NDProxy" (NDProxy) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\NDProxy.sys "NetBios über TCP/IP" (NetBT) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\netbt.sys "NetBIOS-Schnittstelle" (NetBIOS) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\netbios.sys "Nokia USB Generic" (nmwcdc) - "Nokia" - C:\WINDOWS\System32\drivers\ccdcmbo.sys "Nokia USB Phone Parent" (nmwcd) - "Nokia" - C:\WINDOWS\System32\drivers\ccdcmb.sys "Npfs" (Npfs) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Npfs.sys "Ntfs" (Ntfs) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Ntfs.sys "Null" (Null) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Null.sys "Parallelanschluss (direkt)" (Raspti) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\raspti.sys "PartMgr" (PartMgr) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\PartMgr.sys "ParVdm" (ParVdm) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\ParVdm.sys "PCCS Mode Change Filter Driver" (pccsmcfd) - "Nokia" - C:\WINDOWS\System32\DRIVERS\pccsmcfd.sys "PCI-Bus-Treiber" (PCI) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\pci.sys "PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys (File not found) "PCIIde" (PCIIde) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\pciide.sys "PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys (File not found) "PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys (File not found) "PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys (File not found) "PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys (File not found) "PnP-ISA/EISA-Bus-Treiber" (isapnp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\isapnp.sys "Protokoll für ATM ARP-Client" (Atmarpc) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\atmarpc.sys "Prozessortreiber" (Processor) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\processr.sys "PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys "QoS-Paketplaner" (PSched) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\psched.sys "RAS-IP-ARP-Treiber" (Wanarp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\wanarp.sys "RAS-NDIS-TAPI-Treiber" (NdisTapi) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ndistapi.sys "RAS-NDIS-WAN-Treiber" (NdisWan) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ndiswan.sys "Rdbss" (Rdbss) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\rdbss.sys "RDPCDD" (RDPCDD) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\RDPCDD.sys "RDPWD" (RDPWD) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\RDPWD.sys "Redirector für WebDav-Client" (MRxDAV) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mrxdav.sys "Remotezugriff-PPPOE-Treiber" (RasPppoe) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\raspppoe.sys "SAMSUNG Mobile Modem Drivers" (sscdmdm) - "MCCI Corporation" - C:\WINDOWS\System32\DRIVERS\sscdmdm.sys "SAMSUNG Mobile Modem Filter" (sscdmdfl) - "MCCI Corporation" - C:\WINDOWS\System32\DRIVERS\sscdmdfl.sys "SAMSUNG USB Composite Device driver (WDM)" (sscdbus) - "MCCI Corporation" - C:\WINDOWS\System32\DRIVERS\sscdbus.sys "Secdrv" (Secdrv) - ? - C:\WINDOWS\System32\DRIVERS\secdrv.sys (File found, but it contains no detailed information) "Serenum-Filtertreiber" (serenum) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\serenum.sys "Service for Realtek HD Audio (WDM)" (IntcAzAudAddService) - "Realtek Semiconductor Corp." - C:\WINDOWS\System32\drivers\RtkHDAud.sys "Sfloppy" (Sfloppy) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Sfloppy.sys "Silicon Labs CP210x USB to UART Bridge Driver" (silabser) - "Silicon Laboratories" - C:\WINDOWS\System32\DRIVERS\silabser.sys "Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver" (silabenm) - "Silicon Laboratories, Inc." - C:\WINDOWS\System32\DRIVERS\silabenm.sys "Software-Bus-Treiber" (swenum) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\swenum.sys "Sound Blaster Audigy" (P17) - "Creative Technology Ltd." - C:\WINDOWS\System32\drivers\P17.sys "Srv" (Srv) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\srv.sys "ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys "Standard-IDE/ESDI-Festplattencontroller" (atapi) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\atapi.sys "Standardpaketklassifizierung" (Gpc) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\msgpc.sys "StarOpen" (StarOpen) - ? - C:\WINDOWS\system32\drivers\StarOpen.sys (File found, but it contains no detailed information) "Tastatur-HID-Treiber" (kbdhid) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\kbdhid.sys "Tastaturklassentreiber" (Kbdclass) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\kbdclass.sys "TCP/IP-Protokolltreiber" (Tcpip) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\tcpip.sys "TDPIPE" (TDPIPE) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\TDPIPE.sys "TDTCP" (TDTCP) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\TDTCP.sys "Terminal-Gerätetreiber" (TermDD) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\termdd.sys "Treiber für automatische RAS-Verbindung" (RasAcd) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\rasacd.sys "Treiber für die Verwaltung logischer Datenträger" (dmio) - "Microsoft Corp., Veritas Software" - C:\WINDOWS\System32\drivers\dmio.sys "Treiber für direkte Parallelverbindung" (Ptilink) - "Parallel Technologies, Inc." - C:\WINDOWS\System32\DRIVERS\ptilink.sys "Treiber für IPX-Verkehrsweiterleitung" (NwlnkFwd) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\nwlnkfwd.sys "Treiber für Microsoft WINMM-WDM-Audiokompatibilität" (wdmaud) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\wdmaud.sys "Treiber für parallelen Anschluss" (Parport) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\parport.sys "Treiber für seriellen Anschluss" (Serial) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\serial.sys "Treiber für Terminalserver-Geräteumleitung" (rdpdr) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\rdpdr.sys "Treiber für Volume-Manager" (Ftdisk) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ftdisk.sys "truecrypt" (truecrypt) - "TrueCrypt Foundation" - C:\WINDOWS\System32\drivers\truecrypt.sys "TT DVB-PCI driver (SAA7146n)" (SAA7146n) - "TechnoTrend AG" - C:\WINDOWS\System32\DRIVERS\saa7146n.sys "ULi M526X Ethernet NT Driver" (ULI5261XP) - "ULi Electronics Inc." - C:\WINDOWS\System32\DRIVERS\ULILAN51.SYS "Untertiteldecoder" (CCDECODE) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\CCDECODE.sys "upperdev" (upperdev) - "Nokia" - C:\WINDOWS\System32\DRIVERS\usbser_lowerflt.sys "USB Modem Driver" (usbser) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbser.sys "USB-Audiotreiber (WDM)" (usbaudio) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\usbaudio.sys "USB-Massenspeichertreiber" (USBSTOR) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS "USB-Scannertreiber" (usbscan) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbscan.sys "USB-Videogerät (WDM)" (usbvideo) - "Microsoft Corporation" - C:\WINDOWS\System32\Drivers\usbvideo.sys "UsbserFilt" (UsbserFilt) - "Nokia" - C:\WINDOWS\System32\DRIVERS\usbser_lowerfltj.sys "VgaSave" (VgaSave) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\vga.sys "Virtual DVB-S/-C/-T Network Adapter Driver" (TTLOOPHE) - "TechnoTrend AG" - C:\WINDOWS\System32\DRIVERS\ttloophe.sys "VolSnap" (VolSnap) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\VolSnap.sys "WAN-Miniport (L2TP)" (Rasl2tp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\rasl2tp.sys "WAN-Miniport (PPTP)" (PptpMiniport) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\raspptp.sys "WD SCSI Pass Thru driver" (WDC_SAM) - "Western Digital Technologies" - C:\WINDOWS\System32\DRIVERS\wdcsam.sys "Wdf01000" (Wdf01000) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\Wdf01000.sys "WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys (File not found) "Windows Driver Foundation - User-mode Driver Framework Platform Driver" (WudfPf) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\WudfPf.sys "Windows Driver Foundation - User-mode Driver Framework Reflector" (WudfRd) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\wudfrd.sys "World Standard Teletext-Codec" (WSTCODEC) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\WSTCODEC.SYS "WpdUsb" (WpdUsb) - "Microsoft Corporation" - C:\WINDOWS\System32\Drivers\wpdusb.sys "Übersetzer für IP-Netzwerkadressen" (IpNat) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ipnat.sys [Explorer] -----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )----- {7790769C-0471-11d2-AF11-00C04FA35D02} "Adressbuch 6" - "Microsoft Corporation" - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS "Browseranpassungen" - "Microsoft Corporation" - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP >{26923b43-4d38-484f-9b9e-de460746276c} "Internet Explorer" - "Microsoft Corporation" - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE {89820200-ECBD-11cf-8B85-00AA005B4383} "Internet Explorer 6" - "Microsoft Corporation" - %SystemRoot%\system32\ie4uinit.exe {44BBA840-CC51-11CF-AAFA-00AA00B6015C} "Microsoft Outlook Express 6" - "Microsoft Corporation" - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} "Microsoft Windows Media Player" - "Microsoft Corporation" - C:\WINDOWS\inf\unregmp2.exe /ShowWMP {6BF52A52-394A-11d3-B153-00C04F79FAA6} "Microsoft Windows Media Player" - "Microsoft Corporation" - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub {44BBA842-CC51-11CF-AAFA-00AA00B6015B} "NetMeeting 3.01" - "Microsoft Corporation" - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} "Outlook Express" - "Microsoft Corporation" - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE {89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install {2C7339CF-2B09-4501-B3F3-F3508C9228ED} "Themes Setup" - "Microsoft Corporation" - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll {89820200-ECBD-11cf-8B85-00AA005B4340} "Windows Desktop-Update" - "Microsoft Corporation" - regsvr32.exe /s /n /i:U shell32.dll {5945c046-1e7d-11d1-bc44-00c04fd912be} "Windows Messenger 4.7" - "Microsoft Corporation" - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll {0D2E74C4-3C34-11d2-A27E-00C04FC30871} "{0D2E74C4-3C34-11d2-A27E-00C04FC30871}" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll {24F14F01-7B1C-11d1-838f-0000F80461CF} "{24F14F01-7B1C-11d1-838f-0000F80461CF}" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll {24F14F02-7B1C-11d1-838f-0000F80461CF} "{24F14F02-7B1C-11d1-838f-0000F80461CF}" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll {66742402-F9B9-11D1-A202-0000F81FEDEE} "{66742402-F9B9-11D1-A202-0000F81FEDEE}" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll -----( HKLM\Software\Classes\Protocols\Filter )----- {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} "AP Class Install Handler filter" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll {8f6b0360-b80d-11d0-a9b3-006097942311} "AP lzdhtml encoding/decoding Filter" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll {8f6b0360-b80d-11d0-a9b3-006097942311} "AP lzdhtml encoding/decoding Filter" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll {8f6b0360-b80d-11d0-a9b3-006097942311} "AP lzdhtml encoding/decoding Filter" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL {733AC4CB-F1A4-11d0-B951-00A0C90312E1} "WebView MIME Filter" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll -----( HKLM\Software\Classes\Protocols\Handler )----- {3dd53d40-7b8b-11D0-b013-00aa0059ce02} "CDL: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll {32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\11\OWC11.DLL {3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL {12D51199-0DB5-46FE-A120-47A3D7D937CC} "DVD: Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\msvidctl.dll {79eac9e7-baf9-11ce-8c82-00aa004ba90b} "file:, local: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll {79eac9e7-baf9-11ce-8c82-00aa004ba90b} "file:, local: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll {79eac9e3-baf9-11ce-8c82-00aa004ba90b} "ftp: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll {79eac9e4-baf9-11ce-8c82-00aa004ba90b} "gopher: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll {79eac9e2-baf9-11ce-8c82-00aa004ba90b} "http: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll {79eac9e5-baf9-11ce-8c82-00aa004ba90b} "https: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL {05300401-BCBC-11d0-85E3-00C04FD85AB4} "MHTML Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\inetcomm.dll {3050F406-98B5-11CF-BB82-00AA00BDCE0B} "Microsoft HTML About Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\mshtml.dll {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} "Microsoft HTML Javascript Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\mshtml.dll {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} "Microsoft HTML Javascript Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\mshtml.dll {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} "Microsoft HTML Mailto Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\mshtml.dll {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} "Microsoft HTML Resource Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\mshtml.dll {76E67A63-06E9-11D2-A840-006008059382} "Microsoft HTML Resource Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\mshtml.dll {9D148291-B9C8-11D0-A4CC-0000F80149F6} "Microsoft InfoTech Protocols for IE 4.0" - "Microsoft Corporation" - C:\WINDOWS\system32\itss.dll {9D148291-B9C8-11D0-A4CC-0000F80149F6} "Microsoft InfoTech Protocols for IE 4.0" - "Microsoft Corporation" - C:\WINDOWS\system32\itss.dll {0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL {79eac9e6-baf9-11ce-8c82-00aa004ba90b} "mk: Asychronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} "TV: Pluggable Protocol" - "Microsoft Corporation" - C:\WINDOWS\system32\msvidctl.dll {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} "WiaProtocol Class" - "Microsoft Corporation" - C:\WINDOWS\system32\wiascr.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler )----- {438755C2-A8BA-11D1-B96B-00A0C90312E1} "Browseui preloader" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {8C7461EF-2B13-11d2-BE35-3078302C2030} "Component Categories cache daemon" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )----- {AEB6717E-7E19-11d0-97EE-00C04FD91972} "URL Exec Hook" - "Microsoft Corporation" - C:\WINDOWS\system32\shell32.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {01E04581-4EEE-11d0-BFE9-00AA005B4383} "&Adresse" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {32714800-2E5F-11d0-8B85-00AA0044F941} "&Nach Personen..." - "Microsoft Corporation" - C:\Programme\Outlook Express\wabfind.dll {7e653215-fa25-46bd-a339-34a2790f3cb7} "Accessible" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} "Acrobat Elements Context Menu" - "Adobe Systems Inc." - C:\Programme\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll {88C6C381-2E85-11D0-94DE-444553540000} "ActiveX-Cacheordner" - "Microsoft Corporation" - C:\WINDOWS\system32\occache.dll {A08C11D2-A228-11d0-825B-00AA005B4383} "Address EditBox" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {85BBD920-42A0-1069-A2E4-08002B30309D} "Aktenkoffer" - "Microsoft Corporation" - C:\WINDOWS\system32\syncui.dll {875CB1A1-0F29-45de-A1AE-CFB4950D0B78} "Audio Media Properties Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\shmedia.dll {91EA3F8B-C99B-11d0-9815-00C04FD91972} "Augmented Shell Folder" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {6413BA2C-B461-11d1-A18A-080036B11A03} "Augmented Shell Folder 2" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {2559a1f3-21d7-11d4-bdaf-00c04f60b9f0} "Ausführen..." - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {5F327514-6C5E-4d60-8F16-D07FA08A78ED} "Auto Update Property Sheet Extension" - "Microsoft Corporation" - C:\WINDOWS\system32\wuaucpl.cpl {00E7B358-F65B-4dcf-83DF-CD026B94BFD4} "Automatische Diashowwiedergabe der Shell" - "Microsoft Corporation" - C:\WINDOWS\system32\shimgvw.dll {87D62D94-71B3-4b9a-9489-5FE6850DC73E} "Avi Properties Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\shmedia.dll {F61FFEC1-754F-11d0-80CA-00AA005B4383} "BandProxy" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {7A9D77BD-5403-11d2-8785-2E0420524153} "Benutzerkonten" - "Microsoft Corporation" - C:\WINDOWS\system32\netplwiz.dll {add36aa8-751a-4579-a266-d66f5202ccbb} "Bestellung von Abzügen über das Internet" - "Microsoft Corporation" - C:\WINDOWS\system32\netplwiz.dll {67EA19A0-CCEF-11d0-8024-00C04FD75D13} "CDF Extension Copy Hook" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {f39a0dc0-9cc8-11d0-a599-00c04fd64433} "Channel" - "Microsoft Corporation" - C:\WINDOWS\system32\cdfview.dll {f3da0dc0-9cc8-11d0-a599-00c04fd64437} "Channel Menu Handler Object" - "Microsoft Corporation" - C:\WINDOWS\system32\cdfview.dll {f3ea0dc0-9cc8-11d0-a599-00c04fd64438} "Channel Shortcut Property Pages" - "Microsoft Corporation" - C:\WINDOWS\system32\cdfview.dll {f3ba0dc0-9cc8-11d0-a599-00c04fd64435} "Channelhandlerobjekt" - "Microsoft Corporation" - C:\WINDOWS\system32\cdfview.dll {f3aa0dc0-9cc8-11d0-a599-00c04fd64434} "Channelverknüpfung" - "Microsoft Corporation" - C:\WINDOWS\system32\cdfview.dll {7D559C10-9FE9-11d0-93F7-00AA0059CE02} "Code Download Agent" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll {BD472F60-27FA-11cf-B8B4-444553540000} "Compressed (zipped) Folder Right Drag Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\zipfldr.dll {888DCA60-FC0A-11CF-8F0F-00C04FD7D062} "Compressed (zipped) Folder SendTo Target" - "Microsoft Corporation" - C:\WINDOWS\system32\zipfldr.dll {E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31} "CompressedFolder" - "Microsoft Corporation" - C:\WINDOWS\system32\zipfldr.dll {E6CC6978-6B6E-11D0-BECA-00C04FD940BE} "ConnectionAgent" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll {42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll (File not found) {42071713-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Bildschirme" - "Microsoft Corporation" - C:\WINDOWS\system32\deskmon.dll {42071712-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Grafikkarten" - "Microsoft Corporation" - C:\WINDOWS\system32\deskadp.dll {7444C717-39BF-11D1-8CD9-00C04FC29D45} "CryptPKO Class" - "Microsoft Corporation" - C:\WINDOWS\system32\cryptext.dll {7444C719-39BF-11D1-8CD9-00C04FC29D45} "CryptSig Class" - "Microsoft Corporation" - C:\WINDOWS\system32\cryptext.dll {6935DB93-21E8-4ccc-BEB9-9FE3C77A297A} "Custom MRU AutoCompleted List" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {CFCCC7A0-A282-11D1-9082-006008059382} "Darwin App Publisher" - "Microsoft Corporation" - C:\WINDOWS\system32\appwiz.cpl {ECCDF543-45CC-11CE-B9BF-0080C87CDBA6} "DfsShell Class" - "Microsoft Corporation" - C:\WINDOWS\system32\dfsshlex.dll {62AE1F9A-126A-11D0-A14B-0800361B1103} "Directory Context Menu Verbs" - "Microsoft Corporation" - C:\WINDOWS\system32\dsuiext.dll {163FDC20-2ABC-11d0-88F0-00A024AB2DBB} "Directory Object Find" - "Microsoft Corporation" - C:\WINDOWS\system32\dsquery.dll {0D45D530-764B-11d0-A1CA-00AA00C16E65} "Directory Property UI" - "Microsoft Corporation" - C:\WINDOWS\system32\dsuiext.dll {8A23E65E-31C2-11d0-891C-00A024AB2DBB} "Directory Query UI" - "Microsoft Corporation" - C:\WINDOWS\system32\dsquery.dll {F020E586-5264-11d1-A532-0000F8757D7E} "Directory Start/Search Find" - "Microsoft Corporation" - C:\WINDOWS\system32\dsquery.dll {f92e8c40-3d33-11d2-b1aa-080036a75b03} "Display TroubleShoot CPL Extension" - "Microsoft Corporation" - C:\WINDOWS\system32\deskperf.dll {22BF0C20-6DA7-11D0-B373-00A0C9034938} "Download Status" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {60fd46de-f830-4894-a628-6fa81bc0190d} "Drop-Zielobjekt für den Fotodruck-Assistent" - "Microsoft Corporation" - C:\WINDOWS\system32\photowiz.dll {2559a1f5-21d7-11d4-bdaf-00c04f60b9f0} "E-Mail" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {00022613-0000-0000-C000-000000000046} "Eigenschaften für Multimediadatei" - "Microsoft Corporation" - C:\WINDOWS\system32\mmsys.cpl {596AB062-B4D2-4215-9F74-E9109B0A8153} "Eigenschaftenseite für vorherige Versionen" - "Microsoft Corporation" - C:\WINDOWS\system32\twext.dll {8BE13461-936F-11D1-A87D-444553540000} "Eraser Shell Extension" - "-" - C:\WINDOWS\system32\erasext.dll {1F2E5C40-9550-11CE-99D2-00AA006E086C} "Erweiterung der Sicherheitsshell" - "Microsoft Corporation" - C:\WINDOWS\system32\rshx32.dll {4E40F770-369C-11d0-8922-00A024AB2DBB} "Erweiterung der Sicherheitsshell" - "Microsoft Corporation" - C:\WINDOWS\system32\dssec.dll {F37C5810-4D3F-11d0-B4BF-00AA00BBB723} "Erweiterung der Sicherheitsshell" - "Microsoft Corporation" - C:\WINDOWS\system32\rshx32.dll {59099400-57FF-11CE-BD94-0020AF85B590} "Erweiterung für Datenträgerkopien" - "Microsoft Corporation" - C:\WINDOWS\system32\diskcopy.dll {EFA24E64-B078-11d0-89E4-00C04FC9E26E} "Explorer-Band" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {692F0339-CBAA-47e6-B5B5-3B84DB604E87} "Extensions Manager Folder" - "Microsoft Corporation" - C:\WINDOWS\system32\extmgr.dll {7A80E4A8-8005-11D2-BCF8-00C04F72C717} "ExtractIcon Class" - "Microsoft Corporation" - C:\WINDOWS\System32\mmcshext.dll {EFA24E61-B078-11d0-89E4-00C04FC9E26E} "Favorites Band" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {3F30C968-480A-4C6C-862D-EFC0897BB84B} "GDI+ Dateiminiaturansicht-Extrahierungsprogramm" - "Microsoft Corporation" - C:\WINDOWS\system32\shimgvw.dll {D6277990-4C6A-11CF-8D87-00AA0060F5BF} "Geplante Tasks" - "Microsoft Corporation" - C:\WINDOWS\system32\mstask.dll {EF8AD2D1-AE36-11D1-B2D2-006097DF8C11} "Global Folder Settings" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {2559a1f1-21d7-11d4-bdaf-00c04f60b9f0} "Hilfe und Support" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {EFA24E62-B078-11d0-89E4-00C04FC9E26E} "History Band" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {EAB841A0-9550-11cf-8C16-00805F1408F3} "HTML-Extrahierungsprogramm" - "Microsoft Corporation" - C:\WINDOWS\system32\shimgvw.dll {88895560-9AA2-1069-930E-00AA0030EBC8} "HyperTerminal Icon Ext" - "Hilgraeve, Inc." - C:\WINDOWS\system32\hticons.dll {DBCE2480-C732-101B-BE72-BA78E9AD5B27} "ICC-Profil" - "Microsoft Corporation" - C:\WINDOWS\system32\icmui.dll {675F097E-4C4D-11D0-B6C1-0800091AA605} "ICM-Druckerverwaltung" - "Microsoft Corporation" - C:\WINDOWS\system32\icmui.dll {5DB2625A-54DF-11D0-B6C4-0800091AA605} "ICM-Monitorverwaltung" - "Microsoft Corporation" - C:\WINDOWS\System32\icmui.dll {176d6597-26d3-11d1-b350-080036a75b03} "ICM-Scannerverwaltung" - "Microsoft Corporation" - C:\WINDOWS\system32\icmui.dll {3028902F-6374-48b2-8DC6-9725E775B926} "IE Microsoft AutoComplete" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {30D02401-6A81-11d0-8274-00C04FD5AE38} "IE Search Band" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {A2B0DD40-CC59-11d0-A3A5-00C04FD706EC} "IE4 Suite-Begrüßungsbildschirm" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {169A0691-8DF9-11d1-A1C4-00C04FD75D13} "In-pane search" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {0B124F8F-91F0-11D1-B8B5-006008059382} "Installed Apps Enumerator" - "Microsoft Corporation" - C:\WINDOWS\system32\appwiz.cpl {2559a1f4-21d7-11d4-bdaf-00c04f60b9f0} "Internet" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {3DC7A020-0ACD-11CF-A9BB-00AA004AE837} "Internet" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {871C5380-42A0-1069-A2EA-08002B30309D} "Internet Name Space" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {FBF23B40-E3F0-101B-8488-00AA003E56F8} "Internetverknüpfung" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {131A6951-7F78-11D0-A979-00C04FD705A2} "ISFBand OC" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Programme\iTunes\iTunesMiniPlayer.dll {0CD7A5C0-9F37-11CE-AE65-08002B2E1262} "Kabinettdatei" - "Microsoft Corporation" - C:\WINDOWS\system32\cabview.dll {513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8} "Kompatibilitätsseite" - "Microsoft Corporation" - C:\WINDOWS\system32\SlayerXP.dll {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? - (File not found | COM-object registry key not found) {143A62C8-C33B-11D1-84FE-00C04FA34A14} "Microsoft Agent Character Property Sheet Handler" - "Microsoft Corporation" - C:\WINDOWS\msagent\agentpsh.dll {A5E46E3A-8849-11D1-9D8C-00C04FC99D61} "Microsoft Browser Architecture" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {7BA4C742-9E81-11CF-99D3-00AA004AE837} "Microsoft BrowserBand" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {7988B573-EC89-11cf-9C00-00AA00A14F56} "Microsoft Disk Quota UI" - "Microsoft Corporation" - C:\WINDOWS\system32\dskquoui.dll {6A205B57-2567-4A2C-B881-F787FAB579A3} "Microsoft DocProp Inplace Calendar Control" - "Microsoft Corporation" - C:\WINDOWS\system32\docprop2.dll {0EEA25CC-4362-4A12-850B-86EE61B0D3EB} "Microsoft DocProp Inplace Droplist Combo Control" - "Microsoft Corporation" - C:\WINDOWS\system32\docprop2.dll {A9CF0EAE-901A-4739-A481-E35B73E47F6D} "Microsoft DocProp Inplace Edit Box Control" - "Microsoft Corporation" - C:\WINDOWS\system32\docprop2.dll {8EE97210-FD1F-4B19-91DA-67914005F020} "Microsoft DocProp Inplace ML Edit Box Control" - "Microsoft Corporation" - C:\WINDOWS\system32\docprop2.dll {28F8A4AC-BBB3-4D9B-B177-82BFC914FA33} "Microsoft DocProp Inplace Time Control" - "Microsoft Corporation" - C:\WINDOWS\system32\docprop2.dll {883373C3-BF89-11D1-BE35-080036B11A03} "Microsoft DocProp Shell Ext" - "Microsoft Corporation" - C:\WINDOWS\system32\docprop2.dll {63da6ec0-2e98-11cf-8d82-444553540000} "Microsoft FTP Folder" - "Microsoft Corporation" - C:\WINDOWS\system32\msieftp.dll {00BB2764-6A77-11D0-A535-00C04FD7D062} "Microsoft History AutoComplete List" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {5E6AB780-7743-11CF-A12B-00AA004AE837} "Microsoft Internet Toolbar" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {00BB2765-6A77-11D0-A535-00C04FD7D062} "Microsoft Multiple AutoComplete List Container" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\OFFICE11\msohev.dll {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll {2206CDB2-19C1-11D1-89E0-00C04FD7A829} "Microsoft OLE DB Service Component Data Links" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\System\Ole DB\oledb32.dll {03C036F1-A186-11D0-824A-00AA005B4383} "Microsoft Shell Folder AutoComplete List" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {CFBFAE00-17A6-11D0-99CB-00C04FD64497} "Microsoft Url Sucheingriff" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {3C374A40-BAE4-11CF-BF7D-00AA006946EE} "Microsoft URL-Verlauf-Dienst" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {A6FD9E45-6E44-43f9-8644-08598F5A74D9} "Midi Properties Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\shmedia.dll {6756A641-DE71-11d0-831B-00AA005B4383} "MRU AutoComplete List" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {ECF03A33-103D-11d2-854D-006008059367} "MyDocs Copy Hook" - "Microsoft Corporation" - C:\WINDOWS\system32\mydocs.dll {ECF03A32-103D-11d2-854D-006008059367} "MyDocs Drop Target" - "Microsoft Corporation" - C:\WINDOWS\system32\mydocs.dll {4a7ded0a-ad25-11d0-98a8-0800361b1103} "MyDocs menu and properties" - "Microsoft Corporation" - C:\WINDOWS\system32\mydocs.dll {7007ACC7-3202-11D1-AAD2-00805FC1270E} "Netzwerkverbindungen" - "Microsoft Corporation" - C:\WINDOWS\system32\NETSHELL.dll {992CFFA0-F557-101A-88EC-00DD010CCC48} "Netzwerkverbindungen" - "Microsoft Corporation" - C:\WINDOWS\system32\NETSHELL.dll {10CFC467-4392-11d2-8DB4-00C04FA31A66} "Offline Files Folder Options" - "Microsoft Corporation" - C:\WINDOWS\System32\cscui.dll {750fdf0e-2a26-11d1-a3ea-080036587f03} "Offline Files Menu" - "Microsoft Corporation" - C:\WINDOWS\System32\cscui.dll {3EA48300-8CF6-101B-84FB-666CCB9BCD32} "OLE-Eigenschaftenseite für Dokumente" - "Microsoft Corporation" - C:\WINDOWS\system32\docprop.dll {63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice Property Sheet Handler" - ? - C:\Programme\StarOffice7\program\shlxthdl.dll {AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E} "Ordner 'Offlinedateien'" - "Microsoft Corporation" - C:\WINDOWS\System32\cscui.dll {58f1f272-9240-4f51-b6d4-fd63d1618591} "Passport-Assistent" - "Microsoft Corporation" - C:\WINDOWS\system32\netplwiz.dll {41E300E0-78B6-11ce-849B-444553540000} "PlusPack CPL-Erweiterung" - "Microsoft Corporation" - C:\WINDOWS\system32\themeui.dll {35786D3C-B075-49b9-88DD-029876E11C01} "Portable Devices" - "Microsoft Corporation" - C:\WINDOWS\system32\wpdshext.dll {D6791A63-E7E2-4fee-BF52-5DED8E86E9B8} "Portable Devices Menu" - "Microsoft Corporation" - C:\WINDOWS\system32\wpdshext.dll {640167b4-59b0-47a6-b335-a6b3c0695aea} "Portable Media Devices" - "Microsoft Corporation" - C:\WINDOWS\system32\Audiodev.dll {D8BD2030-6FC9-11D0-864F-00AA006809D9} "PostAgent" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Programme\Real\RealPlayer\rpshell.dll {AF4F6510-F982-11d0-8595-00AA004CD6D8} "Registry Tree Options Utility" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {F0152790-D56E-4445-850E-4F3117DB740C} "Remote Sessions CPL Extension" - "Microsoft Corporation" - C:\WINDOWS\system32\remotepg.dll {3F953603-1008-4f6e-A73A-04AAC7A992F1} "Scanner und Kameras" - "Microsoft Corporation" - C:\WINDOWS\system32\wiashext.dll {83bbcbf3-b28a-4919-a5aa-73027445d672} "Scanner und Kameras" - "Microsoft Corporation" - C:\WINDOWS\system32\wiashext.dll {905667aa-acd6-11d2-8080-00805f6596d2} "Scanner und Kameras" - "Microsoft Corporation" - C:\WINDOWS\system32\wiashext.dll {E211B736-43FD-11D1-9EFB-0000F8757FCD} "Scanner und Kameras" - "Microsoft Corporation" - C:\WINDOWS\system32\wiashext.dll {FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD} "Scanner und Kameras" - "Microsoft Corporation" - C:\WINDOWS\system32\wiashext.dll {DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF} "Scheduling UI icon handler" - "Microsoft Corporation" - C:\WINDOWS\system32\mstask.dll {797F1E90-9EDD-11cf-8D8E-00AA0060F5BF} "Scheduling UI property sheet handler" - "Microsoft Corporation" - C:\WINDOWS\system32\mstask.dll {BD84B380-8CA2-1069-AB1D-08000948F534} "Schriftarten" - "Microsoft Corporation" - C:\WINDOWS\system32\fontext.dll {D20EA4E1-3957-11d2-A40B-0C5020524152} "Schriftarten" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {9461b922-3c5a-11d2-bf8b-00c04fb93661} "Search Assistant OC" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {9E56BE60-C50F-11CF-9A2C-00A0C90A90CE} "Sendmail service" - "Microsoft Corporation" - C:\WINDOWS\system32\sendmail.dll {9E56BE61-C50F-11CF-9A2C-00A0C90A90CE} "Sendmail service" - "Microsoft Corporation" - C:\WINDOWS\system32\sendmail.dll {2559a1f7-21d7-11d4-bdaf-00c04f60b9f0} "Set Program Access and Defaults" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {352EC2B7-8B9A-11D1-B8AE-006008059382} "Shell Application Manager" - "Microsoft Corporation" - C:\WINDOWS\system32\appwiz.cpl {0A89A860-D7B1-11CE-8350-444553540000} "Shell Automation Inproc Service" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {ECD4FC4E-521C-11D0-B792-00A0C90312E1} "Shell Band Site Menu" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {ECD4FC4C-521C-11D0-B792-00A0C90312E1} "Shell DeskBar" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {3CCF8A41-5C85-11d0-9796-00AA00B90ADF} "Shell DeskBarApp" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {E7E4BC40-E76A-11CE-A9BB-00AA004AE837} "Shell DocObject Viewer" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\shlext.dll {60254CA5-953B-11CF-8C96-00AA00B8708C} "Shell Extension For Windows Script Host" - "Microsoft Corporation" - C:\WINDOWS\system32\wshext.dll {66e4e4fb-f385-4dd0-8d74-a2efd1bc6178} "Shell Image Data Factory" - "Microsoft Corporation" - C:\WINDOWS\system32\shimgvw.dll {eb9b1153-3b57-4e68-959a-a3266bc3d7fe} "Shell Image Property Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\shimgvw.dll {e84fda7c-1d6a-45f6-b725-cb260c236066} "Shell Image Verbs" - "Microsoft Corporation" - C:\WINDOWS\system32\shimgvw.dll {00BB2763-6A77-11D0-A535-00C04FD7D062} "Shell Microsoft AutoComplete" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {9E51E0D0-6E0F-11d2-9601-00C04FA31A86} "Shell properties for a DS object" - "Microsoft Corporation" - C:\WINDOWS\system32\dsquery.dll {ECD4FC4D-521C-11D0-B792-00A0C90312E1} "Shell Rebar BandSite" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {21569614-B795-46b1-85F4-E737A8DC09AD} "Shell Search Band" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {56117100-C0CD-101B-81E2-00AA004AE837} "Shell-Datenauszughandler" - "Microsoft Corporation" - C:\WINDOWS\system32\shscrap.dll {77597368-7b15-11d0-a0c2-080036af3f03} "Shellerweiterung für Webdrucker" - "Microsoft Corporation" - C:\WINDOWS\system32\printui.dll {764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? - (File not found | COM-object registry key not found) {40dd6e20-7c17-11ce-a804-00aa003ca9f6} "Shellerweiterungen für Freigaben" - "Microsoft Corporation" - C:\WINDOWS\system32\ntshrui.dll {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} "Shellerweiterungen für Freigaben" - "Microsoft Corporation" - C:\WINDOWS\system32\ntshrui.dll {59be4990-f85c-11ce-aff7-00aa003ca9f6} "Shellerweiterungen für Microsoft Windows-Netzwerkobjekte" - "Microsoft Corporation" - C:\WINDOWS\system32\ntlanui2.dll {6b33163c-76a5-4b6c-bf21-45de9cd503a1} "Shellobjekt des Webpublishing-Assistenten" - "Microsoft Corporation" - C:\WINDOWS\system32\netplwiz.dll {5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Programme\ATI Technologies\ATI.ACE\atiacmxx.dll {F5175861-2688-11d0-9C5E-00AA00A45957} "Subscription Folder" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll {ABBE31D0-6DAE-11D0-BECA-00C04FD940BE} "Subscription Mgr" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll {2559a1f0-21d7-11d4-bdaf-00c04f60b9f0} "Suchen" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {0DF44EAA-FF21-4412-828E-260A8728E7F1} "Taskleiste und Startmenü" - "Microsoft Corporation" - C:\WINDOWS\system32\shell32.dll {7BD29E00-76C1-11CF-9DD0-00A0C9034933} "Temporary Internet Files" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {7BD29E01-76C1-11CF-9DD0-00A0C9034933} "Temporary Internet Files" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {acf35015-526e-4230-9596-becbe19f0ac9} "Track Popup Bar" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7} "TrayAgent" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll {7376D660-C583-11d0-A3A5-00C04FD706EC} "TridentImageExtractor" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {DD313E04-FEFF-11d1-8ECD-0000F87A470C} "User Assist" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {FF393560-C2A7-11CF-BFF4-444553540000} "Verlauf" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {D20EA4E1-3957-11d2-A40B-0C5020524153} "Verwaltung" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {40C3D757-D6E4-4b49-BB41-0E5BBEA28817} "Video Media Properties Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\shmedia.dll {c5a40261-cd64-4ccf-84cb-c394da41d590} "Video Thumbnail Extractor" - "Microsoft Corporation" - C:\WINDOWS\system32\shmedia.dll {9DB7A13C-F208-4981-8353-73CC61AE2783} "Vorherige Versionen" - "Microsoft Corporation" - C:\WINDOWS\system32\twext.dll {E4B29F9D-D390-480b-92FD-7DDB47101D71} "Wav Properties Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\shmedia.dll {07798131-AF23-11d1-9111-00A0C98BA67D} "Web Search" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll {E6FB5E20-DE35-11CF-9C87-00AA005127ED} "WebCheck" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll {7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB} "WebCheck SyncMgr Handler" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll {E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB} "WebCheckChannelAgent" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll {08165EA0-E946-11CF-9C87-00AA005127ED} "WebCheckWebCrawler" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll {BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL {CC6EEFFB-43F6-46c5-9619-51D571967F7D} "Webpublishing-Assistent" - "Microsoft Corporation" - C:\WINDOWS\system32\netplwiz.dll {2559a1f2-21d7-11d4-bdaf-00c04f60b9f0} "Windows-Sicherheit" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll (File found, but it contains no detailed information) {F1B9284F-E9DC-4e68-9D7E-42362A59F0FD} "WMP Add To Playlist Launcher" - "Microsoft Corporation" - C:\WINDOWS\system32\wmpshell.dll {8DD448E6-C188-4aed-AF92-44956194EB1F} "WMP Burn Audio CD Launcher" - "Microsoft Corporation" - C:\WINDOWS\system32\wmpshell.dll {CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C} "WMP Play As Playlist Launcher" - "Microsoft Corporation" - C:\WINDOWS\system32\wmpshell.dll {9DBD2C50-62AD-11d0-B806-00C04FD706EC} "Zusammenfassungs-Miniaturansichthandler (DOCFILES)" - "Microsoft Corporation" - C:\WINDOWS\system32\shimgvw.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad )----- {7849596a-48ea-486e-8937-a2a3009f31a9} "PostBootReminder object" - "Microsoft Corporation" - C:\WINDOWS\system32\shell32.dll {fbeb8a05-beee-4442-804e-409d6c4515e9} "ShellFolder for CD Burning" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll {35CEC8A3-2BE6-11D2-8773-92E220524153} "SysTray" - "Microsoft Corporation" - C:\WINDOWS\system32\stobject.dll {E6FB5E20-DE35-11CF-9C87-00AA005127ED} "WebCheck" - "Microsoft Corporation" - C:\WINDOWS\system32\webcheck.dll {AAA288BA-9A4C-45B0-95D7-94D524869DB5} "WPDShServiceObj Class" - "Microsoft Corporation" - C:\WINDOWS\system32\WPDShServiceObj.dll [Internet Explorer] -----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )----- {EFA24E64-B078-11D0-89E4-00C04FC9E26E} "Explorer-Band" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll {C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} "File Search Explorer Band" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll {21569614-B795-46B1-85F4-E737A8DC09AD} "Shell Search Band" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- <binary data> "&Adresse" - "Microsoft Corporation" - C:\WINDOWS\system32\browseui.dll <binary data> "&Links" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll <binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll <binary data> "ITBarLayout" - ? - (File not found | COM-object registry key not found) -----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )----- {CFBFAE00-17A6-11D0-99CB-00C04FD64497} "Microsoft Url Sucheingriff" - "Microsoft Corporation" - C:\WINDOWS\system32\shdocvw.dll -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} "CInstallLPCtrl Object" - "SanDisk Corporation" - C:\WINDOWS\Downloaded Program Files\InstallLP.dll / hxxp://u3.sandisk.com/download/apps/LPInstaller.CAB {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} "Java Plug-in 1.4.2" - "JavaSoft / Sun Microsystems, Inc." - C:\Programme\Java\j2re1.4.2\bin\npjpi142.dll / hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} "Java Plug-in 1.6.0_03" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_03\bin\npjpi160_03.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Sun Microsystems, Inc." - C:\Programme\Java\jre1.6.0_07\bin\npjpi160_07.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_14" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_14.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} "Java Plug-in 1.6.0_14" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_14.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_14" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_14.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab {D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10a.ocx / hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- {53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll "Messenger" - "Microsoft Corporation" - C:\Programme\Messenger\msmsgs.exe {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension )----- "Ulead COOL 360 Viewer" - "Ulead Systems, Inc." - C:\Programme\Internet Explorer\Plugins\NPUPano.dll -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )----- <binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll {327C2873-E90D-4c37-AA9D-10AC9BABA46C} "Easy-WebPrint" - ? - C:\Programme\Canon Drucker\Easy-WebPrint\Toolband.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {AE7CD045-E861-484f-8273-0445EE161910} "Adobe PDF Conversion Toolbar Helper" - "Adobe Systems Incorporated" - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll {E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll {53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [Known DLLs] -----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs )----- "advapi32" - "Microsoft Corporation" - C:\WINDOWS\system32\advapi32.dll "comdlg32" - "Microsoft Corporation" - C:\WINDOWS\system32\comdlg32.dll "gdi32" - "Microsoft Corporation" - C:\WINDOWS\system32\gdi32.dll "imagehlp" - "Microsoft Corporation" - C:\WINDOWS\system32\imagehlp.dll "kernel32" - "Microsoft Corporation" - C:\WINDOWS\system32\kernel32.dll "lz32" - "Microsoft Corporation" - C:\WINDOWS\system32\lz32.dll "ole32" - "Microsoft Corporation" - C:\WINDOWS\system32\ole32.dll "oleaut32" - "Microsoft Corporation" - C:\WINDOWS\system32\oleaut32.dll "olecli32" - "Microsoft Corporation" - C:\WINDOWS\system32\olecli32.dll "olecnv32" - "Microsoft Corporation" - C:\WINDOWS\system32\olecnv32.dll "olesvr32" - "Microsoft Corporation" - C:\WINDOWS\system32\olesvr32.dll "olethk32" - "Microsoft Corporation" - C:\WINDOWS\system32\olethk32.dll "rpcrt4" - "Microsoft Corporation" - C:\WINDOWS\system32\rpcrt4.dll "shell32" - "Microsoft Corporation" - C:\WINDOWS\system32\shell32.dll "url" - "Microsoft Corporation" - C:\WINDOWS\system32\url.dll "urlmon" - "Microsoft Corporation" - C:\WINDOWS\system32\urlmon.dll "user32" - "Microsoft Corporation" - C:\WINDOWS\system32\user32.dll "version" - "Microsoft Corporation" - C:\WINDOWS\system32\version.dll "wininet" - "Microsoft Corporation" - C:\WINDOWS\system32\wininet.dll "wldap32" - "Microsoft Corporation" - C:\WINDOWS\system32\wldap32.dll [LSA Providers] -----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )----- "Authentication packages" - "Microsoft Corporation" - C:\WINDOWS\system32\msv1_0.dll "Notification packages" - "Microsoft Corporation" - C:\WINDOWS\system32\scecli.dll "Security Packages" - "Microsoft Corporation" - C:\WINDOWS\system32\kerberos.dll "Security Packages" - "Microsoft Corporation" - C:\WINDOWS\system32\msv1_0.dll "Security Packages" - "Microsoft Corporation" - C:\WINDOWS\system32\schannel.dll "Security Packages" - "Microsoft Corporation" - C:\WINDOWS\system32\wdigest.dll -----( HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders )----- "SecurityProviders" - "Microsoft Corporation" - C:\WINDOWS\system32\msapsspc.dll "SecurityProviders" - "Microsoft Corporation" - C:\WINDOWS\system32\schannel.dll "SecurityProviders" - "Microsoft Corporation" - C:\WINDOWS\system32\digest.dll "SecurityProviders" - "Microsoft Corporation" - C:\WINDOWS\system32\msnsspc.dll [Logon] -----( %AllUsersProfile%\Startmenü\Programme\Autostart )----- "Catalyst System Tray.lnk" - "ATI Technologies Inc." - C:\Programme\ATI Technologies\ATI.ACE\CLI.exe (Shortcut exists | File exists) "desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini -----( %UserProfile%\Startmenü\Programme\Autostart )----- "desktop.ini" - ? - C:\Dokumente und Einstellungen\Family\Startmenü\Programme\Autostart\desktop.ini "RocketDock.exe.lnk" - ? - C:\Programme\RocketDock\RocketDock.exe (Shortcut exists | File found, but it contains no detailed information | File exists) -----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon )----- "Shell" - "Microsoft Corporation" - C:\WINDOWS\Explorer.exe "Userinit" - "Microsoft Corporation" - C:\WINDOWS\system32\userinit.exe -----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )----- "StartupPrograms" - "Microsoft Corporation" - C:\WINDOWS\system32\rdpclip.exe -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "AEZBProc" - "IBM Corporation" - c:\ibmtools\aptezbtn\aptezbp.exe "ATICCC" - "ATI Technologies Inc." - "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime "avgnt" - "Avira GmbH" - "C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avgnt.exe" /min "CTSysVol" - "Creative Technology Ltd" - C:\Programme\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r "Easy-PrintToolBox" - "CANON INC." - C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon "iTunesHelper" - "Apple Inc." - "C:\Programme\iTunes\iTunesHelper.exe" "LogitechCommunicationsManager" - "Logitech Inc." - "C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe" "LogitechQuickCamRibbon" - "Logitech Inc." - "C:\Programme\Logitech\QuickCam10\QuickCam10.exe" /hide "NeroFilterCheck" - "Ahead Software Gmbh" - C:\WINDOWS\system32\NeroCheck.exe "NokiaMServer" - "Nokia" - C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer /watchfiles startup "Omnipage" - "ScanSoft, Inc" - C:\Programme\ScanSoft\OmniPageSE\opware32.exe "P17Helper" - ? - Rundll32 P17.dll,P17Helper "QuickTime Task" - "Apple Inc." - "C:\Programme\QuickTime Alternative\QTTask.exe" -atboottime "REGSHAVE" - "FUJI PHOTO FILM CO., LTD." - C:\Programme\REGSHAVE\REGSHAVE.EXE /AUTORUN "RTHDCPL" - "Realtek Semiconductor Corp." - RTHDCPL.EXE "SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Java\jre6\bin\jusched.exe" "UserFaultCheck" - "Microsoft Corporation" - %systemroot%\system32\dumprep 0 -u [Network Providers] -----( HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order )----- "Microsoft Windows-Netzwerk" - "Microsoft Corporation" - C:\WINDOWS\System32\ntlanman.dll "Microsoft-Terminaldienste" - "Microsoft Corporation" - C:\WINDOWS\System32\drprov.dll "Web Client Network" - "Microsoft Corporation" - C:\WINDOWS\System32\davclnt.dll [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "Adobe PDF Port" - "Adobe Systems Incorporated." - C:\WINDOWS\system32\AdobePDF.dll "BJ Language Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\cnbjmon.dll "Canon BJ Language Monitor iP5200" - "CANON INC." - C:\WINDOWS\system32\CNMLM79.DLL "Local Port" - "Microsoft Corporation" - C:\WINDOWS\system32\localspl.dll "Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\mdimon.dll "PJL Language Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\pjlmon.dll "Standard TCP/IP Port" - "Microsoft Corporation" - C:\WINDOWS\system32\tcpmon.dll "USB Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\usbmon.dll [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "a-squared Free Service" (a2free) - "Emsi Software GmbH" - C:\Programme\a-squared Free\a2service.exe "Ablagemappe" (ClipSrv) - "Microsoft Corporation" - C:\WINDOWS\system32\clipsrv.exe "Anmeldedienst" (Netlogon) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe "Anwendungsverwaltung" (AppMgmt) - "Microsoft Corporation" - C:\WINDOWS\System32\appmgmts.dll "Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe "Arbeitsstationsdienst" (lanmanworkstation) - "Microsoft Corporation" - C:\WINDOWS\System32\wkssvc.dll "ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe "Ati HotKey Poller" (Ati HotKey Poller) - "ATI Technologies Inc." - C:\WINDOWS\system32\Ati2evxx.exe "ATI Smart" (ATI Smart) - ? - C:\WINDOWS\system32\ati2sgag.exe "Automatische Updates" (wuauserv) - "Microsoft Corporation" - C:\WINDOWS\system32\wuauserv.dll "Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe "Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe "CLCV0" (UTSCSI) - ? - C:\WINDOWS\system32\UTSCSI.EXE "COM+-Ereignissystem" (EventSystem) - "Microsoft Corporation" - C:\WINDOWS\system32\es.dll "COM+-Systemanwendung" (COMSysApp) - "Microsoft Corporation" - C:\WINDOWS\system32\dllhost.exe "Computerbrowser" (Browser) - "Microsoft Corporation" - C:\WINDOWS\System32\browser.dll "Creative Service for CDROM Access" (Creative Service for CDROM Access) - "Creative Technology Ltd" - C:\WINDOWS\system32\CTsvcCDA.EXE "CryptSvc" (CryptSvc) - "Microsoft Corporation" - C:\WINDOWS\System32\cryptsvc.dll "DCOM-Server-Prozessstart" (DcomLaunch) - "Microsoft Corporation" - C:\WINDOWS\system32\rpcss.dll "Designs" (Themes) - "Microsoft Corporation" - C:\WINDOWS\System32\shsvcs.dll "DHCP-Client" (Dhcp) - "Microsoft Corporation" - C:\WINDOWS\System32\dhcpcsvc.dll "Dienst für Seriennummern der tragbaren Medien" (WmdmPmSN) - "Microsoft Corporation" - C:\WINDOWS\system32\MsPMSNSv.dll "Distributed Transaction Coordinator" (MSDTC) - "Microsoft Corporation" - C:\WINDOWS\system32\msdtc.exe "DNS-Client" (Dnscache) - "Microsoft Corporation" - C:\WINDOWS\System32\dnsrslvr.dll "Druckwarteschlange" (Spooler) - "Microsoft Corporation" - C:\WINDOWS\system32\spoolsv.exe "Ereignisprotokoll" (Eventlog) - "Microsoft Corporation" - C:\WINDOWS\system32\services.exe "Fehlerberichterstattungsdienst" (ERSvc) - "Microsoft Corporation" - C:\WINDOWS\System32\ersvc.dll "FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Macrovision Europe Ltd." - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe "Gatewaydienst auf Anwendungsebene" (ALG) - "Microsoft Corporation" - C:\WINDOWS\System32\alg.exe "Geschützter Speicher" (ProtectedStorage) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe "HID Input Service" (HidServ) - ? - C:\WINDOWS\System32\hidserv.dll (File not found) "Hilfe und Support" (helpsvc) - "Microsoft Corporation" - C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll "HTTP-SSL" (HTTPFilter) - "Microsoft Corporation" - C:\WINDOWS\System32\w3ssl.dll "IMAPI-CD-Brenn-COM-Dienste" (ImapiService) - "Microsoft Corporation" - C:\WINDOWS\system32\imapi.exe "Indexdienst" (CiSvc) - "Microsoft Corporation" - C:\WINDOWS\system32\cisvc.exe "InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe "Intelligenter Hintergrundübertragungsdienst" (BITS) - "Microsoft Corporation" - C:\WINDOWS\system32\qmgr.dll "iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Programme\iPod\bin\iPodService.exe "IPSEC-Dienste" (PolicyAgent) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe "Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe "Kompatibilität für schnelle Benutzerumschaltung" (FastUserSwitchingCompatibility) - "Microsoft Corporation" - C:\WINDOWS\System32\shsvcs.dll "Konfigurationsfreie drahtlose Verbindung" (WZCSVC) - "Microsoft Corporation" - C:\WINDOWS\System32\wzcsvc.dll "Lavasoft Ad-Aware Service" (aawservice) - "Lavasoft" - C:\Programme\Lavasoft\Ad-Aware\aawservice.exe "Leistungsdatenprotokolle und Warnungen" (SysmonLog) - "Microsoft Corporation" - C:\WINDOWS\system32\smlogsvc.exe "LVCOMSer" (LVCOMSer) - "Logitech Inc." - C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe "LVSrvLauncher" (LVSrvLauncher) - "Logitech Inc." - C:\Programme\Gemeinsame Dateien\LogiShrd\SrvLnch\SrvLnch.exe "MS Software Shadow Copy Provider" (SwPrv) - "Microsoft Corporation" - C:\WINDOWS\system32\dllhost.exe "NetMeeting-Remotedesktop-Freigabe" (mnmsrvc) - "Microsoft Corporation" - C:\WINDOWS\system32\mnmsrvc.exe "Netzwerkverbindungen" (Netman) - "Microsoft Corporation" - C:\WINDOWS\System32\netman.dll "Netzwerkversorgungsdienst" (xmlprov) - "Microsoft Corporation" - C:\WINDOWS\System32\xmlprov.dll "NLA (Network Location Awareness)" (Nla) - "Microsoft Corporation" - C:\WINDOWS\System32\mswsock.dll "NT-LM-Sicherheitsdienst" (NtLmSsp) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe "Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE "Plug & Play" (PlugPlay) - "Microsoft Corporation" - C:\WINDOWS\system32\services.exe "Process Monitor" (LVPrcSrv) - "Logitech Inc." - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe "QoS-RSVP" (RSVP) - "Microsoft Corporation" - C:\WINDOWS\system32\rsvp.exe "RAS-Verbindungsverwaltung" (RasMan) - "Microsoft Corporation" - C:\WINDOWS\System32\rasmans.dll "Remote-Registrierung" (RemoteRegistry) - "Microsoft Corporation" - C:\WINDOWS\system32\regsvc.dll "Remoteprozeduraufruf (RPC)" (RpcSs) - "Microsoft Corporation" - C:\WINDOWS\System32\rpcss.dll "RPC-Locator" (RpcLocator) - "Microsoft Corporation" - C:\WINDOWS\system32\locator.exe "Secondary Logon" (seclogon) - "Microsoft Corporation" - C:\WINDOWS\System32\seclogon.dll "Server" (lanmanserver) - "Microsoft Corporation" - C:\WINDOWS\System32\srvsvc.dll "ServiceLayer" (ServiceLayer) - "Nokia" - C:\Programme\PC Connectivity Solution\ServiceLayer.exe "Shellhardwareerkennung" (ShellHWDetection) - "Microsoft Corporation" - C:\WINDOWS\System32\shsvcs.dll "Sicherheitscenter" (wscsvc) - "Microsoft Corporation" - C:\WINDOWS\system32\wscsvc.dll "Sicherheitskontenverwaltung" (SamSs) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe "Sitzungs-Manager für Remotedesktophilfe" (RDSessMgr) - "Microsoft Corporation" - C:\WINDOWS\system32\sessmgr.exe "Smartcard" (SCardSvr) - "Microsoft Corporation" - C:\WINDOWS\System32\SCardSvr.exe "SSDP-Suchdienst" (SSDPSRV) - "Microsoft Corporation" - C:\WINDOWS\System32\ssdpsrv.dll "Sunbelt Kerio Personal Firewall 4" (KPF4) - "Sunbelt Software" - C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe "Systemereignisbenachrichtigung" (SENS) - "Microsoft Corporation" - C:\WINDOWS\system32\sens.dll "Systemwiederherstellungsdienst" (srservice) - "Microsoft Corporation" - C:\WINDOWS\system32\srsvc.dll "Taskplaner" (Schedule) - "Microsoft Corporation" - C:\WINDOWS\system32\schedsvc.dll "TCP/IP-NetBIOS-Hilfsprogramm" (LmHosts) - "Microsoft Corporation" - C:\WINDOWS\System32\lmhsvc.dll "Telefonie" (TapiSrv) - "Microsoft Corporation" - C:\WINDOWS\System32\tapisrv.dll "Telnet" (TlntSvr) - "Microsoft Corporation" - C:\WINDOWS\system32\tlntsvr.exe "Terminaldienste" (TermService) - "Microsoft Corporation" - C:\WINDOWS\System32\termsrv.dll "Treibererweiterungen für Windows-Verwaltungsinstrumentation" (Wmi) - "Microsoft Corporation" - C:\WINDOWS\System32\advapi32.dll "Ulead Burning Helper" (UleadBurningHelper) - "Ulead Systems, Inc." - C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe "Universeller Plug & Play-Gerätehost" (upnphost) - "Microsoft Corporation" - C:\WINDOWS\System32\upnphost.dll "Unterbrechungsfreie Stromversorgung" (UPS) - "Microsoft Corporation" - C:\WINDOWS\System32\ups.exe "Verwaltung für automatische RAS-Verbindung" (RasAuto) - "Microsoft Corporation" - C:\WINDOWS\System32\rasauto.dll "Verwaltung logischer Datenträger" (dmserver) - "Microsoft Corp." - C:\WINDOWS\System32\dmserver.dll "Verwaltungsdienst für die Verwaltung logischer Datenträger" (dmadmin) - "Microsoft Corp., Veritas Software" - C:\WINDOWS\System32\dmadmin.exe "Volumeschattenkopie" (VSS) - "Microsoft Corporation" - C:\WINDOWS\System32\vssvc.exe "Webclient" (WebClient) - "Microsoft Corporation" - C:\WINDOWS\System32\webclnt.dll "Wechselmedien" (NtmsSvc) - "Microsoft Corporation" - C:\WINDOWS\system32\ntmssvc.dll "Windows Audio" (AudioSrv) - "Microsoft Corporation" - C:\WINDOWS\System32\audiosrv.dll "Windows Driver Foundation - User-mode Driver Framework" (WudfSvc) - "Microsoft Corporation" - C:\WINDOWS\System32\WUDFSvc.dll "Windows Installer" (MSIServer) - "Microsoft Corporation" - C:\WINDOWS\system32\msiexec.exe "Windows-Bilderfassung (WIA)" (stisvc) - "Microsoft Corporation" - C:\WINDOWS\system32\wiaservc.dll "Windows-Firewall/Gemeinsame Nutzung der Internetverbindung" (SharedAccess) - "Microsoft Corporation" - C:\WINDOWS\System32\ipnathlp.dll "Windows-Verwaltungsinstrumentation" (winmgmt) - "Microsoft Corporation" - C:\WINDOWS\system32\wbem\WMIsvc.dll "WMI-Leistungsadapter" (WmiApSrv) - "Microsoft Corporation" - C:\WINDOWS\system32\wbem\wmiapsrv.exe "Überwachung verteilter Verknüpfungen (Client)" (TrkWks) - "Microsoft Corporation" - C:\WINDOWS\system32\trkwks.dll [Winlogon] -----( HKCU\Control Panel\IOProcs )----- "MVB" - ? - mvfs32.dll (File not found) -----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon )----- "UIHost" - "Microsoft Corporation" - C:\WINDOWS\system32\logonui.exe "VmApplet" - "Microsoft Corporation" - C:\WINDOWS\system32\sysdm.cpl -----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )----- {0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63} "Drahtlos" - "Microsoft Corporation" - C:\WINDOWS\system32\gptext.dll {B1BE8D72-6EAC-11D2-A4EA-00C04F79F83A} "EFS recovery" - "Microsoft Corporation" - C:\WINDOWS\system32\scecli.dll {25537BA6-77A8-11D2-9B6C-0000F8080861} "Folder Redirection" - "Microsoft Corporation" - C:\WINDOWS\system32\fdeploy.dll {A2E30F80-D7DE-11d2-BBDE-00C04F86AE3B} "Internet Explorer-Branding" - "Microsoft Corporation" - C:\WINDOWS\system32\iedkcs32.dll {4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3} "Internet Explorer-Zonenzuordnung" - "Microsoft Corporation" - C:\WINDOWS\system32\iedkcs32.dll {e437bc1c-aa7d-11d2-a382-00c04f991e27} "IP-Sicherheit" - "Microsoft Corporation" - C:\WINDOWS\system32\gptext.dll {C631DF4C-088F-4156-B058-4375F0853CD8} "Microsoft Offline Files" - "Microsoft Corporation" - C:\WINDOWS\System32\cscui.dll {3610eda5-77ef-11d2-8dc5-00c04fa31a66} "Microsoft-Datenträgerkontingent" - "Microsoft Corporation" - C:\WINDOWS\system32\dskquota.dll {426031c0-0b47-4852-b0ca-ac3d37bfcb39} "QoS-Paketplaner" - "Microsoft Corporation" - C:\WINDOWS\system32\gptext.dll {827D319E-6EAC-11D2-A4EA-00C04F79F83A} "Security" - "Microsoft Corporation" - C:\WINDOWS\system32\scecli.dll {42B5FAAE-6536-11d2-AE5A-0000F87571E3} "Skripts" - "Microsoft Corporation" - C:\WINDOWS\system32\gptext.dll {c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - "Microsoft Corporation" - C:\WINDOWS\system32\appmgmts.dll -----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )----- "AtiExtEvent" - "ATI Technologies Inc." - C:\WINDOWS\system32\Ati2evxx.dll "crypt32chain" - "Microsoft Corporation" - C:\WINDOWS\system32\crypt32.dll "cryptnet" - "Microsoft Corporation" - C:\WINDOWS\system32\cryptnet.dll "cscdll" - "Microsoft Corporation" - C:\WINDOWS\system32\cscdll.dll "ScCertProp" - "Microsoft Corporation" - C:\WINDOWS\system32\wlnotify.dll "Schedule" - "Microsoft Corporation" - C:\WINDOWS\system32\wlnotify.dll "sclgntfy" - "Microsoft Corporation" - C:\WINDOWS\system32\sclgntfy.dll "SensLogn" - "Microsoft Corporation" - C:\WINDOWS\system32\WlNotify.dll "termsrv" - "Microsoft Corporation" - C:\WINDOWS\system32\wlnotify.dll "wlballoon" - "Microsoft Corporation" - C:\WINDOWS\system32\wlnotify.dll [Winsock Providers] -----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )----- "mdnsNSP" - "Apple Inc." - C:\Programme\Bonjour\mdnsNSP.dll "NLA-Namespace" - "Microsoft Corporation" - C:\WINDOWS\System32\mswsock.dll "NTDS" - "Microsoft Corporation" - C:\WINDOWS\System32\winrnr.dll "TCP/IP" - "Microsoft Corporation" - C:\WINDOWS\System32\mswsock.dll -----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )----- "MSAFD NetBIOS [\Device\NetBT_Tcpip_{38720C4D-3B78-4976-802B-DBB578E25317}] DATAGRAM 2" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll "MSAFD NetBIOS [\Device\NetBT_Tcpip_{38720C4D-3B78-4976-802B-DBB578E25317}] SEQPACKET 2" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll "MSAFD NetBIOS [\Device\NetBT_Tcpip_{4A6A7E60-D124-4E64-94DE-22D605A8A5C3}] DATAGRAM 4" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll "MSAFD NetBIOS [\Device\NetBT_Tcpip_{4A6A7E60-D124-4E64-94DE-22D605A8A5C3}] SEQPACKET 4" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll "MSAFD NetBIOS [\Device\NetBT_Tcpip_{4B12BFD7-BC30-41C2-9F29-B78B0468BDF9}] DATAGRAM 3" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll "MSAFD NetBIOS [\Device\NetBT_Tcpip_{4B12BFD7-BC30-41C2-9F29-B78B0468BDF9}] SEQPACKET 3" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll "MSAFD NetBIOS [\Device\NetBT_Tcpip_{4E4822C3-AFF7-4CE3-8355-763F4C00A93B}] DATAGRAM 0" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll "MSAFD NetBIOS [\Device\NetBT_Tcpip_{4E4822C3-AFF7-4CE3-8355-763F4C00A93B}] SEQPACKET 0" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll "MSAFD NetBIOS [\Device\NetBT_Tcpip_{D5DE6FA2-CC4E-4123-B4C0-992C4BD742C7}] DATAGRAM 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll "MSAFD NetBIOS [\Device\NetBT_Tcpip_{D5DE6FA2-CC4E-4123-B4C0-992C4BD742C7}] SEQPACKET 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll "MSAFD Tcpip [RAW/IP]" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll "MSAFD Tcpip [TCP/IP]" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll "MSAFD Tcpip [UDP/IP]" - "Microsoft Corporation" - C:\WINDOWS\system32\mswsock.dll "RSVP TCP Service Provider" - "Microsoft Corporation" - C:\WINDOWS\system32\rsvpsp.dll "RSVP UDP Service Provider" - "Microsoft Corporation" - C:\WINDOWS\system32\rsvpsp.dll ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru Geändert von aware (28.09.2010 um 20:30 Uhr) |
|
28.09.2010, 20:36
| #20 |
| | TR/Crypt.XPACK.Gen3 backdoor/trojan Bootkit Remover output: (c) 2009 eSage Lab esage lab - main Program version: 1.2.0.0 OS Version: Microsoft Windows XP Professional Service Pack 2 (build System volume is \\.\C: \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 ATA_Read(): DeviceIoControl() ERROR 1 Boot sector MD5 is: 5ddc20efcc4d1dab37c348c7db7289cf Size Device Name MBR Status -------------------------------------------- 149 GB \\.\PhysicalDrive0 Unknown boot code Unknown boot code has been found on some of your physical disks. To inspect the boot code manually, dump the master boot sector: remover.exe dump <device_name> [output_file] To disinfect the master boot sector, use the following command: remover.exe fix <device_name> Done; Press any key to quit... |
|
28.09.2010, 20:55
| #21 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Crypt.XPACK.Gen3 backdoor/trojan Downloade Dir bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
__________________ --> TR/Crypt.XPACK.Gen3 backdoor/trojan |
|
28.09.2010, 20:59
| #22 |
| | TR/Crypt.XPACK.Gen3 backdoor/trojan MBRCheck, version 1.2.3 (c) 2010, AD Command-line: Windows Version: Windows XP Professional Windows Information: Service Pack 2 (build 2600) Logical Drives Mask: 0x000001fd Kernel Drivers (total 138): 0x804D7000 \WINDOWS\system32\ntkrnlpa.exe 0x806CE000 \WINDOWS\system32\hal.dll 0xF7B1C000 \WINDOWS\system32\KDCOM.DLL 0xF7A2C000 \WINDOWS\system32\BOOTVID.dll 0xF74EC000 ACPI.sys 0xF7B1E000 \WINDOWS\system32\DRIVERS\WMILIB.SYS 0xF74DB000 pci.sys 0xF761C000 isapnp.sys 0xF7BE4000 pciide.sys 0xF789C000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS 0xF7B20000 aliide.sys 0xF762C000 MountMgr.sys 0xF74BC000 ftdisk.sys 0xF7B22000 dmload.sys 0xF7496000 dmio.sys 0xF78A4000 PartMgr.sys 0xF763C000 VolSnap.sys 0xF747E000 atapi.sys 0xF744A000 m5288.sys 0xF7432000 \WINDOWS\system32\DRIVERS\SCSIPORT.SYS 0xF764C000 disk.sys 0xF765C000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS 0xF7413000 fltMgr.sys 0xF7401000 sr.sys 0xF766C000 PxHelp20.sys 0xF73EA000 KSecDD.sys 0xF73D7000 WudfPf.sys 0xF734A000 Ntfs.sys 0xF731D000 NDIS.sys 0xF7303000 Mup.sys 0xF76AC000 \SystemRoot\system32\DRIVERS\AmdK8.sys 0xF6738000 \SystemRoot\system32\DRIVERS\ati2mtag.sys 0xF6724000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS 0xF65D0000 \SystemRoot\system32\drivers\P17.sys 0xF65AE000 \SystemRoot\system32\drivers\portcls.sys 0xF76BC000 \SystemRoot\system32\drivers\drmk.sys 0xF658B000 \SystemRoot\system32\drivers\ks.sys 0xF655B000 \SystemRoot\system32\DRIVERS\ctoss2k.sys 0xF6535000 \SystemRoot\system32\DRIVERS\ctsfm2k.sys 0xF76CC000 \SystemRoot\system32\DRIVERS\saa7146n.sys 0xF79BC000 \SystemRoot\system32\DRIVERS\ULILAN51.SYS 0xF79C4000 \SystemRoot\system32\DRIVERS\usbohci.sys 0xF6512000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0xF79CC000 \SystemRoot\system32\DRIVERS\usbehci.sys 0xF6501000 \SystemRoot\system32\DRIVERS\serial.sys 0xF72C3000 \SystemRoot\system32\DRIVERS\serenum.sys 0xF79D4000 \SystemRoot\system32\DRIVERS\fdc.sys 0xF64ED000 \SystemRoot\system32\DRIVERS\parport.sys 0xF76DC000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0xF79DC000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0xF76EC000 \SystemRoot\system32\DRIVERS\imapi.sys 0xF64D7000 \SystemRoot\System32\Drivers\AnyDVD.sys 0xF76FC000 \SystemRoot\system32\DRIVERS\cdrom.sys 0xF770C000 \SystemRoot\system32\DRIVERS\redbook.sys 0xF771C000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys 0xF7C87000 \SystemRoot\system32\DRIVERS\audstub.sys 0xF772C000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0xF72BB000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0xF64C0000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0xF773C000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0xF774C000 \SystemRoot\system32\DRIVERS\raspptp.sys 0xF79E4000 \SystemRoot\system32\DRIVERS\TDI.SYS 0xF64AF000 \SystemRoot\system32\DRIVERS\psched.sys 0xF775C000 \SystemRoot\system32\DRIVERS\msgpc.sys 0xF79EC000 \SystemRoot\system32\DRIVERS\ptilink.sys 0xF79F4000 \SystemRoot\system32\DRIVERS\raspti.sys 0xF79FC000 \SystemRoot\system32\DRIVERS\ttloophe.sys 0xF647E000 \SystemRoot\system32\DRIVERS\rdpdr.sys 0xF776C000 \SystemRoot\system32\DRIVERS\termdd.sys 0xF7A04000 \SystemRoot\system32\DRIVERS\mouclass.sys 0xF7B64000 \SystemRoot\system32\DRIVERS\swenum.sys 0xF644A000 \SystemRoot\system32\DRIVERS\update.sys 0xF7ABC000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0xF68E0000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xF5D48000 \SystemRoot\system32\DRIVERS\usbhub.sys 0xF7BA0000 \SystemRoot\system32\DRIVERS\USBD.SYS 0xA9635000 \SystemRoot\system32\DRIVERS\flpydisk.sys 0xF7BAE000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xF7C8D000 \SystemRoot\System32\Drivers\Null.SYS 0xF7BB0000 \SystemRoot\System32\Drivers\Beep.SYS 0xA9625000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0xA961D000 \SystemRoot\System32\drivers\vga.sys 0xF7BB4000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xF7BB6000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xA7CA8000 \SystemRoot\system32\drivers\fwdrv.sys 0xA9605000 \SystemRoot\System32\Drivers\Msfs.SYS 0xA95FD000 \SystemRoot\System32\Drivers\Npfs.SYS 0xF5E1C000 \SystemRoot\system32\DRIVERS\rasacd.sys 0xA7C95000 \SystemRoot\system32\DRIVERS\ipsec.sys 0xA7C3D000 \SystemRoot\system32\DRIVERS\tcpip.sys 0xA7C0B000 \SystemRoot\system32\DRIVERS\netbt.sys 0xA7BE9000 \SystemRoot\System32\drivers\afd.sys 0xA9596000 \SystemRoot\system32\DRIVERS\netbios.sys 0xA95F5000 \SystemRoot\System32\Drivers\StarOpen.SYS 0xA7BB4000 \SystemRoot\System32\drivers\truecrypt.sys 0xA95ED000 \SystemRoot\system32\DRIVERS\ssmdrv.sys 0xA7B7F000 \SystemRoot\system32\DRIVERS\rdbss.sys 0xA7AE8000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xA7AC9000 \SystemRoot\system32\drivers\khips.sys 0xA37CE000 \SystemRoot\system32\DRIVERS\ipnat.sys 0xA6866000 \SystemRoot\system32\DRIVERS\wanarp.sys 0xA6856000 \SystemRoot\System32\Drivers\Fips.SYS 0xA6E9F000 \SystemRoot\system32\DRIVERS\usbprint.sys 0xA6E97000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0xF72DF000 \SystemRoot\system32\DRIVERS\hidusb.sys 0xF68D0000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0xF7AF4000 \SystemRoot\system32\DRIVERS\usbscan.sys 0xF79AC000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS 0xA0061000 \SystemRoot\system32\DRIVERS\LVMVDrv.sys 0xA0017000 \SystemRoot\System32\Drivers\usbvideo.sys 0xA942C000 \SystemRoot\system32\drivers\usbaudio.sys 0x9FDD4000 \SystemRoot\system32\DRIVERS\LVcKap.sys 0xA7EAB000 \SystemRoot\system32\DRIVERS\mouhid.sys 0x9DEC9000 \SystemRoot\System32\Drivers\ElbyCDIO.sys 0x9D4E5000 \SystemRoot\system32\DRIVERS\avipbb.sys 0xA760E000 \??\C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avgio.sys 0xBF800000 \SystemRoot\System32\win32k.sys 0x9D686000 \SystemRoot\System32\drivers\Dxapi.sys 0x9DEB9000 \SystemRoot\System32\watchdog.sys 0xBF9C2000 \SystemRoot\System32\drivers\dxg.sys 0xA3A62000 \SystemRoot\System32\drivers\dxgthk.sys 0xBF9D4000 \SystemRoot\System32\ati2dvag.dll 0xBFA13000 \SystemRoot\System32\ati2cqag.dll 0xBFA4C000 \SystemRoot\System32\atikvmag.dll 0xBFA81000 \SystemRoot\System32\ati3duag.dll 0xBFCD4000 \SystemRoot\System32\ativvaxx.dll 0x9B4D1000 \SystemRoot\system32\DRIVERS\avgntflt.sys 0x9DF4D000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0x9B486000 \SystemRoot\System32\Drivers\Fastfat.SYS 0xF68B0000 \SystemRoot\System32\Drivers\Cdfs.SYS 0x9B3F9000 \SystemRoot\system32\drivers\wdmaud.sys 0x9DB24000 \SystemRoot\system32\drivers\sysaudio.sys 0x9B3A4000 \SystemRoot\system32\DRIVERS\mrxdav.sys 0x9D6A4000 \SystemRoot\System32\Drivers\ParVdm.SYS 0x9B0AA000 \SystemRoot\system32\DRIVERS\srv.sys 0xF78EC000 \SystemRoot\system32\DRIVERS\LVPr2Mon.sys 0x9A991000 \SystemRoot\System32\Drivers\HTTP.sys 0x7C910000 \WINDOWS\system32\ntdll.dll Processes (total 57): 0 System Idle Process 4 System 732 C:\WINDOWS\system32\smss.exe 804 csrss.exe 832 C:\WINDOWS\system32\winlogon.exe 876 C:\WINDOWS\system32\services.exe 888 C:\WINDOWS\system32\lsass.exe 1056 C:\WINDOWS\system32\ati2evxx.exe 1072 C:\WINDOWS\system32\svchost.exe 1140 svchost.exe 1340 C:\WINDOWS\system32\svchost.exe 1452 C:\WINDOWS\system32\svchost.exe 1560 C:\WINDOWS\system32\ati2evxx.exe 1620 C:\WINDOWS\explorer.exe 1716 svchost.exe 1972 svchost.exe 220 C:\Programme\Lavasoft\Ad-Aware\aawservice.exe 416 C:\WINDOWS\system32\spoolsv.exe 460 C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe 476 C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe 628 C:\Programme\ATI Technologies\ATI.ACE\CLI.exe 636 C:\WINDOWS\system32\rundll32.exe 652 C:\Programme\Creative\SBAudigy\Surround Mixer\CTSysVol.exe 680 C:\ibmtools\aptezbtn\aptezbp.exe 712 C:\Programme\ScanSoft\OmniPageSE\opware32.exe 748 C:\WINDOWS\RTHDCPL.EXE 776 C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe 780 C:\Programme\Logitech\QuickCam10\QuickCam10.exe 800 C:\Programme\Java\jre6\bin\jusched.exe 808 C:\Programme\iTunes\iTunesHelper.exe 952 C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avgnt.exe 960 C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe 1192 C:\Programme\RocketDock\RocketDock.exe 1712 C:\ibmtools\aptezbtn\rakusb.exe 1864 C:\Programme\a-squared Free\a2service.exe 1880 C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe 1920 C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 1956 C:\WINDOWS\system32\CTSVCCDA.EXE 188 C:\Programme\Java\jre6\bin\jqs.exe 244 C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe 260 C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe 1348 C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe 1184 C:\WINDOWS\system32\svchost.exe 2092 C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe 2152 C:\WINDOWS\system32\UTSCSI.EXE 2648 C:\Programme\iPod\bin\iPodService.exe 2728 C:\WINDOWS\system32\wscntfy.exe 2916 C:\WINDOWS\system32\wbem\wmiapsrv.exe 3112 C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe 3216 alg.exe 1540 C:\Programme\Sunbelt Software\Personal Firewall\kpf4gui.exe 1500 C:\Programme\Gemeinsame Dateien\LogiShrd\LQCVFX\COCIManager.exe 2464 C:\Programme\ATI Technologies\ATI.ACE\CLI.exe 1844 C:\WINDOWS\system32\svchost.exe 2684 C:\DOKUME~1\Family\LOKALE~1\temp\TeamViewer\Version5\TeamViewer.exe 3236 C:\DOKUME~1\Family\LOKALE~1\temp\TeamViewer\Version5\TeamViewer_Desktop.exe 3904 C:\Dokumente und Einstellungen\Family\Desktop\MBRCheck.exe \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) \\.\E: --> \\.\PhysicalDrive0 at offset 0x00000004`801f5c00 (NTFS) PhysicalDrive0 Model Number: SAMSUNGHD160JJ, Rev: ZM100-41 Size Device Name MBR Status -------------------------------------------- 149 GB \\.\PhysicalDrive0 RE: Windows XP MBR code detected SHA1: ADFE55CD0C6ED2E00B22375835E4C2736CE9AD11 Done! |
|
28.09.2010, 21:28
| #23 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Crypt.XPACK.Gen3 backdoor/trojan Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
28.09.2010, 22:14
| #24 |
| | TR/Crypt.XPACK.Gen3 backdoor/trojan Während ich gerade Malwarebytes ausführe kam folgende meldung von Antivir: C:\System Volume Information\...\A0241324.dll ist das trojanische Pferd TR/Crypt.XPACK.Gen3 Löschen? Oder Quarantäne? |
|
28.09.2010, 22:56
| #25 |
| | TR/Crypt.XPACK.Gen3 backdoor/trojan Das Rootkit was vorher gefunden wurde, kam auch wieder, ich habe auf Löschen geklickt (leider zu schnell bevor ich gemerkt hatte, dass es das Rootkit war und habe somit nicht gesehen welches Verzeichnis angegeben war) - auch wieder Antivir. Weitere Nachricht von Antivir: C:\_OTL\MovedFiles\09272010_202550\C_WINDOWS\mshuota.dll ist das trojanische Pferd TR/Crypt.XPACK.Gen3 Da der Scan sonst nicht weiter ausgeführt wird, habe ich immer "Löschen" gewählt. |
|
28.09.2010, 23:12
| #26 |
| | TR/Crypt.XPACK.Gen3 backdoor/trojan Malwarebytes: Code:
ATTFilter Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Datenbank Version: 4712
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180
29.09.2010 00:03:18
mbam-log-2010-09-29 (00-03-18).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 262051
Laufzeit: 1 Stunde(n), 35 Minute(n), 46 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
BTW, nur weil ich es in einem anderen Thread von Dir gelesen habe: Kann es sein, dass der Trojaner + Rootkit in der System Volume wieder auftaucht, weil System Restore noch eingeschaltet ist? |
|
29.09.2010, 08:32
| #27 |
| | TR/Crypt.XPACK.Gen3 backdoor/trojan SASW: SUPERAntiSpyware Scann-Protokoll hxxp://www.superantispyware.com Generiert 09/29/2010 bei 01:32 AM Version der Applikation : 4.43.1000 Version der Kern-Datenbank : 5598 Version der Spur-Datenbank : 3410 Scan Art : kompletter Scann Totale Scann-Zeit : 01:17:53 Gescannte Speicherelemente : 748 Erfasste Speicher-Bedrohungen : 0 Gescannte Register-Elemente : 7146 Erfasste Register-Bedrohungen : 0 Gescannte Datei-Elemente : 112417 Erfasste Datei-Elemente : 0 |
|
29.09.2010, 09:30
| #28 |
| | TR/Crypt.XPACK.Gen3 backdoor/trojan Habe jetzt nochmal mit Malwarebytes gescannt: Wieder kam eine Meldung von Antivir, dass in der System Volume Information der TR/Crypt.XPACK.Gen3 trojan wäre. Code:
ATTFilter Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Datenbank Version: 4715
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180
29.09.2010 10:23:01
mbam-log-2010-09-29 (10-23-01).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 262636
Laufzeit: 52 Minute(n), 7 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
C:\System Volume Information\_restore{E54C5E8B-4A92-4942-9788-26A2E6AA05E0}\RP945\A0244538.dll (Trojan.Agent) -> No action taken.
|
|
29.09.2010, 10:20
| #29 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Crypt.XPACK.Gen3 backdoor/trojan Deaktiviere die Systemwiederherstellung, im Verlauf der Infektion wurden auch Malwaredateien in Wiederherstellungspunkten mitgesichert - die sind alle nun unbrauchbar, da ein Zurücksetzen des Systems durch einen Wiederherstellungspunkt wahrscheinlich wieder eine Infektion nach sich ziehen würde. Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
29.09.2010, 10:24
| #30 |
| | TR/Crypt.XPACK.Gen3 backdoor/trojan Die Systemwiederherstellung habe ich deaktiviert. Das mit dem _OTL habe ich mir schon so gedacht, aber warum sollte ich die infizierte Datei behalten wollen? |
|
| Themen zu TR/Crypt.XPACK.Gen3 backdoor/trojan |
| ad-aware, adobe, antivir, antivir guard, avira, bho, bonjour, canon, desktop, einstellungen, excel, explorer, hijack, hijackthis, hijackthis logfile, hkus\s-1-5-18, internet, internet explorer, logfile, monitor, normaler modus, object, plug-in, remote zugriff, rundll, software, taskmanager, tr/crypt.xpack.ge, tr/crypt.xpack.gen, tr/crypt.xpack.gen3, uleadburninghelper, windows, windows xp |
Linear-Darstellung
